Welcome to the October 2026 edition of the Cyber Threat Report. This month’s articles examine three different ways in which attackers exploit trust in familiar systems, from authenticated email and open-source software to routine browser prompts, reinforcing the need to look beyond whether content, tools or requests initially appear legitimate.
Conor Ackland examines SMTP smuggling and a recently disclosed header-smuggling weakness in Apple iCloud, explaining how attacker-controlled messages can pass established authentication checks and why SPF, DKIM and DMARC should not be treated as standalone proof that an email is legitimate.
Conor also analyses the compromise of the Tensorlake npm SDK by malware linked to Shai-Hulud, demonstrating how a trusted software dependency can expose developer workstations, build systems and credentials before an organisation’s own application or sandbox protections come into play.
Jatinder Seehra explores an evolution of ClickFix in which malicious script content is concealed within a PNG image in the browser cache, highlighting how attackers continue to adapt familiar social-engineering techniques to reduce obvious download activity and persuade users to execute the attack themselves.
A consistent theme across all three articles is that familiar signals of safety can be manipulated - an authenticated sender, a trusted package repository or an ordinary image file may still carry risk. Defenders must therefore combine technical controls with behavioural detection, contextual analysis and clear user guidance rather than relying on trust indicators in isolation.