💥 BREACHES & INCIDENTS
Binance: Fake Job Interviews, Trojanized Homebrew, and AI Tool Abuse Led to $6.43B Theft
North Korean hackers stole $6.43 billion from Binance using fake job interviews, a trojanized Homebrew installer, and abuse of an internal AI tool.- Binance, the world's largest crypto exchange, lost $6.43 billion in assets on 29 October 2026; the FBI attributes the heist to the North Korean group TraderTraitor, and about $2.85 billion has been frozen or intercepted.
- The attack targeted Binance wallet team engineers, starting in June 2026 when a Wallet DevOps engineer downloaded a trojanized Homebrew installer for an AI coding tool found via search engine, exposing wallet infrastructure team details.
- In September 2026, a second engineer was lured via a job platform by a fake 'Project Director' persona through two staged interviews, then told to download a malicious code repository 'assignment' onto his work computer.
- The zero-day malware swapped a legitimate pyenv file for a poisoned copy, evaded endpoint tools, communicated with an attacker-controlled server, and deleted its own forensic traces.
- On 20 October the attacker abused an internal AI tool to compromise two more engineers, then on 29 October used a stolen container deployment token to run a malicious script and access the wallet signing service, moving 233.46 million XRP, ~970,500 SOL, 44.2 million OP, and 18,270 BTC outside normal withdrawal processes.
- The attacker used Ethereum's EIP-7702 to delegate wallet execution rights to attacker code; Binance cleared the delegation on 30 October via a special procedure and has since rebuilt the wallet system and AI tool.
Sources 📄 Source: x.com · 📎 Coverage: cybersecuritynews.com · 👁 via The Hacker News, @campuscodi@mastodon.social (+2)Chainstack breach exposes customer data and password hashes via third-party component
Blockchain infrastructure provider Chainstack disclosed a breach of its development and production systems that exposed customer account data and password hashes.- Affects Chainstack customers using its blockchain node infrastructure platform
- Exposed data includes organization names, account holder names, member email addresses, and password hashes; node credential systems were also accessed though there is no evidence they were read
- The attacker entered a development environment on October 26, 2026, escalated access into parts of production, and was detected and cut off on October 31, 2026
- Entry was gained through a third-party component; the incident is assessed to overlap with the AI-powered ARTEX campaign by a China-linked cluster targeting high-value firms, which also hit WorkOS, Chainalysis, and DIVD
DreamHost discloses breach with hacker access to customer session info for three months
Hackers accessed DreamHost's systems, including customer session information, for at least three months, prompting forced password resets.- DreamHost serves over 400,000 customers in 100+ countries with 1.5 million websites, including 750,000 WordPress installations; email and FTP/SFTP users were forced to reset passwords.
- Per a California AG filing, hackers had access to systems including customer session info that could allow attackers to log in, with access lasting at least three months (breach date listed as August 15, 2026).
- The company discovered on October 23 that an unauthorized third party accessed the server running its web-based File Manager, disrupting connections to that service.
- Customers were advised to review email accounts for unrecognized forwarding rules, suggesting some mailboxes may have been exposed to external actors.
- DreamHost did not respond to press questions about the number of impacted accounts or whether files or messages were exposed.
Sources 📄 Source: dreamhost.com · 📎 Coverage: mastodon.social · 👁 via @zackwhittaker@mastodon.social
🕵️ RESEARCH & DEEP DIVES
Open-source AI pentesting framework ARTEX abused by state-linked and criminal hackers in real attacks
Threat actors including China-aligned Storm-0940 are abusing the open-source agentic AI penetration testing framework ARTEX to automate attacks against organizations worldwide.- Applies to organizations globally across many industries, including South Korean financial institutions targeted in October 2026.
- ARTEX is an open-source multi-agent LLM pentesting framework (Go with Next.js frontend) that works with any AI model, including DeepSeek, GLM, and Grok backends.
- Microsoft ties ARTEX use to Storm-0940, Onyx Sleet and Pearl Sleet; CrowdStrike names VAPOR PANDA; Google also saw extortion groups use it since late August 2026.
- Storm-0940 used ARTEX to accelerate abuse of a ConnectWise supply chain compromise, authenticating via already-authorized apps without interactive sign-in, then performing reconnaissance, credential changes, and privilege modifications.
- AhnLab found ~900 internet-exposed ARTEX instances (600 IPs, 90% in US, China, Hong Kong, Singapore) and recovered 51 files showing web shells, RDP pivoting, Kubernetes network scans, and implant deployment.
- Hunting markers include 'artx'/'artex' in command lines and the folder C:\ProgramData\artx5v; the tool trades stealth for speed, leaving noisy logs and bursts of API activity.
Microsoft: fake-download campaign uses trojanized Inno installers to deliver monetization payloads
Microsoft Threat Intelligence is tracking a fake-download campaign that uses trojanized Inno Setup installers to silently install monetization payloads on victims' devices.- Targets users searching for cracked commercial software, free games, activators, plugins, Roblox executors, and unofficial utilities (e.g., Echo Client, FabFilter Total Bundle, Navicat Premium crack, Red Alert 2).
- Fake installers launch an Inno Setup-style temporary runner under %TEMP%\is-.tmp, spawning numbered eld.exe / set_*.exe stages with /SL5, /SPAWNWND, /FIRSTWND arguments.
- The runner contacts rotating infrastructure using a repeatable d=inno and r=offer_execution callback pattern to coordinate per-offer payload delivery within one installation session.
- Confirmed monetization branches: WorldProxyPool (traffic proxying, with SYSTEM scheduled tasks for watchdog/updater), CharityEngine and BOINC (compute monetization), and Advanced Windows (AW) Manager / Windows Manager adware-style utilities.
- Microsoft published IOCs, advanced hunting queries, and MITRE ATT&CK mappings for the campaign.
🔓 CVEs & KEV
CVE-2026-28336 — SolarWinds Dameware — CVSS 9.9 — SolarWinds Dameware Command Injection Enables Authenticated Remote Compromise
CVE-2026-112917 — Docker Desktop — CVSS 9.2 — Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcallIn Docker ...
CVE-2026-46487 — geonetwork core-geonetwork — CVSS 7.5 — GeoNetwork: ACL bypass on Elasticsearch search when request body omits query ...
CVE-2026-39379 — geonetwork core-geonetwork — CVSS 7.1 — GeoNetwork: Reflected XSS through client-side template injectionGeoNetwork is...
CVE-2026-82976 — Red Hat OpenShift Container Platform 4 — CVSS 7.1 — Image-customization-controller: unauthenticated plaintext image server with d...
CVE-2026-120673 — MongoDB Rust Driver — CVSS 6.8 — Rust Driver 3.9.1 exports CSFLE plaintext in
db.query.textbefore encryptin...
📋 ADVISORIES
📄 Source for Hackers remotely raise supermarket fridge temperatures to 50°C across Europe — en.wikipedia.org
📄 Source for European authorities probe second wave of hacks targeting supermarket refrigeration systems — en.wikipedia.org