News archive · 7 stories
November 2026
- Machine identityOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl saysTodyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organizations including MSP clients, searching mail and downloading files. No Microsoft vulnerability is involved.
- BreachBinance says a fake job interview and an internal AI tool led attackers to its wallet signing serviceBinance's initial findings trace the $6.34 billion theft to a September fake recruiter whose coding assignment infected an engineer's Mac. An internal AI tool let the attacker reach two wallet engineers, and a container deployment token on one laptop opened the signing service.
- BreachChainstack says an attacker reached production through a third-party component and took password hashesBlockchain infrastructure provider Chainstack says an attacker entered a development environment through a third-party component on October 26, reached production on October 29 and accessed customer names, emails and password hashes before being cut off on October 31.
- BreachPassword manager mSecure tells users to change passwords and remove passkeys, without saying what happenedmSecure's developer emailed current and former customers on November 3 about suspicious activity linked to the password manager, advising them to change passwords, reset two-factor authentication and possibly remove passkeys. It has not said what happened or whether vault data was exposed.
- Token theftGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 millionGoogle Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at some organizations. The usual way in was a stolen service account key, access key, GitHub token or session token.
- BreachWorkOS says an AI-assisted attack framework reached its internal sales tool and CRM dataWorkOS found unauthorized access on October 30 to an internal tool its sales and customer teams use, exposing CRM contacts, call and Slack excerpts, and directory health metadata. It saw an AI-assisted offensive framework and no access to production or application data.