Monday Scam Brief — 26 October 2026

ASIC added 33 names to the Moneysmart investor alert list between 19 and 23 October. Six are impersonations of real companies, including Plus500AU and International Capital Markets. The other 27 are unlicensed names. Several put a name ASIC has already listed onto a new domain.

On 21 October the Australian Signals Directorate’s Australian Cyber Security Centre published a critical alert on PHP, and reviewed it on 22 October after patches were released. On 23 October ASD published a critical alert on Fortinet products. ASD says it has not seen either issue exploited in Australia.

Scamwatch’s news feed has no item newer than the 28 September investment-scam alert. WA ScamNet’s four featured warnings are unchanged: event and festival tickets, fake shipping-container sites, flexible-work job scams, and tax phishing emails. The ACCC public warning notice register’s newest entries are still the 3 July 2025 ghost-store notices. Telstra’s active scam list had no new scam type. The ATO’s current scam alert is still the September malware email, last updated 18 September: a payment-update or income-statement message that leads to a malicious download.

Official alerts this week

ASIC Moneysmart investor alert list — new names this week

Source: ASIC Moneysmart investor alert list

ASIC added 33 names from 19 to 23 October 2026. The list checked on 26 October had no names dated after 23 October. Six are in the imposter category. The website or contact in the alert is not the company’s real site:

Impersonation of Plus500AU Pty Ltd (ACN 153 301 681, AFSL 417727) at app.plus500m.com, added 19 October. ASIC lists the real company’s websites as plus500.com and app.plus500.com.
Impersonation of International Capital Markets Pty Ltd (ACN 123 289 109, AFSL 335692) at universalstocktrading.com, added 23 October. ASIC lists the alias Universal Stock Trading, the email support@universalstocktrading.com, and the address 831 Bering Way, Suisun City, California 94585. ASIC lists the real company’s website as icmarkets.com.au. ASIC has listed impersonations of this company before.
Impersonation of Forest Stone Capital Pty Ltd at foreststonecapital.com.au, added 23 October. ASIC lists the phone 02 5301 0307, the email clientcare@foreststonecapital.com.au, the alias Forest Stone Advisory Pty Ltd, and the addresses L 18, 1 Macquarie Place, Sydney NSW 2000 and L 35, 360 Collins St, Melbourne VIC 3000. ASIC says Mountain Australia Capital Pty Ltd (ACN 673 724 902, AFSL 558544) was formerly known as Forest Stone Capital Pty Ltd, and lists no website for that company.
Impersonation of CX Investment Pty Ltd (ACN 625 945 397) at webtrader.cx-investment.io, added 23 October. ASIC lists the email support@cx-investment.net, the phone 61748032040, and the address Epping NSW 2121. ASIC lists no AFSL and no real website. ASIC listed a different CX Investment impersonation domain on 28 July.
Impersonation of FND Co Pty Ltd (ACN 619 267 239) at fndandco.com, added 23 October. ASIC lists the email info@fndandco.com and the address Melbourne VIC 3004. ASIC lists no AFSL and no real website.
Impersonation of Whitechapel Lane Pty Ltd (ACN 637 555 741, AFSL 521472) at wcsec.com, added 23 October. ASIC lists the email info@wcsec.com, the phone 02 7258 2740, and the address 300 Barangaroo Avenue, Sydney NSW. ASIC lists no real website.

The other 27 are in ASIC’s unlicensed category. ASIC has not marked them as impersonations of a named licensee. A familiar brand on an unfamiliar domain is still an alert. Names that stand out this week:

AI Pro App at aumarketstoday.com, added 19 October. ASIC lists 16/F, One Capital Place, 18 Luard Road, Wan Chai, Hong Kong, and the phone 852-278-571-76. The same address and phone appeared on AI Pro App listings added on 17 September and 7 October, on other domains.
Jaaims at jaaimsapp.com, added 23 October. ASIC lists the aliases Jaaims App and Jaaims Technologies, the address 81-83 Campbell St, Surry Hills NSW 2010, the phone 02 7908 0292, and the emails compliance@jaaimsapp.com, marketing@jaaimsapp.com and support@jaaimsapp.com.
Monaro Bondleigh at monarobondleigh.net, added 19 October. ASIC lists 1 Constitution Avenue, 2601 Canberra, the email support@monarobondleigh.net, and the phone +610820302304.
Zurich Group Markets at zurichgroupmarkets.com, added 19 October. ASIC lists Stockerstrasse 33, 8002 Zürich, Switzerland, the email support@zurichgroupmarkets.com, and the phone +61851225961.
Velion Group on two domains, both added 19 October: area.vll-grp.com and veliongroup-ltd.com. The second lists 1–4 Matthew Parker Street, London SW1H, and the email support@veliongroup-ltd.com.
OdinTC at odintcgroup.com, added 19 October. ASIC lists the email support@odintcgroup.net and the phone +61 2 5138 4006. ASIC has listed OdinTC on other domains since August 2025.

Being on the list means ASIC says that name should not be treated as a licensed way to invest in Australia. An imposter entry means the site or contact is copying a real company. The real company is a separate entity from the website in the alert. The list is not complete: a missing name is not a green light. Check the live list and ASIC’s professional registers before you send money, and match the website, not just the company name. Treat unexpected wealth, broker or crypto offers as hostile until you have verified them yourself.

ASD Australian Cyber Security Centre: PHP

Source: ASD ACSC, published 21 October 2026, last reviewed 22 October 2026

This alert is for people and organisations that run websites or other applications on PHP. PHP is a scripting language widely used for web applications. The update on the page says patches have been released for two critical vulnerabilities. ASD says it understands that all PHP versions from PHP 5 onwards may be affected, and that it is not aware of successful exploitation in Australia.

ASD’s advice is to find any PHP in use, read the official PHP security guidance, apply the available updates, and watch those applications for suspicious activity. ASD says media reporting has identified the issues as CVE-2026-109618 and CVE-2026-109619, and that official technical details had not been publicly released when that part of the alert was written. An organisation that finds suspicious activity can contact ASD on 1300 292 371.

ASD Australian Cyber Security Centre: Fortinet products

Source: ASD ACSC, published 23 October 2026

This alert is for organisations that use Fortinet products. Fortinet is releasing critical security updates. ASD says affected products include multiple versions of FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator. ASD says affected FortiSASE versions have already been updated automatically, and that FortiManager may need a manual update. ASD says it has no further detail beyond Fortinet’s public advice, that Fortinet is expected to release more information on 10 November 2026, and that ASD is not aware of active exploitation in Australia.

ASD’s advice is to identify Fortinet products, apply the available updates, follow Fortinet’s guidance, and keep watching for signs of exploitation. Where an update cannot be applied straight away, Fortinet’s advice, as relayed by ASD, is to limit administrative interfaces such as HTTPS and SSH to trusted addresses or turn them off on external interfaces, keep FortiManager administration off the internet, and use strong credentials with multi-factor authentication. An organisation that finds suspicious activity can contact ASD on 1300 292 371 or at cyber.gov.au/submit-a-report.

What to do

Stop. A trading site one character away from a real broker, a .com.au address that is not the licensee’s site, or a news-like page that opens an account form is a warning sign. Pause before you move money. An extra fee or tax demanded before you can withdraw is a warning sign too.
Check. Use a website or phone number you looked up yourself. For an investment, check the investor alert list and ASIC’s professional registers, and match the domain to the real company. Open Plus500, the ATO, myGov or your bank by typing the address yourself. If you run a website or a Fortinet product, apply the vendor’s security update.
Protect. Turn on multi-factor authentication for email and banking, and use a passkey where you can. Do not read a one-time code back to someone who contacted you. Keep administrative logins for firewalls and websites off the public internet.

How to report

Scamwatch (ACCC): scamwatch.gov.au/report-a-scam
Report a cybercrime to police via ReportCyber: cyber.gov.au
Identity and recovery support: IDCARE on 1800 595 160

This brief is a public-interest summary of official Australian sources. It is not legal, financial or tax advice. Always rely on the original agency page linked above.

Sources used

Scamwatch’s news-and-alerts HTML page and RSS returned HTTP 403 to the automated fetch on 26 October 2026. The browse page and the RSS feed were opened the same day. The newest RSS item is the 28 September investment-scam alert. The ACCC public warning notice register also returned HTTP 403 to the automated fetch. The register was opened the same day, and its newest notices remain those dated 3 July 2025. The National Anti-Scam Centre news page and RSS returned HTTP 403. No NASC news item dated in the last seven days was found on the pages that opened.