ThreatsDay Bulletin: $176M Crypto Fine, Hacking Formula 1, Chromium Vulns, AI Hijack & More

ThreatsDay’s 23 October 2025 bulletin highlights a range of credentialable weak points being exploited, from misconfigurations to chain attacks. It notes Lumma Stealer’s activity declined after a doxxing campaign exposed core members, with Trend Micro saying the group’s Telegram accounts were compromised on 17 September and suggesting rivals are influencing customers toward other stealers.

The issue of Rogue npm packages is also covered, with a malicious package called https-proxy-utils used to deploy AdaptixC2, and Henrik Plate of Endor Labs urging caution about supply chain risks. Canadian regulators fined Xeltox Enterprises Ltd. (Cryptomus and Certa Payments Ltd.) $176 million, with FINTRAC stating the firm failed to submit suspicious transaction reports for July 2024 transactions linked to darknet markets and criminal activity; the report cites KrebsOnSecurity as the source.

The bulletin also covers an admin mass‑assignment flaw in FIA’s driver categorisation portal, which was fixed by 10 June after responsible disclosure. Finally, it explains how OAuth abuse can provide persistent cloud access, citing Proofpoint’s Fassa toolkit as a demonstration of a backdoor that survives credential resets. according to FINTRAC, Trend Micro, and Proofpoint, among others.