Daily Cyber Threat Brief — November 5, 2026: DreamHost breach exposed FTP logins and webmail sessions

Incident timeline

Date	Development
June 2026	A Binance wallet-development engineer downloads a tampered Homebrew installer while setting up an AI coding tool, giving attackers their first foothold.
August 2026	The DreamHost intrusion begins inside its File Manager platform; GreyNoise first observes the Kapibala actor exploiting Zyxel GS1900 switches from around August 17.
September 2026	A fake job interview targets a second Binance engineer, and a coding assignment from the supposed employer compromises his work computer; Binarly confirms on September 28 that the Zyxel exploit still works on June-patched firmware.
October 20, 2026	Attackers use the compromised computer and an internal Binance AI tool to take control of two wallet developers' machines.
October 22, 2026	Zyxel ships firmware fixing the GS1900 zero-day, CVE-2026-107441.
October 23, 2026	DreamHost discovers the intrusion, takes the File Manager offline, and resets passwords and ends sessions for affected users.
October 29, 2026	Binance theft: about $6.3 billion in crypto is drained, including 233.46 million XRP moved out of five hot wallets in four minutes.
October 31, 2026	The FBI attributes the Binance theft to North Korea's TraderTraitor unit; North Korea denies the claim.
November 1–2, 2026	Attackers alter cold-room controls at three French blood service sites overnight through a refrigeration contractor's remote monitoring software.
November 3, 2026	Binance publishes its initial incident report; Zyxel publishes its GS1900 advisory; mSeven Software notifies mSecure customers; France's blood service confirms its incident.
November 4, 2026	BleepingComputer reports the DreamHost breach, the mSecure hack, and the Zyxel zero-day; refrigeration firm Coolworld confirms its role in the blood-service incident.

1. DreamHost breach exposed FTP logins and webmail sessions

DreamHost is warning customers of a data breach after attackers gained access to its File Manager platform for about two months and stole FTP and SFTP usernames and passwords. In a breach notification filed with California's attorney general, the company says an unauthorized third party exploited a vulnerability in the third-party software behind its browser-based File Manager at files.dreamhost.com, and was able to access the credentials of anyone who logged into the tool between approximately August 2026 and October 23, 2026. The intruder may also have reached certain webmail systems, exposing session information, including credentials, for a limited number of users, and the notice says email contents and files stored on FTP and SFTP servers may also have been accessed.

DreamHost discovered the intrusion on the afternoon of Friday, October 23, and says it has blocked the attackers' access, addressed the vulnerability, and rebuilt the File Manager with added security and monitoring. Passwords were reset and active sessions ended for accounts believed to be affected. The company puts the damage at well under approximately 10% of its email and FTP/SFTP accounts and says it found no evidence that control-panel login information or customer billing and payment details were accessed. It has not named the exploited software, given no CVE, and has not provided an exact count of affected accounts; BleepingComputer says its questions on the number went unanswered. Impacted customers are being offered one year of credit monitoring and identity theft protection through Equifax.

Investigation notes

The two-month dwell time is the part that matters most. Anyone who used DreamHost's File Manager between August and October 23 should treat those FTP and SFTP passwords as stolen, rotate them, and check website files for changes made since August — especially PHP files in upload folders — because stolen FTP credentials are a direct route to planting webshells and skimmers. The absence of an exact victim count is a gap, not a reassurance: with more than 400,000 customers, even a small fraction is a large number of accounts. DreamHost first described the problem publicly as File Manager connection trouble, and customers reported receiving password-reset emails with no explanation before the fuller notice appeared.

2. Binance reveals how a fake job interview led to the $6.3 billion heist

Binance has published its first detailed account of the record crypto theft on October 29, and the entry point was a hiring scam. The operation began in June, when an engineer on the wallet development team downloaded a tampered software installer — a Homebrew package for an AI coding tool — that exposed the roles of that engineer and colleagues. In September, someone posing as a project director contacted a second engineer through a job-hunting platform; after a video interview with a fake HR representative and a second round with a person posing as the CEO of a fictitious company, the engineer downloaded a coding assignment from a code repository that compromised his work computer. Palo Alto Networks calls this tactic "Contagious Interview."

On October 20, the attackers used that computer, along with an internal Binance AI tool, to take control of two wallet developers' machines. Nine days later they reached the internal wallet signing service and drained about $6.3 billion: 233.46 million XRP left five internet-connected hot wallets in four minutes, followed by other cryptocurrencies including bitcoin, with the final unauthorized transfer at 23:56 UTC. The FBI attributed the theft on October 31 to TraderTraitor, a North Korean state-sponsored unit; North Korea has denied the finding. Binance says about $2.85 billion of the stolen assets has been frozen or intercepted, and that it has replenished about 98% of the affected assets and will cover customer losses.

Investigation notes

This is the second major incident in a week to show attackers weaponizing the hiring process and AI tooling together — a tampered developer tool in June, a fake interview in September, and an internal AI tool as the lateral-movement bridge in October. The signing service was reached without any wallet private key leaking, according to Binance, which is the detail defenders should sit with: the attackers abused legitimate internal access paths rather than breaking cryptography. The FBI attribution and the $6.3 billion figure are both anchored in the official record, but the attribution remains contested by Pyongyang, so treat the actor label as the FBI's assessment, not a settled fact.

3. mSecure password manager hack prompts password reset warnings

mSeven Software is warning current and former customers of its mSecure password manager to change passwords, reset two-factor authentication, and remove passkeys after a cyberattack. In a security notification sent to customers on November 3, the company said it recently discovered suspicious activity involving the mSecure application, but gave few details about what was compromised or how many users were affected.

Customers have since shared responses reportedly received from mSeven's support team indicating that a hacker stole an encrypted database from mSecure Cloud. That same response stated the company had no evidence the attacker accessed the confidential information stored within the encrypted database. The issue affects only users who were syncing with mSecure Cloud. mSecure uses AES-256 encryption and a zero-knowledge architecture that encrypts data locally on users' devices before it reaches company servers — the same design that limited the damage in the 2022 LastPass breach, where attackers also stole encrypted vault backups. BleepingComputer says it contacted mSeven with questions about the incident and has not yet received a response.

Investigation notes

Two things are still unverified here, and both matter. First, the stolen-database claim comes from customer-shared support responses, not from mSeven's public notification, so treat it as reported rather than confirmed. Second, "encrypted database stolen" is not the same as "passwords stolen" — with a zero-knowledge design, the vault contents stay encrypted unless the attacker also obtains users' master passwords. That is exactly why the advice is to change the master password, reset two-factor authentication, and remove passkeys now: rotating the keys that protect the vault closes the window before any offline cracking attempt can pay off.

4. Zyxel fixes zero-day exploited to hack nearly 1,000 network switches

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The flaw, CVE-2026-107441, is an out-of-bounds write in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests. It affects ten GS1900 models; Zyxel released security updates on October 22 and published its advisory on November 3.

The attacks were initially blamed on an older flaw, CVE-2026-7273, which Zyxel patched in June and CISA added to its Known Exploited Vulnerabilities catalog. But firmware security firm Binarly recovered the circulating exploit and confirmed on September 28 that it still worked against all ten firmware releases patched for the June flaw — the attackers were using a separate, previously unknown vulnerability. GreyNoise observed a suspected Chinese-speaking actor it tracks as Kapibala exploiting the switches from around August 17, and reported 996 compromised devices across 48 countries, with Italy, the United States, and Taiwan hit hardest; 564 of the compromised switches were still running factory-default credentials. Zyxel rates the flaw CVSS 8.8; Binarly rates it 9.8.

Investigation notes

Keep the counts straight: GreyNoise's 996-device figure describes the campaign as observed and was originally attributed to the June flaw, so it is unclear how many of those switches fell to the new CVE-2026-107441 specifically. What is established is that the June patch did not stop the exploit, and the October 22 firmware is the fix that does. The newer CVE had not been added to CISA's KEV catalog as of November 4, so defenders should not wait for that signal. Administrators of affected GS1900 switches should install the October 22 firmware or newer and take the web management interface off internet exposure — and the 564 devices still on factory defaults are a reminder that credential hygiene is doing as much damage here as the vulnerability itself.

5. Cyberattack turned French blood service freezers toward 110°C

Attackers tampered with the cold-storage controls of France's national blood service, the Établissement français du sang (EFS), overnight on November 1–2, changing temperature and defrost thresholds on cold rooms at three regional sites through remote monitoring software run by its refrigeration contractor, Coolworld. According to Le Canard enchaîné, which broke the story, rooms normally held at minus 30°C were set to climb toward 110°C. A duty technician spotted the rising temperatures during the night, plasma and samples were moved to other sites, and EFS says no blood products were lost and no patient was affected. EFS confirmed the incident in a statement on November 3, notified France's cybersecurity agency ANSSI and the Health Ministry, and said its own IT systems were not directly targeted.

Coolworld, a Dutch temperature-control rental company operating in France, Germany, Ireland, the Netherlands, and the UK, confirmed on November 4 that it was aware of the incident involving remote monitoring software used in its refrigeration systems, and said the vulnerability concerns a component supplied by a third-party provider that it does not directly control. The blood service is the first healthcare target in the wave of attacks on internet-connected refrigeration controllers that began with roughly 700 French supermarkets on October 11–12 and hit more than 100 stores in a second wave on November 1–2. France's CERT-FR has named Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors among the affected equipment. Shodan currently shows about 7,000 internet-exposed Danfoss interfaces, with France holding the largest share at roughly 1,450.

Investigation notes

The 110°C figure is a programmed setpoint, not a temperature the blood products reached — the alarms caught the change before the rooms heated up, which is why nothing was lost. The pattern across this wave is consistent: controllers exposed to the internet and protected by weak or factory-default passwords, reached through a contractor's remote monitoring stack rather than the victim's own network. That makes this a third-party and OT-exposure problem as much as a healthcare one. For defenders, the immediate actions are the same as in the supermarket waves: take refrigeration controllers off the public internet, change default credentials, and segment operational technology from corporate IT.

Sources

• BleepingComputer — DreamHost confirms data breach exposed FTP logins and webmail sessions
• BleepingComputer — mSecure password manager hack prompts password reset warnings
• BleepingComputer — Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
• The Register — Cyberattack on French plasma stores is enough to make your blood boil
• BusinessWorld (Reuters) — Binance hackers used fake job interview in $6.3-billion attack
• Nextgov/FCW — Binance says fake job interview helped North Korean hackers steal $6.3 billion in crypto