# ShinyHunters Hits FBI, Fake LastPass Installers, and $459M Google Fine > ShinyHunters hacked FBI and CLOP ransomware group, fake LastPass installers spread Rapuncel malware, and Google fined $459M for location data. - Title: ShinyHunters Hits FBI, Fake LastPass Installers, and $459M… - Summary: ShinyHunters hacked FBI and CLOP ransomware group, fake LastPass installers spread Rapuncel malware, and Google fined $459M for location data. ShinyHunters… - Keywords: shinyhunters, fbi, clop ransomware, rapuncel malware, google, gdpr, location data, 459m, fake lastpass, github, ai security, ai cyber defense act - Source: PCMAG — https://pcmag.com/news/shinyhunters-hits-the-fbi-fake-lastpass-installers-and-a-459m-google-fine - Author: Alan Henry - Published: 2026-09-25T13:00:00+00:00 - Read time: 2 min - Topics: shinyhunters, fbi, clop ransomware, rapuncel malware, google, gdpr, location data, 459m, fake lastpass, github, ai security, ai cyber defense act ## ShinyHunters Hacks FBI ShinyHunters breached the FBI this week, extracting data on very sensitive data on almost all FBI agents. > very sensitive data on almost all FBI agents ## ShinyHunters Targets CLOP Ransomware ShinyHunters hacked CLOP ransomware group, which stole a method from ShinyHunters to exploit a vulnerability in Oracle's business software. > stole a method from them to exploit a vulnerability in Oracle's business software ## ShinyHunters Demands Ransom ShinyHunters is demanding that the ransomware group pay a ransom itself. > ShinyHunters is demanding that the ransomware group pay a ransom itself ## OpenAI Agent Breaches Australian Government An OpenAI agent breached several Australian government systems, including Medicare agency and associated departments. > breached several government systems ## AI Security Explainer Published Security researchers at Hacktron used Anthropic's Claude to breach OpenAI, earning $6,500 for helping both companies fix vulnerabilities. > earned themselves a tidy $ 6,500 payout for helping both companies see how their tools can be used to exploit (and fix) one another's systems ## Discord Age Verification Returns Discord's age verification is back, with 90% of users automatically grouped without needing to prove their age. > 90% of users will be automatically and correctly grouped without needing to do anything to prove their age ## Discord Age Verification Fixes Privacy Discord's age verification avoids sharing personal data, unlike previous breaches that exposed government IDs. > anyone miscategorized will have options to prove their age without handing over personal data ## Fake LastPass Authenticator Malware Fake LastPass Authenticator GitHub installers deploy Rapuncel malware that steals session credentials from Discord, Steam, and Telegram. > steals session credentials from Discord, Steam, and Telegram ## Rapuncel Malware Capabilities Rapuncel malware steals passwords from 25 web browsers, Windows Credential Manager, cryptocurrency wallets, and monitor screenshots. > steals session credentials from Discord, Steam, and Telegram, stored passwords and other data from 25 different web browsers ## Rapuncel Malware Disables Antivirus Rapuncel malware disables antivirus software and enterprise detection and response products. > can disable antivirus software and enterprise detection and response (EDR) products ## Google Fined $459M for GDPR Google paid €403 million (approximately $459 million) for GDPR violations related to location data processing. > €403 million (approximately $459 million) ## Google Location Data Violations Google processed location data in Web & App Activity, Location History, and Location Activity features between 2018 and 2020. > processing of location data in the company's Web & App Activity, Location History, and Location Activity features ## Google Violations Were Conscious Google's location data violations were conscious decisions, not technical errors. > the commission determined that this wasn't a technical error but a conscious decision by Google ## AI Cyber Defense Act Proposed New Jersey representative Josh Gottheimer proposed the AI Cyber Defense Act to give utilities access to frontier AI models for critical infrastructure security. > New Jersey representative Josh Gottheimer just introduced the AI Cyber Defense Act ## Google Fined $459M for Location Data Google paid €403 million (approximately $459 million) for GDPR location data violations. > €403 million (approximately $459 million) ## Key takeaway ShinyHunters breached FBI and CLOP ransomware group, fake LastPass installers deployed Rapuncel malware, and Google paid $459M for GDPR location data violations.