Supermarket freezers that cooked their own stock overnight. Text messages about traffic fines that quietly steal payment PINs. North Korean IT workers paying Americans to keep remote jobs at U.S. companies. This weekly cybersecurity roundup brings together incidents that reached well beyond stolen data, causing spoiled food, store fires, disrupted grocery deliveries and drained bank accounts. Here are the stories that shaped the week.

Hackers Turned French Supermarket Freezers Into Ovens Overnight

Hundreds of French supermarkets woke up to spoiled stock after hackers took remote control of internet-connected refrigeration systems overnight. Retailers confirmed on Monday that attackers pushed fridge and freezer temperatures as high as 50 degrees Celsius (122F) while stores were closed. Tonnes of food perished, some equipment melted, and in some stores the heat sparked fires. French TV channel BFM reported that the attackers appeared to trigger a forced defrost option, keeping units heating instead of cooling. The attack did not use a new exploit. It targeted ageing connected devices still online years after their manufacturer stopped supporting them. E.Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. At least 300 Intermarché and Netto stores were affected, Coopérative U reported more than 100, Carrefour said 80, and Monoprix said about 5 percent of its roughly 490 stores were targeted. Bruce Hallas, CEO at Re-thinking the Human Factor, noted that estimates sit around 400 stores, with some branches reporting losses of about €250,000. Some reports put the total above 500 shops. Read More

Fake Traffic Challan Texts Are Stealing UPI PINs From Android Users in India

GhostBat RAT, an Android malware strain first identified by Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI, wallet and fintech apps. It spreads through SMS messages about unpaid traffic challans that lead victims to fake mParivahan download pages, with GitHub repositories also used to host the malicious files. Cyble's research also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution. Many of the fake apps are first-stage loaders that hide the real payload in encrypted files or download it later, helping them pass initial scans. Read More

Death Threats, Laptop Farms, Stolen IDs: Inside North Korea's Job Scam

North Korean IT workers are paying Americans to help them get and keep remote jobs at U.S. companies, according to an updated FBI public service announcement. The Justice Department also announced charges, two arrests and the seizure of about 187 computer devices linked to the scheme. The FBI said Americans are being hired to appear on camera, sit for job interviews, verify fake identities, lend social media or professional networking accounts, ship packages, complete drug tests or fingerprint submissions, and keep work laptops running from their homes. The workers also use stolen identities, extort victims and threaten physical violence. North Korea's government receives an estimated 85 to 90 percent of the revenue they generate, which helps fund its nuclear weapons and military programs. Read More

Ahold Delhaize Incident Disrupts Grocery Supply in Netherlands and Belgium

A cyber incident at Ahold Delhaize has disrupted parts of the grocery retailer's IT infrastructure, prompting it to take some systems offline. Stores remain open, but reports from the Netherlands and Belgium indicate disruption to distribution, customer service and some delivery operations. The company has not disclosed the nature of the incident or whether customer or employee data was affected, and it has given no timeline for full recovery. Ahold Delhaize operates in nine countries, employs more than 384,000 people and owns U.S. brands including Food Lion and Stop & Shop. Read More

Kerala Police Signs MoU With Cyble for Cybercrime Investigations

Kerala Police has signed a three-year Memorandum of Understanding with Cyble to bring threat intelligence into cybercrime investigations. The agreement, signed through Cyble Infosec India Private Limited and announced on October 12, 2026, covers intelligence support, investigative assistance and capacity building. It will support the Kerala Police Cyber Operations wing and Cyberdome in identifying and investigating emerging threats. Read More [caption id="attachment_114716" align="aligncenter" width="600"] Image Source: Cyble[/caption]

Seoul National University Reports 28 Hacking Incidents Since 2021

Seoul National University has suffered 28 hacking incidents since 2021, exposing more than 1,100 pieces of personal information belonging to students, faculty and staff. The figures come from data the university submitted to Rep. Baek Seung-ah of the Democratic Party. There were eight attacks in 2021, a peak of 10 in 2022, none in 2023, one in 2024 and five in 2025, with four confirmed so far this year. Departmental systems were hit most often, in 19 incidents, followed by laboratory systems with six, research systems with two and one institutionwide system. Read More

Morocco Prioritizes AI Threats and Critical Infrastructure Defense

Morocco is placing greater focus on proactive threat detection, critical infrastructure protection and artificial intelligence in its cybersecurity strategy. Speaking at the opening of National Cybersecurity Week in Rabat, Abdellatif Loudiyi, Minister Delegate in charge of National Defense Administration, said cybersecurity must be built into institutional governance rather than treated as an extra expense. He called for stronger preparedness, early detection and coordinated incident response. The event runs from October 12 to 14. Taken together, this week's incidents show attackers targeting the systems people rely on every day, from shop refrigeration and grocery supply chains to payment apps and hiring processes. Follow The Cyber Express for next week's weekly cybersecurity roundup and ongoing coverage of these stories. Read More

A text message about an unpaid traffic challan could cost Android users in India far more than a fine. GhostBat RAT, an Android malware strain first identified by cybersecurity firm Cyble in October 2025, has evolved to capture PINs from 60 banking, UPI apps, wallet and fintech applications, according to new research published by Cyble. The firm's investigation into fake mParivahan and eChallan apps also exposed a wider operator-controlled ecosystem it tracks as GhostX, linking phishing pages, backend control systems and malware distribution.

How GhostBat RAT Reaches Victims

The malware spreads mainly through smishing, or SMS phishing. Victims receive messages with malicious links that lead to pages impersonating the official Parivahan service or a Google Play-style download page. These pages push users to install a fraudulent mParivahan APK. Researchers also found GitHub repositories being repeatedly used to host the malicious files. Many of these apps are only first-stage loaders. The real payload stays hidden in encrypted files or is downloaded later, which makes the app look harmless during an initial scan. [caption id="attachment_114830" align="aligncenter" width="600"] GhostBat-RAT-Infection-Chain-1536x595[/caption]

GhostBat RAT's Ghost Overlay Trick

The most significant change in the latest variant is its abuse of Android's Accessibility Service, a technique commonly linked to modern Android banking trojan families. Earlier variants analyzed by Cyble did not have this capability. Its standout feature, called Ghost Overlay, targets Google Pay and MobiKwik. Instead of showing a fake login screen, the malware places an invisible 12-key grid over the real PIN keypad. When a user taps a digit, the overlay records it and then replays the same tap into the genuine app. The payment goes through normally, so the victim has no visible reason to suspect anything, while the PIN is quietly sent to the attackers' server.

GhostBat RAT Watches 60 Financial Apps

Beyond Google Pay and MobiKwik, a broader keylogging feature monitors 60 financial apps. Cyble's list includes PhonePe, Paytm, BHIM, SBI UPI, Axis Pay, BharatPe, CRED, Freecharge, PayZapp, Groww, Navi, Jupiter, OneCard, JioFinance and Samsung Pay. The malware checks which app is open and the screen context before treating numeric input as a possible PIN. This builds on older capabilities that remain in play, including reading SMS messages and OTPs, manipulating call forwarding, collecting call logs and sending SMS messages through the victim's SIM card, which could be used to spread further smishing campaigns.

Inside the GhostX Network Behind GhostBat RAT

A key finding came from an exposed Firebase backend named "ghostx-panel." It contained administrator records, user roles, login logs with device fingerprints and bot-user mappings. Cyble says these separate roles point to a multi-operator setup and raise the possibility of a Malware-as-a-Service model. While monitoring the backend, researchers saw SMS lure text, phishing links, vehicle registration numbers and recipient phone numbers changing repeatedly, indicating an active campaign. Matching eChallan messages were also reported by users on social media.

Why GhostBat RAT Is Hard to Detect

Cyble identified at least six different loader designs. The newest, built around a native library called libnetbridge.so, passes the payload through several layers of encryption, compression and custom packaging before the final app appears. Security tools that scan only the outer APK are unlikely to catch it consistently. The malware also uses Firebase Remote Config, which lets operators switch command servers and turn features on or off remotely without pushing a new app to victims.

Staying Safe From GhostBat RAT

Cyble advises users to install apps only from official stores such as Google Play and to avoid APK links received by SMS, social media or email. Users should be cautious about granting app permissions, especially Accessibility access, verify website addresses before entering sensitive details, enable multi-factor authentication on financial apps and keep their phones updated. Anyone who suspects infection should contact their bank and local authorities immediately.