AI Decision Models and Their Impact on AI SOC Platforms
In the space of a month, a new category of AI model went from nonexistent to everywhere.
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices.
The developers and operators behind these kits have helped facilitate the sending of more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
These 'fun settings,' as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft." A public disclosure referencing a KGB RAT server at version 0.1 dates to late January 2022, indicating the developer had been building and testing the malware for years before bringing it to market.
Apart from the Google Messages protection, Google has also implemented the enhancements in other areas of the Android system: Google is also expanding its verified bank calls system, introduced earlier this year , adding financial institutions from more.
Mozilla has launched Firefox Enterprise, a browser iteration "built for organizations with strict security, governance, and compliance requirements." Mozilla added, "IT and security teams get more control over their data, IT infrastructure and browser environment — helping strengthen technological independence and operational resilience." Wordfence has detailed an unusual malware that's installed as a must-use WordPress plugin and makes use of "several self-healing mechanisms in place to survive removal.
BragJack attacks hijack AI browser agents through malicious extensions Japan's Digital Agency says VPN flaw exposed 246,000 personnel records BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans.
By catching human-operated ransomware in its early stages, Huntress can help reduce the likelihood and potential impact of Ryuk-class incidents that have cost large organizations tens of millions of dollars.
OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6.
It copies itself to a hidden location, registers a scheduled task to relaunch every 30 minutes, patches the Antimalware Scan Interface, and registers with the same host that delivered it before polling a set of PHP endpoints for tasking." Google said it's rolling out multi-layered protections across Google Messages and third-party messaging apps to protect Android users against mobile scams.
What happened
Google announced new AI-powered defenses against scam messages and call-forwarding abuse on Android, currently rolling out to eligible devices.
The developers and operators behind these kits have helped facilitate the sending of more than one billion phishing emails and SMS messages targeting over 75,000 organizations since January 2026.
What changed
These 'fun settings,' as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft." A public disclosure referencing a KGB RAT server at version 0.1 dates to late January 2022, indicating the developer had been building and testing the malware for years before bringing it to market.
Apart from the Google Messages protection, Google has also implemented the enhancements in other areas of the Android system: Google is also expanding its verified bank calls system, introduced earlier this year , adding financial institutions from more.
Who is affected
Mozilla has launched Firefox Enterprise, a browser iteration "built for organizations with strict security, governance, and compliance requirements." Mozilla added, "IT and security teams get more control over their data, IT infrastructure and browser environment — helping strengthen technological independence and operational resilience." Wordfence has detailed an unusual malware that's installed as a must-use WordPress plugin and makes use of "several self-healing mechanisms in place to survive removal.
BragJack attacks hijack AI browser agents through malicious extensions Japan's Digital Agency says VPN flaw exposed 246,000 personnel records BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
Why it matters
A seller on a restricted criminal forum is marketing an autonomous hacking tool that runs on stolen OpenAI, Anthropic and Google API keys, so the key’s owner pays for the scans.
By catching human-operated ransomware in its early stages, Huntress can help reduce the likelihood and potential impact of Ryuk-class incidents that have cost large organizations tens of millions of dollars.
Technical details
OpenAI announced its own Decisions API at DevDay and opened a public beta on October 6.
It copies itself to a hidden location, registers a scheduled task to relaunch every 30 minutes, patches the Antimalware Scan Interface, and registers with the same host that delivered it before polling a set of PHP endpoints for tasking." Google said it's rolling out multi-layered protections across Google Messages and third-party messaging apps to protect Android users against mobile scams.
Google Gemini could soon get full access to your Mac’s files, apps and the web New RemControl Android banking malware targets users in Europe and Canada
Response
The compliance requirements discussed in Part 2 put added pressure on investigation speed, particularly when legal or compliance teams need to establish whether regulated student, financial, health, or research data was accessed across more than one campus.
One of the analyzed samples stopped running when the computer’s motherboard model matched a name on a built-in list that included “Sandbox,” “Test” and “Virtual Machine.” Code in one sample checks for tools used to inspect malware, such as Wireshark, Process Explorer and dnSpy, and tries to stop the trojan if any of them are running.
What security teams should do
Fake CAPTCHA checks are being used to do more than hide phishing pages.
Attribution
The Hacker News: In the space of a month, a new category of AI model went from nonexistent to everywhere.
The Hacker News: Someone built a tool to steal data, then decided it should scare the victim for fun.
Help Net Security: Google’s new scam protections cover Google Messages and third-party messaging apps, with an enhanced protection mode, expanded scam alert s and safeguards against call-forwarding and screen-sharing scams.
The Hacker News: AI agents being tested online reached the live systems of Indian organizations and read business records, including personal data and confidential material, CERT-In said in an advisory on October 15.
What to watch next
Watch for updated vendor guidance and fixed-version details.