Skip to content
Start with Identity
Join free
This Week in Identity · Issue 20 · 2026-11-03 · Covers 2026-10-28 to 2026-11-03

This Week in Identity, Issue 20

Issue 20 of This Week in Identity, published two days late. This week the attackers mostly did not break authentication; they collected credentials that already worked. A deployment token on an engineer's laptop, a sign-in certificate from a weak template, client secrets for app registrations, AI keys in environment variables. Each one was issued for a good reason and kept working long after anyone was watching it.

In brief

  • Binance says the October 29 theft of about $6.34 billion began in September with a fake job interview whose coding assignment infected a software engineer's Mac; on October 20 the attacker used that machine and an internal AI tool to take over two wallet engineers, and a container deployment token from one of their laptops reached the wallet signing service.
  • Microsoft investigated two intrusions in which attackers posed as IT support on Teams, got remote control through Quick Assist, and abused Active Directory Certificate Services: an ESC1 template yielded certificates for 11 privileged accounts, and an ESC8 relay yielded one for a domain controller.
  • Todyl is tracking one operator who signs in to Microsoft Entra ID as app registrations with stolen client secrets and has reached 27 organizations, including MSP clients; Todyl says no Microsoft vulnerability is involved.

The big story

A fake recruiter, an internal AI tool and a deployment token on a laptop. On October 30 Binance said its roughly $6.3 billion theft started on a DevOps engineer's compromised laptop and that the attacker "did not simply use one engineer's permissions." Its initial findings on November 3 filled in the chain. In September a software engineer was approached on a job-hunting platform by a fake recruiter; a second-round coding "assignment" carried malware that replaced a legitimate pyenv component and evaded endpoint tools. On October 20 the attacker used that computer and an internal AI tool to take control of two engineers on the wallet infrastructure team and found a container deployment permission token on one of their machines. On October 29 it logged into the third engineer's computer, used the second engineer's credentials to deploy a container, and ran a script that reached the wallet signing service. It also abused EIP-7702 delegations, which kept working after withdrawals were suspended. About $2.85 billion has been frozen or intercepted, and the FBI attributes the theft to North Korea's TraderTraitor.

Why it matters: the control that failed is standing privilege on endpoints. A token that can deploy into the signing environment sat on a laptop, where any malware on that laptop could use it, and an internal AI tool could act across engineers' machines, so one infected Mac became three. Binance also says a Wallet DevOps engineer installed a tampered Homebrew package in June; it replaced the device and rotated credentials, but the team's roles remained exposed, and rotation cannot undo an attacker learning whom to target. Keep deployment tokens for transaction-signing systems off workstations, issue them just in time with a second approver, and treat any internal tool that can reach other employees' machines as privileged access. The hiring pipeline is part of that attack surface. Sources: Binance ties its $6.3 billion theft to a compromised DevOps engineer's laptop and Binance says a fake job interview and an internal AI tool led attackers to its wallet signing service.

Patch this week

  • Ivanti Connect Secure: CISA added CVE-2026-111357 (root escalation) and CVE-2026-118527 to KEV on October 30, a day after Ivanti's October 29 builds. Both chain with the CVE-2026-104935 login bypass, so appliances patched only on October 13 are still exposed. Install the October 29 builds and rotate the LDAP bind account. Brief and post.
  • Langflow 1.0.0 through 1.12.8: four flaws including CVE-2026-93680 (CVSS 9.8), an authentication bypass a public Metasploit module already cites, and unauthenticated code execution through MCP tool enumeration. Only 1.13.0 fixes them, and IBM offers no workaround. Post.
  • Canonical LXD and MicroCloud: CVE-2026-112816 (maximum severity) let an attacker authenticate to the HTTPS API as any trusted client by attaching that client's public certificate to their own TLS chain. Fixed in LXD 4.0.15, 5.0.11, 5.21.9 and 6.10.1; Incus fixed it in 7.6.0. Post.

The pattern

Workload credentials were the target, and they were stored where an attacker could read them. Northflank told customers to assume every environment variable was decrypted, and customers saw stored AI keys used within hours. Todyl's operator signed in as Entra ID app registrations with client secrets, then asked for Key Vault tokens to find more. A scan of 7.25 million public Gitee repositories found 26,400 credentials that still worked. Chainstack's attacker had access to systems holding node credentials. Google's LLMjacking report names the most common way in: stolen IAM credentials, service account keys, GitHub tokens and session tokens. The technique pages for this class are static API key abuse and secrets in repositories and CI. None of them had to get past an MFA prompt. The fix is to issue fewer long-lived secrets: workload identity federation or certificates where the provider supports them, scoped and spend-capped keys where it does not, and revocation at the provider when one leaks.

What else happened

  • Microsoft's AD CS cases. Within seconds of getting a privileged certificate the attacker ran DCSync, and one privileged account left out of automated containment carried file-server data out. Microsoft notes a password reset or reimage does not revoke an issued certificate. Audit templates that let requesters name the subject, enable EPA on web enrollment, and review exclusions; Microsoft Defender for Identity posture checks flag ESC1 and ESC8. This is AD CS certificate template abuse reached through help desk social engineering. Post.
  • Northflank, after a Wiz alert, shipped secret rotation for its add-ons and turned on audit logs for every account. Wiz's "Black October" report counts nine incidents at AI developer platforms in October. Rotate at the provider and check AI billing first. Post.
  • Todyl's Microsoft Entra campaign: scripted clients made 95% of sign-ins, and the actor also used an Azure DevOps federated workload identity. Check service principal sign-in logs for 199.19.77.84 and remove unknown secrets and federated credentials. Post.
  • Google's LLMjacking report found fraudulent AI charges above $100,000 in a day and up to $1 million in total at some organizations, with stolen access resold through "LLM Mixers." Alert on any unauthorized enablement of an LLM service. Post.
  • Gitee: the two scanners overlapped on only 1,001 of the 26,400 working credentials, so either alone would have missed about half. Deleting a key from history does not revoke it. Post.
  • WorkOS found an AI-assisted attack framework in an internal sales tool, exposing CRM contacts, call and Slack excerpts, and connection and directory health metadata, but no production or application data. Customers should verify any unexpected request about their SSO or directory connection. Post.
  • Chainstack says an attacker entered a development environment through a third-party component on October 26, reached production, and accessed customer password hashes before being cut off on October 31. Rotate node credentials and platform API keys. Post.
  • mSecure told current and former customers to change passwords, reset two-factor methods and possibly remove passkeys after suspicious activity, without saying what happened. Start with the accounts that can reset others, such as email and your identity provider. Post.
  • A trojanized Claude Code extension sat on Cursor's marketplace for about 11 hours and tried to add an attacker SSH key, a standing credential that survives password resets. Post.
  • A shared ChatGPT link could run script as chatgpt.com and read the viewer's session token, Parameter said; OpenAI fixed it by October 26. Post.
  • One scanner posed as about 32 AI bots to request .env files, cloud credential files and SSH keys, Cequence said. A user agent claiming to be an AI crawler is not an identity. Post.

New from SWI research

New from Start with Identity

Free to read and share. Independent and community-driven, no sponsorship. Subscribe to get the next issue.