RADIO 007

www.osintinvestigate.com

Cyber News Italia dal 13 al 19 settembre 2026: il caso Revolut e la PEC istituzionale compromessa, phishing in Italia, ransomware, vulnerabilità VMware, ScreenConnect e Check Point, malware Android, supply chain attack e nuovi rischi legati all’AI. Tutte le principali notizie cybersecurity della settimana in chiave OSINT.

www.osintinvestigate.com

A major Revolut data breach allegedly exposed the personal and financial information of around 680 customers after hackers impersonated an Italian government agency. The operation reportedly lasted about five months, using compromised government email credentials to send fraudulent data requests to Revolut Bank UAB. The stolen information may include passports, identity documents, phone numbers, email addresses and financial data. A threat actor known as “IAmNotAVillain” has publicly demanded $3 million and threatened to sell the allegedly stolen information. Revolut says it has not received any direct ransom demand from the alleged attackers. Italian authorities are investigating the incident, which also involves claims of more than 147GB of data stolen from an Italian law-enforcement agency. This episode examines what happened, how the attack allegedly worked, what information may have been exposed, and why compromised government identities and trusted communication channels represent a serious cybersecurity risk.

www.osintinvestigate.com

Two oil tankers bound for Texas were boarded by the U.S. Coast Guard and FBI after evidence of cyberattacks on their onboard networks. In this episode, we examine the reported attack on the VL Prosperity, the investigation into a second vessel, the possible impact on operational technology and navigation systems, and the growing cybersecurity risks facing the global maritime sector. Authorities have confirmed evidence of malicious cyber activity but have not publicly attributed the attacks to Iran or another specific actor.

www.osintinvestigate.com

US, UK and Dutch agencies have exposed CHOSEN BRICK, an Iranian-linked spyware campaign targeting dissidents, activists and journalists. The malware can steal emails, messages, contacts and social media data, capture screen content and access microphones. Learn how attackers use spear-phishing, fake identities and malicious files to exploit trust and compromise Windows devices.

Two Robinhood engineers have been charged by US federal prosecutors with allegedly using confidential information about upcoming crypto token listings to make more than $50,000 each through Hyperliquid perpetual futures. The case involves alleged trades linked to tokens including RENDER, HYPE, and POPCAT, and could test how federal commodities and wire fraud laws apply when confidential corporate information is used on decentralized crypto derivatives platforms.

www.osintinvestigate.com

Hackers compromised the official HBO Max Reddit account and used malicious ads to distribute malware through a ClickFix attack targeting Windows and macOS users. Here’s how the PasteSwitch campaign worked and what attackers were after.

www.osintinvestigate.com

OpenAI is investigating a report linking its AI agents to a May 2026 attack against RubyGems. Researchers say AI agents may have uploaded malicious packages, attempted to steal RubyGems API keys, achieved remote code execution on RubyDoc servers, and used malicious packages to collect public information. OpenAI says its investigation has not verified the specific claims. In this episode, we examine what researchers discovered, what OpenAI says, and why autonomous AI agents are becoming a major cybersecurity concern.

www.osintinvestigate.com

Thai broadband provider 3BB was targeted by threat actors who exploited a known Fortinet FortiGate SSL-VPN vulnerability, CVE-2024-21762. In this episode, we examine how attackers gained initial access, performed reconnaissance, exploited vulnerable systems, escalated privileges, and established persistent remote access using MeshCentral. The incident highlights the continuing risks posed by unpatched internet-facing security appliances and the importance of vulnerability management, monitoring, credential protection, and rapid incident response.

Wall Street is getting closer to the ticket resale business—and that could change how quickly ordinary fans can buy tickets.In this episode, we examine a little-known financing deal that highlights a growing connection between institutional capital and ticket resellers. The basic model is simple: with access to financing, professional ticket buyers can acquire thousands of tickets at scale, sometimes before the average fan even gets a realistic opportunity to purchase one.But this is about more than expensive concert tickets. It raises bigger questions about financialization, market access, automated ticket buying, ticket scarcity, and the growing power of professional resellers.How does ticket financing work? Why would Wall Street-backed capital be interested in ticket inventory? And what happens to consumers when tickets for major concerts, sporting events, and entertainment become an asset that can be financed, traded, and resold?We break down the economics behind the model, explain why institutional investors may see opportunities in the secondary ticket market, and explore what this trend could mean for artists, venues, promoters, ticketing companies, and—most importantly—fans.Is the ticket market becoming another financial marketplace? And if institutional money keeps flowing into ticket resale, will consumers face even higher prices and less access to live events?Listen to the full episode for a closer look at the money, incentives, and business model behind the modern ticket resale economy.

www.osintinvestigate.com

Trezor warns that 347,000 customers received phishing emails after a cyberattack on Brevo, the marketing platform used for newsletters. Learn how attackers exploited SSO, how many users clicked the malicious link, and why crypto wallet users should remain alert.