CyberheistNews Vol 16 #44 | November 3rd, 2026
Treat Every Engineer’s Workstation Like a $6 Billion Vault
Binance says attackers stole approximately $6.3 billion after compromising a DevOps engineer's workstation. They reached a service container and started an avalanche of unauthorized withdrawals. Roughly $3 billion was quickly blocked, but just under $3 billion went to North Korean-owned wallets. Cha-ching!
The company subsequently discovered additional breach points, so the complete attack chain is not yet known. But a hacked engineer's workstation immediately raises the most likely question: Was the engineer a social engineering victim?
That has not yet been confirmed. The initial access could have involved an unpatched vulnerability, stolen credentials, a malicious software update, or an insider. However, security experts believe social engineering may have played a role, which fits the modern playbook.
Attackers increasingly impersonate recruiters, vendors, coworkers, and tech support personnel to reach the people with the most valuable access. They do not start by attacking the vault. They attack someone who can open it.
A DevOps engineer is not merely another employee. Their workstation may connect to cloud infrastructure, source code, deployment pipelines, secrets, and prod systems. Compromise that machine, and the attacker may inherit the engineer's authority.
The lesson is not simply "train your developers." Organizations must combine frequent social-engineering exercises with additional layers like phishing resistant MFA, privileged access workstations, short-lived credentials, application allowlisting, and transaction approvals that cannot be bypassed from one compromised device.
Every organization should ask one urgent question this week: "If an attacker took control of one engineer's workstation today, how much money, data and infra could they reach before anyone stopped them?"
More Tech Details at TRM Labs:
https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history?
Ridiculously Easy AI-Powered Security Awareness Training Reduces Risk by 87%
68% of breaches still involve a human element. Attackers now use AI to build hyper-personalized lures that can fool even your most security-conscious users, yet most people still get the same generic training that ignores their real risk.
Join this demo to see training that adapts to each user's actual risk and custom content you can build in minutes instead of months.
In this demo, you'll see how to:
- Change behavior with training tailored to each user's role, behavior, and risk level
- Track Risk Score shifts in a new console experience to instantly understand your risk and automatically trigger remediation before gaps can be exploited
- Create custom, policy-aligned content in minutes with generative AI to prepare your workforce for advanced threats like vishing, deepfakes and AI phishing
- Coach users the moment risky behavior happens, not weeks later
- Cut Phish-prone™ Percentage from 33.1% to 4.1% in one year, an 87% reduction in human risk
See how training that adapts in real time can close the gap generic training leaves open.
Date/Time: TOMORROW, Wednesday, Nov. 4, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/sat-demo-month2?partnerref=CHN2
Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters
Phishing attacks are increasingly using legitimate calendar invites to bypass security filters, according to researchers at Netcraft. Attackers send ICS calendar invite files that plant phishing lures directly on users' calendars, often under the guise of work-related meetings.
"When an invite is sent to a user, having the item penciled into their calendar helps identify conflicts when scheduling," the researchers write. "In this case, however, it allows attackers to go from the target's inbox to their calendar without user interaction.
"Ultimately, the lure's injection into the target's calendar is a normal and intended behavior of their email client. In many email clients, this allows the invite to persist in the target's calendar even after the original phishing email is deleted."
Notably, this technique has been incorporated into popular phishing kits, lowering the bar for unskilled threat actors to launch these attacks.
"Calendar invite abuse has been adopted as a delivery mechanism by widespread campaigns such as those using EvilTokens, a token-stealing phishing toolkit targeting Microsoft 365 accounts that was previously reported by Netcraft," the researchers write.
"This campaign often used ICS files as low- friction lures, attempting to bypass scrutiny, appearing directly in a user's calendar and remaining even if the original phishing email was deleted. Invites associated with this campaign are often disguised as meetings, alerts, or voicemail notifications.
"When users follow them, they are taken to an attacker- controlled page that gives them a device code and instructions to enter it into Microsoft's device authorization page."
Users need to maintain a healthy sense of suspicion and stay up to date on evolving social engineering tactics in order to thwart these attacks.
"Email-attached calendar invites are now so ubiquitous that the average user may barely scrutinize them," the researchers write. "In fast-paced, tech-reliant workplaces, new events appearing in the calendar without manual entry have become normalized.
"This combination of automatic behavior by email clients, users' normalized expectations that events simply appear and persistence even after the original email is deleted gives threat actors an easy route to the user's attention."
Blog post with links:
https://blog.knowbe4.com/warning-attackers-are-using-calendar-invite-files-to-evade-security-filters
[NEW REPORT] 2026 Phishing Threat Trends Report Vol. 8
As social engineering tactics become faster, more sophisticated, and harder to detect, staying ahead of cyber threats requires actionable intelligence. The newest volume of the Phishing Threat Trends Report reveals how attackers are using real platforms, login pages, and even AI tools to launch their campaigns.
Threat actors are bypassing MFA entirely through abuse of trusted platforms, while large language models such as Claude and ChatGPT are being turned into phishing hosts on their own trusted domains. Traditional secure email gateways are missing more than four in 10 of these attacks.
Explore how the phishing economy has industrialized in 2026 and dive into the trends in hijacking breaking news stories to send hyper-targeted phishing attacks.
Download now to discover:
- How a rented "phishing-as-a-service" economy now drives the majority of credential-theft attacks, and which three toolkits make up 90.2% of all kit-based phishing
- Why password resets and MFA re-enrollment no longer stop attackers who've moved to device-code and OAuth consent abuse
- What's driving a 5.4-times increase in cybercriminal newsjacking since 2022 and how a less-than-16-hour turnaround from headline to lure is possible
- How threat actors are hosting fake login pages and API-key harvesters directly on trusted AI platforms — and why traditional filters can't catch it
- How 41% of phishing emails are getting past SEGs
Attackers Abuse Legitimate Infrastructure to Distribute Phishing Emails
Researchers at Cisco Talos are tracking a significant increase in phishing campaigns that abuse legitimate platforms. Attackers abused more than 25 legit services over the past year, including "collaboration, productivity, file sharing, survey, payment, and AI-related platforms."
In two campaigns, attackers used order notifications from Staples and Dell to distribute phishing messages. The organizations themselves were not compromised, but the threat actors inserted phishing content into the fields that were supposed to contain shipping information.
"Talos recently analyzed two order notification campaigns abusing Staples and Dell transactional email pipelines," the researchers write. "Together, these campaigns accounted for roughly 1,400 messages observed by Talos. The malicious element was not the outer sender identity, like a simple forged sender or lookalike domain.
"The suspicious content appeared inside the notification itself, in fields that would normally contain shipping information. The attacker's objective was to use a trusted retail pipeline to create urgency around a high-value purchase and push the recipient toward an attacker-controlled phone number."
Phishing campaigns are also using a technique called "list bombing," in which attackers enter users' email addresses into legitimate registration, subscription, or notification services in order to flood their inboxes with unwanted messages.
"Talos has observed a subset of cases where this behavior is being repurposed as a delivery vehicle for malicious content. This abuse occurs when an attacker identifies public-facing registration, profile, or project-naming forms that lack sufficient input validation.
"By inputting a 'hostile string' — such as a cryptocurrency-themed lure — into fields intended for a name, company, or title, the attacker forces the platform to treat this data as legitimate user information. When the service reflexively incorporates this input into its automated welcome, verification or notification templates, the system acts as an unintended carrier, delivering the attacker's content inside a high-reputation, system-generated email that can pass standard authentication checks."
Blog post with links:
https://blog.knowbe4.com/attackers-abuse-legitimate-infrastructure-to-distribute-phishing-emails
Maximizing Your Microsoft Defender Investment with KnowBe4 Defend
When organizations deploy Microsoft 365, security leaders face a fundamental question: Is native Microsoft Defender protection enough?
Microsoft recently evaluated real-world telemetry from live enterprise tenants running seven ICES add-ons on top of Microsoft Defender. The result? KnowBe4 Defend ranked #1 across every single metric reported, catching 3.7x more dangerous emails that Microsoft Defender missed than the field average, with the lowest overlap.
Join Stuart Clark, SVP of Product at KnowBe4, for a technical breakdown of Microsoft's independent production telemetry and a live demonstration of our ICES ecosystem architecture between Microsoft Defender and KnowBe4 Defend.
We will showcase:
- The #1 Benchmark Telemetry: How Defend caught 3.7x more dangerous emails that Defender missed with the lowest overlap (0.65%)
- Adversarial AI and Model Diversity: How independent behavioral models neutralize polymorphic AI, prompt injections, and zero-payload BEC that slip through perimeter filters
- Microsoft Teams Messaging and Posture Management: Extending protection beyond the inbox into Teams and remediating insecure collaboration configurations
- Native SOC Workflows (Live Demo): Investigating Defend threat verdicts natively inside Microsoft Defender Threat Explorer
- Advanced Threat Hunting via KQL (Live Demo): Querying Defend-enriched threat metadata directly inside Microsoft Sentinel and Defender XDR
See why defense-in-depth no longer requires hopping between consoles or redundant gateway fees. Learn how to maximize your Microsoft 365 investment with native, cloud-native ICES defense.
Date/Time: Wednesday, Nov. 11, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/ecs-ms-demo-month2?partnerref=CHN
[New Threat Trend Data] When Bad Actors Use Reality Against Us
"Is it real?" has become a common question across our digital lives thanks to the rise of AI-generated content.
A fair one, with deepfakes and AI-produced imagery flooding nearly every channel we use daily. A skeptical eye is a must, but our most recent Phishing Threat Trends Report reveals why that might not even be enough.
Our 8th Phishing Threat Trends Report tracks how attackers stopped faking infrastructure and started borrowing it. Modern phishing has no need to fool filters with lookalike domains when it can sit directly on trusted ones.
This shift runs through every finding in this report: campaigns are routed through hyperscalers, attackers harvest API keys from trusted platforms and session hijacking via refresh tokens that render "change your password" meaningless. The only thing left that is fake is the premise.
Overall, phishing volume rose 29.8% in 2026 compared to 2025, and one dangerous email now lands in every 733 an organization receives. The bigger shift is not how much arrives, but how it is built. Attackers have stopped faking infra and started borrowing it. Check out Volume 8 of our Phishing Threat Trends Report to see what that looks like and where security teams should focus next.
Download the full report here:
https://info.knowbe4.com/resources/reports/2026-phishing-threat-trends-vol-8?utm_source=chn_email&utm_medium=email&utm_campaign=dg-ces-campaign-26&utm_content=phishing-threat-trends-report
Read on for some highlights:
https://blog.knowbe4.com/new-threat-trend-data-when-bad-actors-use-reality-against-us
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: [SCARY STATS] What CISOs Told A16Z about AI, budgets, and the priorities shaping 2027:
https://www.a16z.news/p/the-new-security-agenda?
- Coco Chanel - Fashion Designer (1883 - 1971)
- Marcus Aurelius - Roman Emperor and Philosopher (121 - 180)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-44-treat-every-engineers-workstation-like-a-6-billion-vault
Report: Most Fraud Attacks Target Existing Customer Relationships
A new report from TransUnion has found that 81% of digital fraud attacks target existing customer relationships, with more than half of U.S. businesses reporting increased scam and fraud activity over the past year.
"Identity-based fraud attacks often arise before organizations have sufficient information to establish trust in new customers," the report says. "While account creation is a critical trust-establishing event, most fraud exposure occurs after the customer relationship has already been established.
"Different risk patterns appear across account creation, login, and financial transaction activities, especially for AI-enabled fraud. For instance, AI can help fraudsters rapidly generate or modify identities, credentials, and interactions to target the weakest controls across the customer lifecycle."
Most respondents cited synthetic identity fraud, which uses exposed consumer information and AI to craft phony personas, as their top concern over the next two years.
"43% of U.S. business leaders said the growing scale and sophistication of fraud is placing significant or severe pressure on their organizations," TransUnion says. "Synthetic identity fraud is a key concern, with 67% expecting it to increase over the next two years and 53% citing it as the threat they are least prepared to address.
"In the U.S., 51% of business leaders reported increased scam and authorized fraud activity over the past year. U.S. lenders face an estimated $2.4 billion in exposure tied to synthetic identities as of June 30, 2026."
The increase is partly due to adversarial use of AI tools, which allow attackers to drastically improve the scale and sophistication of social engineering attacks.
"AI has fundamentally changed the economics of fraud by automating activities that once required significant human effort, including creating identities, generating content, and targeting victims," TransUnion says. "This allows fraudsters to accelerate and scale their attacks faster than organizations can adapt their detection capabilities and mitigation strategies."
KnowBe4 empowers your workforce to make smarter security decisions every day.
TransUnion has the story:
https://newsroom.transunion.com/81-of-suspected-digital-fraud-attacks-target-existing-customer-relationships-transunion-finds/
What KnowBe4 Customers Say
"Hi Bryan, thank you for reaching out personally. I can confirm we are very happy with KnowBe4. The platform has become a core part of how we keep our users security-aware here.
"Just as important has been the team behind it. Lex L., our sales rep, has been helpful, easy to work with, and always quick to get us what we need. Vanessa V. has also been amazing to work with. She helps me set up our training and phishing campaigns and guides me on which training modules to select for our users. Both of them make the partnership easy, and it is a big part of why we continue to be glad we chose KnowBe4.
"Thanks again for checking in."
– T.T., Network LAN Administrator
- Treasury Sanctions Facilitators of DPRK IT Worker Fraud Targeting U.S. Businesses:
https://home.treasury.gov/news/press-releases/sb0669 - Business email compromise was a top threat in Q3 2026:
https://www.levelblue.com/blogs/spiderlabs-blog/levelblue-ttp-briefing-q3-2026-trusted-access-fuels-data-theft - Phishing remains the top initial access vector:
https://blog.talosintelligence.com/ir-trends-q3-2026/ - Ukrainian National Sentenced to 70 Months in Prison for Multi-Million Dollar Ransomware Conspiracies:
https://therecord.media/nefilim-hive-ransomware-operator-70-months-prison - FBI seizes ‘bulletproof’ hosting site accused of facilitating child abuse, money laundering:
https://www.justice.gov/usao-edva/pr/bulletproof-website-domain-seized-international-law-enforcement-operation - SkyW4lker Exposed: A Growing Microsoft 365 Phishing Threat to American Enterprises:
https://any.run/cybersecurity-blog/skyw4lker-phishing-kit-analysis/ - A Hacker Targeted High-Stakes Poker Players With Malware That Exposed Their Cards:
https://www.wired.com/story/a-hacker-targeted-high-stakes-poker-players-with-malware-that-exposed-their-cards/ - Money-stealing scams are surging:
https://www.bankinfosecurity.com/financial-scams-outpace-credential-phishing-for-first-time-a-33237 - AI-enabled attack framework automates ransomware attacks:
https://blog.talosintelligence.com/nik-c2-new-ai-enabled-framework/ - Attackers are gearing up for the peak holiday shopping season:
https://unit42.paloaltonetworks.com/unwrapping-retail-cyber-threats/
- [SUPER FAVE] Engineering That Will Make You Go WOW | Guinness World Records:
https://youtu.be/kytwXfwLkGc - Virtual Vaca #1 - Medieval City of Kutná Hora, Czechia [Amazing Places 4K]:
https://youtu.be/--ulrbckn2E - Virtual Vaca #2 - Florence, Italy - In depth tour city #19 of 30:
https://youtu.be/ktjtL-8eg4E - Virtual Vaca #3 - The Most Beautiful Places in Jordan from Above:
https://youtu.be/WK_j69hLR08 - Epic Skills | Best of October 2026:
https://youtu.be/A_h6_ge7tNA - This is not your average cold plunge!:
https://youtube.com/shorts/hqOd8bSjByI - Flying the World’s Most INSANE Wingsuit Line in France:
https://youtu.be/iVtVhUdr_Vk - Magician Fools Penn & Teller with Sleight of Hand Magic Trick. It seems totally impossible:
https://youtu.be/oZRZdmVUSec - Athlete crosses 600 monkey bars beneath Africa’s highest bridge:
https://youtube.com/shorts/7XFmzHsHASM - LockPickingLawyer - Picking The Smart Lock’s Hidden Keyway:
https://youtu.be/sJ2qJ06_uHc - It has been a long time since I laughed so hard I was crying. This is CAT WWE!
https://www.instagram.com/reels/DfAr7mOoApf/ - When two real-life martial arts champions share a movie fight scene:
https://www.instagram.com/reels/DfBpXceoSLU/ - [CLASSIC MythBusters] Did Ancient Egyptians Use Mirrors To Light Underground Chambers?:
https://youtu.be/u9ihe9nPK6o - For Da Kids #1 - Bulldog Raised With Pigs Has No Idea He's Different:
https://youtu.be/mmV0dDwtFqw - For Da Kids #2 - Parrot is in love with someone on TV:
https://youtu.be/9eKGGYyANp8 - For Da Kids #3 - Puppy Interrupts Yoga Class And Chooses His Forever Mom:
https://youtu.be/kgOT922ceXw - For Da Kids #4 - Wild Rabbit Keeps Coming Back To Visit His Cat Friend:
https://youtu.be/vWPqHcQBVyo - For Da Kids #5 - Stray Cat Moves On Boat And Becomes Harbor Master:
https://youtu.be/gDkYmr4eDFM
