By the N2K CyberWire staff
Top stories.
- OpenAI engineer charged with planting a secret recording device.
- BeyondTrust patches a critical zero-day.
- Cyberattack targets supermarket refrigeration systems across France.
- Zero-click spyware delivered via targeted ads.
- Microsoft and partners disrupt a major cybercrime marketplace.
OpenAI engineer charged with planting a secret recording device.
An OpenAI engineer has been arrested and charged with allegedly planting a covert recording device in an executive conference room at his employer’s San Francisco offices, the Record reports. 35-year-old Abdulrahman Alfozan, a Saudi national with permanent residence in the US, allegedly inserted a recorder into a USB port on the back of a television in the room, where OpenAI executives frequently discussed “highly confidential technical, commercial, and strategic information, including proprietary research, product plans, and business-development opportunities, as well as nonpublic information about OpenAI’s technical progress and strategic decisions, capabilities, priorities, government engagements, and commercial relationships.”
OpenAI staff found the device and planted a camera nearby, catching Alfozan when he came back to check on the device.
Prosecutors haven’t said whether he’s suspected of acting on behalf of a foreign government or a private entity. The New York Times notes that Alfozan is listed as a partner at Riyadh-based venture capital firm RAED Ventures, and he gave a podcast interview last month saying that he and other Saudi tech professionals in Silicon Valley had formed a group to advise Saudi government agencies on technology.
Cybersecurity certifications you need. Study guides you can trust.
Earning your Security+, CISSP, CCSP, or SecAI+ opens doors. With Sybex, you get comprehensive objective coverage, expert insight, and the practice tools you need to walk into exam day confident. Find your guide on Amazon and advance your career today.
BeyondTrust patches a critical zero-day.
BeyondTrust has patched a critical flaw in its Remote Support (RS) appliances that’s been exploited in zero-day attacks by a suspected Chinese APT since late August, SecurityWeek reports. The vulnerability (CVE-2026-102764) can “allow an attacker to perform file operations on the appliance.” BeyondTrust is withholding technical details of the flaw to give customers time to apply the patches.
Mandiant published a report alongside BeyondTrust’s disclosure, stating that the China-nexus espionage actor ARMORY CASTLE has been exploiting the flaw to gain initial access since at least August 29th, 2026.
The researchers stated, “Throughout the intrusion, ARMORY CASTLE leveraged a deep understanding of BeyondTrust appliance internals, as evidenced by their abuse of proprietary CLI utilities, startup configuration templates, and local reverse-proxy routing. The threat actor used newly identified custom malware, the SAWFLY webshell and the BARECLAW tunneler to interact with the BeyondTrust device. Additionally, the actor routinely deleted appliance logs and endpoint artifacts to maintain access and evade detection.”
Mandiant added, “Organizations should prepare for potential widespread exploitation following this disclosure, as ARMORY CASTLE and other threat actors have historically conducted broad, opportunistic exploitation once the vulnerability becomes public.”
Trinity Cyber stops threats before they become incidents
Trinity Cyber is a network security platform built to stop threats before they become incidents. The Trinity Cyber Platform analyzes network sessions in real time, removes malicious content inline, and gives organizations unified control across users, applications, devices, networks, and AI. By combining protection and policy in one platform, Trinity Cyber helps security teams reduce risk, simplify operations, and stop attacks before they become incidents. Learn how at trinitycyber.com.
Cyberattack targets supermarket refrigeration systems across France.
Hackers compromised refrigeration controllers at hundreds of French supermarkets Sunday night and remotely raised temperatures to more than one hundred degrees Fahrenheit, spoiling food and in some cases causing fires, Reuters reports. The attackers targeted Danfoss refrigeration controllers that were running outdated firmware, gaining control of their automatic defrosting systems. Danfoss told AFP that the attack affected end-of-life AK-SM800 and AK-SC355 systems that no longer receive security updates, and that the company has long advised customers to upgrade from those systems.
BleepingComputer says the incident affected up to 350 stores belonging to Intermarché, Coopérative U, Carrefour Market, Monoprix, Leclerc, and Super U. Intermarché CEO Thierry Cotillard said the attack caused losses of “tens of millions of euros nationwide in a single day.”
Prime Minister Sebastien Lecornu has asked France's National Cybersecurity Agency (ANSSI) to investigate the incident. No group has claimed responsibility for the attack, and the motive remains unknown.
Where cyber leaders come together to turn challenges into action.
The Aspen Cyber Summit brings together leading voices from government, industry, and civil society to address the cybersecurity challenges shaping our future. Join senior leaders and experts in Washington, DC, for consequential conversations focused on moving beyond identifying risks to advancing actionable, cross-sector solutions.
Zero-click spyware delivered via targeted ads.
The University of Toronto’s Citizen Lab is tracking zero-click mercenary spyware delivered via targeted ads, used to plant Candiru’s spyware on devices belonging to Al Jazeera employees. The malicious ads were purchased by Discover-Tech, a seemingly legitimate Israeli advertising company that Citizen Lab says “operates as a facilitator for multiple mercenary spyware partners.”
The researchers say Discover-Tech’s platform, called “Controlium,” “allows malicious actors to precisely profile and de-anonymize millions of individuals, fingerprint their devices, and target them with a form of zero-click hacking, where their devices can be automatically infected when an ad is displayed to them.”
Microsoft and partners disrupt a major cybercrime marketplace.
Microsoft, working with Japanese law enforcement and Health-ISAC, has dismantled key infrastructure powering a major Chinese-language cybercrime marketplace. The operation targeted three platforms—YAM Store, CoGUI, and Iron Man—which supplied criminals with fraudulent accounts, tools, and thousands of impersonation templates. The coordinated takedown involved seizing domains, disabling over 20,000 accounts, and blocking more than 100,000 sites.
Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs also assisted in the takedown.
