The Field Briefing — Issue #018 November 4, 2026 · From the Red Flag Cyber research desk

Next issue: The desk is watching for the NIKKE publisher's follow-up measures — the company says it is still investigating the scope of the impact and will give follow-up measures in a separate notice — and for a total affected count in the Amadeus breach, which Amadeus still has not given.

DEEP DIVE

NIKKE launcher breach: PC launcher scripts tampered with to spread credential- and crypto-stealing malware, fix issued November 4

The Short Version: The developers of Goddess of Victory: NIKKE confirmed on November 4 that a third party tampered with the game's PC launcher scripts, and issued a client fix at about 02:30 (UTC+9) that day. Independent analysis reported by BleepingComputer says the tampered scripts delivered a remote-access agent able to steal game credentials, browser data and files, with code that could target cryptocurrency wallet data. The tampering was in the PC launcher's scripts, not the iOS or Android apps, the publisher has given no count of affected players, and its investigation into the scope is continuing. The exposure window reported by the researcher runs from a September 27 modification until the November 4 fix.

What to do now: - Update the NIKKE PC launcher to the fixed client the publisher issued on November 4 before playing again, and run a full system scan with updated antivirus software. - You can check one reported indicator: the string "k2f_chan registered" in the Launcher/intl_service/debug.log file inside the NIKKE installation folder indicates the malicious agent executed (it does not by itself confirm the wallet-stealing DLL loaded). - If you find signs of compromise, reinstall Windows and change your passwords and other sensitive credentials from a clean device, and review your cryptocurrency wallets for transfers you did not make — move remaining funds to a new wallet created on a clean device if recovery phrases may have been exposed. - Treat any in-launcher or emailed warning that does not come from the publisher's official channels with caution.

Full report: https://red-flag-cyber-site.andrewdpeat.workers.dev/news/nikke-launcher

RED FLAG OF THE WEEK

Do not trust the voice. A call that sounds exactly like a family member may be an AI voice clone — hang up, call the person back on a number you know is theirs, and verify with a question only the real person would know or a family code word agreed in advance before you pay anything. Urgency, secrecy, and payment by wire, cryptocurrency, or gift cards with the numbers and PINs are the warning signs.

Source: https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/voice-clone-family-emergency

This issue covers items published November 3 – November 4, 2026.

NEWS

Singapore Airlines: about 46,000 booking records accessed in the Amadeus breach, 620 may include travel document details

Singapore Airlines said on November 3 that about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer membership numbers. Its own IT systems were not breached, and Amadeus confirmed bank and card information was not leaked and no bookings were modified. The airline says it is directly contacting affected customers with upcoming travel to change their booking reference numbers as a precaution — complete any change inside the airline's official website or app, which you open yourself, and treat any other message about a Singapore Airlines booking as suspect.

Singapore Airlines: about 46,000 booking records accessed in the Amadeus breach, 620 may include travel document details | Red Flag Cyber

Singapore Airlines said on November 3, 2026 that about 46,000 of its booking records were accessed in the Amadeus breach — names, booking references, itineraries and booking classes in every record, and for about 620 records also email addresses, phone numbers, travel document details and KrisFlyer membership numbers; its own IT systems were not breached, and Amadeus confirmed bank and card information was not leaked and no bookings were modified.

Chainstack breach: customer account names, emails and password hashes accessed, node credentials treated as exposed

Chainstack said on November 3 that an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed. Chainstack has given no count of affected customers and is notifying all customers by email. Follow its instructions: change your Chainstack password, and change the same password anywhere else you reused it; rotate your node credentials; and regenerate your platform API keys if you use the platform API. Chainstack says it will never ask for passwords, tokens or keys — treat any message that does as fake.

Chainstack breach: customer account names, emails and password hashes accessed, node credentials treated as exposed | Red Flag Cyber

Chainstack said on November 3, 2026 that an attacker who entered through a third-party component reached a customer account database containing organisation names, account holder names, member email addresses and password hashes, and had access to systems holding node credentials, which the company is treating as exposed; it says the incident was part of a broader AI-powered attack campaign reported in late October.

GitBook breach: attacker using AI agents accessed infrastructure credentials, tokens and assistant questions may have been exposed

GitBook said on November 3 that a sophisticated, highly targeted attack using AI agents gave an attacker access to some of its infrastructure credentials on November 2. Integration tokens, Git Sync secrets, API tokens and questions visitors sent to GitBook Assistant may have been accessed; the company found no evidence hosted content was modified, and it revoked all personal API tokens. Follow its instructions: create fresh GitBook API tokens, replace third-party API tokens and secrets you connected to GitBook, rotate the secrets used by any published integrations, and re-authenticate the MCP server if you use it. If you typed anything sensitive into a GitBook Assistant chat, treat that item as exposed and replace it where it is used.

GitBook breach: attacker using AI agents accessed infrastructure credentials, tokens and assistant questions may have been exposed | Red Flag Cyber

GitBook said on November 3, 2026 that a sophisticated, highly targeted attack using AI agents gave an attacker access to some of its infrastructure credentials on November 2; integration tokens, Git Sync secrets, API tokens and questions visitors sent to GitBook Assistant may have been accessed, the company found no evidence hosted content was modified, and it revoked all personal API tokens and told customers to rotate their credentials.

AI threat — ARTEX campaign expands: Chainstack and GitBook disclose breaches they link to AI-agent attacks

Two more platforms in the late-October AI-powered campaign disclosed breaches on November 3. Chainstack said its findings indicate its breach was part of the broader AI-powered attack campaign reported in late October, and The Hacker News assesses that it shares overlaps with the ARTEX campaign, though Chainstack itself names no framework or actor. GitBook described its November 2 intrusion, in its own words, as "a sophisticated, highly targeted attack using AI agents." The defence is credential hygiene, and both companies have published the same checklist: change the platform password (and anywhere it was reused), rotate node credentials and integration secrets, regenerate API keys and tokens, and re-authenticate connected tools. Do the rotations even if you received no individual notice.

AI Threats | Red Flag Cyber

The AI Threats desk tracks cybersecurity events where AI is materially involved — deepfake and voice-clone scams, AI-powered phishing, fake AI apps, AI-service data leaks, and AI agents abused in real attacks. Verified events only, each labelled by how solid it is, and each stating plainly what AI actually did.

Vulnerability — CVE-2024-27834, Apple Multiple Products

CISA added CVE-2024-27834 to its Known Exploited Vulnerabilities catalog on November 4. Apple's iOS, iPadOS, macOS, Safari, tvOS and watchOS software contains an improper-authentication flaw that could allow an attacker who already has the ability to read and write data on the device to bypass pointer authentication, a protection that helps stop code tampering. If you use this product: apply mitigations in accordance with Apple's instructions and CISA's BOD 26-04 guidance, and discontinue use of the product if mitigations are unavailable — update your Apple devices per the vendor's instructions.

Red Flag Cyber | Breach & Vulnerability News

Plain-language coverage of verified data breaches, exploited vulnerabilities, scams, and the practical steps that protect you next.

VIDEO

Episode 034: That Family Emergency Call Could Be AI

New Short: a panicked call that sounds exactly like family could be an AI voice clone — hang up, call back on a number you know is theirs, and set a family code word.

Watch: https://youtube.com/shorts/CDwX-LD-6ak

Full briefing — Briefing 22: That Family Emergency Call Could Be AI: https://red-flag-cyber-site.andrewdpeat.workers.dev/briefings/voice-clone-family-emergency

WHAT YOU LEARNED TODAY

Update the NIKKE PC launcher before playing again and run a full scan; rotate the passwords, node credentials, tokens and secrets Chainstack and GitBook told customers to replace; update Apple devices per the vendor's instructions; and never trust a family emergency call on the voice alone — call back on a number you know.

Forward this to ONE person who needs it today

👍 Good / 😐 Just OK / 👎 Terrible

—

Red Flag Cyber research desk

Masked and alias email addresses are welcome — subscribe with whatever address you're comfortable with. We never sell your data.