Cybersecurity Brief — 2026-09-20

AI-Assisted Exploit Chain Compromises OpenAI Staff Accounts

Researchers at security firm Hacktron used Anthropic's Claude Opus 5 to chain two vulnerabilities and take over ChatGPT and Codex accounts of multiple OpenAI employees, ultimately reaching an internal OpenAI code repository. The chain began with a libheif image-parsing flaw (CVE-2026-32882) in the Discourse forum software powering OpenAI's public help forum, which allowed remote code execution on the forum server. Because the forum used "Sign in with OpenAI" — the same SSO that staff use internally — compromise of the forum server granted access to staff ChatGPT/Codex accounts without victim interaction. The researchers proved access with a harmless pull request, reported the flaws, and stopped. OpenAI confirmed a fix ~14 hours after the report and paid a $6,500 bounty. Notably, the libheif fix existed since May 2026 (v1.22.0), but the forum's Debian 12 base image still shipped the vulnerable v1.19.7 months later. (Source: The Hacker News)

North Korean "WaterPlum" Campaign Infects 30,000+ Devices via Fake Job Interviews

A joint advisory from cybersecurity agencies in Australia, Germany, Japan, and the US details a North Korean campaign (tracked as WaterPlum) where threat actors pose as recruiters targeting web designers, engineers, and cryptocurrency/Web3 specialists. Victims are sent bogus coding assignments or interview tests that, when opened, install remote access trojans and information stealers. The malware harvests credentials, clipboard contents, keystrokes, crypto wallet data, and identity documents — enabling both direct theft and potential follow-on access to victims' future employers. The campaign has compromised over 30,000 devices, breached more than 7,000 cryptocurrency wallets, and netted approximately $10.71 million funneled to the North Korean regime. This recruiter scam complements the better-known North Korean IT worker infiltration scheme, estimated to generate $500M+ annually for Pyongyang. (Source: The Register)

FBI: Government Impersonation Scams Cost Victims $1.6 Billion Since January 2025

The FBI's Internet Crime Complaint Center (IC3) reports nearly 61,000 complaints of law enforcement/government impersonation scams between January 2025 and July 2026, with total losses exceeding $1.6 billion (average ~$26,000 per complaint). The most common variant involves unsolicited calls claiming the victim faces criminal charges and demanding payment to avoid arrest. A jury-duty variant accounted for 6,833 complaints and ~$36M in losses. Targeted professional scams — e.g., threatening medical license revocation — generated 3,322 complaints and $37M+. The most profitable per-incident category targeted specific ethnic communities, foreign nationals, and international students: scammers used video calls in fake uniforms and movie-set government offices, claiming passport cancellation or extradition threats. This category represented only 1,809 complaints (under 3% of volume) but drove over $140M in losses (nearly 10% of the total). (Source: The Register)

Data Broker Radaris Loses Domains in New Jersey "Daniel's Law" Case

A New Jersey judge ordered the transfer of radaris.com and more than a dozen associated data-broker domains to plaintiffs (Atlas) after Radaris repeatedly stonewalled removal requests for law enforcement personnel data under "Daniel's Law" — a statute allowing state officers, judges, and families to demand removal from people-search sites, with $1,000/violation fines for non-compliance. The Lubarsky brothers (Russian-born, Massachusetts-based) behind Radaris engaged in years of procedural delay and entity shell games, cycling operators through the Marshall Islands, British Virgin Islands, and Seychelles. In one instance, Radaris claimed a new Marshall Islands entity managed the company; investigators found the entity didn't exist yet. Radaris previously lost the radaris.com domain in a 2017 class action ($7.5M default judgment) but regained it on appeal by arguing the domain was owned by a Cyprus company not named in the suit. (Source: Krebs on Security)