Binance Traces $6.3 Billion to a Fake Interview and an Internal AI Tool

Binance’s preliminary report walks the October 29 theft back to a September fake-recruitment lure, a tampered Homebrew pyenv binary, and an internal AI tool used to pivot onto two more engineers’ machines. A second wave of refrigeration attacks hit supermarkets in at least seven European countries, traced to authentication-bypass flaws in Copeland XWEB controllers that have had a firmware fix since August.

Threat Activity

• Binance published a four-stage reconstruction of the $6.3 billion heist, and the new detail is the lateral movement. In September an engineer was approached on a job-hunting platform, run through two fake interviews, and told to pull a “coding assignment” from a code repository; the payload dropped a malicious pyenv_ into the macOS Homebrew directory, deleted the legitimate pyenv, re-pointed the symlink and spawned zsh, and went undetected by endpoint tooling at the time (BleepingComputer). On October 20 the attacker used that host plus an internal AI tool to take control of a Wallet DevOps engineer and a second wallet engineer, picking up a container deployment permission token that led to wallet-signing operations on October 29; Binance also notes that pausing withdrawals did not revoke malicious permissions already recorded on Ethereum (Binance incident report). The FBI attributes the intrusion to TraderTraitor / Lazarus; North Korea denies it (The Record) (earlier coverage) (discussion).
• ARTEX claimed a named victim: developer platform WorkOS says an attacker used the agentic pentest framework to breach an internal sales app, exposing business contact records and summaries of customer communications (BleepingComputer). Kevin Beaumont, who has run the tool, is blunt that “it’s not very good” yet “clearly being used to own lots of orgs” (GossiTheDog); hunters are fingerprinting exposed consoles on the ARTEX Gateway header and the “Autonomous Penetration Testing Console” page title (@cyb3rops). Chinese researchers separately warn that a widely shared modified ARTEX project and Docker image ships a backdoor and should be deleted (poisoning advisory) (earlier coverage).
• Google and partners dismantled the XCPE botnet, 1.3 million+ Android TV set-top boxes shipped with malware by Shenzhen manufacturer Videostrong and monetized by reselling users’ connections through residential proxy services and committing ad fraud; the takedown is expected to sever access to 10 million+ additional compromised systems, including telehealth devices, karaoke machines and digital signage (KrebsOnSecurity, The Record).
• A 3AM ransomware affiliate encrypted roughly 37 of nearly 50 machines reachable from one unmanaged host at a UK school estate; responders found evidence suggesting a model generated and revised commands during the intrusion, but stopped short of calling it full automation (BleepingComputer, Dark Reading).

OT & Critical Infrastructure

• Supermarket refrigeration controls were tampered with overnight into November 2 across Belgium, the Netherlands, Luxembourg, Sweden, Ireland, Estonia, Finland and Romania — the second wave after France. BBC reporting puts the scope at roughly 40 Delhaize, 15 Carrefour and 5 Spar stores in Belgium and Luxembourg, several ICA and Coop stores in Sweden plus an Axfood home-delivery distribution centre near Gothenburg, and 13 SuperValu stores in Ireland tied to one refrigeration model (BBC). Three British meat suppliers were hit through Copeland XWEB supervisory controllers; a security note circulated to members says firmware 1.12.1 and earlier carries “severe authentication bypass vulnerabilities that allow hackers to take control without a password,” with an update available since August. One wholesaler’s MD says he “interrupted a live hacking event” and physically pulled a fridge off the internet. No attribution; Belgium’s cyber agency says it may never be possible to identify who was behind it (The Record, The Hacker News).
• Midnight Blue returned to TETRA to make a point that didn’t land after TETRA:BURST: network authentication provides no authenticity guarantee for traffic, so malicious voice or data can be injected into authenticated networks — an issue only assigned CVE-2025-52944 after the team built a practical demo to disprove vendor claims it was infeasible. Most critical-infrastructure operators run backdoored TEA1 or no encryption at all, and the real exposure is SCADA WANs and security dispatch (Midnight Blue).

Supply Chain & Trusted Channels

• The cPGuard update channel was hijacked to backdoor hosting servers. An attacker used compromised credentials to reach OpsShield’s update CDN at 02:06 UTC on November 2 and pushed malicious versions 5.88.12–5.88.19 for about 12 hours; the script harvested Linux password hashes, root MariaDB/MySQL config, root shell history and root SSH authorized_keys/known_hosts, staging them to the licensing server via a compromised account. OpsShield says the actor retrieved 32 files per customer server, and told BleepingComputer nearly three thousand servers were impacted. Fix is 5.88.25+, then rotate everything (BleepingComputer, OpsShield advisory).
• GitBook revoked all personal API tokens after what it described to customers as “a sophisticated, highly targeted attack using AI agents” beginning 19:00 CET on November 2 (Hacker News). Blockchain infrastructure provider Chainstack disclosed unauthorized access to part of its production infrastructure with customer emails and password hashes accessed, assessed as part of the same large-scale AI-assisted campaign reported last week (The Hacker News).
• Nextron pivoted the npm CSS-package cluster back to October 25, naming birch-css-utils@1.1.0, noelc-css-blender@2.1.9, character-ai-sdk@1.0.0, postcss-semantic-themes@1.0.1 and mocha-ui-themes@1.0.0; they share obfuscated payloads and identical cross-platform VM-detection binaries, and add credential harvesting, AWS/Bedrock and invoice reconnaissance, plus cron, SSH-key and curl PATH-shim persistence pointing at a local 127.0.0.1:8873 relay (Nextron).

New Tools & Releases

• pass-ta-key implements the “Golden Attack” against Google Password Manager: extracting the Security Domain Secret from Chrome process memory and using it to decrypt synced GPM passkeys (PoC, write-up).
• CredGuardRuntimeShutdown deactivates Credential Guard at runtime via LSA_ISO_DISABLE_CREDENTIAL_GUARD and then extracts NT hashes from LSASS on Windows 11 24H2 (GitHub).
• A public exploit shipped for CVE-2026-97798, a command injection in Windows Error Reporting caused by improper argument-delimiter handling that lets a local authorized user escalate privileges (GitHub).
• NWH Stealer teardown covers payload extraction, fileless execution via the Bun JavaScript runtime, in-memory clipboard image theft, and exfiltration over AWS and Cloudflare R2 (analysis repo).

Tradecraft & Detection

• A sideloading chain hides its first stage inside the certificate table of a genuine Microsoft-signed sllauncher.exe (the Silverlight launcher), so Authenticode still validates while a fake oledlg.dll pulls the encrypted blob out of the signed EXE behind a CA FE BA BE marker. It ends in a lean modular x64 implant Nextron tracks as RRCfg — host profiling, installed-AV enumeration via WMI, ECDH P-256/AES-GCM over an IOCP TCP client, config under HKCU\SOFTWARE\RRCfg, and no built-in shell or file transfer, with everything else delivered as PE plugins. Lures are generic invoice and payment documents aimed at Western businesses (Nextron IOC report).
• Part one of a current survey of Microsoft Defender for Identity evasions is out, covering what still slips past MDI sensors in 2026 (cirosec), and a separate write-up walks SmartScreen evasion using custom file extensions (ipurple.team).

Cloud, Identity & AI Abuse

• LLMjacking has matured into a two-tier criminal market, per GTIG and Mandiant: one cluster scans for exposed LLM endpoints, another steals API keys from unprotected machines, and both feed “LLM mixers” that resell access. Victims have seen fraudulent charges exceed $100,000 in a single day and cumulative costs reach $1,000,000; one actor pushed more than 500,000 API calls in under eight hours through jet-night.com, which sells “unlimited access plans” at $60/month. Google also tracks UNC6993 aggregating stolen keys, and has observed exploitation of CVE-2026-40217 in LiteLLM for RCE via the custom-code guardrail testing endpoint (BleepingComputer, Dark Reading). As one practitioner notes, resold keys stay live for weeks — alerting on AI key usage from a new region or at odd hours beats finding it on the invoice.
• Huntress is investigating malicious Entra service principal sign-ins from 199.19.77[.]84, a Poland-based hosting IP, where the actor used valid app secrets to obtain Azure tokens in four customer tenants — consistent with a campaign Todyl reported the same day (Huntress). Responders in the thread flag the familiar problem that service principal logging gives defenders very little to work with.
• One actor is impersonating ~32 AI crawlers to hunt for secrets. Cequence tracked a scanner rotating ChatGPT, Claude, Perplexity and Meta user agents from a major cloud provider, requesting roughly 90 paths for .env files, cloud credential files and private SSH keys in bursts of 50–190 requests in about eight seconds. On one day in October it reached 48% of Cequence-protected organizations that saw any AI bot traffic; tells include evenly cycled identities and fake Claude agents all carrying Anthropic’s crawler contact string (Cequence).
• Stolen Amazon Bedrock keys from October’s AI-platform breaches sat quiet for 4–7 days before 2.5 million calls, a window that was fully visible in CloudTrail — a usable detection gap for anyone rotating credentials after a vendor incident (write-up).
• Check Point named “prompt adware” after finding Haiou, an OpenAI Codex jailbreak bundle that both weakens guardrails for offensive security tasks and persistently rewrites the agent’s global instruction files so common greetings emit an ad for a third-party OpenAI-compatible LLM gateway. The gateway itself isn’t known to be malicious; the point is that a third-party prompt bundle can durably alter instructions the agent trusts, and the same mechanism could bias recommendations invisibly (Check Point Research).

Vulnerabilities & Exploits

• VulnCheck disclosed ten flaws in Control Web Panel, the hosting panel on a large number of internet-facing servers. The lead bug, CVE-2026-73695, is unauthenticated RCE in the user panel; from that foothold the root-owned loopback user API offers two independent paths to root, including ungated routes tracked as CVE-2026-77877 (VulnCheck).
• A request smuggling flaw in NetScaler ADC and Gateway, CVE-2026-88773, now has a public PoC according to Chinese advisory roundups (advisory).
• Full exploitation write-up for Linux kernel CVE-2026-31695: an RTM_DELLINK race frees a net_device while ETHTOOL_MSG_FEATURES_SET calls pm_runtime_get_sync() on the possibly-freed parent struct device, which Alexander Popov turns into local privilege escalation via heap spraying kmalloc-cg-4k, a KASLR bypass and ROP/JOP hijacking of runtime_resume. Fixed by guarding dev->reg_state and clearing stale dev.parent references (a13xp0p0v).
• Brotli CVE-2026-111497 now has a public reproduction chaining WordPress pingback to RCE — the bug was originally found and reported by Project Zero’s Mateusz Jurczyk (Fortbridge) (earlier coverage).
• Barracuda disclosed a two-bug chain to root: CVE-2026-116606 (CVSS 9.3), a pre-auth authorization bypass in Email Security Gateway, and CVE-2026-111560 (8.6), command injection affecting ESG, Load Balancer, ADC, WAF, Control Center and Web Security Gateway. Exploitation requires reaching the admin interface; no in-the-wild activity reported (The Hacker News, BleepingComputer).
• PHP2Shell exposure has barely moved two weeks on: Censys counts 29 million of 46 million scannable servers still running a vulnerable PHP build, both CVEs are in CISA KEV, and a third flaw, CVE-2026-115560, remains unpatched by design — it needs an unusual config, so the fix lands on the regular schedule and the interim advice is to disable session.upload_progress.enabled. Kaspersky’s read is that exploits are multiplying but mass compromise remains unconfirmed (Kaspersky) (earlier coverage).
• Android’s November bulletin fixes CVE-2026-58868, a critical zero-click heap overflow in FrameDecoder.cpp reachable while processing media frames, affecting Android 14 through 17 and fixed at patch level 2026-11-01. No public exploit and no confirmed in-the-wild use (Android bulletin).

Nation-State & Espionage

• Apple’s October 29 threat notifications reached members of Germany’s political elite, including Bundestag members and delegation staff who traveled with Chancellor Merz to South Korea, Japan and Singapore; Green co-leader Franziska Brantner confirmed she was among them, and the wave spanned targets in 99 countries. BSI wrote to recipients within 24 hours telling them to assume their devices are infected and replace them, while saying it cannot confirm how many were actually infected, identify the spyware, or name the operator; zero-click delivery is suspected (The Record, CyberInsider).
• ESET detailed Gorbag, a Russia-aligned actor active since at least February 2025 and targeting only Ukrainian entities — law enforcement and justice bodies, local administrations near the front line, and defense. Its GIFTEDCROOK and BeautyStealer tools pull browser credentials, OpenVPN configs, KeePass databases and RDP/VPN configs to Telegram or a FastAPI C2, delivered via XLSM macros and, earlier, WinRAR CVE-2025-8088 sideloading; ESET suggests it may be a first-stage access broker. The cluster overlaps CERT-UA’s UAC-0226 (WeLiveSecurity). Nextron published IOCs and notes its generic YARA caught each stage well ahead of publication, including weaponized LNKs one day after first submission in February 2026 (Nextron).
• Bitter added PapRAT and three distinct delivery chains: an LNK abusing ftp.exe’s ! prefix to run local shell commands, a VHDX image carrying an LNK that shows a decoy spreadsheet while launching an MSI, and a RAR containing a .url shortcut that fetches an LNK over WebDAV (FortiGuard Labs).
• Zelenskyy confirmed Ukraine hacked Russia’s emergency alert system in a November 2 PBS interview, framing it as retaliation after false nuclear and chemical warnings were pushed through Ukraine’s air-raid alert app; Russia’s emergency ministry says its mobile app suffered a “massive cyberattack” that let attackers broadcast fake information (PBS).
• CyberPartisans and Silent Crow claim 23TB from Rosstat, Russia’s Federal State Statistics Service, including wartime loss data marked “for official use only” and a derived chart putting monthly Russian military deaths between 25,000 and 50,000 over the past two years. Rosstat admits coordinated attacks on its servers between October 29 and 31 but denies the exfiltration; the groups claim they wiped domain controllers, databases, virtualization and VPN infrastructure (Tom’s Hardware). Figures are unverified.
• Chinese researchers describe a new Lazarus campaign dubbed “FlashHole” using AI-generated résumés as the lure, abusing banking security software for intrusion, running in memory, and using GitHub for C2 (report).

Breaches, Leaks & Policy

• Harvard’s November 2025 Alumni Affairs and Development breach has been loaded into HIBP with data tied to 851,000 unique email addresses, linked to a ShinyHunters “pay or leak” extortion attempt (BleepingComputer, HIBP).
• Password manager mSecure told users on November 3 to change passwords, reset 2FA and consider removing passkeys after detecting “suspicious activity” — without saying what happened or what data was touched (The Hacker News, The Register).
• Unverified leak-site claims worth tracking: a group calling itself “byod” listed IHG Hotels & Resorts, claiming guest folio records, employee PII, AWS keys, Active Directory and CyberArk access obtained through a weak LDAP bind password, with no confirmation from IHG (Daily Dark Web); a separate actor advertises 20,564,434 records attributed to Colombia’s national learning service SENA (Daily Dark Web). Posts circulating today for Brazil’s DETRAN and Russia’s Pension Fund appear to be recirculated listings from earlier in 2026.
• FIRST published a crisis-communication framework for cyber incidents plus new TLP usage examples aimed at settling recurring arguments over what can be shared, both flagged by Denmark’s CERT (CERT.dk).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .