security

According to Cryptopolitan, the security company Island released a study on November 12, revealing 186 counterfeit domains mimicking 27 well-known AI brands. Among them, ChatGPT was the most impersonated, with 25 similar domains, followed by Claude with 18, DeepSeek with 16, and Runway with 12. Some of these similar domains redirect users to advertising pages, while others point to malicious websites.The study states that attackers implement their attacks using a technique called TypoPrompting, exploiting spelling errors made by users when entering AI tool URLs. Island tracked three related pathways: redirecting visitors to a fake Cloudflare verification page and enticing Windows users to execute PowerShell commands; promoting a disguised security check application called Net Guard, which can hijack browsers and run remote scripts; and involving 30 browser extensions that hijack searches, of which 13 have been removed, while the remaining 17 collectively have 972,000 users. Island noted that the 186 fake domains are a count of the number, not confirmed infection cases, and it has not yet been confirmed that this activity has caused any losses.

Binance posted on platform X that it has completed the coverage of all affected assets from the previous security incident and released a new reserve proof snapshot. After the zero-knowledge proof is generated, users can independently verify whether their assets have at least 1:1 reserve support.

Binance's Chief Security Officer Jimmy Su stated in a July interview that fake job interviews could lure employees into running malicious code on company devices, leading to device control, credential theft, and infiltration of internal networks.In September, a Binance software engineer downloaded a malicious programming assignment to their work computer during a fake interview; Binance's preliminary investigation indicated that this incident was part of a multi-stage attack in the October theft case. Jimmy Su also pointed out that attackers might exploit seemingly normal technical assessment steps to bypass antivirus tools. Binance's subsequent investigation revealed that the installer for the malicious assignment evaded endpoint security tools through obfuscation and other evasion techniques.Binance stated that it has intercepted 57 suspected cyber threats related to North Korea so far this year, approximately one every five days. After the October attack, Binance announced that it has strengthened device and access controls, rebuilt affected wallet systems and internal AI tools, and increased investments in endpoint protection and development environment security.

The founder of Slow Fog, Yuxian, issued a warning stating that the new version of Telegram supports directly embedding interactive applications in chat messages. The related functionality uses QuickJS to execute JavaScript, which may increase the risk of malicious code attacks, and users are advised to upgrade with caution.The Bot API 10.4 officially introduced this feature on November 9. Although the official version provides a QuickJS sandbox and network access restrictions, recent security researchers have discovered that the related execution engine previously had a remote code execution vulnerability that could potentially break the sandbox isolation.

According to a report by the Korean News Agency, the Financial Security Institute (FSI), a financial security agency under the Financial Services Commission of South Korea, was hacked, resulting in the leakage of hundreds of pieces of information, including about 300 personal information records of employees from financial institutions.

According to The Defiant, malicious code activities targeting the Vizor and Zingo wallets have been disclosed. Attackers attempted to inject credential-stealing code into the relevant code repositories by submitting malicious Pull Requests, involving a total of six requests, all of which were not merged.The report states that the activity combines the credential-stealing code with specific instructions, directing AI code review tools not to flag these secret upload actions, intending to bypass the automated review process.

On November 9, 2026, Google released an emergency stable channel update for the desktop Chrome browser, fixing nine security vulnerabilities, including a zero-day vulnerability that was already being exploited in the wild. This update raises the Chrome version on Windows and Mac platforms to 157.8103.5/.51, and to 157.8103.5 on the Linux platform, and will be gradually rolled out over the next few days to weeks. The core focus of this update is the high-risk vulnerability numbered CVE-2026-125350, which is a use-after-free issue in an XML component. Google explicitly stated in the announcement that "CVE-2026-125350 is known to be exploited in the wild," but did not disclose specific attack methods, the scale of victims, or attribution of the attack activities.The vulnerability was reported by an anonymous researcher on November 6, 2026, just three days before Google released the fix. Among the nine fixes, seven are classified as "high risk" and two as "medium risk." In addition to CVE-2026-125350, another high-risk vulnerability, CVE-2026-125346, also pertains to a use-after-free issue in an XML component, reported by Arni Hardarson of Neonix Security on October 12, 2026, but Google only marked CVE-2026-125350 as an actively exploited vulnerability. The other high-risk vulnerabilities include uninitialized resources in WebGL, improper FileSystem authorization, synthesizer buffer overflow, GPU out-of-bounds write, and V8 type confusion, most of which were discovered by Google's internal security team.Google also confirmed that the Android version of Chrome (157.8103.5) released on the same day includes the same security fixes as the desktop version, with no exceptions noted. Users on the Extended Stable channel should install the update released separately on November 9, with Windows and Mac versions being 156.8078.96, which also lists CVE-2026-125350 as a high-risk fix. The Hong Kong Government Computer Security Incident Coordination Centre (GovCERT.HK) issued a security alert on the same day, defining affected systems as versions prior to Chrome 157.8103.5, and pointed out that successful exploitation of the related vulnerabilities could lead to remote code execution, denial of service, tampering, or bypassing security restrictions. The Hong Kong Computer Security Incident Coordination Centre (HKCERT) rated the risk level of this update as "extremely high risk." Google explained in the announcement that access to vulnerability details and links may remain restricted until most users complete the update. The company recommends that users manually check and trigger the update via "Settings → About Chrome," and restart the browser after completing the update for the patch to take effect. For users still running versions prior to Chrome 157.8103.5, the current priority action is to confirm the version number and restart immediately to complete the upgrade.

According to Apple's security announcement, the iOS and iPadOS 27.2.1 update fixes multiple security vulnerabilities, one of which is a Messages vulnerability that could allow remote attackers to join iMessage group chats and receive messages.Another Messages vulnerability could allow new users joining a group chat to read messages sent before they joined. Apple also fixed issues where malicious Bluetooth devices could pair without user interaction, and where attackers within Bluetooth range could bypass pairing code attempt limits. Apple stated that the above update was released on November 9.

According to Barron's, Robbie Mitchnick, head of BlackRock's digital asset business, stated that since regulators approved the physical creation and redemption of crypto assets last year, the company has recorded approximately $3.6 billion in physical conversions of directly held Bitcoin into shares of its spot Bitcoin ETF, IBIT. Since BlackRock does not handle all transactions itself and may not see every conversion, the actual scale may be larger.BlackRock also provides physical conversions for the iShares Ethereum Trust ETF and the iShares Staked Ethereum Trust ETF, but the related scale is much smaller than IBIT. Mitchnick noted that demand continues to rise, and this is currently the highest level of interest the company has seen, which does not change with Bitcoin price fluctuations. The primary motivation is security and peace of mind. Outsourcing custody to an institutional-grade cold storage model is more attractive for holders; holding ETF shares managed by large fund managers is generally seen as less risky than placing assets on crypto trading platforms or in always-online hot wallets.He mentioned that the recent hacking incident at Binance has once again highlighted the risks of trading platforms, although large Bitcoin holders have long understood these risks. The minimum threshold for physical conversions has been reduced from the initial approximately $30 million to about $1 million to $2 million, with the threshold set by intermediary firms facilitating the transactions, such as Galaxy Digital, Talos, and Virtu. Mitchnick expressed hope that the threshold could be lowered to a single ETF share, but the cost structure is unlikely to drop to zero in the short term.

Confidential AI Infrastructure NEAR AI updated on platform X, stating that on November 8, an attacker exploited a vulnerability in its inference engine SGLang to access part of the infrastructure.NEAR AI has indicated that it has revoked relevant access permissions and completed the repairs. Affected users have been notified, and users who have not received notifications do not need to take any action.

The Vice President of Engineering at the prediction market platform Polymarket, Josh Stevens, announced that the platform has launched a withdrawal address whitelist feature. Users can lock the withdrawal address of their deposit wallet, and adding a new address requires email verification and setting a 48-hour time lock. Operations not performed by the user can be canceled via email.Stevens stated that even if a session is compromised or a malicious transaction is mistakenly signed, funds cannot be transferred to an uncontrolled address. This feature can be enabled in "Settings - Account," and Passkey support will be launched soon. The team is developing a migration tool for non-deposit wallets and will introduce advanced built-in security protections that do not require manual activation.

The Chief Information Security Officer of Slow Fog, 23pds, reminds that malicious IPA can utilize worse_query to read other application containers, and plaintext stored wallet data may be at risk.

NEAR AI tweeted that it has closed unauthorized access and continues to complete the investigation. NEAR AI Cloud will remain suspended until it can be safely restored. NEAR Protocol and other services are not affected, and the team stated that further updates will be provided within two hours.Previously, NEAR AI tweeted that it recently discovered unauthorized access to its internal systems and has suspended NEAR AI Cloud inference services as a precautionary measure to conduct an investigation. NEAR AI Cloud inference operates in hardware-isolated TEE to protect user prompt privacy.

The founder of Slow Fog, Yu Xian, posted on the X platform stating that iOS has released a security update again, and the security of the iPhone is not as good as before, with various malicious exploits emerging.He reminded users not to install apps or open unfamiliar websites casually, especially those involving adult content, and noted that such reminders were mainly aimed at Windows in the past.

The development team Sigma Prime of the Ethereum consensus client Lighthouse has released a high-priority security update and recommends node operators to complete the upgrade as soon as possible. The official statement indicates that specific details of the vulnerability will be disclosed after operators have had sufficient time to complete the upgrade.This update does not introduce any disruptive changes. Lighthouse is one of the mainstream clients of the Ethereum consensus layer, developed and maintained by the Sigma Prime team.

GreyNoise reported that the Alpine SSH password bypass vulnerability has been successfully exploited, and Previdian has also detected 20 exploitation attempts.

Binance's Chief Security Officer Jimmy Su stated during a fireside chat on Binance X Space that Binance is hiring external security experts to conduct a comprehensive independent review of the security incident that occurred on October 29, in order to verify the conclusions of the internal investigation and provide improvement suggestions.At the same time, Binance is collaborating with leading AI companies and security firms to establish a security research fund, focusing on researching security threats related to blockchain and AI. In the future, internal AI tools and development environments will be managed according to critical infrastructure standards.Regarding the previous security incident, Jimmy Su explained that the transaction authorization used by the attackers exists on-chain and does not go through the Binance withdrawal system. Therefore, suspending withdrawals cannot prevent the related funds from being transferred; it must be revoked through a new on-chain transaction.Due to Binance's hot wallet using multi-party computation (MPC) technology, there is no single private key that can be directly used to revoke authorization. The team needed to temporarily formulate a revocation process, which took several hours to control the situation.

During TOKEN2049 in Singapore, trader Frogman had two wallets stolen, totaling over 4 million dollars. Another attendee reported to the police regarding the "Don't Get Played" security side event. According to market news, hackers used counterfeit Wi-Fi to commit the crime, but no independent sources were provided.