Attackers industrialise trust, and developers are the target

A job interview that steals billions

Attackers exploited access to the internal wallet-signing service of Binance on October 29, 2026, affecting approximately $6.34 billion in digital assets. The Binance theft followed a campaign involving a malicious coding assignment delivered to a software engineer through a fraudulent recruitment process. Abnormal Security identified a live variant of PolinRider malware consistent with DPRK-linked Contagious Interview activity. The attack path is now familiar: a fake recruiter, a coding task, a developer who runs it, and a backdoor that spreads from there. m:…0765

PolinRider malware modifies development tools like VS Code and npm to establish persistent access. The PolinRider loader retrieves command-and-control server addresses from Ethereum transactions, using an Ethereum address controlled by the operator to extract server IP addresses from transaction recipient fields. The Python stage of the PolinRider malware targets browser data, cryptocurrency wallets, password manager files and developer secrets. The malware hides its instructions in a public blockchain, so there is no suspicious server to block, and it goes after the developer's own tools, which are the keys to everything the developer can touch. m:…0765

The recovered upload configuration for PolinRider identifies a Telegram fallback bot, @file_1018_bot, with bot ID 7870147428, and JFrog reported the same Telegram bot ID and recipient ID in a June 2026 research report involving hijacked npm packages. Abnormal Security observed code designed to tamper with editor startup components, including the @vscode/deviceid module and npm's lib/cli.js file. Binance reported that its endpoint protection failed to detect the malware involved in the September compromise. The same infrastructure keeps reappearing across incidents, which means the campaign is a standing operation, not a one-off. m:…0765

Stolen credentials, tens of thousands of repos

A threat actor used stolen GitHub credentials to push a malicious workflow payload into tens of thousands of repositories starting November 10, 2026. 4,837 compromised accounts opened probe pull requests in 61,764 repositories, and at least 1,806 repositories ran the payload and had credentials exfiltrated. The scale is the story: nearly five thousand accounts, more than sixty thousand repositories probed, and over eighteen hundred that actually ran the payload. m:…2949

The threat actor uses three variants for payload delivery: workflow injection, install hooks and throwaway branches. The payload bypasses branch protection by posting forged success status checks, and the threat actor deletes the workflow run and logs after execution to cover tracks. A forged green check is the detail that should worry every team: the protection that says a change was reviewed and tested can be faked by the attacker. m:…2949

The payload rewrites AWS trust policies to open roles to any AWS account, injects new federated identity credentials into Azure AD applications, and has proliferated into at least one Packagist and one Golang package. The payload exfiltrates data via HTTP POST to 194.150.166.244:8080 or 18.143.168.96:8080. The attack does not stop at stealing a secret. It rewrites the cloud permissions so the attacker keeps access after the secret is rotated, and it jumps from GitHub into package registries, where other developers will install it. m:…2949

New banks, old flaws

79.3% of independent neobank apps carry at least one high or critical security finding, compared with 51.2% of traditional-bank apps, according to Ostorlab's Mobile App Security Report. 51.5% of all apps in the study carry a high or critical finding. The gap between new banks and old banks is wide, and more than half of all banking apps in the study have a serious finding. m:…3869

Independent neobanks ship embedded credentials more than twice as often as traditional banks, and 37.9% of independent neobank apps integrate a passkey API, compared to 4.6% of traditional-bank apps. 48.3% of independent neobank apps use app or device attestation, compared to 19.9% of traditional-bank apps, yet 79.8% of apps show no app or device attestation. The pattern is the paradox of the study: neobanks adopt modern controls like passkeys and attestation faster than old banks, and still ship the basic flaws that make those controls irrelevant. A passkey does not help if the app also embeds the credentials that let an attacker in. m:…3869

48.3% of independent neobank apps embed credentials beyond Google API keys, compared to 19.8% of traditional-bank apps, and high or critical OAuth account-takeover findings appear in 24.1% of independent neobank apps, compared to 6.1% of traditional-bank apps. Only 22.3% of Android banking apps detect remote-control tools used to commit fraud, and 41.1% of all apps in the study ship a third-party component with a published vulnerability. Mobile banking accounted for 52% of UK authorized push-payment scam losses in 2025, which is the money at stake when the app on the phone is the weakest part of the bank. m:…3869

The defence responds with research

Horizon3 launched the Adversarial Intelligence Frontier Lab on November 12, 2026, with Dr. Z. Berkay Celik as its inaugural director. The lab will pursue four lines of research: AI-enabled attacks, adaptive defense, autonomous security agents and cyber resilience. Celik is an Associate Professor of Computer Science at Purdue University, and Horizon3 has a base of more than 7,000 customers. m:…5732

Horizon3 collects 30 billion tokens of anonymized, aggregated and labeled attack-defend training data per day, and the lab will oversee Horizon3's Cyber Resilience Centers of Excellence focused on critical infrastructure. The data volume is the asset: a lab that watches attacks and defences at that scale can train defensive agents on what actually happens, rather than on what textbooks describe. Whether that turns into protection that reaches customers is the test that follows every lab launch. m:…5732