mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity

thehackernews.com Nov 3, 2026

mSecure Warns Users to Change Passwords, Reset 2FA and Passkeys After Suspicious Activity

Curated by Shubham · TechCapsules · Nov 3, 2026

AI-summarised brief · reviewed before publication

mSecure, a password‑manager developed by mSeven Software, sent an email on Nov. 3 urging all current and former users to change passwords, reset two‑factor authentication and delete stored passkeys after the company detected “suspicious activity” linked to the app. The notice provides no details about the nature of the activity, when it occurred, which systems were affected, or whether any vault data was compromised. mSeven said it has launched an investigation, taken containment steps and hired external cybersecurity experts, but has not posted any comment on its X or Facebook accounts and staff have not responded in the support forum where a customer shared the email. The app encrypts vault data on the device before syncing to cloud services, per prior analysis.

💡 Why It Matters

· The vague alert forces millions of password‑manager users to scramble for security measures, exposing how limited transparency can erode trust in tools meant to protect digital identities.

Capsules Cybersecurity

Read full article on thehackernews.com

Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to…

Binance disclosed that a $6.43 billion theft from its platform resulted from a coordinated, multi‑stage attack that began with a trojanized Homebrew installer used by a Wallet DevOps engineer in June 2026. The malware installed a malicious AI tool, exposing internal credentials. In September, attackers posed as a recruiter on a job‑hunting site, conducted fake interviews with a second engineer, and delivered a poisoned code repository that compromised his workstation. By October, the threat actors leveraged the compromised machines and an internal AI tool to hijack a container deployment token, gain control of additional engineers, and access the wallet‑signing service, enabling unauthorized transactions. Binance has since rebuilt the affected wallet system, hardened device and AI controls, and expanded AI‑driven anomaly detection.

💡 The breach shows how social‑engineering via fake recruitment can infiltrate even highly secured crypto exchanges, turning internal developer tools into a conduit for massive fund loss.

thehackernews.com · Nov 2

Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts

Cybersecurity firm Palo Alto Networks’ Unit 42 tracked a cyber‑espionage campaign against government‑linked Linux servers from October 2025 to April 2026, labeling it CL‑UNK‑1211. Researchers said the attackers used large‑language‑model‑generated PHP and shell scripts, as well as a custom Go‑based remote‑access trojan named SysGoRAT, to gain persistent, multi‑platform access. The malware establishes a WebSocket C2 link to 104.194.158.65:443, disables endpoint defenses, wipes logs and plants fake red‑team markers. Operators exfiltrated database dumps, government mailboxes and social‑media‑related emails, employing in‑memory reverse shells and scripts that enumerate mail directories. The playbook blends open‑source tools, bespoke web shells and AI‑crafted code, allowing rapid adaptation while minimizing manual effort. The campaign also attempted to compress targeted emails with a faulty zip_mails.sh script, illustrating the nature of tooling.

💡 Automating exploit development with LLMs lets adversaries scale attacks on Linux infrastructure that was previously less targeted, reshaping defensive priorities.

thehackernews.com · Nov 2

Is Your SOC Ready for AI Agents? A Maturity Check Before You…

Prophet Security’s 2026 State of AI in Security Operations survey of over 250 CISOs and SOC leaders shows 40 % of security teams use AI daily and 56 % are testing it, with only 4 % planning no adoption. The report outlines a two‑part readiness checklist for deploying AI agents in Security Operations Centers: identifying alert‑handling problems the agents can solve, and ensuring the SOC has the necessary data access, context, written investigation standards, and oversight rules. Technical readiness spans four areas—access and context, baseline metrics, operational rules, and a plan for reclaimed analyst time. The SOC Hierarchy of Needs model emphasizes that most teams struggle at the alert‑management level, where AI agents can immediately improve investigation speed and free analysts for detection, hunting, and posture work. The survey highlights common gaps such as limited tool access, data‑privacy concerns, undocumented investigation standards, and disabled detections, urging a pilot that maps required queries and establishes metrics like investigation share and mean time to investigate.

💡 Without addressing these foundational gaps, AI agents cannot deliver their promised efficiency gains, leaving under‑investigated alerts and wasted analyst capacity.

techcrunch.com · Nov 1

Binance resumes withdrawals following $6.3 billion breach

Binance announced it would resume withdrawals in a phased manner after a $6.3 billion hack that froze all deposits and withdrawals. The exchange reported covering 95 % of the stolen assets and is still sourcing the remaining, less liquid holdings. Binance confirmed it would absorb the financial loss and not pass it on to users. Withdrawals will restart gradually, with Bitcoin and Ethereum services partially suspended, and users may experience delays. The company will publish a detailed incident report post‑investigation.

💡 The swift restoration of withdrawals signals Binance’s resilience and commitment to user trust amid a massive security breach. It also underscores the broader industry challenge of safeguarding digital assets against sophisticated cyber threats.

thehackernews.com · Nov 1

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

Kaspersky researchers have uncovered a sophisticated infection chain that targets a custom Windows 10 build used exclusively by Asian government agencies. The campaign deploys an undocumented .NET assembly‑loading framework, dubbed NetamLoader, delivered inside a Windows cabinet (CAB) archive placed in the system’s SoftwareDistribution folder. The archive contains a “.config” file that leverages AppDomainManager injection to load arbitrary .NET assemblies, effectively sideloading malicious code into legitimate processes. Four of the seven files in the archive belong to Patch My PC, an endpoint‑management tool, while only “Resources.resx” carries malicious payloads. The operation appears to be a supply‑chain attack, though the exact delivery method remains unknown. Kaspersky detected the artifact in early 2026 and identified a single victim, likely in China, where the targeted Windows 10 China Government Edition is in use.

💡 It demonstrates that even highly curated, government‑only operating systems are vulnerable to novel .NET injection techniques, exposing critical state infrastructure to covert compromise.

thehackernews.com · Nov 1

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

On October 29, malicious code injected into Polymarket’s website hijacked a third‑party DebugBear page‑speed script and used signed‑in traders’ credentials to transfer their positions and funds to a hacker‑controlled wallet. The attack moved roughly $2.64 million worth of POL tokens from 33 wallets in under an hour, after which the funds were quickly split among three addresses. Polymarket identified the breach, removed the compromised script within an hour, cleared caches, reset sessions and paused trading. The company is refunding about $2.7 million to 726 affected wallets and an additional $1.19 million to roughly 5,500 users impacted by the trading pause, totaling $3.9 million in reimbursements. DebugBear confirmed its DNS was compromised but its own systems remain intact. The incident underscores risks of third‑party scripts.

💡 Exploiting a trusted monitoring script let attackers bypass user authentication, exposing a systemic vulnerability in how crypto platforms rely on external code.