> InfoSec News Nuggets – 11/09/2026

Trio accused of using deepfake CEOs and bogus lawyers to scam businesses out of $129 million The US Justice Department has charged three men with running a two-year fraud scheme that used AI-generated deepfakes of company CEOs and impersonated attorneys at major international law firms to convince employees to wire more than $129 million into accounts the group controlled. Victims ranged from two US hospital systems that lost nearly $7.8 million combined to a Rhode Island bank, a Florida pet food company, and a UK fintech firm that lost $11.6 million, with the stolen funds converted to cryptocurrency and laundered through accounts in nine countries. Each defendant faces seven counts, including wire fraud, aggravated identity theft, and money laundering.   Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH Botnets and cryptocurrency miners have begun exploiting SSHole (CVE-2026-123158), a high-severity OpenSSH authentication bypass that lets attackers log into accounts such as root that should never accept a password by supplying any password between 257 and 1,024 characters long. The flaw affects Linux distributions built on the musl C library with PAM disabled, including Alpine, Buildroot, OpenWrt, and Yocto, where musl’s crypt() function returns a value that sshd mistakes for a matching hash. Researchers recorded exploitation attempts from 13 unique IPs across nine countries between November 6 and 8, and administrators are urged to update to OpenSSH 10.6p2 or disable password authentication immediately.   Hackers pull off $133 million French bank heist via service provider French cooperative bank Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions estimated at up to €118 million ($133 million), with the attacker reaching the bank’s network through a third-party service provider’s platform and using the bank’s own account, not customer accounts, to move funds to other institutions and convert them into stablecoins. Blockchain investigator ZachXBT first flagged the unauthorized withdrawals and said roughly $30 million had already been laundered before the bank’s public disclosure. The bank, which describes the incident as a “sophisticated attack,” says customer assets were unaffected but warns customers to watch for phishing attempts exploiting the news.   Claude Code’s “Don’t Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub Researchers at Apiiro found that when developers choose “Yes, and don’t ask again” in Anthropic’s Claude Code, the AI coding assistant can save the exact approved command, including any embedded passwords or API keys, in plain text to a .claude/settings.local.json project file that frequently ends up committed to public GitHub repositories. Their search turned up 1,122 public copies of the file containing at least one secret, and 2,539 exposed credentials across 1,994 repositories once shared settings files, git history, and agent logs were included, among them database passwords, SSH logins, and AWS keys. Popular secret scanners missed many of these leaks, and the researchers advise rotating every exposed credential before removing the file and adding it to project .gitignore templates.   Chainalysis warns all users hit in cyber breach involving ‘agentic’ techniques Blockchain analytics firm Chainalysis, whose customers include law enforcement and national security agencies, has disclosed that names, usernames, password hashes, and live tokens for all of its users were exposed in a cyberattack it previously said involved “offensive agentic techniques.” The company also said some Know Your Transaction (KYT) customer accounts appear to have been accessed and that a separate on-path attack intercepted some customer passwords, prompting it to take KYT, its address-screening products, its Reactor investigations tool, and its login page offline. All users must reset passwords and rotate API keys, though the company says it has found no evidence that investigations or attribution data were accessed or manipulated. The post InfoSec News Nuggets – 11/09/2026 appeared first on AboutDFIR - The Definitive Compendium Project.