22-Sep-2026 Google Fined, Water Utilities Hacked, Fake LastPass Malware Attacks

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily. Each episode delivers concise, credible analysis for CISOs, security leaders, and business decision-makers. Today’s briefing: 1. Water utilities targeted Attackers altered operational technology settings, pumping cycles, alarms, and remote access at two small Colorado water utilities. Service and public safety were unaffected, but the incident highlights the exposure of critical infrastructure controls and the potential impact of attacks on essential services. 2. Google fined €403 million Ireland’s Data Protection Commission fined Google over GDPR failures involving the collection, transparency, and retention of location data. Google says the issues relate to older policies, but the decision reinforces the compliance, privacy, and reputational risks of location analytics. 3. Fake LastPass Authenticator installer A malicious GitHub installer used a Microsoft-signed driver to disable security tools before stealing passwords, wallet data, and sessions. The campaign shows how attackers can abuse trusted signing chains and SEO tactics to bypass endpoint defenses. 4. Fake recruitment targets Rust developers The Rust project warned that attackers are using convincing job offers and company profiles to trick contributors into installing malware or executing commands. A compromised developer account or device could enable supply-chain attacks across the Rust package ecosystem. 5. Malware hidden in PNG files Microsoft researchers found the TerminalFix campaign hiding an executable and a split DLL inside PNG files. The technique demonstrates how seemingly harmless images can carry malware and support multistage intrusions while challenging routine detection. Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.