> InfoSec News Nuggets 10/13/2025

Insurers balk at paying out huge settlements for claims against AI firms OpenAI and Anthropic are considering using investor funds to settle potential claims from multibillion-dollar lawsuits, as insurers balk at providing comprehensive coverage for the risks associated with artificial intelligence. The two US-based AI start-ups have traditional business insurance coverage in place, but insurance professionals said AI model providers will struggle to secure protection for the full scale of damages they may need to pay out in the future. OpenAI, which has tapped the world’s second-largest insurance broker Aon for help, has secured cover of up to $300 million for emerging AI risks, according to people familiar with the company’s policy.   Investigating targeted “payroll pirate” attacks affecting US universities Microsoft Threat Intelligence has observed a financially motivated threat actor that we track as Storm-2657 compromising employee accounts to gain unauthorized access to employee profiles and divert salary payments to attacker-controlled accounts. These types of attacks have been dubbed “payroll pirate” by the industry. Storm-2657 is actively targeting a range of US-based organizations, particularly employees in sectors like higher education, to gain access to third-party human resources (HR) software as a service (SaaS) platforms like Workday.     Fake ‘Inflation Refund’ texts target New Yorkers in new scam An ongoing smishing campaign is targeting New Yorkers with text messages posing as the Department of Taxation and Finance, claiming to offer “Inflation Refunds” in an attempt to steal victims’ personal and financial data. The Inflation Refund is an initiative from New York State that automatically sends refund checks to eligible residents to help offset the effects of inflation. Those who qualify include taxpayers who filed a return, meet certain income thresholds, and were not claimed as dependents by another filer. New Yorkers do not need to apply, sign up, or provide any personal information to receive their checks, as they are automatically sent to qualified taxpayers.   Cybercrime ring GXC Team dismantled in Spain, 25-year-old leader detained Spanish Guardia Civil dismantled the “GXC Team” cybercrime group, arresting its 25-year-old Brazilian leader “GoogleXcoder.” The gang sold AI-powered phishing kits, Android malware, and voice-scam tools via Telegram and Russian forums, becoming a major supplier of credential theft tools in Spain. In January 2024, Resecurity uncovered a cybercriminal faction known as “GXC Team“, which specializes in crafting tools for online banking theft, ecommerce deception, and internet scams. Around November 11th, 2023, the group’s leader “googleXcoder“ made multiple announcements on the Dark Web.  On New Year’s Eve, the group declared significant price reductions, offering up to a 20% discount on their products available on the Dark Web.   SimonMed Imaging Data Breach Impacts 1.2 Million SimonMed Imaging has revealed that a data breach resulting from a ransomware attack has impacted more than 1.2 million individuals.  According to its website, SimonMed Imaging is one of the largest medical imaging providers and physician radiology practices in the US, with more than 170 facilities across 10 states.  The Arizona-based healthcare organization learned in late January 2025 that one of its vendors had been breached and an investigation conducted by SimonMed showed that its own network had also been hacked.  The post InfoSec News Nuggets 10/13/2025 appeared first on AboutDFIR - The Definitive Compendium Project.