Good morning!

The DOJ seized the infrastructure behind two hacking tools a Chinese company allegedly ran as the FBI raided a scam compound in Ghana. Two U.S. strikes, same Thursday, two continents — credit is already contested.

Here are the 7 things you don't want to miss:

1. 🚔 DOJ seizes China-linked hacking tools as advisory lands

The Justice Department and FBI seized the domains behind Microscan and FishHub, two tools a Chinese company allegedly ran for hacking and scanning critical-infrastructure targets. The same day, CISA, the NSA and allied agencies published a joint advisory on Integrity Technology Group. It is the DOJ's second Integrity Tech disruption since 2024. (Justice Department)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 📦 Tensorlake's npm release shipped a revocation trap

Package tensorlake 0.5.144 hit npm at 01:12 UTC on October 8 with a valid provenance attestation, built from the project's own main branch. StepSecurity reported the release steals cloud and code-hosting credentials, republishes victim packages through stolen npm tokens, and plants a service that deletes your home directory if the stolen GitHub token is revoked. Provenance says where code was built, not that it's safe. (StepSecurity)

4. 🌍 FBI announces Ghana raid, Ghana's agency disputes the credit

The FBI says its Operation Blackout raid in Ghana arrested or detained more than 130 people, identified 89 fraud victims and nearly $10 million in losses, and seized more than 300 devices. Ghana's Cyber Security Authority issued a statement the same day, rejecting any portrayal that the operation was independently conceived or commanded by the FBI. (Fox News)

5. 🇯🇵 Japan's CERT flags a surge in web data leaks

JPCERT/CC warned on October 8 that Japanese organizations are suffering an unusual run of data leaks. Its alert describes mass scanning for known flaws, abuse of internal app APIs not meant for direct public use, and exploitation of Metabase SQL-injection flaw CVE-2026-72898. Macnica's security researchers counted 119 such incidents through October 6. Nobody budgets security for the tools nobody visits. (JPCERT/CC)

6. 🏆 Master of Pwn goes to Ikotas Labs after a $300,000 Pixel chain

Pwn2Own Ireland's day three ended with Ikotas Labs on top, after the team chained bugs on the Google Pixel 10 for $300,000 and 30 points. Xint collected $150,000 on the same phone; Team MAMMOTH closed the event with six zero-days against a Home Assistant Green. The phones carried the purse; the hub carried the zero-days. (Zero Day Initiative)

7. 🕵️ MATCHBOIL has spent two years changing shape

ESET researchers analyzed MATCHBOIL samples from April 2024 to April 2026, which they attribute to the Russia-aligned UAC-0099 group. Along the way it gained a check-in timer, sandbox checks and decoy interfaces that mimic everyday utilities. Every victim ESET observed was in Ukraine, across transport, manufacturing and energy. Two years of work, same job: fetch the next payload. (ESET)

Bonus. Threat Road Tip Of The Day

Before your next install, check when your dependencies were published. Anything released in the last few days deserves a second look; the registry lists the publish date for every version. A two-minute habit at the start of every project.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.