Cybersecurity Weekly News (October 19–25): AI agents automate attacks, PHP flaws face mass exploitation, and bank brandname SMS scams rise
Cybersecurity weekly news October 19–25 highlighted a series of notable trends, from AI Agents being used to automate more than 1,200 intrusion attempts and critical PHP vulnerabilities triggering millions of exploitation attempts, to fraudulent bank Brandname SMS campaigns in Vietnam. At the same time, customer data in the financial and healthcare sectors continued to attract cybercriminal attention.
One of the clearest themes this week is that both the speed and scale of attacks are increasing. AI is significantly reducing the cost of automating reconnaissance and exploitation, while newly disclosed vulnerabilities can move into mass exploitation within hours. On the user side, Social Engineering is also increasingly abusing channels that people normally consider trustworthy, including Brandname SMS, family accounts, and familiar social content.
Businesses can follow additional developments in the IPSIP Vietnam Cybersecurity News.
I. Cybersecurity news in Vietnam
1. Warning over fake bank Brandname SMS: fraudulent messages can appear inside trusted conversation threads
On October 23, Vietnam Cybersecurity Magazine cited a warning from the Department of Cybersecurity regarding fraudulent bank Brandname SMS messages. A particularly concerning aspect is that fake messages may appear inside existing conversation threads where users are accustomed to receiving legitimate bank notifications, making them harder to recognize as scams.
When a message appears under a familiar brand name, users may be more likely to trust the content without checking the destination link. Attackers exploit that trust to direct victims to fake websites where login credentials, OTP codes, or payment information can be stolen.
For businesses, the incident shows that Security Awareness programs should go beyond the simple rule of “check the sender name.” Employees should also verify the context of the request, the destination domain, and the action the message asks them to perform.
For financial transactions in particular, users should access official applications or websites directly instead of opening links sent via SMS.
2. Woman loses more than VND 1.5 billion after receiving messages impersonating her daughter in Japan
On October 23, a woman in Dak Lak was reported to have transferred more than VND 1.5 billion after receiving messages from a Facebook account using the name of her daughter, who was studying in Japan.
This type of scam does not require malware or a sophisticated technical exploit. Attackers only need to create enough trust that the victim believes they are communicating with a family member, then use urgency or emotional pressure to bypass normal verification.
The same model can appear in business environments as Business Email Compromise, CEO fraud, or impersonation attacks. If an executive, colleague, or partner account is compromised or convincingly spoofed, a fraudulent payment request may appear completely legitimate.
A simple but highly effective control is to establish out-of-band verification for unusual transactions: call a known phone number, verify with a second person, or require an additional approval step.
3. Cybersecurity authorities warn about online wedding invitation scams
On October 22, Vietnam’s cybersecurity authorities warned that cybercriminals were taking advantage of online wedding invitations distributed through Facebook, Messenger, and Zalo to spread malicious links or harmful content.
This is a good example of how phishing campaigns increasingly mirror normal everyday behavior. Instead of relying only on familiar bait such as “you won a prize” messages or account alerts, attackers use content that feels more personal and less suspicious, such as wedding invitations.
For businesses, the lesson is not to memorize every new scam scenario. The more important habit is to assess risk before opening any unexpected link, attachment, or login request, regardless of how familiar or harmless the content appears.
4. Cross-border scam operation involving more than 100 people dismantled
On October 22, authorities in Thanh Hoa dismantled a cross-border fraud operation operating from a hotel and allegedly led by a Chinese national, with more than 100 participants of multiple nationalities involved.
The scale of the case shows that online fraud is becoming increasingly industrialized.
Rather than being carried out by isolated individuals, many campaigns now operate through structured organizations with assigned roles, physical operating locations, target lists, and standardized victim-manipulation procedures.
For businesses, effective defense therefore requires both technology and human awareness: monitoring suspicious behavior, preventing impersonation, protecting digital identities, and training employees to recognize psychological manipulation techniques.
5. Cyberattacks targeting banks risk becoming an “industry”
On October 22, a representative of Vietnam’s Department of Cybersecurity and High-Tech Crime Prevention warned that attacks targeting banking systems are becoming increasingly professionalized, while tracking criminal infrastructure and financial flows is becoming more difficult.
The financial sector remains one of the most attractive targets for cybercrime because it combines identity information, account access, transaction data, and direct opportunities for financial gain.
The threat does not come only from malware or technical vulnerabilities. Credential theft, Social Engineering, SIM-related fraud, compromised third-party accounts, and privileged internal accounts can all become starting points for an incident.
Banks and financial institutions should therefore prioritize identity security, transaction monitoring, privileged access management, threat intelligence, and real-time incident response capabilities.
II. International cybersecurity news
1. Hacker uses AI Agents for around 1,200 intrusion attempts, compromising more than 100 websites
One of the most notable developments of the week came from a Reuters investigation published on October 19.
A Chinese-speaking hacker used AI Agents to carry out around 1,200 intrusion attempts, ultimately compromising more than 100 websites. Reuters identified organizations appearing in the attacker’s activity data, including Deere, SharkNinja, and Cummins.
IPSIP Vietnam also analyzed the case and reported that the AI Agents were capable of autonomously carrying out multiple steps, including reconnaissance, vulnerability discovery, exploitation attempts, credential collection, and deployment of tools to maintain access.
The most concerning point is not that AI created an entirely new type of cyberattack. Most of the Agent activity still involved familiar penetration-testing or attack techniques.
An attacker can now allow AI Agents to probe hundreds or thousands of targets without needing to scale human resources proportionally.
For businesses, this significantly reduces the amount of time between the appearance of a weakness and the moment an attacker can discover and exploit it.
2. Critical PHP vulnerabilities trigger a global patching race
On October 21, critical PHP vulnerabilities forced multiple organizations and government agencies to temporarily take websites offline while remediation was underway.
PHP underpins a significant portion of the web ecosystem, including many sites powered by WordPress, Drupal, Joomla, and Magento. One of the disclosed weaknesses had existed in the software for a long period before its practical exploitation risk was fully recognized.
By October 22, the situation had escalated rapidly. Cloudflare reported millions of exploitation attempts following disclosure of the vulnerabilities, while companies and government agencies around the world rushed to deploy patches.
The incident is a clear example of how the time = from disclosure to exploitation is shrinking.
Once a proof of concept, technical detail, or even early vulnerability signal becomes public, attackers can use automation and AI to rapidly search the Internet for unpatched systems.
For businesses, vulnerability management can no longer rely solely on a monthly scanning schedule. Internet-facing systems need continuously updated asset inventories, prioritization based on exploitability, and an emergency patching process for vulnerabilities likely to see widespread exploitation.
3. State Bank of India reports cyberattack affecting nearly 3,900 customer records
On October 21, State Bank of India - the country’s largest bank by assets — reported a cyberattack involving 3,897 customer records containing personally identifiable information.
According to Reuters, data found on the dark web included fields such as names, phone numbers, dates of birth, email addresses, physical addresses, and some loan-related information.
SBI said it had hired an independent cybersecurity firm to investigate the incident. The bank also stated that customer account balances were not affected and that the incident was not expected to have a material impact on business operations.
Businesses should therefore assess data breaches beyond the immediate question of whether money was stolen. A relatively small but accurate dataset can continue to create risk for months or even years.
4. Quest Diagnostics detects unauthorized access to laboratory management system
On October 22, Quest Diagnostics said it had detected unauthorized access to Quanum LSM, a system used by some customers to order laboratory tests and access results.
The full scope of the incident was still under investigation at the time of disclosure, but unauthorized access to a platform associated with patient data once again raises concerns about cybersecurity in the healthcare sector.
Passwords can be changed and bank cards can be cancelled, but many types of health information cannot simply be “reissued” after exposure.
Organizations operating healthcare systems or storing sensitive information should ensure that access control, logging, data segmentation, and behavioral monitoring are proportionate to the sensitivity of the data they manage.
5. Warning of fake Amazon domain may differ by only one character
Another phishing trend highlighted by IPSIP Vietnam this week was the use of homograph or homoglyph attacks, in which attackers use characters that visually resemble Latin letters to create domains that look almost identical to legitimate websites.
After registering a convincing lookalike domain, attackers can copy logos, login pages, payment interfaces, and other content from major brands such as Amazon in order to steal usernames, passwords, OTP codes, or payment information.
The key issue is that modern phishing websites can look extremely convincing.
As a result, advice such as “check whether the website looks professional” is becoming less useful.
Users need to verify the actual domain name, rather than simply checking whether a brand name appears somewhere in the URL.
For businesses, brand protection should also become part of cybersecurity strategy. Detecting fake domains, impersonation websites, and phishing campaigns that abuse company brands can help prevent incidents before customer or employee credentials are stolen.
III. What should businesses prioritize after this week’s incidents?
The developments during October 19–25 point to four major trends:
First, automation is reducing attacker costs. AI Agents can perform large amounts of reconnaissance and exploitation almost autonomously, allowing one individual to generate activity that previously required an entire team.
Second, time-to-exploit is getting shorter. The PHP case shows that once a vulnerability is disclosed, exploitation can quickly scale to millions of attempts.
Third, identity and trust remain central attack targets. Bank Brandname SMS, family impersonation, fake Amazon domains, and leaked financial data all rely on the same mechanism: convincing victims that they are interacting with a legitimate party.
Finally, data remains a long-term high-value asset. The SBI and Quest Diagnostics incidents show that both financial and healthcare data remain highly attractive to attackers.
IPSIP Vietnam's expert perspective
Cybersecurity developments during October 19–25 show that the gap between manual and automated attacks is rapidly narrowing. AI Agents are helping attackers scale operations at low cost, while newly disclosed vulnerabilities can quickly be exploited across large numbers of Internet-facing systems.
For critical systems, businesses can combine IPSIP Vietnam's SOC 24/7 services to improve continuous monitoring, vulnerability assessment to identify exposed weaknesses before attackers do, and penetration testing to validate the real-world exploitability of important security gaps.
For businesses, the priority should not be to chase each attack technique individually, but to build strong attack-surface visibility, protect identities, patch vulnerabilities based on risk, and detect suspicious activity early enough to contain incidents before they spread.
Nguồn tham khảo
Vietnam Cybersecurity Magazine - Fake Bank Brandname SMS Used for Fraud
Vietnam Cybersecurity Magazine - Woman Loses VND 1.5 Billion to Messages Impersonating Her Daughter in Japan
Vietnam Cybersecurity Magazine - Warning Over Online Wedding Invitation Scams
Vietnam Cybersecurity Magazine - Cross-Border Scam Operation Hidden in a Hotel Dismantled
Vietnam Cybersecurity Magazine - Cyberattacks on Banks Risk Becoming an “Industry”
