$1.9B Outsider Takedown, 400+ Arch Packages Compromised, ShinyHunters Hits American Tower & MSG, Handala Claims Cal Water, Conti Guilty Plea, phpBB Decade-Old Auth Bypass

The takedown of Outsider, the China-based phishing-as-a-service platform linked to an estimated $1.9 billion in losses, is the day's defining story. Operation Ghost Hook, run by the FBI with Google and Lumen, seized the platform's admin domains, a Shopify storefront, and roughly $100,000 in payment wallets, and recovered 3.9 million stolen credit cards tied to its phishing domains. Outsider sold phishing kits and SMS and email verification bypasses for as little as $88 a week and coached customers on using AI platforms to generate custom phishing code, so the takedown lands on the industrial supply side of credential theft.

The compromise of more than 400 Arch Linux AUR packages through spoofed maintainer accounts is the other headline: tampered PKGBUILDs shipped an infostealer with optional eBPF rootkit capabilities aimed at developer workstations, and rootkit removal may require reinstalling from scratch. ShinyHunters widened its extortion beyond PeopleSoft, threatening American Tower with 5.2 million records including cell tower gate codes, a step change from data theft toward physical infrastructure access. Handala's claim on a California Water Service district, with custom wipers in its toolkit, should be read as a possible precursor to destructive action.

Watchlist: audit AUR package lists for tampered PKGBUILDs, rotate physical access codes at communications sites, patch phpBB to 3.3.17, and treat water utility exposure as a wiper risk.