ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - October 16, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

FBI Flags Possible Election Fraud and Threats Ahead of 2026 Midterms
Vibetech Database Exposes 13.7 Million Records Including AT&T and FBI Data
Geopolitical Focus: Houthi Strikes Yemeni Presidential Palace, Four Killed in U.S. School Mass Shooting, and More

FBI Flags Possible Election Fraud and Threats Ahead of 2026 Midterms

Source: https://www.ic3.gov/PSA/2026/PSA261015-3

What we know: The FBI has issued alerts ahead of the November 2026 U.S. midterm elections, warning of election-related fraud, threats against voters, and election workers.

Context: The advisories warned that scammers could impersonate candidates, campaigns, government entities, and other trusted sources—including with AI-generated content—to solicit fake donations, run investment and merchandise scams, or steal personal information through fraudulent voter-registration pages. Additionally, voters are at risk of misinformation, vote buying, and intimidation among other threats; while election workers can face harassment or other forms of threats.

Analyst note: State-backed cyber actors and groups are also likely to seek to exploit the election period to advance their governments’ strategic interests. Likely objectives can include attempting to collect intelligence on campaigns and political organizations, leak or manipulate stolen information, and influence public opinion.

Vibetech Database Exposes 13.7 Million Records Including AT&T and FBI Data

Source: https://hackread.com/vibetech-database-exposes-att-fbi-data-more/

What we know: An unsecured database linked to Vibetech, an India-based AI software development and IT services company, has reportedly exposed 13.7 million records from previous breaches and leaks, affecting organizations such as AT&T, the FBI, Casio, and Interpol.

Context: The exposed data reportedly included names, phone numbers, email addresses, plaintext passwords, and bank account details. The database was reportedly accessible online without authentication or a password and appeared to aggregate data from previously compromised collections. The database was restricted shortly after the incident was reported.

Analyst note: The exposure is likely to be leveraged for credential abuse, account takeover, fraud, and targeted phishing.

Geopolitical Focus: Houthi Strikes Yemeni Presidential Palace, Four Killed in U.S. School Mass Shooting, and More

Iran-backed Houthis fired missiles and drones at the Yemeni presidential palace, killing five people and wounding 16. The site houses Yemen’s Saudi-Arabia backed government.
Four people have been killed in a mass shooting incident at an elementary school in Oregon, United States. Two others are critically injured. The suspected shooter was also killed.
Multiple wildfires erupted across California amid strong winds and heat. The Henderson Fire in San Diego burned over 1,000 acres, prompting evacuations, while utilities cut power to nearly 62,000 customers. Separately, Indonesia is testing dry-ice dispersal to tackle fires that have burned nearly 900,000 hectares since January 2026.
Kenya has confirmed a second Ebola case, involving a relative of the first victim who was already in quarantine. Authorities reported no evidence of wider community transmission. The country confirmed that travel, trade, and public gatherings remain unrestricted.
An earthquake of magnitude 7 struck Russia’s Kamchatka Peninsula. So far, no tsunami alert has been issued.

DEEP AND DARK WEB INTELLIGENCE

XSS user Marx1337: Untested threat actor "Marx1337" has advertised a dataset allegedly associated with Vested Finance, a U.S.-based financial technology platform serving international and non-resident Indian (NRI) investors on dark web forum XSS. The actor claims the dataset contains over 11 million records consisting of SMS logs with One-Time Password (OTP) codes, phone numbers, timestamps, and mobile carrier information for users across the United Arab Emirates, Qatar, Bahrain, and India.

Marx1337 has also advertised three additional datasets on the same forum, allegedly linked to a Qatar-based electronics retailer Garey Trading, a UAE-based EV charging point operator ForEVo (or 4EVo), and a Kuwait-based retail delivery platform Talabat.
The legitimacy of the data breaches has not been determined. If legitimate, a common SMS-log theme found across all four datasets likely indicates exposure of a large number of phone numbers and service-related information. Such data is likely to enable targeted phishing and courier or invoice-related fraud.

VULNERABILITY AND EXPLOIT INTELLIGENCE

NGINX patches five vulnerabilities: NGINX has released patches addressing five vulnerabilities. Among these, three memory safety flaws tracked as CVE-2026-15176, CVE-2026-93479, and CVE-2026-97205, enable remote code execution (RCE) under specific configurations.

Affected products: Affected products are listed here.