> InfoSec News Nuggets – 10/29/2026

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering The U.S. Department of Justice announced the seizure of virtualine[.]net, the domain of a bulletproof hosting provider that allegedly advertised its services on cybercrime forums for phishing, carding, spam and port scanning. Court documents say the service, which also operated under names such as Secury, Massgod and Omegatech, knowingly continued hosting a forum trading explicit images of minors despite repeated notices from law enforcement, and accepted payments through unhosted bitcoin addresses that let ransomware operators, infostealer crews and other criminal customers pay without triggering exchange compliance checks. The coordinated operation involved police in Germany, the Netherlands and the U.K. alongside private sector partners, although researchers caution that bulletproof hosts often resurface quickly by acquiring new network space.   Tailscale warns of SSH flaws allowing root privilege escalation Tailscale is racing to fix 11 vulnerabilities, collectively dubbed Tailworm, that Cyberdione Labs found in Tailscale 1.104.2 and the self-hosted headscale control server and published before patches were available. The most serious issue sits in Tailscale’s embedded SSH server, where Unix-socket forwarding performs path checks and file operations as root, letting an already-authorized user gain root execution on target servers, capture enrollment keys or delete root-owned files, while other flaws affect app connectors, headscale, the DERP relay client and tailscale serve. Tailscale is not recommending that users disable Tailscale SSH, but advises reviewing SSH access policies, setting TS_SSH_DISABLE_FORWARDING=1 where forwarding is not needed, and applying the patched client release as soon as it is available.   Chrome extensions with 13.4 million users funnel searches through tracking servers Researchers at Socket identified 319 Chrome extensions with roughly 13.4 million combined users that route search queries through operator-controlled servers to collect referral revenue from Yahoo and Bing search syndication programs. Many were marketed as PDF tools, manual finders, security utilities or AI search products, most were unlisted in the Chrome Web Store and promoted through popunder ads, and some consisted of little more than a manifest that overrides the default search provider without requesting any permissions. Because the intermediary servers can see every query and change where searches land without an extension update, they create a privacy exposure and could be used to steer users to phishing pages or malicious downloads, so users are urged to review installed extensions and check their default search provider.   Energy Giant Engie Notifies Customers of Supply Chain Breach French energy multinational Engie has notified an undisclosed number of customers that their names, postal and email addresses, phone numbers, energy supply IDs, customer IDs and contract numbers may have been exposed after threat actors compromised a third-party marketing platform its partners use for customer prospecting in France. The company says its own IT systems were not breached, no banking data was involved, and the incident has been contained, but it warned customers to watch for impersonation, fraud and phishing attempts that leverage the stolen details. No extortion group has claimed responsibility so far, though Engie’s U.S. retail energy business was previously listed on a leak site during last year’s wave of Salesforce-related data theft.   Fake US Court Notices Target 100,000+ Businesses With LodaRAT Researchers at ThreatDown uncovered a phishing campaign impersonating the U.S. District Court for the Southern District of Florida that has targeted more than 100,000 businesses with fake Alternative Dispute Resolution notices carrying unique civil case identifiers. The links lead to a fraudulent court portal personalized with each target company’s details that only serves content to Microsoft Edge visitors to evade security scanners, and it prompts victims to download a password-protected archive containing an ISO with three different launch files. Every execution path pulls LodaRAT from a typosquatted domain, giving attackers a remote access trojan that logs keystrokes, steals saved browser credentials and Wi-Fi passwords, records audio and video, enables RDP, spreads across local networks and uses multiple persistence mechanisms to survive reboots. The post InfoSec News Nuggets – 10/29/2026 appeared first on AboutDFIR - The Definitive Compendium Project.