Bitget: $387M Stolen Through Security Gear - Weekly Cybersecurity and AI Brief

Somebody took nearly $388 million from the crypto exchange Bitget, and this week its investigators said how: through compromised third-party security products, with malicious activity in the logs going back to August 31. Also: Citrix NetScaler zero-days and the Dutch NCSC's advice to save the evidence before patching, a Dutch security nonprofit hacked by what it says was an AI agent, an Android banking trojan whose control panel uses Gemini to rank victims, and an Apple CoreGraphics bug with a federal deadline of today. Everything here was read on the primary source. Links below. WHAT TO DO Citrix NetScaler ADC / Gateway: per the Dutch NCSC, save a memory dump, disk image and logs first, then install the fixed builds from CTX697096 (14.1-73.37, 13.1-64.23 or later, or the matching FIPS/NDcPP builds). Keep at least a month of logs off the device. Zammad: DIVD advises upgrading to version 7 or taking it offline; the root escalation (CVE-2026-102490) affects every version and Zammad is working on a fix. DIVD publishes indicators and a log check script. iPhone, iPad or Mac not on the latest release: install iOS/iPadOS 26.7.1, macOS Tahoe 26.7.1 or macOS Sequoia 15.8.1 (CVE-2026-86950). Android: don't install apps from links in texts or ads, and be wary of anything asking for accessibility access. SOURCES Bitget, security notice: hot wallets incident, 24 Sep 2026 https://www.bitget.com/support/articl... Bitget, latest incident update: fund tracing and recovery bounty program, 25 Sep 2026 https://www.bitget.com/support/articl... Bitget, update on SlowMist and Mandiant report, 30 Sep 2026 (UTC+8) https://www.bitget.com/support/articl... SlowMist, investigation progress report: Bitget (findings as of 29 Sep 2026) https://github.com/slowmist/Knowledge... Mandiant, Bitget incident response status report, 28 Sep 2026 https://img.bgstatic.com/multiLang/ev... Citrix, CTX697096: NetScaler ADC and NetScaler Gateway security bulletin, 27 Sep 2026 https://support.citrix.com/external/a... NCSC-NL, Kwetsbaarheden in Citrix NetScaler ADC en NetScaler Gateway: update nu, 27 Sep 2026 (updated 30 Sep) https://www.ncsc.nl/alerts/kwetsbaarh... DIVD, DIVD-2026-00014: When, not if... (statements 24 Sep to 1 Oct 2026) https://csirt.divd.nl/cases/DIVD-2026... DIVD, DIVD-2026-00015: vulnerabilities in Zammad, last modified 1 Oct 2026 https://csirt.divd.nl/cases/DIVD-2026... Cleafy Labs, From BlackCat to Panda Workshop: inside the evolving C2 panel behind RATHat, 28 Sep 2026 https://www.cleafy.com/cleafy-labs/fr... Apple, about the security content of iOS 26.7.1 and iPadOS 26.7.1, 28 Sep 2026 https://support.apple.com/en-us/149226 CISA Known Exploited Vulnerabilities catalog (CVE-2026-86950 added 29 Sep, due 2 Oct; CVE-2026-88771 and -88772 added 27 Sep, due 30 Sep) https://www.cisa.gov/known-exploited-... Microsoft Digital Defense Report 2026, 1 Oct 2026 https://www.microsoft.com/en-us/secur... 0:00 Intro 0:39 Bitget: $387M through the security gear 3:13 Quick hits: NetScaler 3:56 Quick hits: DIVD 5:08 Quick hits: RatHat 5:59 Quick hits: Apple 6:25 The take