In four October weeks Italy's national CERT analysed 755 malicious campaigns. The ones that stood out pulled the oldest levers in the book: a police fine to pay right away, a PagoPA notice sent from a real certified mailbox. And for the first time, AI tools appear on the list of vulnerabilities. A month read through the CPF3 indicators.
```chart
{"title": "Malicious campaigns per week seen in Italy, October 2026", "unit": "", "series": ["Campaigns"], "rows": [["3-9 Oct", 178], ["10-16 Oct", 254], ["17-23 Oct", 202], ["24-30 Oct", 121]], "note": "CERT-AGID weekly summaries. Most targeted Italian users directly."}
```
## The numbers
Italy's national CERT (CERT-AGID) analysed **755 malicious campaigns** in the four weeks from 3 to 30 October, most of them aimed directly at Italian targets, with the peak in the week of 10 to 16 October (254 campaigns, 217 Italian). These are attacks that, by and large, only work if a person opens, clicks or pays.
## Three campaigns, three levers
| Campaign | Lever | CPF3 indicator |
|---|---|---|
| SMS "fines" in the name of the State Police, for a toll road ticket, with a link to pay | Authority plus a deadline | [1.3 Authority impersonation](https://cpf3.org/indicators/1-3-authority-figure-impersonation-susceptibility/), [2.1 Urgency-induced bypass](https://cpf3.org/indicators/2-1-urgency-induced-security-bypass/) |
| PagoPA payment requests for "fines", sent from **real, compromised certified mailboxes (PEC)** | Trust in the channel | [4.3 Trust transferred to systems](https://cpf3.org/indicators/4-3-trust-transference-to-systems/) |
| Fake payment page that checks in with its control panel every half second, to steer each victim live | Urgency, a person on the other end | [2.1 Urgency-induced bypass](https://cpf3.org/indicators/2-1-urgency-induced-security-bypass/) |
The second one is the instructive case. A PEC message carries legal weight in Italy, so people trust it more than ordinary e-mail. The attackers did not fake that trust: they took over real mailboxes and borrowed it.
## AI tools are on the list now
Among the vulnerabilities of the month that need a person to act:
- **Langflow**, a popular builder for AI apps: a dependency confusion flaw in versions 1.0.0 to 1.12.2 could let an attacker run code when a package is installed.
- **A consumer robot dog's chat component**: a command could be injected through its AI chat feature; fixed in the vendor's latest firmware.
The tools that build and run AI assistants are now part of the same attack surface as e-mail and office software, and they are installed by people who trust them.
## What to do this month
1. Tell staff by name: fines do not arrive by SMS with a link, and a PEC can be compromised like any mailbox.
2. Patch the AI tooling like any other software, and keep an inventory of it.
3. See where your organisation is exposed with the CPF3 [quick scan](https://cpf3.org/scan/), and follow the live list on [the human factor, day by day](https://cpf3.org/human-factor/).
*Sources: CERT-AGID weekly summaries and alerts, and public vulnerability records, as collected by the escom.it bulletin. Data as of 6 November 2026.*
This update is not available.