Offensive Lab

Binance, the world’s largest cryptocurrency exchange, said on Thursday it is investigating reports of a potential security issue as its founder said the incident “does look like a hack on Binance”. The company said cryptocurrency firms had frozen about $3bn in funds by Thursday evening. It was not immediately clear the extent of the damage hackers might have been able to accomplish and Binance had not explicitly confirmed that funds had been pilfered, but stablecoin issuers quickly froze funds Thursday evening. “Our teams continue to work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets,” Binance said in a statement posted to social media. “User funds are safe.” Stablecoin providers Tether and Circle each said they froze funds Thursday in response to the incident. Jeremy Allaire, co-founder and CEO of Circle, wrote on X that the company had frozen more than an equivalent of $800m in currency associated with the incident “in coordination with law enforcement”. Paolo Ardoino, the CEO of Tether, said on X that the company froze the equivalent of more than $1.5bn in currency related to “a potential Binance exchange hack”. The price of bitcoin dropped 3.2% Thursday afternoon to under $79,000. Binance was founded in 2017 by Changpeng Zhao, who in 2023 pleaded guilty to a felony related to his failure to prevent money laundering on the platform and stepped down as CEO. Donald Trump pardoned him in 2025.

An unreleased Anthropic AI model found security flaws in Chrome, Safari, Android, Windows, and Linux and chained them into working proof-of-concept exploits, the company said in its latest report. The exploits were built in the lab after the model was prompted, not seen in any real attack, and Anthropic reported every flaw to the vendor first, so all of them are already patched. One proof of concept opened the Calculator app on a stock Mac running Chrome within seconds of a page loading, with no further clicks. Anthropic's Frontier Red Team described five chains in a research post. The strongest claim is not any single bug, but that one model found several separate flaws and combined them into a working exploit, something the company says has until now been the work of a few specialist teams. That capability claim rests on Anthropic's own account. The patches and the fact that Apple and Google credit Anthropic and its Claude model for specific fixes can be verified with the vendors. What a reader cannot check is how much of each chain the model built on its own. Anthropic says the work needed only "initial prompting" and "little human involvement," but it does not break down what a person did at each step, and it does not name the model beyond calling it an unreleased, internal research model.

🔐 Hacker With Limited Skills Used DeepSeek AI to Breach Indian University and Steal Over 5,200 Records A cybercriminal using the online handle BUGSTER used artificial intelligence tools to support attacks on Indian organizations, including two universities. In one confirmed intrusion, the attacker stole a MongoDB database containing more than 5,200 records, including personal information about students

GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in 2014. The fix matters even for administrators who patched nine days earlier: the October 12 update covered only versions 19.2 and later, and the new fixed versions sit one patch above it, so an instance updated then is in range again. The flaw, tracked as CVE-2026-110264, is rated 10.0 on the CVSS scale, the maximum. GitLab says that, under certain conditions, it could allow an unauthenticated user to run arbitrary code on the server due to an integer overflow during the compilation of a specially crafted regular expression. GitLab has not said what those conditions are. The company reports no sign the flaw has been used in attacks, and it is not listed in the U.S. CISA catalog of known exploited vulnerabilities as of October 22. Only self-managed installations need to act. GitLab.com already runs the fixed version, and GitLab Dedicated tenants on the internal releases 19.3.5-internal0 and 19.4.2-internal0 or later already have the fix. GitLab fixed the flaw in seven versions at once.

Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing. The latest version of the package is 1.0.3. "The npm package imgdecode hides a malicious loader in a compiled Node.js addon," SafeDep said. "Its nine-line JavaScript file loads a Windows dynamic-link library (DLL). When a Node.js program calls require('imgdecode') from a Windows console, the DLL attempts to download encrypted shellcode from GitHub. It decrypts the response and injects the result into a new dllhost.exe process." First documented by both Checkmarx and CloudSEK, MALFEX is the name assigned to a long-running campaign in which an unknown threat actor has been publishing malicious packages to npm since August 6, 2023, with an aim to compromise Windows systems. These packages were published across five npm publisher handles: malfexkkj, malfex_user, malfexteste2, malfexteste3, malfexteste4. Of the eight identified packages, three were found to act as a loader for Overlord RAT, while three others ("cdn-img-fetch," "img-to-native," and "native-runner") worked together to download and run a Node.js stealer. A third infection pathway involved the use of a postinstall hook to execute JavaScript capable of contacting an external server and retrieving an unspecified next-stage binary.

Cybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes. The activity is being tracked by Cisco Talos under the moniker UAT-11985, describing it as likely fueled by artificial intelligence (AI)-assisted content generation so as to quickly craft bespoke lures aimed at different targets within the confines of a common social engineering framework. The campaign was first observed in mid-2026. "The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions to establish credibility," Talos researcher Joey Chen said in an analysis. "Beyond traditional email phishing, the actor incorporated QR code phishing (quishing) techniques by modifying legitimate event posters with malicious QR codes, expanding the attack surface beyond email recipients to secondary victims who may encounter printed materials." Central to the operation is the use of legitimate or plausible public event information in spear-phishing emails and embedding within them a URL that points to attacker-controlled infrastructure, while hovering over the hyperlink displays a legitimate-looking Google Forms URL.

A suspected advanced threat actor has been observed exploiting a security flaw in Fortinet FortiOS to deliver a previously unreported memory-resident ARM64 malware known as PEERSTITCH. The attack involves the exploitation of CVE-2025-61624 (CVSS score: 5.4), a path traversal flaw in the command line interpreter of FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager that could allow a privileged attacker to achieve arbitrary write or delete files via specifically crafted arguments to existing commands. It was patched by Fortinet in April 2026. "PEERSTITCH leaves no persistent binary on disk, opens no listening ports and initiates no outbound network connections," Palo Alto Networks Unit 42 researchers Daniel Gott and Shawn Westfall said. "Instead, it communicates through traffic generated by legitimate processes on the infected host, which makes the malware resistant to conventional endpoint and network detection." The cybersecurity company said it discovered the activity as part of its prolonged network intrusion against a telecommunications managed service provider that took place in September 2024. The multi-stage network intrusion is being tracked as CL-STA-0954 (aka UNC5820), with initial access obtained by exploiting a critical Fortinet FortiManager flaw dubbed FortiJump (CVE-2024-47575).

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent States (CIS). The activity, observed from June 2025 through August 2026, involves four different infection chains that make use of macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and crafted WinRAR archives exploiting CVE-2025-8088. The attacks lead to the deployment of custom reverse shells like FoalShell, Chvost, Laplas, and PickleShell that facilitate interactive remote access to compromised hosts, according to Cisco Talos and Recorded Future Insikt Group, which are tracking the campaign under the monikers UAT-6275 and TAG-193. "UAT-6275's targeting is concentrated in Central Asia, and the wider CIS region," security researcher Ashley Shen said. "Across the reviewed campaigns, observed victims and lure themes span nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia, and Belarus." Silent Lynx was first publicly documented by Seqrite Labs in early 2025, highlighting the threat actor's attacks on embassies, lawyers, government-backed banks, and think tanks across Kyrgyzstan and Turkmenistan.

Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking apps, while credential targeting in the malware spans Indonesia, China, India, Mexico, Morocco and Thailand. "The operation combines credential theft, device takeover, screen and camera capture, and SMS theft, in combination with a fairly mature backend," Eward Driehuis, vice president of fraud engineering at ThreatFabric, said in a statement shared with The Hacker News. Hirudo facilitates on-device credential theft and live remote control. The malware is delivered by shopping, adult video, and entertainment dropper apps that carry the trojan as a separate installation package, which is then served as an in-app update. Some of the dropper apps are listed below - Shopora (com.agbbh.kjdrttt) 1V1 X (com.onev.vip) KoiShort (com.koishort.app) ZoyaTV (com.zoyatv.app) "The lure is functional, loading real content in a WebView, a storefront, a video catalogue or short dramas, so the experience looks legitimate," ThreatFabric explained. "Behind that content the dropper runs a fixed startup routine: it collects promotion-tracking data, fetches its campaign configuration, and checks whether the payload, the Hirudo RAT, is already installed with its accessibility service and notification access enabled."

Low-cost Android smartphones have been shipped with malicious software baked into the device firmware, allowing bad actors to covertly install apps, conduct ad fraud, and turn devices into residential proxies. The activity, which targets Android devices built on MediaTek platforms across several brands, is being tracked by Bitdefender under the moniker Midnight Mimosa. The preinstalled malware ("com.android.system.lite") runs with system-level privileges, which make it possible to install or uninstall apps, grant itself additional permissions to accessibility services, notifications, and SMS, and load arbitrary code supplied remotely by the operators. Specifically, it fetches a remote configuration from an external server and then downloads and executes additional payloads designed to conduct ad fraud and silent installation or removal of partner apps. These apps incorporate proxyware, ad fraud, and code execution features. It can also grant permission to any Android app package. "This essentially means its operators could install and delete apps at will, tuning each device to their needs, including making them part of large botnets," the Romanian cybersecurity company said.

Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller. On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter. "We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger said in an X post. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed)." The company has since revealed that one of the impacted users' devices contained an unauthorized hardware implant, and that it's reaching out to impacted users as part of an ongoing probe into the incident. Out of an abundance of caution, CryptoBilis has ceased sales of all hardware wallet inventory until the investigation is concluded