This week in cybersecurity: X users face unsolicited password resets, Sality botnet dismantled, and Pegasus spyware targets Serbian activists.
This week has seen several noteworthy developments in cybersecurity.
- X users are currently experiencing a spike in unsolicited password reset requests.
- Law enforcement has successfully dismantled the Sality botnet, which had been active for over two decades.
- A Russian citizen has been charged in the U.S. for distributing malware that impacted 80,000 freelancers.
- Hackers have developed a method to bypass AI antivirus systems with deceptive messages.
Unsolicited Password Reset Requests Target X Users
Users of X have reported an alarming increase in unsolicited emails about password resets and alerts related to unfamiliar login attempts, as noted by Decrypt. Many users have expressed anxiety despite having two-factor authentication in place, fearing for their account security.
"Someone has been aggressively trying to reset my X password... I have 2fa but I'm still anxious... anyone else experienced this?" — cap.eth (@TheCapHimself) September 1, 2026
X engineers have acknowledged the situation but insist there is no breach in their infrastructure. They believe these incidents are automated attempts by hackers to gain access to accounts for potential exploitation of X's internal monetization system.
This surge in suspicious activity may be linked to a vulnerability in the Twitter API identified in January 2022, which allowed for the matching of user email addresses and phone numbers. A subsequent leak in March 2025 revealed a database with personal data from 201 million X users.
In April 2026, researchers noted that a botnet had tested over 4.8 million accounts through X's login system, with two-factor authentication successfully blocking a majority of these attempts.
To safeguard their accounts, X advises users to enable password reset protection, verify the sender of emails, and use authentication apps instead of SMS.
Law Enforcement Takes Down Sality Botnet
Authorities from the U.S. and Europe have successfully shut down the Sality botnet, which has been operating since 2003, and seized its infrastructure. At the time of its dismantling, over 15,000 devices remained infected.
Cybersecurity experts revealed that the botnet was controlled by a group known as SALTY SPIDER, based in Bashkortostan, Russia. The operation involved taking over key supernodes to disrupt the botnet's communication, effectively isolating infected machines.
Over its lengthy operation, Sality was utilized for various cybercrimes, including password theft and DDoS attacks, with a recent focus on a module that targeted cryptocurrency addresses.
Charges Filed Against Russian National for Malware Campaign
Sirazhudina Aktulaeva, a 40-year-old Russian national, has been indicted in California for orchestrating a malware campaign that affected 80,000 freelancers. He was arrested in Cyprus in May 2025.
Between June 2016 and November 2017, Aktulaeva created numerous fake profiles on a U.S. job platform. He distributed Excel files containing malicious macros, which installed remote access Trojans on victims' devices.
His actions led to significant data theft, particularly targeting e-commerce credentials. Aktulaeva has been extradited to the U.S. and is awaiting a hearing scheduled for October 5, 2026.
Hackers Employ New Tactics to Evade AI Antivirus
Experts from ESET have uncovered a new technique used by hackers to bypass cybersecurity measures, dubbed GuardBreaker. This method involves embedding bait phrases in malicious scripts to confuse AI antivirus systems.
The pro-Russian hacker group UAC-0099 has been using this tactic in operations against Ukrainian infrastructure. The embedded messages disrupt AI analysis, allowing malware to be delivered without detection.
Such tactics highlight the evolving landscape of cybersecurity threats and the need for robust defenses against increasingly sophisticated attacks.
Pegasus Spyware Targets Serbian Student Movement
Recent findings indicate that the iPhone of a member of the Serbian student movement was compromised by Pegasus spyware via a zero-click exploit in iMessage. This issue has prompted investigations following a broader notification from Apple regarding targeted attacks.
Since early 2026, numerous members of Serbian civil society, including students and activists, have reportedly been targeted, coinciding with significant political events.
The SHARE Foundation has documented these attacks, which also include the discovery of local spyware on activists' devices, further raising concerns about privacy and security in the region.
