Cybersecurity Weekly News (October 12–18): Microsoft-Abused Phishing, “Online Kidnapping” Scams, and Hackers Taking Control of Refrigeration Systems
Cybersecurity developments during October 12–18, 2026 highlighted several notable trends, from phishing campaigns abusing legitimate Microsoft infrastructure and “online kidnapping” scams in Vietnam to attacks that remotely manipulated refrigeration systems across hundreds of supermarkets in France. At the same time, AI continued to appear in financial-sector incidents, while remote administration platforms such as BeyondTrust remained high-value targets for threat actors.
A common thread across this week’s incidents is that the attack surface is expanding far beyond traditional malware. Digital identities, cloud platforms, administrative tools, OT/IoT devices, and AI are increasingly interconnected within the same chain of risk.
Businesses can follow additional developments in the IPSIP Vietnam Cybersecurity News section.
I. Cybersecurity news in Vietnam
1. Even emails sent through legitimate Microsoft infrastructure can become phishing traps
One of the notable warnings resurfacing in Vietnam this week involved attackers abusing legitimate Microsoft authentication and notification infrastructure to make phishing emails appear more trustworthy.
According to Kaspersky, more than 31,000 scam emails using legitimate Microsoft service links were detected between August 1 and September 18. Attackers could register applications in Microsoft Entra, configure redirection to malicious websites, and then distribute Microsoft-hosted links to victims. In some cases, legitimate account-related features could also be abused to insert deceptive content into official-looking notifications.
This weakens one of the most common phishing-detection habits: checking whether an email comes from an apparently “official” domain. An email originating from legitimate infrastructure may still redirect users to credential-stealing pages or malware.
For businesses, security awareness programs should therefore move beyond simply looking for spelling mistakes, suspicious sender addresses, or fake domains. Employees also need to evaluate the context of the request, destination URLs, login behavior, and unusual actions requested after clicking a link.
IPSIP Vietnam also published a warning this week on attackers abusing Google and Microsoft infrastructure to make malicious emails more convincing.
2. “Online kidnapping” scam: Ho Chi Minh City police stop a family from transferring VND 1.2 billion
On October 14, Ho Chi Minh City police said they had rescued an 18-year-old student who had been psychologically manipulated by scammers using an “online kidnapping” scheme.
The victim left his dormitory on October 12 and repeatedly urged his family to urgently transfer VND 1.2 billion to unknown individuals. Authorities identified signs of fraud and located the student at a hotel around 30 minutes after receiving the report.
What makes this type of scam dangerous is that attackers do not need to compromise a sophisticated technical system. Instead, they exploit fear, impersonate authorities, isolate victims from family members, and apply time pressure to trigger financial transfers.
The same principle applies in business environments through CEO fraud, executive impersonation, urgent payment requests, or fake supplier bank-account changes. An independent verification process outside the communication channel being used remains one of the most effective defenses against Social Engineering.
3. Fraud ring targets more than 200 credit-card holders, causing losses of around VND 24 billion
On October 13, Ho Chi Minh City police announced a special wanted notice for a company director allegedly linked to a fraud operation that stole around VND 24 billion from more than 200 credit-card holders.
According to the investigation, the group purchased customer data, built a website to manage the information, and hired staff to call victims while impersonating banks. Victims were offered “cash withdrawal services from credit cards” and were then asked to provide card information and OTP codes. The group reportedly carried out more than 7,000 transactions worth approximately VND 136 billion.
The case shows that leaked or illegally traded personal data is not merely a privacy issue. When phone numbers, financial information, and transaction details are combined, the data can become highly effective “raw material” for personalized fraud.
Businesses should therefore treat customer-data protection and credential security as part of financial risk management, not only as a compliance requirement.
4. 95% of organizations in Vietnam experienced cybersecurity incidents affecting business operations
On October 14, Cisco’s Relentless Defense 2026 report was released in Vietnam, showing that 95% of surveyed organizations had experienced at least one cybersecurity incident affecting business operations during the previous 12 months, compared with 91% globally.
Notably, more than 40% of incidents in Vietnam were reported as AI-related. The report also highlighted that internal coordination, decision-making speed, and access to the right data during incident response significantly affect cyber resilience, not just the security technology itself.
The message for businesses is clear: adding more security tools does not necessarily solve the problem if detection, escalation, and response processes remain slow.
As automated attackers become capable of executing multiple actions within seconds, the time between detecting suspicious behavior and isolating a compromised account or endpoint must also become significantly shorter.
5. Vietnam strengthens ASEAN cybersecurity cooperation in Singapore
On October 13–14, a Vietnamese delegation attended Singapore International Cyber Week 2026 and the 11th ASEAN Ministerial Conference on Cybersecurity.
According to Vietnam’s Ministry of Public Security, discussions focused on strengthening regional cybersecurity cooperation, sharing views on the evolving threat landscape, and improving coordination among ASEAN countries and dialogue partners.
From a business perspective, cyberattacks are increasingly unconstrained by national borders. Cloud infrastructure, software supply chains, outsourced services, and cross-border data flows make threat-intelligence sharing and coordinated incident response more important than ever.
II. International cybersecurity news
1. Hackers manipulate supermarket refrigeration systems in France, causing physical losses
This was one of the most notable international cybersecurity incidents of the week.
During attacks occurring in the early hours of October 11–12, hackers reportedly compromised refrigeration control systems at multiple supermarkets in France and raised temperatures in some freezers to around 50°C, forcing large quantities of food to be discarded.
Reuters reported that at least around 350 stores were affected. The targeted systems relied on older software or equipment from vendors including Danfoss, Copeland, and Dixell, with many control interfaces still accessible from the public Internet.
Around 4,980 Danfoss refrigeration controllers remained directly exposed to the Internet, with more than half located in France. The article also noted that AK-SM and AK-SC systems play a central role in managing refrigeration temperatures, schedules, and alerts.
The incident is particularly significant because the impact extended beyond data theft or downtime. A cyberattack directly caused physical losses, damaged goods, and raised questions about whether cyber-insurance policies cover this type of material damage.
Reuters reported that losses could reach tens of millions of euros and that some existing cyber-insurance policies might not cover physical property losses.
For organizations operating OT/IoT environments, the incident reinforces the need to reduce direct Internet exposure, update firmware, replace default credentials, segment networks, and tightly control remote access.
2. South Korea identifies hacking incidents at 16 financial firms, with around 100,000 data records exposed
On October 14, South Korea’s Financial Services Commission said hacking incidents had been identified across 16 financial companies, with approximately 100,000 cases of data exposure.
Authorities are continuing to investigate the attack methods, including whether AI was used during the attacks. Regulators are also planning broader security inspections and measures aimed at detecting early indicators of compromise.
This represents an expansion of the financial-sector cyber incidents reported in the previous week. The key issue is not only the growing number of affected institutions, but also the possibility that AI may have been used to accelerate reconnaissance, exploitation, or data processing.
For financial organizations, identity security, privileged access management, and lateral-movement detection remain critical controls.
3. Google warns of a critical BeyondTrust Remote Support vulnerability
On October 15, Google Threat Intelligence Group and Mandiant warned about a critical vulnerability affecting BeyondTrust Remote Support appliances.
According to Reuters, successful exploitation could allow attackers to access sensitive credentials, upload malicious files, and take control of affected systems. A threat group suspected of links to China reportedly exploited the flaw before public disclosure, increasing the risk that additional threat actors could attempt exploitation after details became known.
Remote-support platforms are particularly attractive targets because they are often granted administrative privileges and broad access across enterprise environments.
Organizations should therefore treat these platforms as privileged infrastructure: restrict Internet exposure, enforce MFA, patch urgently, retain detailed logs, and monitor administrative sessions for suspicious activity.
4. Google DeepMind calls recent AI-enabled hacks “early warning shots”
On October 14, Demis Hassabis, co-founder of Google DeepMind, described recent AI-related hacking incidents as “early warning shots” of a class of risk that could become significantly more serious.
He argued that new standards and best practices will be needed as AI systems gain greater autonomy. Reuters also reported that technology leaders are increasingly calling for more adaptable oversight mechanisms for AI systems capable of carrying out multiple steps independently.
From a cybersecurity perspective, the issue is not simply that autonomous AI is inherently dangerous. Risk increases when an agent has simultaneous access to systems, credentials, execution tools, and decision-making authority without sufficient safeguards.
Organizations deploying agentic AI should apply least privilege, separate access permissions, log agent activity, and require human approval for high-risk actions.
5. TFG London suffers cyber incident affecting multiple fashion brands
On October 13, The Foschini Group confirmed a cyber incident affecting its UK operations, including the brands Phase Eight, Hobbs, and Whistles.
The company said it was investigating the scope of the incident and assessing whether personal or sensitive data had been affected. Some IT systems were disrupted as part of containment efforts.
Although technical details were not yet available, the incident demonstrates how a cyberattack on a multi-brand organization can quickly become a business-continuity challenge.
The ability to isolate affected systems, maintain critical services, and coordinate across IT, security, legal, and communications teams can determine the actual scale of operational disruption.
III. What should businesses prioritize after this week’s incidents?
The incidents reported during October 12–18 do not share a single attack vector, but they converge around four major risk areas: digital identity, Social Engineering, privileged access, and Internet-connected systems.
Attackers’ ability to abuse legitimate Microsoft infrastructure shows that organizations can no longer rely solely on domain or sender reputation when deciding whether an email is trustworthy.
“Online kidnapping” schemes and credit-card fraud continue to demonstrate that people remain an important part of the attack surface. Credentials, OTP codes, and personal data can be exploited without attackers needing a zero-day vulnerability.
BeyondTrust and the incidents involving South Korean financial institutions highlight the risk associated with high-privilege accounts and administrative tools. A legitimate account that has been compromised can be more difficult to detect than conventional malware.
The supermarket refrigeration attacks in France demonstrate that when OT/IoT systems are connected to the Internet, cybersecurity incidents can translate directly into physical losses, damaged goods, and operational disruption.
IPSIP's Vietnam expert perspective
For businesses, the priority is not to react to each threat in isolation, but to strengthen identity controls, reduce the attack surface, maintain continuous monitoring, and respond quickly when suspicious activity appears.
Cybersecurity weekly news October 12–18 show how closely cyber risk is now tied to real-world business operations. A legitimate email can become a phishing vehicle, an administrative account can provide broad access to enterprise systems, and an Internet-connected refrigeration controller can turn a digital attack into physical loss.
References
Kaspersky - Kaspersky detected over 31,000 scam emails abusing Microsoft authentication system in seven weeks
VnExpress - Police Stop Student’s Family from Transferring VND 1.2 Billion to an “Online Kidnapping” Scam Group
VnExpress - Ho Chi Minh City Director Wanted in Fraud Case Targeting More Than 200 Credit-Card Holders
VietnamPlus - AI Is Increasing Cybersecurity Risk in Vietnam
Vietnam Ministry of Public Security - Strengthening International Cooperation in Cybersecurity and Digital Transformation
