Fake Job Interview Leads to $6.43 Billion Crypto Heist — Biggest Ever
Tuesday, November 3, 2026 · 5-minute read
Cybercriminals remotely broke into refrigeration control systems at supermarkets across several European countries and changed the temperature settings on freezers and coolers. Shoppers faced spoiled food and store disruptions as the systems were brought back under control. This is a reminder that internet-connected industrial equipment is just as hackable as your laptop.
↗ BleepingComputerHackers who broke into Harvard's alumni and fundraising systems back in November 2025 made off with data tied to more than 850,000 unique email addresses. The breach only surfaced publicly now via breach-notification service Have I Been Pwned. If you've ever donated to Harvard or attended an event registered through their alumni office, your email could be in this dataset — check haveibeenpwned.com to find out.
↗ BleepingComputerA Chinese hacking group used an open-source AI tool called ARTEX — a multi-agent AI framework designed for penetration testing — to automate attacks against more than 200 organizations across 14 countries. This is one of the clearest examples yet of real attackers putting AI to work at scale to speed up their campaigns. It hit organizations across many industries worldwide.
↗ BleepingComputerGoogle is warning businesses that attackers are stealing AI API keys through phishing emails, leaked source code, or misconfigured servers. Once they have a key, they quietly run massive AI workloads on the victim's account — charging up to $1 million in cloud computing costs in just hours. Unlike slower attacks, this can drain a corporate budget before anyone notices something is wrong. Companies across finance, retail, technology, and transportation in North America, South America, and Asia Pacific have already been hit.
Attackers broke into the update delivery system for cPGuard, a popular security tool used on Linux web servers, and pushed a malicious script to customers' machines. The script installed a backdoor and collected password hashes and other sensitive files. The attack hit in the early hours of November 2 and was caught within 12 hours, but the stolen credentials may still work — so servers that ran the bad versions need all passwords changed immediately.
A serious flaw in the Linux kernel — the core software that runs most web servers, Android phones, and cloud infrastructure — lets a remote attacker with no login credentials whatsoever take full control of a vulnerable machine over the internet. The bug has existed since Linux version 4.4, meaning it's been quietly sitting in systems for years. Red Hat initially rated it as moderate, then reversed course and called it Critical after a closer look.
Status: Red Hat Enterprise Linux 8, 9, and 10 patches are available now. Ubuntu fixes are in an opt-in testing channel with no firm release date for standard users yet — apply the Red Hat patch if applicable, and watch for Ubuntu's update.
This flaw lets an attacker skip the login process entirely on Barracuda's Email Security Gateway — no username or password needed. When chained with a second vulnerability (CVE-2026-111560, rated 8.6), the attacker can then run any command they want with full administrator-level privileges on the device. Barracuda's affected products are widely used by businesses to filter email and protect web traffic, making this a high-priority fix.
Status: Patches available from Barracuda. Exploitation requires access to the administrative interface, so restrict that access immediately as a first step while patching.
This is the second half of the Barracuda pair. Once an attacker bypasses authentication using CVE-2026-116606, they can use this command injection vulnerability to run arbitrary commands with root privileges. It affects a wide range of Barracuda products including Load Balancers, Web Application Firewalls, Message Archivers, and Web Security Gateways.
Status: Patches available. Apply both CVE fixes together — neither is as dangerous alone as they are when combined.
Google has added a new top-tier reward to its Cloud Vulnerability Reward Program, offering $250,000 for discovering high-impact architectural security flaws that could affect the core of Google Cloud. This is a meaningful jump from previous payouts and signals how seriously Google is taking deep infrastructure risks. Bug bounty programs like this are a major reason why many serious flaws get found and fixed before criminals discover them — rewarding researchers keeps the internet safer for everyone.
↗ BleepingComputerBinance — the world's largest cryptocurrency exchange — confirmed today that it lost $6.43 billion in a meticulously planned attack that unfolded over months. This isn't a story about a simple password getting guessed. It's a story about how patient, creative criminals can dismantle even well-defended organizations one human at a time.
The attack began with something that looks completely normal: a job interview. Attackers posed as recruiters and reached out to Binance engineers. One engineer — referred to as "Engineer A" from the Wallet DevOps team — searched online for a popular AI tool and downloaded what appeared to be a legitimate installer. It wasn't. The file was a trojanized version of a Homebrew installer, delivered through a supply chain attack. Once installed, the malware quietly compromised the engineer's computer. A second engineer was also targeted through similar recruitment-themed social engineering. From those two footholds, the attackers worked their way deeper into Binance's internal systems, eventually compromising internal AI tools and finding a way to manipulate how transactions were authorized — the final lock on the vault.
What makes this attack remarkable — and frightening — is how it combines so many tactics that individually sound manageable: a fake recruiter, a bad download, a compromised internal tool. None of those steps alone moves $6 billion. But chained together, with patience and precision, they did. For regular people, the lesson is this: even the most security-conscious organizations in the world can be beaten through their employees. You don't need to hack a server if you can trick the person who has the keys.
Binance says it has since overhauled its transaction authorization controls and internal tooling. But the broader question — how do you protect employees from elaborate, targeted deception — has no easy answer. Expect to see more attacks like this. Criminals now know that AI tools are a tempting download for technical workers, and that fake job offers open doors that firewalls can't close. Watch for new guidance from security teams on verifying software downloads and spotting fake recruiter outreach in the weeks ahead.