Hacktron got from a compromised Codex account to OpenAI’s internal monorepo in under 72 hours. The bigger issue: coding agents can turn one compromised account into a much wider access problem.

HACKERS CLAIM MASSIVE FBI DATA BREACH Hacking group ShinyHunters claims it stole 2–3 terabytes of FBI data, including sensitive information on thousands of current and former employees. A leaked sample reportedly contains personal details and job assignments, including work involving Chinese and Russian intelligence and drug cartels. The FBI says it is actively investigating the alleged breach, while Reuters independently verified details for more than 22 individuals.

Hackers want $3 million by tomorrow. Revolut says nobody has called. Italy has opened a file. IAmNotAVillain put a clock on a site: 6,000 Monero (about $3m), pay in 24 hours, or the packs go on sale (FT). Reuters asked Revolut. The answer: no direct contact, no demand. The actor made the ask public. Revolut hasn't used channels to open dialogue. In Italy, the picture moved. Reggio Calabria prosecutors have a case (LaPresse). Postal Police are on the PEC. The DNA — national anti-mafia and counter-terrorism directorate — has been looped in because a government mailbox is in play, not because anyone has proved a mafia job (ANSA). The Garante is asking other banks how they check official mail (La Stampa). Interior Ministry has not confirmed the box. Some coverage slips into “Italian hackers.” That is a jump. What they have is an Italian official channel. Who sat at the keyboard remains unknown. The method is clearer if you take Duel / Korra, who say they spoke to the same actor. They scraped public Bitcoin addresses and txids, dumped hundreds on Revolut as a fake European Investigation Order, and asked who sat behind each one. Spray and pray, hoping they find "whales". Korra says they saw the .emls: folders with IDs, selfies, statements. Three things in those emails should have stopped by a competent officer. 1. The envelope was a prefettura Enti locali PEC in Reggio Calabria — local-authorities admin (entilocali.prefrc@pec.interno.it). The PDF inside looked like it was from the Postal Police / Milan procura / an EIO. Wrong address, wrong instrument. 2. An EIO in Italy is a judicial act issued by a prosecutor or judge. A prefettura cannot issue one. 3. The letterhead was wrong. Staff wrote back and told them to address Revolut Digital Assets Europe Ltd in Cyprus, not “UAB Italian Branch” (Korra). That is fixing the attacker’s homework and still fulfilling. Three flags. A live PEC was treated as enough. A person I believe is inside the firm told me, "They are so scared of government agencies they are almost over-compliant." Revolut still will not confirm the number. FT and my other channels put it at about 680. Nicola Vicino is GM of the Italian branch of Revolut. Not the person who hit send, but I believe he has questions to answer. What happened. From spring to September, mail authenticated on a real Italian government domain asked for KYC. Revolut sent identity documents, selfies, statements and Bitcoin histories. Eventually, Revolut found out it was a scam, blocked the address, and told those customers. Not a hack of the app. Money stayed. Files left. People on that list are not debating PEC law. They are waiting to see if a pack with their face and their chain history is sold. Others watching from the sidelines are asking a simpler question: if official-looking mail is enough, how much of this bank is process and how much is judgment.

Hackers are now using passkeys as bait to target Microsoft 365 accounts. The scam is pretty simple: >Attackers pretend to be IT support and tell employees they need to set up or update a passkey. >They then send them to a fake Microsoft login page. >The page looks legitimate, but it’s actually designed to trick people into giving the attackers access to their account. >Once they get in, hackers can add their own way to log in and keep access searching through emails, SharePoint and OneDrive files and steal sensitive company data.