Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Latest News

Florida Reports Major Data Breach Affecting 4.9 Million Financial Aid Applicants

The Florida Department of Education (FLDOE) has disclosed a data breach involving its student financial aid website that may have exposed th...

All the recent news you need to know
stablecoin
Binance Blockchain Crypto Theft cryptocurrency Data Breach North Korea stablecoin

North Korean Hackers Drain $6.3 Billion from Binance in Record-Breaking Crypto Theft

 



Hackers tied to North Korea stole roughly $6.36 billion from Binance on Wednesday, stripping the world's largest cryptocurrency exchange of funds across ten blockchains in a heist that blockchain intelligence firms are calling the largest crypto theft in history.

The attack, which began at 8:05 p.m. UTC on October 29, moved faster than most exchange security teams could respond. The bulk of the money was gone within 20 minutes.

Binance suspended deposits and withdrawals shortly after detecting the breach and said user funds would be covered in full. "Investigating a potential security issue," the exchange wrote in an early-evening post, adding that user assets were safe. By late that night, a coalition of blockchain infrastructure firms had frozen roughly $3 billion of the stolen assets, though more than $2.4 billion remained in the attacker's control as of press time.


How They Got In

Blockchain intelligence firm TRM Labs, which traced the attack in near real-time, said the intrusion bore the hallmarks of TraderTraitor, the North Korean state-sponsored hacking unit that the FBI also attributed to February's $1.5 billion Bybit breach.

The preparation started at least 36 hours before the theft. TRM Labs found that the attackers funded an operator wallet with small withdrawals from Tornado Cash, a crypto mixing service, then ran test transactions across wallets they controlled. In the day before the main theft, the attackers rehearsed the final version of their code on a third wallet before installing it on a live Binance hot wallet.

The technical method on Ethereum was particularly precise. The attackers used EIP-7702, an account delegation feature introduced in a recent Ethereum upgrade, to effectively convert a Binance hot wallet into a sweeper they controlled. A single transaction carried 50 pre-signed authorizations; one matched the wallet's transaction count exactly, granting the attackers the ability to sweep new incoming deposits for hours after the initial theft, all the way until 11:56 p.m. UTC.

On nine other blockchains, including Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, and several Ethereum layer-2 networks, wallets sent funds through standard signed transfers during the same window. TRM's analysis concluded the most likely explanation was that the attacker had somehow obtained the ability to instruct Binance's hot wallet signing infrastructure to authorize transactions of their choosing. Binance has not yet published a root cause analysis.


What Was Taken

The breakdown by chain is staggering. Ethereum accounts for the largest slice: about $3.79 billion, including 200,630 ETH and roughly 1.875 billion USDT. Bitcoin follows with 18,270 BTC worth approximately $1.47 billion. Tron contributed about $628 million, primarily USDT, and XRP Ledger added 233 million XRP worth around $296 million. The remaining losses were spread across Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon.

At those figures, the theft dwarfs every previous crypto hack on record by a considerable margin. The Bybit breach in February 2025, which itself broke every prior record, involved $1.5 billion. This attack is roughly four times larger.


The Freeze Race

Within hours of the theft, stablecoin issuers and blockchain governance bodies began freezing assets. Tether moved first, blacklisting 971 million USDT across wallets traced to the attacker at 9:01 p.m. UTC. Circle followed three minutes later with a freeze on $823 million in USDC, acting in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 10:01 p.m. The Arbitrum Security Council executed forced transfers of 8,426 ETH and 74.6 million ARB tokens after midnight.

By 11:35 p.m. UTC, Binance said the verified total of frozen assets had reached $2.54 billion. TRM Labs placed the figure closer to $2.7 billion by 12:30 a.m. the following morning.

The attacker, however, moved quickly to convert portions of the stolen funds. Some USDT was swapped for ETH at a discount of more than 10%, and the attacker used Aave, a decentralized lending protocol, to borrow ETH against frozen stablecoin positions. As of the morning of October 30, the attacker still held more than 420,000 ETH and all 18,270 BTC, assets beyond the reach of any issuer's freeze function.


North Korea's Crypto Playbook

The FBI said it was aware of the incident and working with partners to assess the activity. The U.S. Secret Service had not responded to a request for comment at time of publication.

The timing fits a pattern that intelligence analysts have tracked closely. Chainalysis reported that North Korean operatives stole about $2 billion in cryptocurrency throughout 2025. TRM Labs found that two North Korea-linked groups accounted for three-quarters of all crypto hack losses in the first quarter of 2026 alone. The funds are widely believed to support Pyongyang's weapons programs, which have been cut off from conventional financial markets through international sanctions.

TRM Labs said it expects the attacker to route remaining funds through cross-chain bridges, swap services, and over-the-counter brokers in the coming weeks, and said it was monitoring those flows in real time.



Read more »
FEC
America Midterms Campaign Finance Cyber Attacks Cyberattack election transparency FEC

Cyberattack Clouds Political Spending Transparency in America

 

A cyberattack targeting the United States Federal Election Commission disrupted access to campaign finance disclosures shortly before the November 3 midterm elections, prompting concerns about electoral transparency. The commission suspended its filing systems for approximately 41 hours after an unidentified malicious actor attempted to gain access. This interruption prevented campaigns and political organizations from submitting certain time-sensitive financial reports, temporarily limiting public oversight of election funding. The incident concerned financial disclosure infrastructure; the available information did not establish any interference with voting systems or election results. 

The disruption affected disclosures ordinarily required within 24 or 48 hours, producing an information gap during a particularly consequential period of campaign activity. Millions of dollars in political financing may have remained outside immediate public scrutiny while the systems were unavailable. Nevertheless, delayed reporting does not demonstrate that contributions were permanently concealed or that donors deliberately exploited the interruption. Limited public information about the attacker, the techniques employed, and the underlying motive prevented definitive conclusions regarding the incident’s origins, scope, or broader political implications and consequences. 

Transparency advocates emphasized that the timing substantially increased the significance of the outage. OpenSecrets executive director Hilary Braseth argued that delayed disclosure undermines meaningful public access to campaign finance information. Research director Brendan Glavin indicated that political spending before the interruption had reached approximately $50 million per day. At that scale, even a relatively brief suspension can impede efforts by journalists, researchers, and voters to identify financial interests behind election messaging. Information disclosed after voting may have less practical value for assessing candidates and their supporters. 

The incident also renewed attention to SuperPACs and technology interests seeking to influence public policy through election spending. Political organizations supporting artificial intelligence development have invested substantial resources in promoting sympathetic candidates and challenging opponents. These activities coincide with disputes over data center construction, local infrastructure pressures, and potential regulatory restrictions. Electoral outcomes may therefore affect both technology policy and future investment decisions. Such connections underscore the importance of prompt financial disclosure, but they provide no basis for attributing responsibility for the cyberattack to these interests. 

Speculation that the outage facilitated undisclosed political contributions remained unsubstantiated. Political spending researcher Molly White expressed concern about diminished visibility into rapidly increasing expenditures while acknowledging uncertainty surrounding the incident. The episode demonstrates that effective campaign finance oversight depends on resilient reporting infrastructure as well as legal disclosure requirements. Authorities must therefore balance cybersecurity precautions with the need to maintain accessible public records. Reliable systems, timely reporting, and clear communication are essential to preserving scrutiny when voters are preparing to make consequential decisions about political representation.
Read more »
Hacker attack
AI Powered Cyber Attacks Cyberattacks Cybersecurity Data Center data centres data security Digital Infrastructure Hacker attack

U.S. Data Centers Face Security Risks From Physical Attacks, Insiders and AI-Powered Hackers

 

Attacks on data centers in other countries are raising concerns about the security of similar facilities in the United States. Although American data centers are unlikely to face the same kind of military strikes seen overseas, cybersecurity experts warn that they remain vulnerable to physical intrusions and cyberattacks. Earlier this week, Ukraine targeted Russian data centers. 

In March, the Iranian military struck Amazon data centers in the United Arab Emirates, leaving the affected facilities out of service for several months. Charles Brooks, an adjunct lecturer in cybersecurity at Georgetown University, told Mashable that data centers are valuable targets because so much of modern life depends on them. Everyday activities such as watching Netflix, using Google Docs and accessing online banking services rely on servers housed in these facilities. 

Data centers also support cloud services used by government agencies, hospitals, financial institutions and businesses, as well as communications between Earth and space. This makes them attractive to state-backed hackers and criminal groups seeking sensitive information or attempting to disrupt essential services. Brooks warned that a serious breach could have catastrophic consequences. He identified three major security concerns for American data centers. 

The first is physical security. Although a drone-powered attack is considered unlikely, facilities could still face attacks involving explosives or unauthorized physical access. Even limited damage could serve as a symbolic victory for terrorist groups or organizations opposed to AI infrastructure. Brooks said security measures should extend beyond surveillance cameras, alarms and barbed-wire fences. He recommended stronger perimeter defenses, security guards and protected areas around sensitive sections, including control centers and water-cooling systems. 

The second concern is the threat posed by insiders. Employees with authorized access to servers and infrastructure could expose sensitive information, reveal security weaknesses or interfere with operations. This could involve a disgruntled worker, someone recruited by an adversary or an employee who makes a costly mistake. Brooks recommended rigorous background checks comparable to those conducted for staff at hospitals and power plants. He also suggested AI-powered surveillance to identify unusual employee behavior, arguing that the potential security benefits could justify occasional false alarms. 

The third threat comes from AI-assisted hacking. Artificial intelligence can help attackers automate cyber operations, identify weaknesses and expand espionage campaigns. Brooks pointed to an Anthropic security report describing how individuals, including foreign government-backed actors, have used AI to automate cyber spying. Hackers could use these tools to scan for vulnerabilities in data center systems or launch phishing attacks against employees to steal login credentials. 

AI allows attackers to conduct these operations at greater scale and identify weaknesses more efficiently. Brooks said protecting data centers should be treated as a national security priority. A breach may not be immediately apparent to the public, but its effects could disrupt businesses, prevent people from working or expose personal information through ransomware attacks. He argued that stronger security requires cooperation between government agencies and the private companies that own and operate these facilities.
Read more »
Supply Chain Attack
Claude Code Extension Cursor Marketplace Cyber Security Developer Security Malicious Extension Remote Access Trojan Software Supply Chain SSH Backdoor Supply Chain Attack

Trojanized Claude Code Extension on Cursor Marketplace Exposes Users to SSH Backdoor


The Cursor IDE extension marketplace was flooded with modified versions of Anthropic's official Claude Code extension, exposing developers to a persistent SSH backdoor. This malicious package, version 2.1.313, appeared to be a legitimate update as opposed to a separate malicious application as it was published under the legitimate extension identity, making it appear to be an authentic update. 

A report was issued on October 29, 2026, following the discovery of the compromised extension installing an attacker-controlled SSH key, establishing remote access, and maintaining persistence on affected systems. According to Cursor, the malicious version was accessible for approximately 11 hours from 2:27am to 1:35pm Pacific Time. 

The company estimates that up to 5,000 users could have been affected. 66 lines of JavaScript code were inserted into the main code bundle of the extension by the attackers. The malicious component was designed to execute before the extension's normal functions, allowing it to perform unauthorized activities without requiring any suspicious interaction from users. 

Despite the extension's continued normal operation, the injected code attempted to modify system files and establish connections with attacker-controlled infrastructure in order to alter the extension's behavior. According to researchers, the compromised package was distributed by Cursor under the legitimate extension identifier of Anthropic, anthropic.claude-code. This incident was particularly concerning because the malicious update appeared as an authentic publisher rather than as a mere imitation. 

It remains unclear how the unauthorized package was introduced. Based on Microsoft Threat Intelligence's confirmation, the malicious versions have not been distributed via Microsoft's official Visual Studio Marketplace or Anthropic's npm package. Furthermore, Anthropic confirmed that the company had not been compromised and did not develop the malicious package. Based on the available evidence, Cursor's extension marketplace was the focus of the incident. 

The injectable loader attempted to modify the victim's authorized_keys file to include an SSH public key labelled "svc-telemetry". This modification was intended to enable the attacker to access the affected user's account via SSH. In addition to enabling local SSH services and establishing reverse SSH tunnels to external servers 134.209.82[.]225, the malware also attempted to maintain access to the external server. This was accomplished by incorporating separate persistence mechanisms for Windows, Linux, and macOS, which allowed the backdoor connection to be restarted depending on the platform's startup configurations. 

Additionally, the malicious payload collected information that could allow attackers to identify valuable developer environments by using system information. There was a collection of information on the device hostname, logged-in username, operating system, CPU architecture, home directory, the current working directory, public IP address, and the global Git email configuration. There were also up to 40 environment variables named KEY, TOKEN, SECRET, PASS, AWS and GCP, which contained up to 400 terms. 

Even though the initial beacon did not transmit the values for these variables, this information can be used to identify what cloud services, development platforms and credential types are on a compromised system. As well as sending data to the attacker-controlled server at 134.209.82[.]225:8099/beacon, the loader attempted to send a request to a local loopback address as well. 

It has been determined that the attacker's infrastructure has been permanently shut down with the assistance of its hosting provider, which prevents further communication through the reported server. However, the shutdown does not remove malicious files or persistence mechanisms that are already installed on affected systems. However, researchers have not identified any additional payloads, despite the possibility of attackers executing commands and transferring files via a successful SSH tunnel.

It was later clarified that two malicious versions of the software were released through Cursor's marketplace for Windows and macOS, respectively, during the exposure period of October 29 between 2:27 a.m. and 1:35 p.m. Pacific Time. According to the company, up to 5,000 users may have been affected. They will be contacted directly by the company. Cursor temporarily shut down its marketplace while investigating the incident following discovery of the affected packages. 

A thorough audit of marketplace access by the company revealed no evidence of tampered with other extensions. After rotating the keys of the marketplace and rebuilding the marketplace, the company was able to restore service. Anthropic also confirmed that its official distribution channels and systems were not compromised. 

The extension 2.1.314 was then released through Open VSX and Microsoft's Visual Studio Marketplace. However, Microsoft's Security teams have warned that simply uninstalling it is not sufficient to stop the threat. Scripts, scheduled tasks, cron entries, LaunchAgent files and unauthorized SSH keys marked svc-telemetry should be checked on affected systems. 

When evidence of malicious activity is present, systems should be isolated and confirmed malicious components removed after relevant evidence has been preserved. Additionally, organizations are being advised to review endpoint, network, and authentication logs in order to identify suspicious connections and activity involving SSH. Credentials and active sessions accessed from affected machines should be rotated or revoked from trusted devices.

Whenever unauthorized access is confirmed or its security cannot be restored, it may be necessary to rebuild the system. This incident adds to the series of attacks targeting trusted developer tools in the software supply chain. This follows the attack on OVHcloud's official command-line interface that resulted in the replacement of legitimate release binary packages with malware containing secret stealing features. The combined effect of these incidents demonstrates the risks associated with tampered software updates distributed through otherwise reputable channels.
Read more »
ShinyHunters
cisa systems Data Breach DHS Employee Data Hacktivist group ShinyHunters

Hacktivists Dump Records of 41,000 DHS Employees, Citing ICE Escalation

 



A hacktivist group has published internal records identifying more than 41,000 Department of Homeland Security employees and contractors, in what security researchers are calling one of the most detailed government workforce exposures in recent memory.

The group, which calls itself the "Department of Peace," shared the data with Distributed Denial of Secrets (DDoSecrets), a nonprofit that publishes leaked government datasets, and with Swiss hacker-journalist maia arson crimew. The records went public on October 29 and cover staff across nine DHS agencies.

The group tied the release directly to DHS Secretary Markwayne Mullin's July 17 comments, in which he told reporters he was "turning up the heat" on immigration enforcement. That remark, the group said, was the trigger.


What the data contains

The leaked dataset holds 41,191 records spanning employees and contractors across nine DHS sub-agencies, pulled from nearly 7,000 offices and more than 2,200 locations. Each record contains names, job titles, supervisor relationships, direct reports, employment status, workplace addresses, email addresses, phone numbers, and internal group memberships.

CBP accounts for the largest share with 21,329 records, followed by ICE at 6,598 and USCIS at 6,245. Homeland Security Investigations holds 3,421 records, DHS headquarters 1,755, and CISA 980. The Federal Protective Service, FLETC, and the Science and Technology Directorate account for the remainder. Combined, the exposed records represent roughly one-fifth of DHS's reported headcount of 222,538, according to the DOGE website. CISA records were pulled from the public-facing search results but remain in the underlying dataset.


The Icepick tool

Crimew, who faces a U.S. federal indictment tied to prior leaks, built a searchable interface called "Icepick" and hosted it at icepi.cx. The domain registrar pulled the site down shortly after launch. DDoSecrets responded by releasing the tool's source code publicly. By Thursday morning, the searchable site was offline, but the data itself continued to circulate.

DDoSecrets co-founder Emma Best said the dataset extends well beyond contact information. The records, she wrote, identify officials overseeing covert and undercover operations, the government's internal effort to track down leakers, and the now-defunct BlueLeaks investigation. Crimew described it as "a complete game changer for anyone investigating DHS" and said it "provides FOIA material for years to come."

Ryan Shapiro of Property of the People, a government transparency organization, offered a narrower read, noting that staff contact information could prove useful for Freedom of Information Act requests.


Okta in the spotlight

The Department of Peace claimed the data came from an Okta single sign-on service used internally at DHS. Okta said it reviewed the report and found no evidence that its systems or data had been affected.

That denial has not fully closed the question. CyberScoop verified that numerous active CISA employees appear in the dataset alongside former agency leaders who left government years ago. The records also reference internal groups tied to COVID-19 planning and a 2023 internal summit, suggesting the data spans multiple years and may reflect sustained access rather than a single point-in-time pull.

Bluesky moved to block links pointing to the leaked data and flagged them as malicious, according to WIRED. The speed with which journalists and researchers confirmed active employees in the dataset drew particular concern, given that portions of the records appear to touch on undercover personnel.


A pattern of DHS breaches

This is not the first substantial data exposure tied to DHS. In 2014, a breach potentially affected as many as 390,000 current and former employees, applicants, and contractors. In 2018, the department notified nearly 250,000 people after another incident. Earlier this year, security firm GitGuardian found a publicly accessible GitHub repository containing credentials for privileged AWS GovCloud accounts and internal CISA systems, with the exposure dating back to at least November 2025.

Last month, the hacking group ShinyHunters published a separate spreadsheet containing records on roughly 5,000 alleged FBI employees, including home addresses and emergency contacts, framing that release as retaliation for an FBI advisory about the group.

DHS confirmed it is investigating the current incident. "DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively," as mentioned by a spokesperson, adding that the department would release further details as they became available. DHS did not respond to additional requests for comment by publication time.



Read more »
Yoba
ChatGPT Claude cryptomining malware Yoba

Fake ChatGPT and Claude Apps Deliver Crypto-Mining Malware

 

Cybersecurity researchers have uncovered a malware campaign, known as Yoba, that uses fake desktop applications for ChatGPT and Claude to trick users into installing cryptocurrency-mining malware. The attackers created convincing GitHub projects and websites for supposed AI tools such as “GPT-5.6 Sol,” “GPT-6 Astra,” and “Claude Opus,” then distributed malicious ZIP files that appeared to be legitimate installers. According to Check Point Research, the campaign exploits public interest in AI tools and the trust people place in familiar technology brands. 

The malicious archives contain two key files: a genuine, digitally signed executable from OpenAI or Anthropic, and a harmful Windows DLL named winmm.dll. When a user runs the legitimate-looking Setup.exe, Windows loads the malicious DLL alongside it. This technique, called DLL sideloading, lets attackers abuse trusted signed software to make malicious code appear less suspicious and evade basic security checks. Importantly, the research does not suggest that OpenAI, Anthropic, ChatGPT, or Claude themselves were compromised. 

Once launched, the malicious DLL—called YobaDropper—checks that it is being run through the expected host executable, making it harder for researchers to activate it in a sandbox. It then copies a legitimate Windows media component, wmpdmc.exe, into a new folder and places another malicious DLL beside it. This second component, YobaLoader, establishes persistence through a scheduled task and retrieves further instructions from the attacker. 

YobaLoader uses an unusual command-and-control method to avoid detection. It downloads an image from a Telegram channel, takes the final 50 bytes as a seed, and generates a new domain using a domain-generation algorithm. It then queries Google’s DNS-over-HTTPS service for a hidden command stored in a DNS TXT record, which leads it to download the next-stage payload. By using DoH and common file-hosting services, the attackers make their traffic resemble ordinary internet activity and evade passive DNS monitoring. 

The downloaded payload is injected into Windows’ svchost.exe process, where it launches XMRig, a cryptocurrency miner. Victims may notice slower performance, higher CPU usage, increased electricity consumption, or unexpected system heat. Users should download AI applications only from official vendor websites or verified app stores, avoid installing “desktop versions” from random GitHub repositories, and be cautious of search results promoting unfamiliar AI tools. Organizations should also restrict installations from unknown sources and monitor endpoints for unusual scheduled tasks and mining activity.
Read more »
Subscribe to: Posts (Atom)

Featured