CyberheistNews Vol 16 #45 | November 10th, 2026
FBI: North Korea Was Behind $6 Billion Cryptocurrency Theft
The U.S. FBI has attributed October 29's record-breaking $6.3 billion crypto heist to a North Korean state-sponsored threat actor. Binance said on November three that approximately $2.85 billion had been frozen or intercepted, but the threat actor is in the process of rapidly laundering the rest.
Decrypt reports that the crooks have spread the stolen funds through 20,000 crypto wallets since the theft. "The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the Bureau said in a statement.
"The FBI refers to this specific North Korean malicious cyber activity as 'TraderTraitor.' The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ether (ETH)."
The FBI stated in a previous advisory on TraderTraitor, "Educate users on social engineering on social media, and spear phishing. North Korean actors rely heavily on social engineering, leveraging email, and social media platforms to build trust and send malicious documents to unsuspecting users.
"A cybersecurity aware workforce is one of the best defenses against social engineering techniques like phishing. User training should include how to identify social engineering techniques and awareness to only open links and attachments from trusted senders."
The hackers posed as recruiters, convincing a Binance employee to download a fake assignment as part of a broader and sophisticated campaign. Speaking to reporters, company executives revealed that the hackers targeted a Binance engineer on LinkedIn and arranged a series of fake job interviews in order to persuade the employee to download an "assignment" that let them invade the company's systems.
Takeaway: Textbook example why security awareness training is still CRITICAL. Rebuild high-risk-user training around complete attack narratives. Engineers and privileged employees need simulations involving recruiters, live interviews, collaboration tools, and code. Not just email.
Here is the FBI report:
https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack?
Maximizing Your Microsoft Defender Investment with KnowBe4 Defend
When organizations deploy Microsoft 365, security leaders face a fundamental question: Is native Microsoft Defender protection enough?
Microsoft recently evaluated real-world telemetry from live enterprise tenants running seven ICES add-ons on top of Microsoft Defender. The result? KnowBe4 Defend ranked first across all three incremental detection metrics reported. Its incremental malicious-email detection rate was 3.7 times the field average.
Join Stuart Clark, SVP of Product at KnowBe4, for a technical breakdown of Microsoft's independent production telemetry and a live demonstration of our ICES ecosystem architecture between Microsoft Defender and KnowBe4 Defend.
We will showcase:
- The #1 Benchmark Telemetry: How Defend caught 3.7x more dangerous emails that Defender missed with the lowest overlap (0.65%).
- Adversarial AI and Model Diversity: How independent behavioral models neutralize polymorphic AI, prompt injections, and zero-payload BEC that slip through perimeter filters.
- Microsoft Teams Messaging and Posture Management: Extending protection beyond the inbox into Teams and remediating insecure collaboration configurations.
- Native SOC Workflows (Live Demo): Investigating Defend threat verdicts natively inside Microsoft Defender Threat Explorer.
- Advanced Threat Hunting via KQL (Live Demo): Querying Defend-enriched threat metadata directly inside Microsoft Sentinel and Defender XDR.
See why defense-in-depth no longer requires hopping between consoles or redundant gateway fees. Learn how integrated cloud email security helps you get more from your Microsoft 365 investment.
Date/Time: TOMORROW, Wednesday, Nov. 11, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/ecs-ms-demo-month2?partnerref=CHN2
Warning: Phishing Operations Are Impersonating Prediction Markets'l
Fraudsters are exploiting the increased public interest in prediction markets such as Polymarket and Kalshi, according to researchers at Recorded Future. Criminal groups known as "traffers" are providing fellow crooks with "websites, administrative panels, cryptocurrency payment infrastructure, victim-management capabilities, technical support, and promotional guidance" to target users of prediction markets.
"This model lowers barriers to entry for affiliates and enables campaigns to scale rapidly as new trends attract potential victims," Recorded Future says. "The services combine convincing prediction-market interfaces with established fraud mechanisms designed to manipulate victims and prevent them from recovering deposited funds.
"These mechanisms include controlled trading outcomes, fabricated market activity, artificial withdrawal restrictions and fees, and the collection of sensitive identity and payment information." The attackers are using AI tools to accelerate their operations by "reducing the time, cost, and expertise required to adapt campaigns to emerging events."
Recorded Future warns that attackers are now able to exploit current trends faster than ever before, as AI supercharges their development.
"The rapid adoption of prediction markets by multiple traffer teams illustrates a broader threat from mature fraud ecosystems that can pivot toward emerging technologies, financial products, and cultural trends without having to develop entirely new criminal capabilities," the researchers write.
"Prediction markets are particularly well-suited to this model because legitimate platforms already combine cryptocurrency, speculative financial activity, rapidly changing news events, and social media discussion. Fraud actors can imitate these characteristics to establish credibility and manufacture urgency.
"As the fraudulent prediction markets gain visibility, additional traffer teams may experiment with the prediction market theme or reuse the underlying tooling for adjacent fraud schemes."
Blog post with links:
https://blog.knowbe4.com/warning-phishing-operations-are-impersonating-prediction-markets
Anatomy of a Pretext: How Multi-Vector Phishing and Vishing Still Fool Your Smartest People
Attackers don't just hack systems. They hack trust. They build a pretext first: who reports to whom, which vendor sends the invoices, whose assistant runs the inbox, and what your CFO posted last night.
Join renowned friendly hacker and CEO of SocialProof Security, Rachel Tobac, and KnowBe4 CISO Advisor Erich Kron as they examine how attackers anchor pretexts in vishing, smishing, and phishing. Together, they explore why voice-led and multilayered attacks slip past traditional defenses, what's changing in modern social engineering tactics, and how to protect your organization.
You'll learn:
- How attackers turn your company's public posts and vendor relationships into convincing narratives
- The psychological levers—urgency, authority, familiarity, and fatigue—that manipulate your smartest people
- How multi-layered attacks use phone calls and text messages to validate fake emails, manufacturing an inescapable illusion of legitimacy
- What a single compromise can cost your organization: wire fraud, stolen credentials, ransomware, and compromised customer data
- Practical tips to prepare your workforce to catch convincing stories before they cost you
Plus, Rachel Tobac will break down how the OSINT, target selection, pretexting ideation, phishing messaging, and live attacks happen so that you can keep your organization ready to catch the attacks we're seeing in the news right now!
Earn CPE credit for attending.
Date/Time: Wednesday, Nov. 18, @ 2:00 PM (ET)
Save My Spot:
https://info.knowbe4.com/anatomy-of-a-pretext-webinar?partnerref=CHN
How Are We Doing? Tell Emma, and Help Make CyberheistNews Better
Your time is valuable. Every week, CyberheistNews has to earn some of it.
My goal is to give you information you can use to protect your org and your users. To find out how well we're delivering, I'd love to hear directly from you.
So, I have a small favor to ask. :-D
We've created a short, three-question "How are we doing?" survey about your experience reading CyberheistNews, putting its advice into practice, and what would make it more valuable to you. Please be candid. Knowing what needs improvement is just as useful as knowing what you like.
And you'll be meeting someone new: Emma, the AI interviewer at ReadingMinds, the new company I'm building. Emma will ask you the questions, and you'll answer her in your own words.
By participating, you'll also help me test Beta three of the ReadingMinds platform. Your participation will help me improve both this newsletter and the interview experience itself.
Have a quick chat with Emma and tell us how we can make CyberheistNews better:
https://interview.readingminds.ai/1544881186383c08
Thanks for helping us make the next issues better!
Stu
Why Email Security Is Failing—and How to Close the Gap in the Age of AI-Powered Phishing
AI has rewritten the phishing playbook. Today's attackers don't rely on obvious malware—they exploit trust. Business email compromise (BEC), vendor email compromise (VEC), and account takeover (ATO) attacks are personalized, context-aware, and engineered to blend into everyday workflows. And they're bypassing traditional defenses at scale.
Secure email gateways (SEGs) were built to block bulk spam and signature-based threats. Many legacy cloud email security tools still depend on static detection and post-delivery remediation. That's not enough in an AI-driven threat landscape.
Real-world data from KnowBe4 PhishER Plus shows millions of confirmed phishing emails bypass leading email security platforms every month, creating unnecessary risk and operational drag for security teams.
In this white paper, you'll learn:
- Why SEGs and legacy cloud tools are missing modern, payload-less attacks
- The data behind millions of confirmed threats that reached user inboxes
- The architectural gaps in perimeter-based and disconnected security models
- How to combine Cloud Email Security with AI-driven, human-vetted incident response
- What a closed-loop, measurable email defense strategy looks like in practice
It's time to take a good, hard look at SEGs.
Download the whitepaper now and close the gap before attackers widen it further.
Let's stay safe out there.
Warm regards,
Stu Sjouwerman, SACP
Executive Chairman
KnowBe4, Inc.
PS: Andreessen Horowitz has a very good article on SubStack about "Defense in Depth, Rebuilt For Machine Speed":
https://www.a16z.news/p/defense-in-depth-rebuilt-for-machine?
PPS: Tell me how we are doing with CyberHeistNews? Chat with Emma and let her know:
https://interview.readingminds.ai/1544881186383c08
- Augustine of Hippo - Philosopher (354 - 430)
- Attribution uncertain, possibly Benjamin Franklin (1706 - 1790)
You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-16-45-fbi-north-korea-was-behind-6-billion-cryptocurrency-theft
Report: Social Engineering Remained the Top Initial Access Vector in Q3 2026
Phishing remained the most common initial access vector for attackers in the third quarter of 2026, according to a new report from Cisco Talos. Ransomware gangs are using voice phishing attacks to trick employees into granting them a foothold within organizations.
"In addition to traditional phishing links and attachments, we observed numerous threat actors conducting voice phishing (vishing) in tandem with IT desk impersonation to socially engineer the victim into allowing remote access via a legitimate remote monitoring and management (RMM) tool," Cisco Talos says.
"Exploitation of public-facing applications was the next most common vector, accounting for one-third of Talos IR engagements. Threat actors predominantly targeted edge devices such as security gateways and remote network management interfaces.
"These are critical components within enterprise environments, often responsible for managing authentication, network traffic, or sensitive data. Compromising them can provide broad access to internal networks or user credentials."
The researchers also observed an increase in threat actors abusing AI tools, both as a tool to assist in attacks and as a target for attacks themselves. "[An] investigation revealed an attack chain in which a compromised macOS endpoint, infected via a trojanized application, was scripted to scrape credentials from the macOS keychain specifically associated with the Anthropic Claude Code AI assistant," the researchers write.
"This direct targeting of AI-related secrets highlights an emerging threat, where attackers seek to compromise not only traditional user and system credentials but also those tied to AI platforms, which may grant access to additional sensitive data and advanced automation capabilities.
"These incidents highlight the critical need for organizations to implement strong MFA and robust credential management practices, especially for AI platforms and development tools."
AI-powered security awareness training gives your organization an essential layer of defense against evolving social engineering attacks. KnowBe4 empowers your workforce to make smarter security decisions every day.
Cisco Talos has the story:
https://blog.talosintelligence.com/ir-trends-q3-2026/
Google Calendar Phishing Attacks Target Corporate Users
Researchers at Material Security warn that phishing attacks are harvesting live Google sessions from corporate users and bypassing multifactor authentication.
"The messages arrive as Google Calendar invites, sometimes delivered by BCC and often sent from an organization the recipient has already corresponded with," the researchers write. "The pretexts are mundane: voicemail notifications, RFP and RFI requests, court summonses, and missed payment notices. Most links point to Google itself.
"The typical pattern is Google's own /url redirector with the real destination in a query parameter, though other waves used share[.]google and Drive file links for the same purpose. One variant used Intuit transaction notification links. In every case, when the message is scored, the domain, certificate, and reputation displayed are legitimate and trusted."
The attacks are designed to harvest a range of multifactor authentication codes, enabling the threat actors to immediately gain access to the victims' accounts. "The attacker runs a live reverse proxy in front of the genuine Google sign-in page," the researchers explain. "The victim enters a password, receives a real prompt, and approves it, all while the operator watches the session in real time.
"The server relays SMS codes, authenticator codes, Google's Tap-Yes number matching, and phone-based account recovery to Google as each one arrives, so none of the second-factor controls stop the session from being captured."
Material disrupted the attackers' infrastructure, and this particular campaign has been shut down. The researchers stress, however, that the threat actors will most likely set up new infrastructure to continue launching attacks.
"Rebuilding the infrastructure is cheap, the framework has been public since February, and the operator shipped an unfinished Microsoft 365 branch alongside the live Google code," the researchers write. "The branch includes a stylesheet path, a second harness, and a title string that decodes to a Microsoft sign-in prompt.
"None of those paths resolve today, and adding the brand requires dropping in a file rather than changing any code. The operator has built the follow-on and has not activated it. Material reads the theme rotation as iteration, not retirement, and expects the next pivot to look much like this one with a different brand."
Over 70,000 organizations worldwide trust the KnowBe4 Platform to strengthen their security culture and reduce workforce risk.
BleepingComputer has the story:
https://www.bleepingcomputer.com/news/security/google-calendar-phishing-campaign-hijacks-sessions-bypasses-mfa/
What KnowBe4 Customers Say
"Thank you so much for yesterday's call. I have not had much time on the KSAT platform, so your support is helping a lot.
"In the short time that you have supported me, I have managed to get our SAT programme back on track, which is mostly down to your support and help with fixing things. Thank you so much, your assistance has made such a difference here! Have a lovely week and kind regards,"
– O.T., Information Security Officer
- U.S. order to purge Acronis tied to years of scrutiny over Russian ties:
https://www.nextgov.com/cybersecurity/2026/11/us-order-purge-acronis-tied-years-scrutiny-over-russian-ties/416970/ - Researchers warn that AI can crawl social media to craft targeted phishing attacks:
https://www.digitaltrends.com/cool-tech/ai-can-turn-your-instagram-posts-into-scam-that-know-a-little-too-much-about-you/ - Cyber-Attack on Refrigeration Systems Hits Supermarkets Across Europe:
https://www.infosecurity-magazine.com/news/cyber-refrigeration-supermarkets/ - Police seize over 100 servers in investment scam crackdown:
https://www.bleepingcomputer.com/news/security/police-seizes-over-100-servers-in-investment-scam-crackdown/ - This Job Interview Cost Binance $6.3 Billion (Detailed Insta Reel):
https://www.instagram.com/reels/DfShfbnu3hU/ - Britain on notice: AI-powered ransomware attacks to arrive by 2028:
https://www.theregister.com/security/2026/11/03/britain-on-notice-ai-powered-ransomware-attacks-to-arrive-by-2028/5307200/ - Russian and Ukrainian hackers hijack emergency apps to spread fake nuclear attack warning:
https://therecord.media/ukraine-hackers-russia-alert-system - Russia's APT29 uses watering-hole sites to target unpatched mobile devices:
https://www.infosecurity-magazine.com/news/apt29-watering-holes-iphones/ - Ongoing phishing campaign impersonates 189 U.S. financial institutions:
https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/ - Fake Game Cheats Spread Password-Stealing Malware:
https://www.mcafee.com/blogs/other-blogs/mcafee-labs/marsalek-malware-fake-game-cheats-password-theft/
- Virtual Vaca #1 - Top 10 Places To Visit in The UAE - Travel Guide:
https://youtu.be/wDZiQH0noB4 - Virtual Vaca #2 - Cinque Terre, Italy - In depth Tour city #20 of 30:
https://youtu.be/PeWswpq9KIw - Virtual Vaca #3 - 14 DAYS IN JAPAN (2026) The Ultimate Japan Itinerary for First-Timers:
https://youtu.be/N_wG4Vq6asM - Spectacular NEW Wingsuit Flight at Majotissimo Italy:
https://www.youtube.com/watch?v=xIy1fQiaLYk - Why Hong Kong Is Laying a Skyscraper on its Side:
https://youtu.be/cYhGqtQELd0 - Penn & Teller Perform Egg Magic Trick Fool Us:
https://youtu.be/xildQPUvbdU - It's getting harder to balance the UK power grid. Here's why:
https://youtu.be/NBXu6Z9Fw_M - 48 pistons. 24 cylinders. Four crankshafts. One output. Interesting AI simulation. But how about cooling?:
https://www.instagram.com/reel/DfUuefWtfXS/?obrf=MTZqMXM1N3pqNGhreg== - Simply amazing Perceptive Dynamic Manipulation with Robot Dawg Spot:
https://youtu.be/nDIWulWjDz8 - Creating an Avalanche and then trying to avoid it in Alaska:
https://youtube.com/shorts/veCMD_ITN4g - Best of the Month Extreme Skills & Epic Talents:
https://youtu.be/nkNYJf6MY70 - James May drives America's cheapest new pick-up truck SLATE:
https://youtu.be/z1-G2Qn9F1Q - For Da Kids #1 - Officer Earns Moose's Trust During Rescue:
https://youtu.be/ikIFAjbDpPc - For Da Kids #2 - Parrot's Love Of Biggie Smalls Helps Solve Mystery Of His Past:
https://youtu.be/V8UAaGgsM9I - For Da Kids #3 - Cat Gives Hairstyles to Dogs Like Their Little Hairdresser:
https://youtu.be/iYSslahHsp0 - For Da Kids #4 - Fawn and Dogs Become Unlikely Friends:
https://youtube.com/shorts/-Fp2bFoRUj8 - For Da Kids #5 - Clever Dog Unlocks Shelter Door And Runs Straight Back Home:
https://youtu.be/L3f6KGki2Oc
