US moves to seize $1.2 billion stolen from Binance and shuts North Korea's FaceStealer video-call scam

The stories

28 on this beat today.

Every story told the same way: what happened, who is involved, why it matters, how it works, the truth and the good news.

1. 01

   US moves to seize $1.2 billion stolen from Binance and shuts North Korea's FaceStealer video-call scam

   $1.2 billion

   of the crypto stolen from Binance, now under a US court order

   more than $2.7 billion has been frozen in all [1]

   $400 million

   taken by North Korea's FaceStealer video-call scam in 18 months

   the FBI seized more than 900 secretly recorded webcam videos [5]

   20,000

   wallets used to move the stolen Binance coins

   spread over 16 blockchains, Elliptic counts [6]

   What happened

   • The US Justice Department won court approval to seize or hold more than $1.2 billion stolen from Binance. [1]
   • Binance, the world's biggest crypto exchange, lost about $6.3 billion in a hack last month. [2]
   • Companies and investigators have frozen more than $2.7 billion of the stolen coins. [1] The court order covers $1.2 billion of that. [1]
   • The same day, the US Justice Department said it had seized the servers behind FaceStealer, a North Korean video-call scam. [3]
   • The department says FaceStealer took more than $400 million in crypto over 18 months. [3]
   • The hackers send meeting invites from accounts they took over from earlier victims. [3]
   • On the call, they play recorded clips of earlier victims the target knows, so friends seem to be there. [3]
   • Then the sound seems to fail, and a link offers to fix it. [4] The fix puts malware on the computer. [4]
   • The seized servers held more than 900 webcam videos the hackers had secretly recorded of victims. [1]
   • Each victim's video and contacts help fool the next target, so the pool of victims keeps growing, the FBI warns. [1]
   • The FBI blames the Binance theft on TraderTraitor, a North Korean hacking group. [5]
   • It ties FaceStealer to a separate North Korean group known as Sapphire Sleet. [3]
   • North Korea has denied it was behind the Binance hack. [4]
   • The FBI's Brett Leatherman says North Korea's government relies on crypto theft to fund its weapons programme. [5]
   • The hackers keep moving the coins through crypto bridges, mixers and exchanges to hide them, the US Justice Department says. [5]
   • Elliptic, a firm that traces crypto, counts more than 20,000 wallets on 16 blockchains used since the theft. [6]
   • It says about $3 billion still sits in wallets linked to the theft. [6]

   Who is involved

   • TraderTraitor a North Korean hacking group; the FBI blames it for the Binance theft
   • Sapphire Sleet a separate North Korean group; the FBI ties it to FaceStealer
   • US Justice Department the US government's law department; it won court approval to seize $1.2 billion of the Binance coins
   • FBI the US federal police; it seized FaceStealer's servers and blames North Korea for both schemes
   • Binance the world's biggest crypto exchange; it lost about $6.3 billion and promised users will not carry the loss

   How it unfolded

   Binance has promised that its users will not carry the losses. [7]

   1. Past 18 months FaceStealer takes more than $400 million in crypto [4]
   2. 29 Oct Binance loses more than $6 billion to hackers [3]
   3. 12 Nov US seizes FaceStealer servers and wins an order over $1.2 billion [1]

   Why it matters

   Tysen Duva, who runs the department's criminal division, says it halted "about half of this historic breach". [1]

   FaceStealer is now aimed at people who keep open-source code, free software that others build on. [3]

   This year it lured the keeper of a big JavaScript library into a fake Teams call. [1] The hackers then used the keeper's access to make poisoned add-ons. [1]

   How it works

   Lawyers call this civil forfeiture: the case is brought against the property itself, not against a person.

   The department froze the coins "before they got beyond law enforcement reach". [1] Then a judge usually decides who rightfully owns them. [2]

   Seen it before

   A lost wallet handed in to the police waits at the station until its real owner proves it is theirs.

   Why the court case is against the stolen coins, not the thieves

   Lawyers call it civil forfeiture: when the owners are out of reach, a government takes the property itself to court, and a judge decides who owns it.

   The twist

   A court cannot try hackers who stay out of reach. It can still rule on the coins they left within reach, so part of a theft can be undone without one arrest.

   The picture

   Stolen$6.30 billion

   Frozen$2.70 billion

   Court order$1.20 billion

   Step by step

   1. 1 The thieves are out of reach
   2. 2 Their coins or servers can still be held
   3. 3 The state brings a case against the property
   4. 4 Anyone with a claim comes to court
   5. 5 A judge decides who owns it

   The same force, elsewhere today

   Where this chain is also running, in today's other stories.

   • Police take down three malware kits

     Police in 9 countries took 235 servers and 257 web addresses with no arrests, acting on the machines while the people behind them stayed free.

   • The FaceStealer servers

     The FBI used a warrant to take the scam's cloud servers and 900 webcam videos, the things it could reach, rather than the hackers themselves.

   • StealC, taken down a second time

     Police took StealC's servers in June, its makers rebuilt them, and German police say the rebuilt network led them to this week's seizure.

   Where you've seen this

   Ships in port

   courts have long held a ship itself when its owner is abroad, so a dispute is settled where the ship is

   Lost property

   police keep a found wallet until someone proves it is theirs

   Cash at a border

   customs can take undeclared cash, and the owner must go to court to claim it back

   The catch

   Taking the property does not stop the people: StealC's servers were seized in June, and its makers had a rebuilt network running by November.

   And the whole of it

   Binance's users, the people whose webcams were recorded and StealC's 40,000 victims did not choose the court that now decides their case. The hackers are inside it too, and the coins they still hold keep moving.

   The truth

   • What is really going on The US moved to seize $1.2 billion of the coins stolen from Binance. [1]
   • Why it works on people A seizure figure sounds like money handed back to victims, but a judge still has to decide who owns it. [2]
   • An FBI agent told The Record it is unclear whether FaceStealer was used to break into Binance. [5]
   • Who gains Binance — It promised to cover users' losses, so any seized coins a judge hands back would cut its bill. [7]
   • Who pays Open-source maintainers — FaceStealer now aims at them for their access to code others install, so one fake call can poison many projects. [3]
   • Nobody knows yet

     Who will get the seized $1.2 billion, and when.

     In a forfeiture case a judge decides who has a rightful claim, and the US has only now won the order to seize the coins. [2][1]

   • Nobody knows yet

     How many people FaceStealer fooled.

     The BBC reports more than 900 victims, while the 900 the FBI counted were webcam videos it seized, and the FBI has not found the first victim. [4][5]

   Good news

   • A US court approved seizing more than $1.2 billion of the crypto stolen from Binance, and more than $2.7 billion of it is frozen.

   What comes next

   The department says tracing, freezing and seizing the rest of the coins is still going on. [5]

1. 02

   Police take down three malware kits

   What happened

   • Police in 9 countries seized 235 servers and 257 web addresses used by three malware kits, Europol said on Thursday. [8]
   • Gootloader alone infected at least 25,000 computers and caused about $28.8 million in losses since 2018, US prosecutors say. [8]
   • The servers held about 6.4 million stolen logins from more than 40,000 victims. [19]
   • No arrests or charges came with the action, The Record reports. [19]

   Servers235

   Domains257

   Who is involved

   The kits were Gootloader, StealC and CastleRAT, which get attackers in, steal passwords or control computers remotely. [18]

   • Gootloader gets attackers in
   • StealC steals passwords
   • CastleRAT remote control

   How it unfolded

   The raid is part of Operation Endgame, a police campaign since 2024 against tools sold to cybercriminals. [8]

   Why it matters

   The stolen logins were for sale, to be used later in ransomware attacks, Europol said. [18]

   How it works

   Criminologists call this crime as a service: one group builds the tool, and many others rent it.

   Police went after these kits because one group builds and maintains them while others rent them for break-ins and fraud. [8]

   Seen it before

   When the only shop that rents out party costumes shuts, every party in town has to find another.

   Police in 9 countries took 235 servers and 257 web addresses with no arrests, acting on the machines while the people behind them stayed free.

   The idea, in story 01: Why the court case is against the stolen coins, not the thieves →

   The truth

   • What is really going on Police in 9 countries took 235 criminal servers, with no arrests. [19]
   • StealC was taken down in June too, and its makers rebuilt it before this week's seizure. [19]
   • Who gains People whose logins StealC stole — Police will pass the seized logins to checking sites, so victims can be told. [18]

   Good news

   • Victims can check whether their logins were taken on Have I Been Pwned, a free checking site. [18]
2. 03

   Stolen GitHub logins plant a password stealer

   What happened

   • An attacker used stolen logins for 4,837 accounts on GitHub, the code-sharing site, to plant a password stealer. [9]
   • The attack began on 10 November, Aikido Security says. [20]
   • Test requests went to 61,764 code projects, and the stealer ran in at least 1,806 of them. [9]
   • 92% of the test requests are still open, which suggests the owners did not notice. [20]

   Who is involved

   Hijacked accounts include ones at the US General Services Administration, the French government and Nextcloud. [20]

   • US General Services Administration accounts hijacked
   • French government accounts hijacked

   Why it matters

   The stealer hunted for keys to Amazon, Microsoft and Google cloud accounts and to AI services. [20]

   About 50 of the hacked accounts appear able to publish packages that other developers install, Aikido says. [20]

   How it works

   Security engineers call this a supply-chain attack: poisoning code that many other people then pull in.

   The attacker used no bug in GitHub Actions, the site's automation tool, but real logins. [21] So it could change any project those accounts could write to. [9]

   Seen it before

   Someone with a copied school key can open every room that key was cut for.

   The truth

   • SafeDep, another firm, counted 8,093 projects with bad changes. [21] Not all of them necessarily ran the stealer. [21]
   • Nobody knows yet

     How the GitHub attacker got 4,837 logins.

     StepSecurity traced some to tokens from the Fly.io app but could not say how they were obtained. [21]

3. 04

   ScreenConnect break-ins traced to a blank key

   What happened

   • Huntress traced attacks on 288 computers at 48 organisations to a ScreenConnect add-on called RMM+. [22]
   • Two versions of RMM+ accepted a blank key when nobody had set one. [22]
   • That could let attackers send commands without passing ScreenConnect's normal logins or its second login check. [24]
   • ConnectWise, which makes ScreenConnect, switched the add-on off in about 400 customer setups. [25]
   • The malware, called SCKit, was built to spread to IT staff who connected to infected machines. [23] Researchers have not seen that step succeed. [23]

   Who is involved

   ScreenConnect is a tool IT firms use to manage and fix their clients' computers from afar. [23]

   Why it matters

   Each IT firm manages many clients, so a few weak setups reached 48 organisations within 90 minutes. [23]

   How it works

   Security engineers call this an insecure default: what a setting does when nobody ever sets it.

   Most RMM+ installs were added for a project and left in place, Huntress said. [22] Left unset, the key stayed blank. [22]

   Seen it before

   A new padlock that opens with no code, until someone sets one, is open to anyone who tries.

   The truth

   • What is really going on The day's break-ins came through things people already trusted: real GitHub logins, a ScreenConnect add-on that accepted a blank key, and fake IT calls to law firms. [21][22][10]
   • ConnectWise warns that switching the add-on off may not remove software the attackers already installed. [25]
   • Who pays Clients of IT service firms — Their computers were reached through an add-on installed in their IT firms' ScreenConnect setups. [24]
   • Nobody knows yet

     Whether more IT firms were broken into through ScreenConnect.

     Huntress says the attackers seemed to number victims in order, pointing to earlier attacks it did not see. [24]

4. 05

   New N-able flaw used within hours

   What happened

   • Attackers began using a new flaw in N-able's N-central hours after a researcher posted code for it on 12 November. [12]
   • Previdian, a security firm, saw the first probes on its trap server at about 08:30 UTC. [12]
   • Researchers counted at least 21 hacked servers, and 19 were running N-able's newest fix. [12]
   • The attackers installed programs that use the servers to make cryptocurrency. [12]

   Who is involved

   N-central is software IT firms use to watch and manage their clients' computers. [12]

   How it unfolded

   The researcher, Sean Bales, posted more than 30 N-central flaws last weekend without warning N-able first. [26]

   1. 12 Nov attack code posted
   2. 08:30 UTC first probes seen

   Why it matters

   A second exploit is claimed to work on N-central's agents, the part installed on each managed Windows computer. [12]

   How it works

   Security people call this time to exploit: how long attackers need once attack code is public.

   Here the code worked on servers with N-able's 10 November fix, so updating did not close it. [12]

   Seen it before

   Once someone posts a photo of a door key online, copies can be cut that same afternoon.

   The truth

   • N-able said it had seen no break-ins using the new flaws, while researchers report real ones. [12]
   • Who gains Crypto-mining gangs — Public attack code let them take over N-central servers even where owners had installed the latest fix. [12]
5. 06

   Apache fixes a serious web server flaw

   What happened

   • Apache released a fix on 11 November for a critical flaw in its HTTP Server. [15]
   • The flaw lets an attacker with no login run code on servers that have HTTP/2 turned on. [28]
   • HTTP/2 is one way for servers and browsers to talk, and it is off unless an admin turns it on. [28]
   • Wiz, a cloud security firm, found affected versions in 64% of the cloud setups it can see. [15]

   Who is involved

   Apache HTTP Server is free software that runs roughly one in five websites. [27]

   How it unfolded

   Anthropic's code scanner reported it on 26 October, and Google researchers found it again on 3 November. [15]

   1. 26 Oct Anthropic reports it
   2. 3 Nov Google reports it
   3. 11 Nov fix released

   Why it matters

   A web server faces the whole internet, so anyone who can reach one could try the flaw. [28]

   How it works

   Programmers call this kind of bug a race condition: two jobs change the same memory at the same time.

   In Apache, threads handling HTTP/2 traffic can touch shared memory together and corrupt it. [15]

   Seen it before

   Two people writing on one whiteboard at the same moment scribble over each other's words.

   The truth

   • Red Hat says public research shows a reliable exploit, but Wiz says none is available. [28]
   • Nobody knows yet

     How many Apache servers can really be attacked.

     Wiz's count of affected versions ignores whether HTTP/2 is switched on, and it is off by default. [27]

6. 07

   Hacked phone networks used to spy on Taiwan

   What happened

   • A state-level group used hacked mobile networks in Asia to intercept calls and texts, mostly of people in Taiwan. [29]
   • SilentAir attacked from hijacked equipment at phone operators in at least 6 Asian countries. [29]
   • For some targets, their login codes arrived moments after the spying on their phone began. [29]
   • Most of its other activity was silent texts, which never show up on the phone. [29]

   Who is involved

   Enea, a firm that makes telecom security software, named the group SilentAir and has watched it since early 2025. [29]

   • Enea telecom security firm
   • SilentAir the group it tracks

   Why it matters

   Enea says the timing of the codes points to an aim of breaking into victims' other accounts. [29]

   How it works

   Telecom security calls this a signalling attack: abusing the messages phone networks send each other to route calls.

   SilentAir sent those network messages from hijacked equipment inside real operators. [29]

   Seen it before

   A fake note handed in through the school office gets believed, because it came through the office.

   The truth

   • Enea links SilentAir to China with low confidence, from its Taiwan focus and China-hours working pattern. [29]
   • Who pays People targeted in Taiwan — Political and government figures were among those whose calls and texts were targeted. [29]

   Good news

   • Enea says it alerted the operators hosting SilentAir, and both groups it tracked have been set back for now. [29]
7. 08

   Romania says it stopped Russian email spies

   What happened

   • Romania's intelligence service says it stopped a Russian state hacking attack on a government body's email. [30]
   • The service, called SRI, says it found the break-in in December 2025 and restored the email system. [30]
   • The SRI says no sensitive data was taken out. [30]

   Who is involved

   It blamed Turla, a spy group linked to Russia's FSB security service. [30]

   • Turla spy group linked to Russia's FSB

   How it unfolded

   Earlier this week ESET, a Slovak security firm, said Turla's tool Cereal picked out emails with NATO and the EU. [30]

   1. Dec 2025 break-in found
   2. This week made public

   Why it matters

   Romania borders Ukraine, and its then defence minister warned this year of thousands of attempted attacks a day. [30]

   How it works

   Spy agencies call this counterintelligence: finding and stopping another country's spies.

   The SRI says Turla used flaws in Microsoft systems, and its specialists contained the attack. [30]

   Seen it before

   A shop guard who catches a thief in the aisle stops the loss before the thief reaches the door.

   The truth

   • Nobody knows yet

     How Turla first got into Romania's government email.

     The SRI did not name the Romanian body or say how the hackers got in. [30]

   Good news

   • Romania's intelligence service found Russian spies inside a government email system, shut them out and restored the service, and it says no sensitive data left.
8. 09

   Windows flaw posted with no fix yet

   What happened

   • A researcher posted code for a Windows flaw that gives an attacker top control of a PC. [31]
   • Microsoft has not confirmed the flaw or released a fix, The Hacker News reports. [13]
   • The attack needs someone already logged in to the computer, then lifts them to the top level. [13]
   • He estimates that 80% of Windows installations are open to it. [31]

   Who is involved

   The researcher, Abdelhamid Naceri, says he is a former Microsoft employee. [31]

   • Abdelhamid Naceri researcher, ex-Microsoft

   Why it matters

   He says it can switch off any antivirus, because the request looks like it comes from the antivirus itself. [31]

   How it works

   Security engineers call this privilege escalation: turning a small foothold into full control.

   SignDrop abuses a safety check Microsoft added in October 2025 to CLFS, a Windows logging system. [31]

   Seen it before

   A new lock on the staff room helps nobody if a pupil can talk a teacher into opening it.

   The truth

   • Naceri says there is no safe workaround, because turning the check off reopens older flaws. [31]
9. 10

   Old Exchange email servers get no more fixes

   What happened

   • Microsoft told users of its Exchange 2016 and 2019 email servers to treat them as "permanently vulnerable". [14]
   • Its November fixes came only for the newest edition, Exchange Server SE. [14]
   • The November update fixed 9 flaws in Exchange SE, including a critical one. [14]

   How it unfolded

   Support ended on 14 October 2025, and paid fixes ran until 13 October 2026. [14]

   1. 14 Oct 2025 support ends
   2. 13 Oct 2026 last paid fixes

   Why it matters

   Any new flaw found in the old versions now stays open on every server still running them. [14]

   How it works

   Software makers call this end of life: the date after which a product gets no more fixes.

   Microsoft no longer even tests the old versions for flaws, so it will not look for the next one. [14]

   Seen it before

   A phone that no longer gets updates keeps working, but every new bug found in it stays there.

   The truth

   • Who pays Organisations still on Exchange 2016 and 2019 — They must move to the newer subscription edition, or run email in which new flaws stay open. [14]
10. 11

    Extortion gang goes back to law firms

    What happened

    • Luna Moth, a gang that steals data and demands payment, is going back to law firms it hit before. [10]
    • This time it sends a broken PDF, then calls pretending to be IT support offering to fix it. [10]
    • On a screen-share call, it talks the worker into copying a Microsoft login token and pasting it online. [10]
    • The gang then uses the token to download the firm's files. [10]

    Who is involved

    ReliaQuest, a security firm, says these are likely the firms that did not pay the first demand. [10]

    • ReliaQuest security firm that tracked it

    How it unfolded

    The gang has targeted law firms since at least mid-2023, Dark Reading reports. [10]

    Why it matters

    Law firms hold very sensitive client files, so a leak hurts them badly, ReliaQuest says. [10]

    How it works

    Security people call a login token a bearer credential: whoever holds it is let in.

    The worker has already passed the two-step login check, so the copied token works without it. [10]

    Seen it before

    A concert wristband works for whoever wears it, not only the person who bought the ticket.

    The truth

    • The attack needs no malware and no software flaw, only a person tricked into helping. [10]
    • Who pays Law firms' clients — Their confidential files are what Luna Moth threatens to leak to make firms pay. [10]
11. 12

    Brazil's biggest port recovers from ransomware

    What happened

    • A ransomware attack hit Brazil's Santos Port Authority, one of South America's largest ports, on 6 November. [32]
    • The attack caused a power outage and long delays in loading and unloading cargo. [32]
    • Staff had to plan routes and send bills by hand. [32]
    • By Thursday the port said it had brought back about 70% of its systems from backups. [32]
    • Brazil's Federal Police are investigating. [32]

    Why it matters

    Ports in the US, Europe and Asia have been targeted by ransomware again and again over five years. [32]

    How it works

    Incident responders call this recovery from backup: rebuilding from copies the attackers did not lock.

    Santos had backups, so it could bring 70% of its systems back from them. [32]

    Seen it before

    A copy of homework saved on a memory stick means a broken laptop is not a fresh start.

    Good news

    • Santos, one of South America's biggest ports, had about 70% of its systems back from backups within a week of a ransomware attack.
12. 13

    Apify resets keys after a break-in

    What happened

    • Apify, a Czech firm, says intruders got into its internal systems on 9 and 10 November. [33]
    • It spotted the intrusion the next day and cut the attacker off. [33]
    • It changed its internal passwords, reset customers' access keys and logged everyone out. [33]
    • It also asked some customers to reset their two-step login setup, as their codes may have been exposed. [33]

    Who is involved

    Apify sells tools that collect data from websites, and reports 80,000 customers. [33]

    How it unfolded

    1. 9 and 10 Nov intruder inside
    2. Next day found and cut off

    Why it matters

    Apify's customers include Microsoft, Samsung, Siemens and the European Commission. [33]

    How it works

    Security teams call this rotating secrets: replacing every key an intruder might have seen.

    Apify replaced its key passwords and customers' access keys, so any copies the intruder took stop working. [33]

    Seen it before

    Changing the locks after losing your keys means the lost keys open nothing.

    The truth

    • The only account of what was reached comes from Apify, which says it found no sign account data was hit. [33]
13. 14

    Hackers keep a quiet way back into Linux servers

    What happened

    • Several attack groups are planting GSocket, a free remote-access tool, on Linux servers, Microsoft says. [34]
    • It lets them come back even after the flaw they used to get in is fixed. [34]
    • Microsoft saw GSocket detections rise 356.2% between March and August. [34]
    • Most cases involved websites and web hosting, often sites built with PHP. [34]

    Why it matters

    Fixing the hole is not enough, because the attackers have already left their own way back in. [34]

    How it works

    Incident responders call this persistence: a way back in that survives the first repair.

    The hacked server and the attacker both connect out to a public relay, so blocking incoming traffic misses it. [34]

    Seen it before

    A friend who climbs in through a window you never lock does not need the front door.

14. 15

    Red Hat warns of a flaw in its code store

    What happened

    • Red Hat warned of a critical flaw in Quay, its system for storing packaged software called container images. [35]
    • The flaw is rated 9.8 out of 10. [35]
    • An attacker can install their own signing key and make passes to read or change any stored image. [35]
    • Red Hat says turning off anonymous access does not help, since any valid account can still use it. [35]

    Why it matters

    Other systems download those images, so a changed one can carry the attacker's code into them. [35]

    How it works

    Cryptographers call it a signing key: the secret that proves a pass came from the real system.

    With their own key installed, the attacker's passes look as real as the system's own. [35]

    Seen it before

    If someone can add their own stamp at the school office, their fake notes look official.

15. 16

    Chrome and Firefox fix more than 180 flaws

    What happened

    • Google and Mozilla released Chrome and Firefox updates fixing more than 180 security flaws. [17]
    • Chrome's update fixes 83, including 5 rated critical. [17] Firefox 160 fixes 99. [17]
    • Firefox 160's fixes include 57 rated high severity, and Mozilla patched Thunderbird, its email program, too. [17]
    • Neither company says any of the flaws has been used in attacks. [17]

    Chrome83 flaws

    Firefox99 flaws

    Why it matters

    Researchers at Anthropic and OpenAI reported 18 of Chrome's flaws, and Google found 52 itself. [17]

    How it works

    Programmers call the commonest bug here use-after-free: a program keeps using memory it already gave back.

    Chrome's update fixed 24 bugs of that kind, more than any other type. [17]

    Seen it before

    Sitting at a cafe table that has just been given to someone else means your things get mixed with theirs.

16. 17

    Lego's BrickLink shop offline for a week

    What happened

    • BrickLink, Lego's online market for spare bricks and figures, has been offline since 6 November. [36]
    • Lego says it found "unusual activity" and is investigating how it happened. [37]
    • It first called the outage necessary work and promised a return on 9 November. [36]

    How it unfolded

    Lego bought BrickLink in 2019, and the site went offline for days after a suspected attack in 2023. [37]

    1. 6 Nov site goes offline
    2. 9 Nov promised return passes
    3. 2019 Lego buys BrickLink
    4. 2023 offline after a suspected attack

    Why it matters

    Buyers and sellers cannot trade spare parts while it is down. [36]

    How it works

    Incident responders call this containment: cutting a system off so a problem cannot spread while it is studied.

    Lego says it took the site down to secure it and check for related issues before reopening. [37]

    Seen it before

    A pool closes after something is spotted in the water, and stays shut until the water is tested.

    The truth

    • Who pays BrickLink's sellers — They cannot sell parts while Lego keeps the site closed. [36]
    • Nobody knows yet

      What happened to BrickLink.

      Lego has not said whether it was a cyberattack or what was reached, and did not immediately answer The Register. [36]

17. 18

    Groups oppose slipping a spy law into a defence bill

    What happened

    • 27 civil liberties groups asked the US Congress not to renew a lapsed spying law inside the yearly defence bill. [38]
    • It lapsed this summer, but a court has allowed the searches to continue until March. [38]

    Who is involved

    The law, Section 702, lets US agencies search Americans' messages with foreign targets without a warrant. [38]

    How it unfolded

    In 2023 the US Congress renewed it for a short time the same way, through the defence bill. [38]

    1. Summer law lapses
    2. March court's permission runs out

    Why it matters

    The groups want a warrant required before agencies search Americans' messages. [38]

    How it works

    Political scientists call this a must-pass bill: a disputed measure rides on a bill lawmakers cannot vote down.

    The groups say it would force lawmakers to choose between the defence bill and ending warrantless spying. [38]

    Seen it before

    Hiding a vegetable in a pizza gets it eaten, because nobody turns down the pizza.

18. 19

    Police tool tracks phones through ordinary apps

    What happened

    • Webloc, a tool sold to police by Penlink, locates people using data from weather, gaming, email and religious apps. [39]
    • It can show where a phone has been over the past 12 months, updated every hour. [39]
    • Officers can pick a place and time on a map and see every phone that was there. [39]

    How it unfolded

    Bloomberg reported the details from company documents, writes Bruce Schneier, a security expert. [39]

    Why it matters

    Anyone with a weather or gaming app sharing location can show up in Webloc's map. [39]

    How it works

    Privacy researchers call this location data brokering: data collected for one use is sold on for another.

    The location data leaves the phone through everyday apps, then ends up in a police tool. [39]

    Seen it before

    A photo posted for friends can be saved and passed on to people you never chose.

19. 20

    AI finds 99 flaws in 90 hours

    What happened

    • Forescout, a security firm, says an AI tool found 99 flaws in network code for smart devices in 90 hours. [16]
    • It estimates the same work would have taken people about 9 months. [16]
    • The code runs in things like street lights and safety-critical devices. [16]
    • 66 of the flaws were new, and 24 have been fixed so far. [16]
    • The AI work cost $1,200 to $2,300, about a hundredth of an expert's salary, Forescout says. [16]

    90 hoursWith AI

    vsvs

    9 monthsBy hand

    Why it matters

    7 flaws were in an unsupported access point, so no maker will fix them. [16]

    How it works

    Programmers call this static analysis: reading code for risky patterns without running it.

    Forescout's AI was good at memory bugs that match a pattern, but missed most logic mistakes. [16]

    Seen it before

    A spell-checker catches typos fast, but cannot tell you your essay argues the wrong point.

    The truth

    • Forescout ran the work on Claude models made by Anthropic, and the time and cost figures are its own estimates. [16]

    Good news

    • Maintainers have fixed 24 of the 66 new flaws an AI tool found in code that runs street lights and safety-critical machines.
20. 21

    OpenAI sells AI tools to test and fix code

    What happened

    • OpenAI launched two security products on Thursday: one tests websites for flaws, the other writes fixes. [40]
    • Daybreak Red Team uses AI agents to probe companies' web apps for weak spots. [40]
    • Daybreak Defense Factory scans code, finds flaws and drafts patches that engineers approve. [40]
    • Greg Brockman, OpenAI's president, said companies will be secure only to the extent of the frontier model they defend with. [40]

    Why it matters

    The same day, nonprofits sued in San Francisco to stop AI firms building more capable models. [40]

    How it works

    Security teams call this penetration testing: attacking your own systems on purpose to find weak spots first.

    OpenAI's agents read a firm's own code and test the paths an attacker could take. [40]

    Seen it before

    A fire drill tests the exits before a real fire does.

    The truth

    • Brockman's warning came from a company selling those very tools, at its own launch. [40]
    • Who gains OpenAI — Its president's warning that firms are safe only with frontier AI points buyers to the tools it launched the same day. [40]
21. 22

    Microsoft security chief asks for Artex rules

    What happened

    • Microsoft's security chief, Igor Tsyganskiy, urged governments to regulate Artex, a free AI hacking tool. [41]
    • Tsyganskiy wrote that its use "is spreading like fire" across the internet. [41]
    • He asked lawmakers to limit the release of such tools, especially as free code anyone can copy. [41]

    How it unfolded

    Artex was released in July as a tool for testing defences, then linked to major attacks within months. [41]

    1. July released for testing
    2. Within months linked to attacks

    Why it matters

    Some experts told TechTarget that rules would hurt defenders and do little to stop attackers. [41]

22. 23

    eMudhra blames a script for its weak keys

    What happened

    • eMudhra, an Indian firm that issued website security certificates, blamed a faulty script for its weak keys. [42]
    • Some of its keys were as weak as the number 4, The Register reports. [43]
    • eMudhra says a script cut its keys short while moving them between machines. [42] The Register says 47 of 48 bytes appear lost. [42]
    • A developer, Daniel Vratil, used the weak keys to block ads on his Samsung smart TV. [43]

    How it unfolded

    It needed the script because supply problems kept it from buying the key machines it wanted. [42]

    Why it matters

    Anyone can forge an eMudhra certificate to fake a website on devices that still trust it. [43]

    How it works

    Cryptographers call this key strength: a key is safe only if there are far too many to try.

    eMudhra's keys came out as small numbers of two or three digits, easy to guess. [43]

    Seen it before

    A bike lock with a one-digit code opens for anyone who tries every number.

    The truth

    • eMudhra's account comes from its own post, which says the script ran only on one isolated computer. [42]
23. 24

    Weak passwords open SQL databases to miners

    What happened

    • Attackers are breaking into online Microsoft SQL Server databases that use weak passwords, FortiGuard Labs says. [11]
    • A tool tried user names like "sa" and "admin" against more than 2,700 passwords on each server. [11]
    • Once in, they installed a program that mines Monero, a cryptocurrency, and a remote-control tool, Gh0st RAT. [11]
    • The miner was named to look like a Microsoft Edge update. [11]

    Why it matters

    The miner uses the victim's own processor, and the remote tool lets attackers come back. [11]

    How it works

    Security people call this brute force: trying password after password until one works.

    The scanner found servers on SQL Server's default port, then tried thousands of passwords on each. [11]

    Seen it before

    Trying every key on a huge ring will open any lock that uses a common key.

    The truth

    • Nobody knows yet

      Who is breaking into SQL Server databases, and how many.

      FortiGuard's report did not say how many servers were hit or who was behind it. [11]

24. 25

    UK starts realistic test attacks for key services

    What happened

    • The UK's National Cyber Security Centre launched a scheme of realistic test attacks for critical services. [44]
    • Critical service providers pick testers from a vetted list, who plan attacks from the firm's real systems. [44]

    How it unfolded

    The scheme, called CyAS, was first shown at the CYBERUK conference in 2025. [44]

    Why it matters

    Ollie Whitehouse, the centre's technology chief, said it helps protect essential services the UK relies on. [44]

    How it works

    Security teams call this red teaming: a friendly team plays the attacker to find weak spots first.

    The testers act like real attackers instead of following a fixed list of known tricks. [44]

    Seen it before

    A coach who plays for the other side in practice shows where the defence will break.

25. 26

    London hotel wrote its booking login on a whiteboard

    What happened

    • A London hotel wrote its Booking.com admin username and password on a whiteboard behind the front desk. [45]
    • A guest, Neycho Tepavicharov, saw it through an open door and warned the manager. [45]
    • He says the login could change bookings, show guests' details or send fake messages as the hotel. [45]

    Who is involved

    • Neycho Tepavicharov guest who spotted it

    Why it matters

    Fake "please confirm your payment" messages from hacked hotel accounts are a known scam, he said. [45]

    How it works

    Security people call this shoulder surfing: reading a secret just by looking at it.

    Anyone passing the desk could photograph the board and log in later from anywhere. [45]

    Seen it before

    Writing your locker code on the locker door means the lock stops only people who do not look.

    The truth

    • Whether the password alone was enough depends on the account's other security settings, The Register notes. [45]
26. 27

    European buyers pick more European security firms

    What happened

    • Sales of security products from EU-based firms rose 35% in two years, Context, a market data firm, says. [46]
    • Total security sales grew 10% over the same period, and US firms' sales grew 8%. [46]
    • EU firms now have 15% of tracked sales, against 62% for US firms. [46]

    Why it matters

    Context says firms are reviewing their tech suppliers because of EU security laws, NIS2 and DORA. [46]

    The truth

    • The Register ties it to lost trust in the Trump administration, but Context stopped short of saying so. [46]
    • Who gains European security firms — EU laws make companies review their tech suppliers, which sends buyers towards local firms. [46]
27. 28

    Daylight raises $80 million for AI security

    What happened

    • Daylight, an Israeli-American security start-up, raised $80 million, bringing its total to $120 million. [47]
    • The round was led by Goldman Sachs Alternatives' Growth Equity. [47]
    • Its platform, Aura, uses AI agents with human experts to find and contain attacks. [47]

    How it unfolded

    Daylight was founded in 2024 and is based in New York and Tel Aviv. [47]

    Why it matters

    Daylight also sells protection against AI tools inside companies being turned against them. [47]