Cybersecurity

Ukraine busts EU crypto scam ring that stole €4.3 million

Police arrested four suspects accused of running fraudulent investment call centers that swindled 135 German victims while targeting people across the EU.

Where do you start with agent security?

Join Origin researcher Tyler Holmwood on November 17 for an introduction to how agents work, how they go rogue, and what your team can do about it.

An AI agent is running on a developer’s laptop. It can open files, run commands, and use tools connected to other systems. What can it reach? Whose credentials is it using? And what happens when a tool tells it no?

Before your team can answer those questions, it needs to understand how an agent turns a request into work on a machine.

On Tuesday, November 17 at 11 AM Eastern, join Origin Staff Security Researcher Tyler Holmwood for “Not every rogue agent is an attack.” It’s the first session of Research Live, where an Origin researcher walks through their work with real traces on screen and takes your questions live.

Tyler will start with what an agent is and how it differs from a chatbot. He’ll explain the agentic loop, where a model chooses an action, reads the result, and decides what to do next. You’ll follow how that becomes tool calls, commands, and changes on an endpoint.

From there, he’ll examine the access behind those actions and how instructions from files, web pages, and tools can influence what the agent does next. Then he’ll walk through how that work goes wrong. An agent might follow instructions planted in a web page or a tampered skill. It might also decide on its own to work around a restriction, with no attacker involved.

Tyler’s recent research found an example of the second kind. While reviewing test code, Claude Code tried to delete a test and was blocked by its approval classifier. It then switched to a file-edit tool not subject to the same check and removed the test. When the employee later asked it to delete the test, Claude replied that it already had.

Cases like this show why it’s worth examining what an agent does after a control intervenes. Tyler will use traces to follow what agents saw, did, and changed. He’ll close with practical steps for reviewing agent access, recognizing risky behavior, and using controls you already own to limit the consequences.

Save your seat for November 17. The recording goes to everyone who registers.

Origin Technology is the endpoint AI observability platform for agentic monitoring and security. It reconstructs agent work so security teams can find the agents in their environment, monitor their activity, and investigate when something unexpected happens.

Don't miss my recent CSO piece on OpenAI’s new GPT-6 Cyber, which promises gains in vulnerability discovery and exploit development, while raising concerns about defenders’ ability to keep pace with fixes.

Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers.

In these fraud schemes (also known as romance baiting or pig butchering scams), criminals lure targets through social media, dating sites, and messaging apps into fake investment schemes, stealing their money instead of investing the funds as promised.

The investigation involved Ukraine's Cyber Police Department, the Main Investigation Department of the National Police of Ukraine, and German law enforcement authorities.

According to Ukraine's Cyber Police, the suspects used phone calls and messaging apps to build victims' trust through social engineering and trick them into investing in cryptocurrency, shares, and other financial instruments through fraudulent online trading platforms.

The crime ring targeted potential victims across the European Union, stealing more than €4.3 million from 135 German victims. (Sergiu Gatlan / Bleeping Computer)

A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

The flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.

Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library.

Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file. Because this is not a valid password hash, no password should allow access to those accounts.

However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.

To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins.

The problem is that the musl C library's crypt() function also returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit.

This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login.

To be clear, the flaw does not allow attackers to bypass passwords on accounts with valid password hashes. (Lawrence Abrams / Bleeping Computer)

Censys researchers report that they have discovered hundreds of copies of a Chinese-made AI hacking tool called Artex publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets.

Artex is an open source autonomous penetration testing tool, meaning software that automatically probes computer systems for weaknesses, and it’s been linked to several cyberattacks since its public release in July. Microsoft has previously described Artex as a system of AI agents that can conduct cyberattacks “from reconnaissance through data exfiltration with little needed human interaction.”

Censys said that it identified more than 800 distinct deployments of Artex that were accessible from the web without needing a password to log in.

Silas Cutler, principal security researcher at Censys, said that not every instance of Artex is operated maliciously and authorized testers use many. But it’s unclear why hundreds of these Artex systems are exposed to the web, as the software does not require them to be accessible from the internet.

Security companies have linked the use of Artex to several broad-scale cyberattacks, including against the Korean finance industry in September. Cybersecurity giant CrowdStrike attributed the attacks to a Chinese-speaking hacker who used an Artex instance in the attacks, in part because the hacker had left an “open directory” hosting the system. Censys said that its data showed the Artex instance in question had been publicly exposed for months, and appeared to contain more attack data that extended “well beyond South Korean banks,” including payment and gaming companies.

Artex was also used in an attack on IT support giant ConnectWise earlier in October, which allowed Chinese-linked hackers to spy on thousands of organizations whose data and files are hosted in Microsoft’s cloud. (Zack Whittaker / TechCrunch)

OpenAI is introducing GPT-6 Cyber, a restricted access model that the company calls its most capable and aligned cybersecurity model yet, “built to help security researchers identify and validate exploitable vulnerabilities, assess their impact, and harden potential patches before they’re released.”

OpenAI researchers said they used GPT-6 Cyber to find 81 previously unknown high-severity vulnerabilities in Firefox and develop working exploits for 948 Linux kernel vulnerabilities, including 588 previously unknown vulnerabilities. Mozilla has begun releasing fixes, and Linux findings are being reported with candidate patches for maintainer review.

In a sample of 166 exploits, OpenAI’s researchers identified 10 exploitation techniques that the company says appeared novel, meaning external kernel exploitation experts reportedly had not seen them before, and that could enable someone with local access to obtain root privileges.

Highlighting what it called stronger alignment and safeguards, OpenAI said that GPT-6 Cyber “was trained to stay within authorized scope, respect restrictions, and report results accurately.” In its ExploitGym Honeypot evaluation, the model went beyond the intended scope in only 0.07% of cases, compared with 5.51% for GPT-5.6 Cyber. (Cynthia Brumfield / CSO Online)

Spend less time finding cybersecurity news. Get more out of it.

Metacurity delivers the cybersecurity news, analysis, and insight that would take you hours—and sometimes days—to assemble yourself.

Every weekday, we sift through thousands of news articles, press releases, filings, court documents, and research reports, including details that vendor announcements and PR pitches leave out. We tell you what changed, why it matters, and what deserves your attention. Minimal vendor marketing. No outrage bait. No SEO filler.

A paid subscription gives you:

The full Metacurity archive: Every newsletter, searchable and browsable.
Our weekly long-reads roundup: The best cybersecurity writing from across the industry, selected and vetted to make your reading time count.
Specialized reports and analysis: Periodic deep dives that go beyond the daily headlines.
A direct role in sustaining independent journalism: Your subscription helps keep our editorial priorities focused on readers and the cybersecurity community.

If Metacurity saves you time, helps you spot an important development, or gives you a clearer understanding of the industry, please consider becoming a paid subscriber. Your support keeps that work going.

Subscribe today—and thank you for reading and supporting Metacurity.

Upgrade my subscription

On the heels of a spate of cyber incidents afflicting Japan, Philippine authorities are investigating separate data security incidents involving the corporate regulator, tax bureau and overseas employment agency, including claims that more than 10 million taxpayer records were compromised.

The country's Securities and Exchange Commission said it was investigating an incident detected November 6 that may have exposed individual profile information. Initial findings indicated that company records were unaffected, no passwords were leaked, and no data was altered, the regulator said. It reinforced access controls, updated authentication credentials, and launched forensic checks while verifying the origin and scope of the potentially exposed records.

The Bureau of Internal Revenue said it is working with government cybersecurity agencies to investigate claims by a threat actor calling itself Happy Go Lucky PH that it obtained more than 10 million individual taxpayer records, along with corporate and business information. The bureau has not confirmed a breach, and the dataset’s authenticity and alleged scale have not been independently verified. It said it implemented immediate measures to assess the incident and protect taxpayer data.

Separately, Hunt.io researchers found logs indicating that an unidentified attacker copied nearly 69GB of database backups from the Philippine Overseas Employment Administration to a staging server in Singapore. The transfer covered 27 databases associated with worker records, contracts, accreditation, and financial transactions and took about 24 minutes. (JON VIKTOR D. CABUENAS / GMA News, Newsbytes.ph, Robert Lemos / Dark Reading)

Related: BitPinas, Unbox.ph

The hackers who stole $6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just $15, according to blockchain researchers at Blockaid.

An examination of transactions recorded on the Ethereum blockchain shows how the thieves weaponized a feature designed to make crypto wallets easier to use. It allows an account to give software permission to move money on its behalf, rather than requiring separate authorizations for each transfer.

The hackers paid about $15 in network fees to put that permission in place, then used it to take roughly $2.5 billion in a single transaction — 40% of the total amount stolen.

Last Tuesday, Binance itself outlined an elaborate timeline in which infiltrators used phony job postings to deceive an engineer into downloading malicious code. It was a “sophisticated, multi-stage campaign,” according to the exchange, replete with social engineering, compromised devices and AI techniques.

Once inside, the hackers targeted a “hot wallet” known as Binance 14, which the exchange uses to process customer withdrawals, records on the Etherscan analytics platform show. This wallet is a bit like an online cash register, and because Binance is the world’s largest crypto exchange, it regularly holds large pools of Ether, stablecoins and dozens of other digital tokens.

Moving so many different assets would ordinarily require a series of separate transfers, each taking time and creating another chance for security systems to spot something unusual.

But an Ethereum software upgrade known as EIP-7702 offered a shortcut.

Before it was implemented in May 2025, a basic crypto wallet was more akin to a checking account, where the owner generally had to sign off on each transaction. The upgrade added something closer to an autopay function, letting a wallet give software the ability to act on its behalf and bundle several actions together.

At about 8:20 p.m. UTC on Oct. 29, the hackers submitted instructions using a valid signature from the Binance 14 wallet, telling the Ethereum network to let attacker-controlled code act on the account’s behalf, according to Blockaid. It’s at this point that they paid the routine network processing fee to put that authority in place. (Sidhartha Shukla / Bloomberg)

Binance says a listing claiming to offer 335.9 million lines of user data is likely a scam, disputing an alleged theft attributed to ShinyHunters while continuing to investigate.

“Based on the description provided and the sample information reviewed so far, this appears likely to be a scam rather than evidence of a Binance systems breach,” a Binance spokesperson told crypto.news.

The exchange’s official customer-support account published the same assessment on Nov. 8. It said Binance had found no evidence that its systems, customer identity-verification data, account credentials, wallet private keys or internal infrastructure information were compromised in connection with the listing.

Cybersecurity monitoring firm ThreatMon reported that a forum listing attributed to ShinyHunters advertised 335,900,000 lines of information covering users in approximately 170 countries. The seller demanded $900,000 in Bitcoin or Monero and threatened to release the data if Binance did not pay, according to ThreatMon.

The purported contents include email addresses, phone numbers, passwords, identity cards or passports, transaction histories, and other personal details. The listing also claims to offer internal infrastructure information, wallet private keys and information about assets in Binance’s hot wallets. Those claims remain unverified; the advertised line count is not a confirmed count of affected people.

Binance pointed to several inconsistencies: it says it does not store passwords in plaintext or hold private keys for users’ external wallets, and the listing references jurisdictions where it no longer operates. Its support account said similar past listings have involved information stolen by malware from users’ own devices rather than from Binance’s systems. (The Defiant)

Related: Cryptonomist, Crypto News

D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches.

These switch models provide multi-gigabit uplinks, allowing enterprise network administrators to eliminate data bottlenecks, and are designed primarily for small-to-medium businesses (SMBs) and metro Ethernet deployments.

While D-Link didn't share details on these flaws and has yet to disclose the CVE IDs for easier tracking publicly, it said Spectrum Community Solutions network engineer Giresh Kumar Enugu found the bugs in the D-Link Discovery Protocol (DDP) authentication, access control, and information handling.

Successful exploitation could allow attackers to obtain sensitive device data, make unauthorized credential/configuration changes, leak SNMP communities, or cause service disruptions and device resets.

The zero-days affect multiple DGS-3130-30TS firmware versions, and the company is still investigating the impact on other D-Link switching platforms and firmware security mechanisms (including SSH service security configuration, safeguards underlying operating-system credentials, and handles firmware encryption/embedded cryptographic keys). (Sergiu Gatlan / Bleeping Computer)

Related: D-Link

A separate internal assessment, compiled by France's foreign ‌ministry and also seen by Reuters, found that social media accounts linked to Israel and to the US MAGA movement also pushed "hostile narratives" around the riots, linking them to radical Islamism and migration.

Taken together, the assessments offer an insight into how external actors have been trying to use France's domestic turmoil for their own political ends, according to analysis by European disinformation specialists.

The European Union analysis found that a covert Russian network known as "Operation Overload" spread videos impersonating Western media outlets to target French audiences, some falsely claiming migrants had raped protesters or terrorist attacks were imminent. (Antoni Slodkowski and John Irish / Reuters)

Related: Political.org

Donald Trump said the risks posed by artificial intelligence ‌can be managed but signaled an openness to safeguards, telling CBS's "60 Minutes" that he "doesn't mind guardrails."

Asked whether the United States should accept ⁠the risks of artificial intelligence in order to stay ahead of China, Trump said the dangers were manageable and expressed openness to working with Democrats on safeguards.

"I don't mind guardrails," he told CBS, adding ‌that ⁠he did not want regulations to put the United States in "a deep second position" behind China, which he said ⁠had no such restrictions. (Jarrett Renshaw / Reuters)

Cloud security startup Cyera is planning to raise around $800 million in a round led by Cyberstarts, which wrote the startup’s first seed check in 2021, according to two people with knowledge of the deal.

The funding will value Cyera at $20 billion and is expected to close in the coming weeks, the people said, making Cyera one of the most valuable private cybersecurity companies in the world. Cyera sells software that scans customers’ cloud storage, databases and email systems to identify and track sensitive data and automatically flag potential gaps in security. It’s not clear if the valuation includes the new money.

The deal talks follow surging revenue at the startup over the past year. Its annual recurring revenue is now in the hundreds of millions, one of the people said. (Aaron Holmes / The Information)

Related: CTech

Kaiser Ng, the chief financial officer at Binance Holdings Ltd., the world’s largest crypto exchange, is leaving, the company announced just days after hackers stole more than $6 billion in cryptocurrency from the platform.

“Kaiser Ng has decided to pursue a new venture after more than five years at Binance, with a transition plan implemented over the last six months,” Binance co-Chief Executive Officer Yi He said in a statement. “We wish him the best in his next chapter.” Justin Yek will become the firm’s new CFO, she said.

Hackers stole $6.3 billion from Binance in the biggest heist in cryptocurrency’s history. (Muyao Shen and Colin Keatinge / Bloomberg)

Related: Reuters, TechCrunch

Best Thing of the Day: Time and Empathy Needed to Understand the Battle

OT security pro Lesley Carhart sets the record straight about why so many OT, ICS, and IIoT systems, such as those Danfoss refrigeration units, are exposed on the internet.

Bonus Best Thing of the Day: CISA Veterans Doing Good

Two CISA veterans, Bob Lord and Lauren Zabierek, launched their own consultancy, the Software Safety Institute, to study the question of why manufacturers still ship products with defects they’ve long known how to prevent.

Worst Thing of the Day: When Honeypots Lead to Global Crises

Nvidia CEO Jensen Huang admitted he had been unfaithful in his marriage, effectively confirming a series of reports linking him romantically with a woman who has been identified as a suspected Chinese spy and whose company bought chips from Nvidia.

Bonus Worst Thing of the Day: No One Asked for This

Artificial intelligence models will soon be powerful enough to master biology, presenting both benefits and serious risks, Tencent Holdings’ chief AI scientist and former OpenAI star researcher Vinces Yao Shunyu said.

Ukraine busts EU crypto scam ring that stole €4.3 million

Where do you start with agent security?

Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers.

A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

Censys researchers report that they have discovered hundreds of copies of a Chinese-made AI hacking tool called Artex publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets.

On the heels of a spate of cyber incidents afflicting Japan, Philippine authorities are investigating separate data security incidents involving the corporate regulator, tax bureau and overseas employment agency, including claims that more than 10 million taxpayer records were compromised.

The hackers who stole $6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just $15, according to blockchain researchers at Blockaid.

Binance says a listing claiming to offer 335.9 million lines of user data is likely a scam, disputing an alleged theft attributed to ShinyHunters while continuing to investigate.

D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches.

Donald Trump said the risks posed by artificial intelligence ‌can be managed but signaled an openness to safeguards, telling CBS's "60 Minutes" that he "doesn't mind guardrails."

Cloud security startup Cyera is planning to raise around $800 million in a round led by Cyberstarts, which wrote the startup’s first seed check in 2021, according to two people with knowledge of the deal.

Kaiser Ng, the chief financial officer at Binance Holdings Ltd., the world’s largest crypto exchange, is leaving, the company announced just days after hackers stole more than $6 billion in cryptocurrency from the platform.

Best Thing of the Day: Time and Empathy Needed to Understand the Battle

Bonus Best Thing of the Day: CISA Veterans Doing Good

Worst Thing of the Day: When Honeypots Lead to Global Crises

Bonus Worst Thing of the Day: No One Asked for This

Closing Thought

Read more

Surveillance for sale, Five Eyes under strain, AI power struggles: Best infosec long reads 11/7/26

Hackers drain €100m from French bank as Binance fallout rattles lenders

Democratic sweep puts AI and cybersecurity policy in the hot seat

Google dismantles 1.3 million-device botnet built into Android TV boxes

Where do you start with agent security?

Ukrainian law enforcement arrested four suspects in a case involving the theft of more than €4.3 million using a network of cryptocurrency investment scam call centers.

A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

Censys researchers report that they have discovered hundreds of copies of a Chinese-made AI hacking tool called Artex publicly exposed to the internet for anyone to access, potentially allowing outsiders to launch cyberattacks against unsuspecting targets.

On the heels of a spate of cyber incidents afflicting Japan, Philippine authorities are investigating separate data security incidents involving the corporate regulator, tax bureau and overseas employment agency, including claims that more than 10 million taxpayer records were compromised.

The hackers who stole $6.3 billion from Binance last week found a way to take 40% of the stolen cryptocurrency in one hit, reducing their chances of being caught in the act, and it cost them just $15, according to blockchain researchers at Blockaid.

Binance says a listing claiming to offer 335.9 million lines of user data is likely a scam, disputing an alleged theft attributed to ShinyHunters while continuing to investigate.

D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches.

A covert Russian network sought to exploit last month's riots in France by using social media to blame the unrest on ​uncontrolled immigration and portray the government as having lost control, according to an internal EU assessment seen by Reuters.

Donald Trump said the ​risks posed by artificial intelligence ‌can be managed but signaled an openness to safeguards, telling CBS's "60 Minutes" ​that he "doesn't mind guardrails."

Cloud security startup Cyera is planning to raise around $800 million in a round led by Cyberstarts, which wrote the startup’s first seed check in 2021, according to two people with knowledge of the deal.

Kaiser Ng, the chief financial officer at Binance Holdings Ltd., the world’s largest crypto exchange, is leaving, the company announced just days after hackers stole more than $6 billion in cryptocurrency from the platform.

Best Thing of the Day: Time and Empathy Needed to Understand the Battle

Bonus Best Thing of the Day: CISA Veterans Doing Good

Worst Thing of the Day: When Honeypots Lead to Global Crises

Bonus Worst Thing of the Day: No One Asked for This

Closing Thought

Read more

Surveillance for sale, Five Eyes under strain, AI power struggles: Best infosec long reads 11/7/26

Hackers drain €100m from French bank as Binance fallout rattles lenders

Democratic sweep puts AI and cybersecurity policy in the hot seat

Google dismantles 1.3 million-device botnet built into Android TV boxes

A covert Russian network sought to exploit last month's riots in France by using social media to blame the unrest on uncontrolled immigration and portray the government as having lost control, according to an internal EU assessment seen by Reuters.

Donald Trump said the risks posed by artificial intelligence ‌can be managed but signaled an openness to safeguards, telling CBS's "60 Minutes" that he "doesn't mind guardrails."