💥 BREACHES & INCIDENTS
Hijacked DebugBear Script Drains ~$2.7M From 726 Polymarket Wallets
A hijacked DebugBear RUM script on Polymarket.com drained about $2.7 million from 726 traders' wallets on October 29, 2026.- Polymarket traders on polymarket.com were affected; 726 wallets lost funds, and Polymarket is refunding about $2.7 million plus $1.19 million to ~5,500 other wallets, totaling $3.9 million.
- The malicious file was served from cdn.debugbear[.]com/C7xcKKrjUnXK.js after DebugBear's DNS records were compromised through its domain registrar; the attacker wallet 0x3F99139F1C5854bb628c2e576Aaf638e99dFfc18 received 28.6M POL (~$2.64M) between 17:10 and 18:02 UTC.
- The script reused logged-in sessions, reading Polymarket auth data and API keys from browser storage and hijacking the page's order-book client to trade as the user.
- Email-login users had positions sold via fill-and-kill orders through an embedded Magic wallet with no prompt; external-wallet users saw an ERC-1155 safeBatchTransferFrom signature request submitted via Polymarket's relayer.
- The script exfiltrated portfolio summaries and theft confirmations to data.debugbear.com/metrics/submit, disguised as ordinary RUM telemetry; Polymarket went cancel-only, paused the relayer, removed the script, and reset sessions within the hour.
CyberPartisans and Silent Crow claim breach of Russia's Rosstat, 23TB stolen, systems wiped
Belarusian and Ukrainian hacktivist groups CyberPartisans and Silent Crow claim they breached and destroyed the IT infrastructure of Russia's state statistics service Rosstat.- Targets Rosstat, Russia's Federal State Statistics Service, including its central office, regional divisions, and the Main Interregional Center for statistical data processing.
- Hackers claim control of ~25,000 machines, domain controllers, and virtualization systems including ZVIRT, oVirt, and VMware ESXi.
- They claim to have exfiltrated ~23TB of data: databases with statistical, economic, and personal data, census materials, ~2TB of 'Official Use Only' documents, and data related to Russian military losses in Ukraine.
- They also claim to have wiped databases, servers, VPN, workstations, and key systems (STAT-EC, TsSOD, Demography, SED, Statregister) and posted Ukrainian casualty statistics on the Rosstat website.
- The same duo previously claimed a hack of Aeroflot's IT systems in July 2025.
Russia's statistics agency Rosstat hit by cyberattack as hackers claim 23TB data theft
Hackers attacked Rosstat's websites and claimed to have stolen 23 terabytes of data, including information on Russian war losses.- Rosstat, Russia's state statistics agency, said its main website and regional portals were hit by a coordinated cyberattack between Oct. 29 and Nov. 1, 2026.
- The Belarusian Cyber Partisans and Silent Crow hacking groups left messages on the sites claiming they stole 23 TB of data, including wartime losses, demographic and economic statistics, and documents marked "for official use only."
- Rosstat denied any databases or legally protected information were leaked, saying monitoring systems detected suspicious activity in time to respond; the agency's main website was inaccessible.
- Both groups are designated as extremist in Russia and previously claimed the July 2025 Aeroflot attack and a January 2025 theft of 2 billion records from state real estate registry Rosreestr.
- Russian prosecutors opened a criminal investigation into unauthorized access to computer systems.
October cyberattack wave hits PHP, Node.js, Binance, LiteLLM, Pentagon and more
October brought a heavy wave of cybersecurity incidents spanning crypto exchanges, web runtimes, AI tooling, and government records.- Who is affected: users of Binance and Polymarket, PHP and Node.js server operators, LiteLLM developers, and organizations including Coinbase, eMudhra, Capcom, Railway, and OpenCode.
- Binance suspended deposits and withdrawals while investigating an estimated $6.3 billion in unauthorized transactions, with ~$3 billion frozen; a compromised DevOps laptop may have exposed a service container, though private keys were reportedly not leaked.
- PHP2Shell involves two 9.2-severity flaws, CVE-2026-109618 and CVE-2026-109619, enabling unauthenticated code execution via Apache mod_php; fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with AWS reporting exploitation attempts before disclosure.
- Node.js shipped fixes for ten vulnerabilities (four high severity) affecting Brotli decompression, TLS hostname validation, and DNS handling in versions 26.12.1, 24.22.1, and 22.23.4.
- A compromised LiteLLM 1.107.0 release on PyPI carried credential-stealing malware across all seven wheel files, harvesting cloud credentials, SSH keys, browser data, and AI tokens, activated via Python startup hooks without explicit import.
🕵️ RESEARCH & DEEP DIVES
NetamLoader Malware Targets Government-Only Windows 10 Build in Asia via .NET Injection
Kaspersky has documented a sophisticated NetamLoader malware campaign targeting a government-only Windows 10 build in Asia.- Targets a custom Windows 10 build used exclusively by government entities in Asia, likely China's Windows 10 China Government Edition; one victim identified so far
- Delivered via a CAB archive placed in the Windows update download directory (C:\Windows\SoftwareDistribution\Download), suspected supply chain attack; initial delivery vector unknown
- Abuses legitimate Patch My PC components and AppDomainManager injection to load malicious .NET assemblies, executing code inside trusted processes
- Multi-stage XAML/.NET loader chain bypasses AMSI, moves execution into dllhost.exe, deletes forensic traces, and delays C2 contact 20-40 minutes
- Communicates with C2 server openaigpt4v[.]com over HTTPS using AES-128-CBC with HMAC-SHA256; no threat actor attribution established
Attacker poses as 32 AI bots including ChatGPT and Claude to hunt enterprise credentials
A threat actor has been impersonating AI agents at scale to scan enterprise networks for passwords, API keys, and cloud credentials.- Applies to organizations exposed to AI bot traffic; on one October day the actor reached 48% of Cequence-protected organizations that saw any AI bot traffic.
- The attacker impersonated about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials.
- The malicious scanner runs from a major cloud provider, ignores web pages, and requests files that commonly store secrets.
- The actor probes which AI agents a business trusts, then impersonates the agents expected to get through, so a bot's self-reported identity no longer proves anything.
Mirage2FA phishing kit stole 4,561 M365 session cookies via AiTM proxy amid Entra ID flaw CVE-2026-69836
CVE-2026-69836
The Mirage2FA phishing-as-a-service toolkit used an AiTM WebSocket proxy to steal thousands of Microsoft 365 session cookies despite MFA, coinciding with Microsoft's patch of critical Entra ID vulnerability CVE-2026-69836.- Targets Microsoft 365 users, primarily US companies; 9,426 accounts targeted with 4,561 confirmed session thefts (~48% success rate).
- Mirage2FA (LinX Coders group) is a phishing-as-a-service toolkit that steals M365 credentials and authenticated session cookies.
- Attack works via a transparent WebSocket proxy mimicking login.microsoft.com: the victim completes MFA normally while the proxy captures the authenticated session cookie for later replay.
- Password resets alone don't stop the attack — the stolen cookie remains valid until sessions are explicitly revoked.
- Separately, Microsoft patched CVE-2026-69836 (CVSS 10.0), an untrusted deserialization RCE in Entra ID, fixed server-side with no customer action; Microsoft retracted its initial 'Exploited: Yes' flag, saying there is no confirmed in-the-wild exploitation.
🔓 CVEs & KEV
CVE-2026-120307 — beam-cloud Beta9 worker — CVSS 9.9 — Beta9 container escape via unvalidated sandbox file pathsThe Beta9 worker ser...
CVE-2026-120306 — beam-cloud Beta9 worker — CVSS 9.9 — Beta9 build sandbox escape via chroot-only isolationBeta9 turns each shell co...
CVE-2026-66570 — Nickboss WordPress File Upload — CVSS 7.1 — WordPress WordPress File Upload plugin through 5.2.1 - Cross Site Scripting (XSS) ...