A Fake Job Interview Led to a $6.43 Billion Theft (11/04/2026)

Binance’s account of its $6.43 billion loss reads like a hiring process run in reverse. Somebody approached an engineer on a job site, put them through two rounds of interviews with people who did not exist, and handed them a coding assignment whose setup script installed the attacker’s tools. Every step looked like an ordinary career conversation, and the engineer was doing what any candidate would do.

Top 5 Critical Security Alerts

1. Binance Traces a $6.43 Billion Theft to a Fake Job Interview

Binance described a multi-stage campaign in which a Wallet DevOps engineer downloaded a trojanized installer while searching for an AI tool in June, and a second engineer was approached in September by a fake project director, interviewed by a fake HR representative and a fake chief executive, and told to download an “assignment” repository whose setup ran malware, per The Hacker News and The Register. On October 20 the attacker abused an internal AI tool to gain control of other engineers’ machines, one of which held a container deployment token, and on October 29 used it to deploy a container and reach an internal wallet signing service outside the normal withdrawal process. The activity is linked to North Korea, and researchers had warned about the fake-interview technique for years, per TechCrunch.

Operator Note: Tell engineers plainly that a coding test from a recruiter is untrusted code, and that it runs in a disposable virtual machine or not at all. Then check where deployment tokens live, because a token on a laptop turns one compromised workstation into production access.

2. Refrigeration Attacks Reach French Blood Storage

Attackers raised temperature and defrost settings in cold-storage chambers at three French Blood Establishment facilities on November 2 by exploiting a vulnerability in a third-party component of a refrigeration supplier’s remote monitoring software, per BleepingComputer. The blood service reported no health impact and no loss of blood products after moving plasma to safe storage. It follows attacks in October that disrupted an estimated 250 to 350 French supermarkets and a second wave hitting more than 115 stores in six other European countries, per Dark Reading.

Operator Note: Refrigeration, HVAC, and building controllers with vendor remote monitoring are network devices. Find out which of yours can be changed remotely, by whom, and whether anybody would notice a setpoint change before the product spoiled.

3. WordPress Core Flaw Exploited During Upgrades

CISA confirmed exploitation of CVE-2026-119977, a WordPress core race condition that lets an attacker with no privileges abuse predictable, web-accessible staging paths used during full-package core upgrades, per BleepingComputer and The Hacker News. It is fixed in WordPress 7.1.4, released October 28, and Wordfence said it blocked 13,095 attacks on the flaw in a single day.

Operator Note: Confirm every WordPress site you run, including marketing microsites and agency-built pages, reports 7.1.4 or later.

4. Zyxel Switch Zero-Day Hit Nearly 1,000 Devices

Attackers exploited CVE-2026-107441, an out-of-bounds write in the web management interface of ten Zyxel GS1900 switch models, to run commands without authentication and collect device configurations, root credential hashes, and network information from 996 devices in 48 countries, per BleepingComputer. Zyxel released fixed firmware on October 22.

Operator Note: A switch that leaked its configuration has leaked its passwords and your network map. Patch, take the management interface off any network users can reach, and rotate every credential the configuration held.

5. DreamHost Attackers Were Inside for Months

DreamHost said attackers exploited a vulnerability in its file manager starting in August and took customer emails, credentials, and session tokens before the intrusion was detected last week, affecting what it called “well under 10%” of its roughly 400,000 paying customers, per TechCrunch and BleepingComputer.

Operator Note: If any of your sites or mailboxes sit at DreamHost, rotate the hosting, FTP, and email passwords and sign out every active session.

Additional Security Alerts

Threat Intelligence

• APT29 hijacks a web analytics script to deliver mobile exploits: The watering hole campaign targets iOS and Android users through compromised sites, fake domains, and the Plerdy analytics service. The Hacker News
• A security tool’s update channel delivers a backdoor: An attacker broke into cPGuard’s update system on November 2 and pushed a script that collected password hashes from customers’ Linux servers. The Hacker News
• Google warns LLMjacking costs some enterprises up to $1 million: Attackers use stolen API keys to run expensive AI workloads on the victim’s account. The Hacker News
• Google Calendar invites deliver session-stealing phishing: The campaign used trusted redirects and fake login pages to bypass multi-factor authentication. BleepingComputer

Security Breaches & Incidents

• Crédit Mutuel Arkéa confirms an estimated $133 million theft: Attackers made transfers from the bank’s own account after compromising an unnamed supplier. The Record
• More Asian airlines report breaches traced to Amadeus: Japan Airlines, Cathay Pacific, Korean Air, Asiana, Singapore Airlines, and Malaysia Airlines have all disclosed incidents. The Record
• mSecure tells users to change passwords and reset 2FA and passkeys: The password manager warned customers after suspicious activity. The Hacker News

Vulnerabilities & Patches

• Android fixes a critical zero-click flaw: CVE-2026-58868 affects Android 14 through 17 and is fixed at patch level 2026-11-01. The Hacker News
• SonicWall will not patch two flaws in end-of-life GMS: CVE-2026-109593, rated 9.1, allows unauthenticated file reads on GMS 9.5.2 and earlier. The Hacker News
• An APT flaw lets a network attacker swap verified Debian and Ubuntu packages: The attacker’s code runs as root. The Hacker News

The Axe Report is a daily briefing from Grab The Axe. Need help assessing your organization’s security posture? Take our free Human Attack Surface Score assessment.