Posts of last few hours

Fresh European Fridge Attacks Put Cold-Chain Security in Focus
Beyond food storage, the same combination of Internet connectivity, remote access, and inadequate security practices can put temperature-controlled infrastructure across other critical sectors at risk.
https://www.darkreading.com/ics-ot-security/fresh-european-fridge-attacks-cold-chain-security
Germany Busts 'Crime-as-a-Service' Investment Fraud Outfit
German police led a multinational probe that exposed an alleged crime-as-a-service provider supplying fraudulent trading platforms to investment scammers.
https://www.darkreading.com/cybersecurity-operations/germany-crime-service-investment-fraud
WordPress security advisory (AV26-1117)
https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-1117
Binance Hack: How Fake Job Interviews and AI Abuse Led to a $6.34 Billion Attack
Binance reveals how fake job interviews, malware and internal AI abuse enabled attackers to steal $6.34 billion. The Binance security incident on October 29 shows how a fake recruitment process can become the entry point to critical financial infrastructure. The attackers combined social engineering, compromised developer tools, stolen credentials and abuse of an internal AI […]
https://securityaffairs.com/202369/cyber-crime/binance-hack-how-fake-job-interviews-and-ai-abuse-led-to-a-6-34-billion-attack.html
mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity
Customers of the mSecure password manager are being urged to act now to protect the confidential information they store in it, possibly by changing passwords, resetting two-factor authentication (2FA), and removing passkeys. The warning came in an email sent on November 3 in the name of developer mSeven Software. It says the company recently learned of suspicious activity linked to the app but
https://thehackernews.com/2026/11/msecure-warns-users-to-change-passwords.html
Chainstack Reports Production Systems Breach Exposing Customer Data and Password Hashes
Blockchain infrastructure provider Chainstack on Tuesday disclosed that it was targeted in a cyber attack that allowed an unauthorized party to gain access to some parts of its infrastructure. The incident is assessed to be part of a large-scale, artificial intelligence (AI)-powered attack campaign that came to light last week. "An external attacker gained unauthorized access to part of
https://thehackernews.com/2026/11/chainstack-reports-production-systems.html
Fake-download campaign uses trojanized installers to deliver monetization payloads

Microsoft Threat Intelligence tracks a fake-download campaign that uses trojanized Inno installers to deliver multiple monetization offers and provides detection and investigation guidance across the complete installer session.

The post Fake-download campaign uses trojanized installers to deliver monetization payloads appeared first on Microsoft Security Blog.

https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/
OpenAI Builds Pando Git Infrastructure Using AI Agents and Deploys Continuous Security Testing

OpenAI has built Pando, a new Git backend, with Codex agents in just 10 weeks, replacing the system behind its main shared code repository without stopping engineering work. The company says agents now run around the clock to red-team both Git and Pando, testing the software that supports its growing AI-driven development workload. In its […]

The post OpenAI Builds Pando Git Infrastructure Using AI Agents and Deploys Continuous Security Testing appeared first on Cyber Security News.

https://cybersecuritynews.com/openai-builds-pando-git-infrastructure/
Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft
Binance on Tuesday said the record-setting theft of $6.43 billion in assets from the world's largest cryptocurrency exchange was the culmination of a "sophisticated, multi-stage campaign" that involved the use of a tampered Homebrew installation and recruitment-themed social engineering attack targeting two of its engineers. "It was not a single isolated breach or a simple phishing incident,"
https://thehackernews.com/2026/11/binance-reveals-how-fake-job-interviews.html
North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist

North Korean hackers used a fake job interview, a poisoned coding task, and a hijacked internal AI tool to reach Binance’s wallet systems. The FBI says the North Korean group it calls “TraderTraitor” stole more than $6 billion in digital assets on 29 October 2026. Binance puts the impacted value at about USD 6.34 billion. […]

The post North Korean Hackers Abuse Internal AI Tool and Fake Job Interviews in $6.34 Billion Binance Heist appeared first on Cyber Security News.

https://cybersecuritynews.com/fake-job-interviews-binance-heist/
Synology Warns of Ransomware Attacks Targeting NAS Devices Running Outdated DSM Versions
Synology warns of ransomware attacks exploiting a 2024 flaw in outdated NAS devices, urging users to update DSM immediately. A security fix released in 2024 is now at the centre of ransomware attacks against Synology NAS devices. The company has found attackers targeting systems that still run outdated versions of DiskStation Manager (DSM), putting files […]
https://securityaffairs.com/202343/security/synology-warns-of-ransomware-attacks-targeting-nas-devices-running-outdated-dsm-versions.html
Password Manager mSecure Urges Users to Secure Logins and Confidential Data Stored

Password manager mSecure has urged current and former customers to immediately protect passwords and other confidential information stored in its application after its maker, mSeven Software, detected suspicious activity. The warning also covers two-factor authentication methods and existing passkeys, making it broader than a routine password reset notice. In its customer email, mSeven said it […]

The post Password Manager mSecure Urges Users to Secure Logins and Confidential Data Stored appeared first on Cyber Security News.

https://cybersecuritynews.com/msecure-security-incident/
Barracuda Flaws Could Be Chained to Bypass Authorization and Gain Root Access
Barracuda has disclosed details of two vulnerabilities affecting its products that, if chained together, could allow an attacker to bypass authorization controls and gain root access to a susceptible device. The vulnerabilities, a pre-authentication authorization bypass vulnerability and a command injection vulnerability, have been assigned the CVE identifiers CVE-2026-116606 (CVSS score: 9.3)
https://thehackernews.com/2026/11/barracuda-flaws-could-be-chained-to.html
Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks

A ransomware affiliate has hit a group of UK schools with a mix of human control and AI-style automation. The attackers used built-in Windows tools, stolen backup passwords and fake admin accounts to spread across the school network, then encrypted about 37 machines. The group behind the encryptor is 3AM, also written ThreeAM. It sells […]

The post Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks appeared first on Cyber Security News.

https://cybersecuritynews.com/hackers-use-ai-agents-2/
Hackers Target Supermarket Refrigeration Systems Across Europe, Raising Freezer Temperatures to 50°C

Hackers have targeted supermarket refrigeration systems across at least 10 European countries, forcing retailers to remove chilled and frozen food from sale after temperature controls were changed. The attacks, reported on Monday, November 2, have raised concerns about the security of connected equipment across Europe’s food supply chain. Some stores reported settings or temperatures reaching […]

The post Hackers Target Supermarket Refrigeration Systems Across Europe, Raising Freezer Temperatures to 50°C appeared first on Cyber Security News.

https://cybersecuritynews.com/supermarket-refrigeration-systems-across-europe/
Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges
Google on Monday warned that threat actors are hijacking enterprise access to Large Language Models (LLMs) to fraudulently leverage expensive computing resources and AI services. The tactic is called LLMjacking, a form of resource hijacking adapted for the LLM era, where an attacker obtains an API key through phishing, source code leaks, misconfigured environments, or exposed client-side code
https://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.html
9 Cyber Awareness Tips That Actually Match Today's Maze of Threats
Practical guidance on safer search, stronger login security, better executive protection, and other habits that help reduce enterprise risk.
https://www.darkreading.com/cyber-risk/9-cyber-awareness-tips-todays-maze-threats
LLMjacking Emerges as Thriving Cybercriminal Enterprise
Cybercriminals have turned reselling cloud access to LLMs into a lucrative business model, with some victims paying as much as $1 million in resource consumption before access was revoked.
https://www.darkreading.com/cloud-security/llmjacking-thriving-cybercriminal-enterprise
Hackers Hijack Emergency Alert Apps in Ukraine and Russia to Send Fake Nuclear Attack Warnings

Hackers targeted emergency alert apps in Ukraine and Russia late on November 1 and into November 2, sending false warnings about radiation, chemical threats, and nuclear strikes. The incidents disrupted trusted public safety channels during wartime. However, officials said the app breaches did not disable their wider warning systems. No independent report has linked either […]

The post Hackers Hijack Emergency Alert Apps in Ukraine and Russia to Send Fake Nuclear Attack Warnings appeared first on Cyber Security News.

https://cybersecuritynews.com/hackers-hijack-emergency-alert-apps/
Russia-Aligned Gorbag Targets Ukraine for Intelligence
Russia-aligned Gorbag has hit Ukrainian justice, local government and defense bodies since 2025
https://www.infosecurity-magazine.com/news/russia-gorbag-targets-ukraine/

Managed ad