Fridge attacks hit France’s blood service, NIKKE launcher trojan, and other cybersecurity developments - ForkLog

Hackers have launched a series of attacks targeting critical infrastructure and personal data across Europe and the United States. The incidents range from the manipulation of hospital equipment to the theft of millions of dollars in cloud computing resources.

The French Blood Establishment (EFS) was the target of a cyberattack that compromised plasma storage units. Simultaneously, refrigeration systems at supermarkets in Sweden, Belgium, Ireland, and other European countries were remotely reconfigured by hackers.

At an ICA branch in Sweden, attackers set freezer temperatures to 50°C, forcing the disposal of spoiled goods. In Belgium, Carrefour reported 15 affected locations out of more than 700, while Ireland’s Musgrave, owner of SuperValu, counted 13 out of 223.

AI key theft costs millions

A new form of cyberattack, known as LLMjacking, has cost companies millions of dollars. Attackers steal API keys for large language models and use them at the owner’s expense, with costs spiking by more than $100,000 a day.

The group UNC6993 set up a fake page posing as a corporate app portal and tricked employees into pasting their verification tokens. With these tokens, hackers logged into the victim’s cloud environment and resold the access via underground brokers.

One such marketplace, Jet Night, offered an unlimited plan at roughly $60 a month. In under eight hours, it made more than 500,000 requests on stolen credentials, nearly $1 million in spend.

Trojan in game launcher

A trojan was distributed through the PC launcher of the game Goddess of Victory: NIKKE, stealing passwords and crypto wallet data. The publisher, Level Infinite, confirmed that a third party hijacked the domain insightjs.com on September 27.

Distribution of the malware began on October 30 Korea time. Code in four files on the company’s CDN fetched a remote access agent that executed commands, took screenshots, and extracted saved passwords, cookies, SSH keys, cloud tokens, and data from 28 crypto wallet extensions.

Level Infinite recommended checking the launcher’s debug.log for the line k2f_chan registered, which indicates the trojan may have run. The mobile version of the game was not affected.

AI-assisted malware pricing victims

A new stealer called VOLTA sends a dossier on an infected user to the Claude Opus 4.6 model to estimate potential revenue. The malware targets Windows PCs, pulling passwords, cookies, and payment data from browsers and cracking open crypto wallet stores.

It then queries seized accounts to verify a home address from Gmail receipts and pulls food order history. The final summary includes place of residence, employer, approximate year of birth, the last four digits of a card, and the value of a Roblox profile.

The dossier is sent to Claude Opus 4.6 via the OpenRouter aggregator, which provides access to multiple AI services through a single API. The model is asked to act as a forensic analyst preparing a target appraisal and categorize discovered assets by monetization value.

If the model refuses, VOLTA switches to Kimi K2, then to Gemini 2.5 Flash. Talos concluded that AI does not speed up the attack but offloads the operator’s most labor-intensive task—victim triage.

Google dismantles TV box botnet

Google and its partners dismantled the XCPE botnet, which affected more than 1.3 million Android TV boxes. The backdoor was intentionally embedded by Shenzhen-based manufacturer Videostrong Technology.

The company sells such hardware under its own brand and for other labels, and it sold control of these devices to criminals. They profited from ad fraud and routed third-party traffic through owners’ home internet connections.

Cybersecurity specialists at Synthient traced the operation to Videostrong after finding infected firmware in a MECOOL KM9PRO Max bought in late 2025. Similar implants were present in telemedicine equipment, karaoke systems, and digital signage.

Google revoked Videostrong’s license to ship TV boxes with Google services and banned it and future affiliated entities from producing certified Android devices. The backdoor itself remains—it has simply stopped receiving commands.