Touchpoint Security Advisory

SonicWall SMA1000 Flaw Draws Attacks, iRhythm Notifies Cardiac Patients, and Fake Claude Installer Ads Target Mac Users

TSTouchpoint Security·October 12, 2026

Covering the weekend of October 9–12. Attackers began probing a maximum-severity SonicWall remote access flaw within two days of its patch. Cardiac monitoring company iRhythm is notifying hundreds of thousands of patients that their health information was stolen. And a malvertising campaign is using lookalike domains and a copy-and-paste trick to push a fake Claude installer to Mac users.

Priority at a glance

SonicWall and the fake Claude campaign both involve attackers active right now. iRhythm's incident already happened in June and is now in the notification and response phase — the urgency there is for affected patients and anyone holding similar third-party vendor exposure.

Issue	Exploited	Fix status	Our recommended timing
SonicWall SMA1000, CVE-2026-102255 (CVSS 10.0 pre-auth SSRF)	Attempts confirmed — 135 attempts from 2 IPs against decoys	12.4.3-03670 / 12.5.0-03082, no workaround	Today — treat unpatched exposure since Oct 6 as compromise
iRhythm patient data theft (June intrusion via third party)	N/A — breach occurred in June, now in disclosure	Notifications ongoing; no credit monitoring offered	Ongoing — affected patients should act now
Fake Claude installer malvertising (ClickFix clipboard swap)	Active campaign, no takedowns reported	N/A — block published domains	Today — block indicators, warn staff

1. SonicWall SMA1000: exploit attempts follow a CVSS 10.0 patch

What's new. We've flagged this SonicWall flaw twice already as it moved from patch to confirmed CVSS score. Now it's moved to confirmed exploitation attempts: Defused and Previdian reported exploit attempts against their decoy appliances starting October 8, and Previdian has logged 135 attempts from two US IP addresses. SonicWall's own notice still reports no evidence of exploitation, and it isn't known whether any attempts succeeded.

What happened. On October 5–6, SonicWall released hotfixes for four vulnerabilities in its SMA 1000 appliances. The most serious, CVE-2026-102255 (CVSS 10.0), is a pre-authentication SSRF flaw in the Work Place interface that lets an unauthenticated attacker make the appliance send requests on their behalf and reach internal functions.

Who is affected. SMA 1000 models 6210, 7210 and 8200v, physical and virtual, on firmware 12.4.3-03526 or older, or 12.5.0-02952 or older. The SMA 100 series and SonicWall firewalls are not affected. Shadowserver tracks more than 400 SMA1000 appliances exposed online. The pattern here is familiar: earlier SMA1000 zero-days were exploited for weeks this summer to steal credentials, session data and MFA seeds before attackers moved into corporate networks.

What to do. — click a step to check it off

Upgrade to 12.4.3-03670 or 12.5.0-03082 (or later) now. SonicWall lists no workaround.
Treat any appliance that was exposed and unpatched after October 6 as potentially compromised. Review Work Place logs for requests to internal services, and look for new accounts, web shells or configuration changes.
If you find signs of compromise, reset credentials and re-enroll MFA for users who signed in through the appliance.

2. iRhythm notifies patients after June data theft

What happened. iRhythm Technologies, maker of the Zio cardiac monitor, began notifying patients on October 2 about a June intrusion. Attackers used social engineering to reach business applications hosted by a third party and downloaded data between June 3 and June 8, 2026. iRhythm told the SEC in June that the attackers then threatened to leak the data unless paid.

360,000+ people in Texas and South Carolina alone (298,647 and 69,526 respectively, per state filings) — iRhythm has not disclosed a total.

Who is affected. The data includes names, addresses, email addresses, phone numbers, dates of birth, patient account and device serial numbers, insurance numbers and dates of service. iRhythm's notice states this includes protected health information (PHI) under HIPAA. The company says it holds no payment card data and that patient safety was not affected.

Why it matters. These are people being monitored for heart conditions. Insurance numbers and service dates can fuel medical identity theft and convincing phishing that references real care. iRhythm reports no evidence of misuse and has not offered credit monitoring.

What to do. — click a step to check it off

Affected individuals: review explanation-of-benefits statements for services you did not receive, and ask your insurer for a year-to-date claims report. Consider a free fraud alert or credit freeze. Verify any call or email about your heart monitor or insurance using the number on your card — iRhythm's response line is 1-844-770-7175.
Organizations: inventory patient data held in third-party applications, and require out-of-band verification for help-desk and access requests.

3. Fake Claude installer ads use lookalike domains and a clipboard swap

What happened. Push Security reported on October 9 that a Google search ad for "claude mac" displayed bing.com as its destination. The click passed through Bing's own redirect and a compromised retail website before landing on a fake "Download Claude" page. The campaign imitates Anthropic's Claude, whose legitimate domains are claude.ai and anthropic.com.

Lure domains. Push Security published these domains (defanged): claude-desk-code[.]com, cli-desktop[.]com, ksmgakajgpsals.pages[.]dev, rapid-craft567[.]com, too.clawddddd[.]com, fine-byte2[.]com, fairpoint29[.]com and turbowave45[.]com. The payload comes from lake-90[.]com. The techniques are combosquatting, free-hosting abuse and malvertising; no takedowns have been reported.

What the fake site does. The page shows Anthropic's genuine install command, but its copy button places a different command on the clipboard. That command prints a message naming claude.ai, then downloads and runs a script from lake-90[.]com. This "ClickFix" technique has the victim run the malware themselves. The final payload has not been identified, and direct visitors see only a 404 page.

What to do. — click a step to check it off, click any code snippet to copy it

Block the published domains in DNS filtering, web gateways and email security, and hunt in DNS and proxy logs for past connections, especially to lake-90[.]com.
Install developer and AI tools only through managed software distribution or the vendor's official site, never from search ads.
On managed Macs, alert on commands that pipe downloaded or base64-decoded content into zsh or bash.
Teach staff to type known addresses or use bookmarks, and to treat "copy this command" instructions as a red flag.

Compliance and personal data

We found no new rules, enforcement actions or regulatory deadlines published between Friday and Monday morning. The items below cover the compliance implications of the weekend's incidents instead.

HIPAA notification clocks HHS's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach. Breaches affecting 500 or more people must also be reported to HHS, and to the media in any state with more than 500 affected residents. Document when a breach was discovered and why notices went out when they did. The iRhythm incident is also likely to engage state breach-notification laws (filings appear in Texas, South Carolina and California) and was disclosed to the SEC on Form 8-K.

Vendor-held personal data Daiichi Kosho's exposure (see Also notable) arose at a contractor handling its customer data and is likely to engage Japan's APPI reporting rules. Contracts should require prompt incident notice, limit data kept on vendor endpoints, and give the data owner audit rights.

Exploited edge devices If a SonicWall appliance proves compromised, establish whether credentials or session data reached systems holding regulated data. That finding drives HIPAA, state-law and SEC materiality assessments, so record patch dates and investigation results.

This section is general information, not legal advice.

Also notable

Karaoke customer data exposed at a contractor (Japan) Daiichi Kosho says malware on a PC at its contractor, Nippon Columbia Group, may have exposed about 8.63 million customer records and 93,000 employee records, including names, gender, dates of birth, email addresses and phone numbers (no passwords). It has confirmed no leak or misuse so far and updated customers on October 9. Affected customers should expect targeted phishing; Daiichi Kosho says it will never ask for passwords or card details.

Arrest in the ShinyHunters investigation The FBI arrested a Canada-based ransomware response executive in Pennsylvania on October 8, according to court records reported by SecurityWeek and KrebsOnSecurity. He is charged with extortion-related conspiracy and interference with commerce by threats; the case has moved to the Eastern District of Texas. The charges are allegations only, but they're a reminder to vet incident response and negotiation vendors carefully.

Tampered Ledger hardware wallets Ledger says it found an unauthorized hardware implant in a device bought through Southeast Asian reseller CryptoBilis, after customers reported drained wallets from October 9. Ledger says only a limited number of devices are affected and its own channels weren't compromised. Buyers from that reseller should not set up the device, and anyone who already did should move funds to a new device bought directly, with a new recovery phrase.

Windows 11 23H2 end of support Microsoft's lifecycle page shows Windows 11 23H2 Enterprise and Education reaching end of support on November 11, 2026, making the November security update the last for those editions. Plan upgrades now so devices don't go unpatched.

Touchpoint's Take

The weekend's stories share a theme: attackers go where trust is assumed. Remote access appliances are trusted gateways, so a CVSS 10.0 flaw drew probes within two days of its patch. Third-party applications hold patient data outside the controls organizations apply to their own systems. Search ads and copy buttons look trustworthy, which is exactly what the fake Claude campaign exploits.

With Microsoft's Patch Tuesday arriving tomorrow, October 13, patch internet-facing appliances first, review the personal data your vendors hold, and install software only through managed channels.

If you would like help assessing your exposure or breach-notification readiness, the Touchpoint Security team is available to talk.

Sources

SonicWall: Product Notice — SMA 1000 Series affected by Multiple Vulnerabilities (SNWLID-2026-0017)
The Hacker News: Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks
SecurityWeek: Critical SonicWall Vulnerability Exploited Days After Disclosure
iRhythm: Notice of Data Event
California Attorney General: iRhythm Technologies breach listing
The Record: Hundreds of thousands impacted by data breach at biosensor firm iRhythm
SecurityWeek: iRhythm Data Breach Impacts at Least 360,000 People
The HIPAA Journal: iRhythm Notifies Individuals Affected by June 2026 Hacking Incident
Push Security: Adception — malvertising abusing another search engine's search results
BleepingComputer: Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
HHS: HIPAA Breach Notification Rule
Daiichi Kosho: notice on possible personal data leak at contractor (October 8)
Daiichi Kosho: update (October 9)
BleepingComputer: Nippon Columbia malware incident exposes 8.6 million karaoke fan records
KrebsOnSecurity: FBI arrests founder of ransomware negotiation firm
SecurityWeek: Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
The Hacker News: Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet
Help Net Security: Hidden implant in Ledger hardware wallets
Microsoft Learn: Windows 11 Enterprise and Education lifecycle
BleepingComputer: Windows 11 23H2 reaches end of support in 30 days

Not sure where you stand on any of this?

Our team is available to talk through your exposure to today's issues.