Security firm Avast has warned that data stolen during October's wave of AI-driven cyberattacks, dubbed Black October, is now being reused to run realistic phishing at scale. Criminals are combining real records with AI tools to send high-volume messages aimed at private email accounts and online-banking customers, according to Avast's warning published on 29 October. No mass bank takeover tied to these incidents has yet been widely reported.

Four risks to watch

Avast lists four risks for the coming weeks: follow-up phishing claiming an account was affected and urging the reader to verify now, to steal passwords and two-factor codes; misleading padlock icons, since stolen certificate keys may let fake pages appear secure; risk through connected AI tools, where compromised add-ons could reach email, cloud storage or financial accounts; and automated identity theft using stolen names, phone numbers, dates of birth and addresses.

What happened in Black October

The warning follows a month of separate incidents. On 21 October researchers disclosed serious flaws in PHP, the scripting language that powers about 70% of websites. A Reuters investigation published on 19 October described a hacker using AI agents to probe more than 1,200 websites and breach more than 100 companies. Salt Security showed on 1 October that a hidden email instruction could take over an AI assistant, and Railway disclosed credential-system access on 21 October.

How to stay safer

Avast advises people to use a unique password for every login, turn on passkeys or two-factor authentication where available, and revoke unneeded third-party app and AI-tool access in Google, Apple and Microsoft accounts. Crucially, it says never to click a link in a breach message: instead, open the company's app or type its website address directly.