> InfoSec News Nuggets – 11/04/2026

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft Binance has detailed how attackers pulled off the record $6.43 billion theft from the exchange, describing a multi-stage campaign rather than a single breach. It began in June 2026 when a Wallet DevOps engineer downloaded a trojanized Homebrew installer while looking for a popular AI tool, exposing details about the wallet infrastructure team. In September, a second engineer was lured through a fake recruitment process and told to download a coding “assignment” that ran malicious code during setup. By late October the attackers had abused an internal AI tool, stolen a container deployment token, and used it on October 29 to reach an internal wallet signing service and push transactions outside the normal withdrawal process. Binance says it has rebuilt the affected wallet system and AI tool, replaced devices and credentials, and tightened controls, while Chainalysis links the operation to a string of smaller North Korea-linked fake interview schemes.   Malicious cPGuard Updates Served in OpsShield Supply Chain Attack Indian security firm OpsShield says attackers used compromised credentials to break into its update distribution infrastructure on Monday and push malicious versions of its cPGuard Linux server protection tool to customers. Versions 5.88.12 through 5.88.19 carried a script that ran as root, collected data, and planted a hidden root shell, and the company estimates about 2,950 servers executed the fake update during a roughly 70-minute window. The attackers first gained command execution on OpsShield’s billing and licensing server, copied around 7,900 client account records including hashed passwords, and retrieved files collected from 32 customer servers. Customers whose servers may have run the update are told to rotate password hashes, root SSH keys, MySQL root passwords, and other secrets, and to install cPGuard 5.88.25 or later, which removes the backdoor and leftover files.   Ukraine and Russia’s emergency alert apps both hacked, residents warned of fake nuclear, chemical strikes Emergency alert apps in both Ukraine and Russia were hacked just hours apart on Sunday night, pushing false warnings to civilians about radiation, chemical attacks, and nuclear strikes. Ukraine’s Air Alert app began sending the bogus notifications at 10:47 p.m. local time, including claims of street fighting in Kyiv, and the Ukrainian Air Force confirmed within minutes that the alerts were false and the app had been subjected to “hostile interference.” Hours later, Russia’s Emergencies Ministry app sent fake warnings of nuclear warheads to users in 33 regions, with the ministry blaming a vulnerability in the app’s administrative panel. Developers of the Ukrainian app temporarily disabled push notifications, and officials stressed that the app is not tied to the country’s military command systems.   British businesses caught in Europe-wide supermarket fridge attacks A second wave of cyberattacks on refrigeration controls hit supermarkets and grocery stores across Europe early Monday, following an earlier campaign in France, with attackers remotely switching fridges into defrost mode and causing stock to spoil. Three British meat suppliers and a fruit and vegetable wholesaler were among the victims, with the meat suppliers attacked through Copeland XWEB supervisory controllers running firmware 1.12.1 or earlier, which contains authentication bypass flaws that have had a fix available since August. No group has claimed the attacks, and Belgian officials say the culprits may never be identified. The UK’s National Cyber Security Centre said the national impact has been minimal but that it worked overnight to warn organizations with exposed systems, noting the attacks relied on long-known vulnerabilities in internet-connected equipment.   Ransomware Gangs Claim 30% More Victims, but Researchers Warn Some Breaches May Be Fake The number of organizations named on ransomware leak sites rose 30% in the third quarter of 2026, but researchers caution that the jump does not reflect an equal rise in actual attacks. ReliaQuest found that 43 groups that had never posted before Q3 drove 93% of the increase, and some of their listings look like bulk dumps, rebrands, recycled data, or claims with no proof behind them. One newcomer, ExfilSquad, appears to grab limited data using credentials exposed on GitHub and then frame it as a major breach on a ransomware-style leak site. Researchers advise organizations named by new groups to verify whether a compromise actually occurred before responding, while continuing to patch edge devices, block vulnerable drivers, and audit code repositories for exposed secrets. The post InfoSec News Nuggets – 11/04/2026 appeared first on AboutDFIR - The Definitive Compendium Project.