Monday Scam Brief — 12 October 2026

ASIC added 21 names to the Moneysmart investor alert list between 7 and 9 October. Two are impersonations of real Australian companies. The other 19 are unlicensed names. Two of those use Australian-sounding news domains and the same Hong Kong address. One lists a Perth street address.

On 9 October the Australian Signals Directorate’s Australian Cyber Security Centre updated its critical Citrix NetScaler alert. A further vulnerability is not fixed by the earlier patches, and a separate login issue has already affected Australian organisations. The same day ASD published a joint advisory on Chinese government-linked actors stealing data from organisational networks. On 7 October ASD published a personal cyber security handbook for individuals and families, during Cyber Security Action Month.

WA ScamNet’s four featured warnings are unchanged: event and festival tickets, fake shipping-container sites, flexible-work job scams, and tax phishing emails. Telstra’s active scam list had no new scam type. The ATO’s current scam alert is still the September malware email, last updated 18 September: a payment-update or income-statement message that leads to a malicious download. Scamwatch’s news page and the ACCC public warning notice register returned HTTP 403 from this machine, so this brief does not add an item from either page. The latest Scamwatch alert confirmed on the agency’s own article pages remains the 28 September warning about investment scams in chat groups and on fake news sites.

Official alerts this week

ASIC Moneysmart investor alert list — new names this week

Source: ASIC Moneysmart investor alert list

ASIC added 21 names from 7 to 9 October 2026. Two are in the imposter category. The website or contact in the alert is not the company’s real site:

Impersonation of Montgomery Asset Management Pty Ltd (ACN 679 155 509, authorised representative 001311486) added 7 October. ASIC lists the impersonation contact as the Gmail address bnyholdingsinc@gmail.com. ASIC lists the real company’s websites as baysideam.com.au and baysideassetmanagement.com.
Impersonation of Asteri Asset Management Pty Ltd (ACN 690 712 193, AFSL 700147) at asteri-am.com, added 8 October. ASIC lists the phone +61 2 8271 8245 and the email info@asteri-am.com. ASIC’s entry does not list a real website for this company.

The other 19 are in ASIC’s unlicensed category. ASIC has not marked them as impersonations of a named licensee. A familiar brand on an unfamiliar domain is still an alert. Names that stand out this week:

AI Pro App at theaussiereport.com and Ai App at australiandigitalreview.com, both added 7 October. Both list 16/F, One Capital Place, 18 Luard Road, Wan Chai, Hong Kong, and the phone +852 2785 7176. ASIC’s aliases are DE3 Marketers and DE3Marketers. Emails on the alerts include contact@dethreemarketers.com, contact@thethreemarketers.com and mario@de3marketers.com.
Report Scams Community at reportscam.net, added 8 October, listing International House, 12 Constance Street, London E16 2DQ. The name sounds like a reporting service. It is an unlicensed listing, not Scamwatch.
Tzelkagrun BTC at tzelkagrun-btc.com, added 9 October, listing 12 Hay Street, Perth WA 6000, and the phone +61 8 9226 5483.
Marble Zinsara at flashbeatnu.org, added 8 October. The same name was listed on 30 September at marblezinara-au.com.
True Accrumance at northlanternvkm.top, added 9 October. ASIC had already listed that name on two other domains on 30 September and 2 October.
Stakemoor Equity on willowdriftwayx.com and sablecrestcob.com, and Bold Accrudency on aquncugirden.pro and igossamerby.info, all added 9 October.

Being on the list means ASIC says that name should not be treated as a licensed way to invest in Australia. An imposter entry means the site or contact is copying a real company. The real company is a separate entity from the website in the alert. The list is not complete: a missing name is not a green light. Check the live list and ASIC’s professional registers before you send money, and match the website, not just the company name. Treat unexpected wealth, broker or crypto offers as hostile until you have verified them yourself.

ASD Australian Cyber Security Centre: Citrix NetScaler update

Source: ASD ACSC, updated 9 October 2026

This alert is for organisations that run Citrix NetScaler ADC or NetScaler Gateway, not a new consumer-payment scam. On 9 October ASD said a further critical vulnerability, CVE-2026-107406, affects those products when they are set up as a SAML identity provider or service provider. ASD describes it as a memory overflow that can lead to remote code execution or a denial of service. Patches for the earlier vulnerabilities on this alert do not fix this one. ASD’s advice is to apply the latest patches from Citrix.

A separate note dated 3 October says Citrix published guidance on a newly identified issue in deployments that use SAML authentication. A remote attacker may be able to crash the system. ASD says it is aware of impacts to Australian organisations, and that this issue is separate from CVE-2026-88771 and CVE-2026-88772. Organisations using that setup should review Citrix’s advice, watch for unusual activity, and report an impact to ASD.

ASD Australian Cyber Security Centre: personal cyber security handbook

Source: ASD ACSC, published 7 October 2026

ASD published a handbook for individuals and families. The steps it puts first are to turn on multi-factor authentication, use a passkey where the service offers one, and use a long unique password where a passkey is not available. It also says to keep devices and apps updated, back up important files, and stop before clicking a link, scanning a QR code, or answering an unexpected message. A passkey signs you in without typing that account’s password. ASD says a code by SMS or email is the weaker form of multi-factor authentication, because those accounts are easier to take over.

ASD Australian Cyber Security Centre: Chinese government-linked data theft

Source: ASD ACSC, published 9 October 2026

ASD published a joint advisory for cyber teams in government, critical infrastructure and other organisations. It describes how actors linked to the Chinese government, enabled by the China-based company Integrity Technology Group, get into networks and steal data, mixing automated infrastructure with hands-on access. ASD’s listed actions are to check systems against the indicators in the advisory, turn on multi-factor authentication, apply patches, disable unused services, watch for unusual account use and attempts to reach sensitive data, and update incident-response plans. This is not a consumer scam alert.

What to do

Stop. An investment offer on a news-like domain, a Gmail address claiming to be an asset manager, or a site called “report scams” that you did not look up yourself is a warning sign. Pause before you move money. An extra fee or tax demanded before you can withdraw is a warning sign too.
Check. Use a website or phone number you looked up yourself. For an investment, check the investor alert list and ASIC’s professional registers, and match the domain to the real company. Open the ATO, myGov or your bank by typing the address yourself.
Protect. Turn on multi-factor authentication for email and banking, and use a passkey where you can. Do not read a one-time code back to someone who contacted you. If you look after NetScaler systems, apply the latest Citrix patches. The September patches do not cover the 9 October vulnerability.

How to report

Scamwatch (ACCC): scamwatch.gov.au/report-a-scam
Report a cybercrime to police via ReportCyber: cyber.gov.au
Identity and recovery support: IDCARE on 1800 595 160

This brief is a public-interest summary of official Australian sources. It is not legal, financial or tax advice. Always rely on the original agency page linked above.

Sources used

Scamwatch’s news page and RSS, and the ACCC public warning notice register, returned HTTP 403 when fetched on 12 October 2026. They are listed because they were checked, not because a new item was confirmed on them.