Japan extradited a Russian suspect arrested in Osaka, but the gang kept attacking during the handover.
A four-nation advisory ties WaterPlum to 30,000 infected devices, 7,000 drained wallets and $10.71 million in losses.
AI safety nonprofit METR says attackers stole an API key and burned about $600,000 in model credits across two incidents.