The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it the largest cryptocurrency heist on record. In a security alert published Saturday, the agency attributed the attack to TraderTraitor, a North Korean hacking group also tracked as Lazarus Group, Jade Sleet, and APT38, linked to numerous cryptocurrency thefts. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said. This official attribution follows blockchain intelligence firms TRM Labs and Chainalysis, which had already linked the theft to TraderTraitor.
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity, reshaping both the techniques used by attackers and the tools available to defenders. AI agents can automate tasks, analyze large amounts of data, discover vulnerabilities and accelerate offensive operations. At the same time, AI is creating new capabilities for threat detection, incident analysis and response. Security Affairs’ new newsletter follows this evolution, covering every week the latest threats, attacks, vulnerabilities and developments at the intersection of AI and cybersecurity. Investigating alignment failures in AISI’s incident An alignment assessment of the UK AISI cybertesting incident Improving our alignment and security efforts Will AI expose the rickety infrastructure of the internet? Anthropic’s IPO filing reveals its strategy for keeping enterprise customers hooked Alibaba’s Qwen AI caught trying to contact server in China Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Discovering and exploiting vulnerabilities in critical, real-world software with Claude Invasive Ads: The Unconventional Cyber Surveillance Attack Surface Early progress on accelerating drug development with Claude Putting Claude Code in a box: a sandboxed dev container for Zed How AI tools are used for doxing Gemini 4 Carbon: our next frontier model Tricks from the Past deployed via signed ChatGPT and Claude binaries AI models may be capable of self-replicating without access to a datacenter Load/Mine: A Hugging Face Malware Campaign Returns After Takedown Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps deepveindrilling.com: Magento CMS block loader hits 953 stores CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Operation FlashHole: Lazarus breaks security, defies control Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Tricks from the Past deployed via signed ChatGPT and Claude binaries Trezor warns of suspected crypto-theft implant in hardware wallet Load/Mine: A Hugging Face Malware Campaign Returns After Takedown Decoding Maliciousness: LLM-Assisted Semantic Filtering for Scalable Malicious PyPI Package Detection A Two-Stage Selective Deep Learning Framework for Malware Family Classification in Encrypted Network Traffic Silent Blindness: Fault Vulnerability of Hardware Malware Detectors Measuring Duplication, Leakage, and Rendering Dependence in Malware-as-Image Benchmarks Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise.
OpenAI has just confirmed that it's rolling out ChatGPT Work capabilities directly into regular Chat, while also combining usage allowances across ChatGPT and Codex. In an email seen by BleepingComputer, OpenAI noted that it will test a combined experience for Chat and Work tabs in the coming weeks, initially with a small group of users. If you're selected for the test, you'll be able to move from ordinary conversations to more complex tasks without switching modes. "This will enable you to move from exploring an idea to having ChatGPT carry it through, all in one place," OpenAI explained. "You can bring in your files and plugins and ask ChatGPT to build a website, create a presentation, or do things for you on the web, while reviewing and guiding its work." The combined experience will initially be tested with a small group of users before OpenAI expands it to more people.
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including international press. U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogAttackers Exploit Critical Drupal Commerce Core Vulnerability CVE-2026-118539Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic BinariesU.S. CISA adds GitLab and Cisco flaws to its Known Exploited Vulnerabilities catalog$6.3 Billion Stolen from Binance in Attack Attributed to North KoreaHow to prioritize remediation after a pentest: a practitioner workflowHacker leaks data on more than 40,000 Homeland Security employeesBinance Investigates Suspicious Crypto Transfers Worth Up to $5.8 BillionUS Probes Suspected Hack Behind Military Base Freezer Failures484,142 Exposed Cloud Buckets Contain 18 Billion FilesU.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalogVolt Typhoon Used Silent Train to Hide Zero-Day AttacksElection Website Security: 42% of US County Sites Still Lack .gov DomainsENGIE Data Breach Exposes Customer Details and Energy ContractsVirtualine Domain Seized, but Allegedly Abusive Website Remains OnlineHive and Nefilim Ransomware Affiliate Gets 70 Months In JailAds or Surveillance? Researchers Flag Suspicious Targeting of Starlink UsersCVE-2026-97631: 16-Year-Old UEFI Flaw Threatens ServersU.S. CISA adds Google Brotli and Adobe Commerce and Magento flaws to its Known Exploited Vulnerabilities catalogThree Japan-Focused Cyberattacks Show How Hackers Use AIItaly ’s Parliament Under Cyber Pressure: Why the Attack on the Chamber MattersAustralia’s Cyber Spy Chief: Expect More Disruption as AI Accelerates HackingU.S. CISA adds PHP flaws PHP2Shell to its Known Exploited Vulnerabilities catalogAttackers Take Control of Dahua Cameras and Video Recorders Via Easy4IPCohere Finds Qwen AI Model Contacting a Server in ChinaMagento Campaign Infects 953 Online Stores Across Five DomainsAI-Generated Fake Bank Calls and NFC App Enabled €380,000 Fraud, Dutch Police SayResearchers Uncover Rentable Android Spyware uCreater Targeting WeChat and TelegramPHP2Shell: Suspected North Korean campaign targets 216 vulnerable PHP hostsAnthropic reveals how Claude Mythos 5 crossed security testing boundariesOpenAI Paused Frontier AI Training After a Security Incident International Press – Newsletter Cybercrime Binance Says User Funds Are ‘Completely Safe’ After $3.5 Billion Drains From Its Hot Wallets Police arrest two suspects in AI-powered bank fraud that cost victims €380,000 M365 Token Spray and Replay Campaign Compromises Business Email Accounts Chinese National Extradited for Alleged Role in Multimillion-Dollar Cryptocurrency Scam Targeting U.S. Citizens Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents deepveindrilling.com: Magento CMS block loader hits 953 stores “Bulletproof” website domain seized in international law enforcement operation Trezor warns of suspected crypto-theft implant in hardware wallet Polymarket halts trading after crypto-draining script breach, $2.5M traced Malware uCreator: virtualization-based Android spyware platform targeting WeChat, Telegram and other messaging apps CLAUDE CODE FOUND SPYWARE ON MY FAMILY’S PHONES AND A BACKDOOR ON MY MAC Security notice — malicious version of Anthropic.claude-code (2.1.313) identified in the Cursor Extension Marketplace Tricks from the Past deployed via signed ChatGPT and Claude binaries Hacking PHP2Shell exploitation observed: packet-to-process RCE evidence CYFIRMA Threat Advisory: Suspected DPRK Campaign staging PHP2Shell Targeting against Global PHP infrastructure Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access Not Only ARTEX: The Different Levels AI is Used in Attacks Targeting Japan Broccoli2shell: Everything You Need To Know About The Critical Brotli Decoder Vulnerability Discovering and exploiting vulnerabilities in critical, real-world software with Claude Putting Claude Code in a box: a sandboxed dev container for Zed Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Last Proof of Human Craft: Forging a Microsoft Edge Full Chain with Logic Bugs Only! Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say GitLab security incident: attempted exploitation of CVE-2026-97229 Intelligence and Information Warfare Alibaba’s Qwen AI caught trying to contact server in China Hackers can gain control of cameras and DVRs through cloud access Disruptions ‘inevitable’ as AI-powered cyber threats grow, Australian Signals Directorate says Operation FlashHole: Lazarus breaks security, defies control Hackers Sympathetic to Russia Are Hitting Utilities and Factories Alleged Israeli spy company heavily targeted Starlink users, sources say Silent Train: uncovering Volt Typhoon’s operational framework for zero-day exploitation and strategic access North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History Mapping the Political Influencer Industry and the Problems it Causes for Democracy Cybersecurity NIS 2 Italy: Key Deadlines, Board Duties and What ACN Expects From Companies The Two Things CISOs Should Be Thinking About In The Wake Of The PHP Nightmare Code-execution flaw in UEFI firmware affects most servers on planet Earth 2026 County Election Website Security Census: Key Findings Cloud Exposure Index 2026: 484,142 open buckets mapped ENGIE: Data leak via a tool belonging to its business partners Beyond Framework Signatures: Understanding AI-Driven Intrusions I Think The Military Commissary’s Freezers Were Hacked Manifestos, Fear, and ‘Loser Thinking’: Inside Proton’s AI Reckoning Passkeys Are Better Than Passwords. But They Are Not Enough Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, newsletter)
SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the smartphone unusable. The attack requires no interaction from the victim and can even compromise the ability to contact emergency services. The vulnerability, dubbed the SMS of Death, is bringing renewed attention to the security of the messaging system in Android smartphones. The issue, documented by independent researcher Mark Blaszczyk, allows a remote attacker to cause a disruption in phone service by sending a single, specially crafted WAP Push message. WAP Push (Wireless Application Protocol Push) is a particular message transmitted over the mobile network, generally in the form of a binary SMS, which contains structured data and is processed automatically by the smartphone without requiring user intervention. Unlike a traditional SMS, it can carry notifications, links to Internet resources, and configurations for mobile services. The most worrying aspect is the execution method. It’s a zero-click attack, in which the recipient doesn’t have to open the message, select a link, or authorize any action. The content is automatically processed by the operating system and can cause the process responsible for phone functionality to crash. The vulnerability affects “WapPushOverSms“, an Android framework component located in the “frameworks/opt/telephony” path, responsible for interpreting and managing WAP Push messages received by the device. The technical cause lies in the incorrect handling of a numeric value used during message interpretation. Specifically, the “decodeWapPdu()” function, the researcher explains, reads the length of the WSP header through a value encoded as “uintvar” , initially returned as a 64-bit number. The value is subsequently converted to a 32-bit integer without prior range checking. This operation can transform a seemingly valid number into a negative value, which is then used to determine the size of an array. The consequence of this is a “NegativeArraySizeException” exception, thrown when Android attempts to allocate a negative-sized array. The exception is not handled correctly in the processing path and causes the “com.android.phone” process, responsible for telephony functions, to terminate. The researcher demonstrated that a five-byte WSP header can generate the value “-2147483648“, which is sufficient to trigger the issue. Therefore, it is not necessary to transmit particularly large amounts of content to cause the issue. “A 5-byte uintvar of 88 80 80 80 00 decodes to 0x80000000. Cast to a signed 32-bit int, that is -2147483648. Allocating new byte[-2147483648] throws an uncaught NegativeArraySizeException on the telephony main thread, killing com.android.phone:” reads the analysis. An invisible attack that also interrupts emergency calls The message is transmitted as a data SMS via the WAP Push channel on port 2948. Unlike a regular SMS, it isn’t displayed in the message inbox and doesn’t generate a user-recognizable notification. The sender’s number isn’t normally visible in the conversation, and when the device receives the message, Android automatically starts processing it. A crash in the phone process causes a temporary loss of connectivity and interrupts active voice calls, including those to emergency services. According to the researcher’s published evidence, each message processing can cause a disruption in telephone service lasting about one to two seconds, during which the component is rebooted. However, the problem can become much more serious if the message is processed repeatedly. One of the most significant aspects of SMS of Death is the ability to transform a simple crash into a persistent Denial of Service condition. The malicious message can remain in the incoming SMS queue and be reprocessed during subsequent delivery attempts. The telephone operator’s retransmission mechanism can also contribute to a repeat of the event, causing further service disruptions. The researcher reports observing intermittent crashes for up to a week after receiving a single message. Sending around twenty specially crafted messages can render the device unusable for an extended period. In more severe cases, the phone process can continue to crash during system startup, triggering a condition similar to a boot loop. Recovery may require using the Android Debug Bridge (ADB) on a computer, directly intervening in the queue of messages waiting to be processed. For a typical user, this is far from a simple procedure. A threat to communications availability SMS of Death demonstrates how a cyberattack doesn’t necessarily have to involve information theft, code execution, or device control to have significant consequences. In this case, the target is phone service availability, a crucial feature especially when contacting emergency services. The ability to interrupt communications without any user interaction makes this vulnerability particularly sensitive. To reduce exposure, it’s important to check the Android security patch level installed and apply available updates, paying particular attention to devices no longer receiving manufacturer support. Testing conducted by Mark Blah has shown that the issue is reproducible on several devices, including the Google Pixel 9 and Samsung smartphones from the Galaxy and Galaxy A families. The vulnerable code appears to be present on Android versions ranging from Android 12 to Android 17. However, the availability of the fix is not uniform across all generations of the operating system. According to documentation published by the researcher, Google has distributed a fix via the October 2026 security update for Android 14, 15, 16, and 17. Older devices, such as those running Android 12 and 13, may remain exposed if they do not receive corrective updates. It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:https://t.co/tBoWBpALw1 — GrapheneOS (@GrapheneOS) October 29, 2026 About the author: Salvatore Lombardo (X @Slvlombardo) Electronics engineer and Clusit member, for some time now, espousing the principle of conscious education, he has been writing for several online magazine on information security. He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”. “Education improves awareness” is his slogan. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SMS of Death)
Malicious code on the website of prediction market Polymarket sold some signed-in traders' positions and moved their funds to the hackers on October 29. The code had replaced a page-speed script that the site loaded from an outside company. Polymarket says it is refunding about $2.7 million to 726 affected wallets. Blockchain records show crypto worth about $2.64 million reached
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it
Cybersecurity researchers have disclosed details of what has been described as a "highly sophisticated infection chain" targeting government organizations in Asia. The activity, detailed by Kaspersky this week, targeted a custom Windows 10 build used exclusively by government entities in Asia and involves the deployment of a previously undocumented .NET assembly-loading framework codenamed
Confirm this action.
Leaving now will discard your changes.