Cybersecurity incidents reported this week ranged from large-scale cryptocurrency theft and covert infrastructure to phishing, software supply-chain attacks and spyware targeting mobile users. Several cases began with seemingly routine tools or services, including shared links, browser extensions, remote-support software and third-party platforms.
The FBI attributed the theft of more than $6 billion in virtual assets from Binance to the North Korean hacking group TraderTraitor. The reported haul reached $6.43 billion across 11 blockchains, with 82% of the assets located on Ethereum and Bitcoin. Tether, Circle, Ripple, Arbitrum and Optimism have frozen $2.85 billion of the stolen funds on-chain, according to the report.
Chinese state-sponsored group Volt Typhoon was also linked to Silent Train, a relay infrastructure made from rapidly rotating chains of compromised SOHO, IoT and enterprise devices. The network is designed to conceal the origin of attacks, support selected operations and be dismantled after use. The reported activity points to efforts to maintain access to communications, critical infrastructure, defense, logistics and other systems that could become important during geopolitical tensions.
Prediction market platform Polymarket temporarily suspended trading after attackers compromised DebugBear, a third-party service. Malicious JavaScript distributed through the service drained approximately $2.7 million from 33 deposit wallets in less than an hour. DebugBear said its domain registrar records had been compromised and that it had not found evidence of an intrusion into its internal systems at the time of its update.
Researchers from Parameter Labs disclosed a patched ChatGPT flaw involving shared conversation links. An attacker could create a malicious conversation and send its sharing link to another user, causing JavaScript to run within the victim’s authenticated ChatGPT session. Successful exploitation could expose conversation lists and private conversation content, and transmit data to an external server.
Cursor reported that two versions of the official Claude Code extension on its marketplace had been modified to install a persistent SSH backdoor. The incident may have affected up to 5,000 users. Cursor said it rotated its keys, rebuilt the marketplace and took the relevant server offline, while stating that no other extensions were maliciously modified. Questions remain about how the altered extension was published under Anthropic’s name and what access the attacker obtained.
The U.S. Department of Justice announced the seizure of a domain associated with Virtualine, a bulletproof hosting provider. Authorities said the service facilitated criminal activity including the distribution of sexually explicit images of minors, nonconsensual intimate imagery and international money laundering. The report also noted that previous infrastructure disruptions may fragment the market by pushing customers toward newer services.
Hardware wallet manufacturer Keystone disclosed a security incident involving its website and a vulnerability in a third-party data-monitoring tool. The attacker obtained customer information and a key used to verify device authenticity. The exposed information included records with names, contact details, shipping addresses and order information, as well as checkout records. Keystone said it would destroy 18,835 inventory devices containing the old key and temporarily suspend shipments from its official website while moving to a preorder model.
Trezor separately warned about credible reports of a suspected hardware crypto-theft implant in a Safe 5 device sold by reseller CryptoBilis in Southeast Asia. Customers who bought a Trezor from that reseller from March 2026 onward were advised to move funds to a newly created wallet with a new seed.
Researchers identified uCreator, a commercial Android spyware offering aimed at users of mobile wallets and messaging services in China and Southeast Asia. The malware targets applications including GCash, WeChat, WeCom, QQ, Telegram, WhatsApp, LINE, Zalo, KakaoTalk, Viber and MoMo, and can reportedly clone WeChat accounts. Victims receive repackaged legitimate applications through sideloading or social-engineering campaigns. The spyware uses on-device virtualization to instrument targeted applications and support fraud.
A campaign called Gheist has been using stolen GitHub tokens to plant a workflow named “sync-check” in accessible repositories. The workflow prints repository secrets into its own log, downloads that log through the GitHub API and deletes the run shortly afterward. Wiz said it recovered more than 13,500 planted branches linked to over 850 compromised accounts. The campaign was first detected in mid-September 2026.
The week also brought a broad set of vulnerability disclosures affecting products and projects including Wasmtime, Fireblocks mpc-lib, COVESA vsomeip, ASUS software, Drupal, EPICS Base, TianoCore EDK II, GoAhead, Apache Camel, Okta, Apache Kafka, Google Chrome, Mozilla Firefox, the Linux kernel, Veeam, Juniper Networks Session Smart Router, TeamViewer, Intelbras IP cameras, WatchGuard Fireware OS, Apache Tomcat, Canonical LXD, Langflow OSS and TightVNC. The list included a pre-authenticated remote-code-execution vulnerability in TightVNC and multiple vulnerabilities affecting widely deployed software.
Security researchers also reported the Searchjacked campaign, involving 319 Chrome extensions with a combined 13.4 million reported installations. The extensions hijacked searches through tracking servers, captured queries and generated referral payments from Bing and Yahoo. Other malicious browser extensions impersonated cryptocurrency wallets or document applications, with activity involving the theft of recovery phrases, private keys and browsing data.
Microsoft detailed two human-operated intrusions in which attackers used Teams messages and calls to impersonate IT or help-desk staff. The operators persuaded users to grant remote access, mainly through Quick Assist, then staged portable runtimes, performed system and network discovery and examined Active Directory Certificate Services for paths to certificate-based authentication. Microsoft warned that a user-approved remote session can lead to access to privileged identities and domain infrastructure.
Other developments included the growing use of vulnerabilities to enter corporate networks, the abuse of anti-detect browsers such as Kameleo, AdsPower and MultiLogin to manage large numbers of accounts, and cyberattacks against emergency alert systems in Ukraine and Russia. Ukraine reported false nationwide air-raid warnings, while Russia said its alert application had also been attacked, describing it as an ancillary service. The relationship between the two incidents was not established.
Sources: The Hacker News.