Latest scams & hacks

Recent scams, frauds and breaches, explained simply.

Language: English Ελληνικά Español Français Deutsch Italiano Português Nederlands Polski Türkçe Русский العربية हिन्दी 中文 日本語

• Two Vulnerabilities Found in Google Auth Library for Perl1 Nov 2026 · Greece · Source: SecNews.gr (GR)
  Two security flaws in the Google::Auth Perl library allow unauthorized requests to internal services and acceptance of local authorization codes. No patches are currently available, posing risks to systems using this library for AWS credentials and OAuth login.
• Tool boosts GeForce RTX AI performance but poses security risks1 Nov 2026 · Greece · Source: SecNews.gr (GR)
  Open-source tools remove Nvidia limits on GeForce RTX 20, 30, and 40 cards, doubling AI performance. The Windows version runs from USB but requires disabling Secure Boot and risks fake installers.
• Critical LXD Vulnerability Allows Client Impersonation1 Nov 2026 · Greece · Source: SecNews.gr (GR)
  A critical CVSS 10.0 vulnerability (CVE-[phone number]) in LXD and MicroCloud lets attackers with HTTPS API access impersonate trusted clients without private keys. Administrators should update their snaps immediately to mitigate this risk.
• Critical LXD, MicroCloud Flaw Allows Client Impersonation Without Private Key1 Nov 2026 · Worldwide · Source: The Hacker News
  A severe vulnerability in Canonical's LXD and MicroCloud lets attackers impersonate trusted clients without their private keys by accessing the HTTPS API and using the client's public certificate. This grants unauthorized access to clusters and virtual machines.
• Hackers Steal $2.7M from Polymarket Traders via Hijacked Script1 Nov 2026 · Worldwide · Source: The Hacker News
  Hackers injected malicious code into Polymarket's site by replacing a page-speed script, selling traders' positions and stealing about $2.7 million. Polymarket is refunding affected users after 726 wallets were compromised on October 29.
• FBI Links North Korea Hacker Group to $6.43B Binance Crypto Theft1 Nov 2026 · Worldwide · Source: The Hacker News
  The FBI attributes a $6.43 billion cryptocurrency theft from Binance to TraderTraitor, a North Korea-aligned hacking group. Multiple U.S. agencies are involved in investigating this major virtual asset heist.
• NetamLoader Malware Targets Asian Government Windows 10 Systems1 Nov 2026 · American Samoa · Source: The Hacker News
  NetamLoader malware uses a sophisticated .NET injection method to infect custom Windows 10 builds used by Asian government organizations. This previously undocumented framework poses a significant threat to targeted government systems in the region.
• FFmpeg Huffyuv Decoder Memory Leak Vulnerability CVE-[phone number]1 Nov 2026 · Greece · Source: SecNews.gr (GR)
  A memory leak vulnerability in the Huffyuv decoder of FFmpeg affects versions 2.3 to 9.0.2 and requires user interaction to exploit. Users should be aware of potential risks when handling media files with these versions.
• Fake Microsoft Teams Update Page Delivers Malware1 Nov 2026 · Worldwide · Source: scammers.com
  A fake Microsoft Teams update site tricks users into downloading malicious software and reports activity to attackers via Telegram. This is part of recent phishing campaigns impersonating IT support or software updates.
• New AEGIS VPN Phishing Site Steals Payment Details via Telegram1 Nov 2026 · Worldwide · Source: X (public post)
  A newly registered phishing site posing as AEGIS VPN collects phone numbers, card details, and security answers. Data is sent in real-time to a Telegram bot, targeting users seeking VPN services.
• Fake UBA SMS Scam Leads to Phishing Site Stealing Personal Data1 Nov 2026 · Nigeria · Source: fij.ng
  Scammers in Nigeria send urgent texts impersonating United Bank for Africa, urging users to verify identity via a fake website. The site steals login, personal, and financial details, with the scam active for at least two weeks before being reported.
• Northflank warns of AI key misuse after security incident31 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Northflank reports unauthorized use of AI keys following a security incident and advises customers to change their credentials immediately. The company has not disclosed the cause or extent of the exposure but warns stored secrets may be compromised.
• Chainalysis Reports Cybersecurity Incident Exposing Customer Identity Data31 Oct 2026 · United States · Source: The Hacker News
  Chainalysis confirmed a cybersecurity breach where an external actor accessed non-sensitive customer identity data. The company stated no unauthorized access occurred to investigation content or authentication credentials.
• Fake CAPTCHAs Used to Distribute Malware31 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Cybercriminals are exploiting users' trust in CAPTCHA checks to install malware. Users should learn to recognize fake CAPTCHAs to avoid infection.
• Fake CAPTCHA Tests Used to Spread Malware31 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Cybercriminals exploit users' familiarity with CAPTCHA tests to distribute malware. Recognizing fake CAPTCHA prompts can help prevent malware infections.
• New Phishing Sites Target Crypto Users to Steal Wallets and Keys31 Oct 2026 · Worldwide · Source: stopascammer.com
  Several new phishing domains impersonate crypto wallets and exchanges to trick users into revealing private keys or connecting wallets. These scams aim to drain victims' crypto assets by stealing sensitive information.
• HKMA Warns of Phishing and Fake Bank Websites Targeting Hong Kong Customers31 Oct 2026 · Hong Kong · Source: hkma.gov.hk
  The Hong Kong Monetary Authority alerts the public about fraudulent websites and fake internet banking login screens impersonating several banks. Scammers use phishing emails and SMS to steal login credentials, OTPs, and personal data, while banks never request sensitive info via these channels.
• $6.3 Billion Stolen from Binance Hot Wallets in Major Security Breach30 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Binance confirmed a security breach resulting in $6.3 billion stolen from hot wallets, possibly starting from a DevOps engineer's laptop. The attack, linked to North Korean group TraderTraitor, exploited EIP-7702 to drain funds.
• Binance confirms $6.3 billion hot wallet theft linked to DevOps laptop30 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Binance reported a security breach resulting in a $6.3 billion loss, possibly starting from a DevOps engineer's laptop. The attack exploited EIP-7702 to drain hot wallets and is attributed to North Korean group TraderTraitor by TRM Labs.
• CERT-AGID Reports 121 Malicious Campaigns Targeting Italy in Late October30 Oct 2026 · Italy · Source: National agency CERT (IT)
  Between October 24-30, CERT-AGID identified 121 malicious campaigns affecting Italy, with 76 targeting Italian entities specifically. They shared 965 indicators of compromise to help accredited organizations respond to these threats.
• Chinese Hackers Use AI Tool ARTEX to Target 200+ Organizations Globally30 Oct 2026 · Worldwide · Source: The Hacker News
  Chinese state-sponsored hackers known as Vapor Panda use an AI-powered framework called ARTEX to conduct simultaneous attacks on high-value targets worldwide. This advanced tool enhances their penetration testing capabilities, increasing the threat level for organizations globally.
• Coruna & DarkSword Spyware Hacks iPhones via Malicious Websites30 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Coruna and DarkSword are spyware tools that exploit iOS vulnerabilities to hack iPhones through a simple click on malicious websites. Users risk having their devices compromised without any interaction beyond visiting a harmful site.
• Trezor Safe 5 Wallets Risk Recovery Phrase Theft from Hidden Circuit Board30 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Trezor has warned that a hidden circuit board inserted into Trezor Safe 5 wallets can steal recovery phrases, risking users' cryptocurrency security. Users should be cautious of tampered devices to prevent potential theft.
• Binance suffers largest-ever crypto theft with $6.3 billion stolen30 Oct 2026 · Worldwide · Source: Malwarebytes Labs
  Attackers stole approximately $6.3 billion in cryptocurrency from Binance, marking the largest crypto theft on record. Users should be cautious and monitor their accounts for suspicious activity.
• Trezor Warns of Hardware Wallet with Suspected Spy Implant Sold by CryptoBilis30 Oct 2026 · Worldwide · Source: The Hacker News
  A Trezor Safe 5 wallet bought from reseller CryptoBilis reportedly contains an extra circuit board that transmits recovery phrases over mobile networks. Trezor advises all buyers from CryptoBilis since March 2026 to transfer funds to new wallets with new recovery phrases immediately.
• $2.7M stolen from Polymarket traders in supply chain attack30 Oct 2026 · Greece · Source: SecNews.gr (GR)
  Polymarket suffered a supply chain attack through DebugBear, resulting in $2.7 million stolen from trader accounts. Users of Polymarket and related services are at risk of financial loss due to such attacks.
• Hackers Leak Data of 41,000 Homeland Security Workers30 Oct 2026 · United States · Source: Malwarebytes Labs
  A hacker group has stolen and published data on 41,000 Department of Homeland Security employees, including work contact details and internal group memberships. This breach exposes sensitive employee information to potential misuse.
• Syrian Hacker Sentenced for Fake Tweet Causing $136B Market Drop30 Oct 2026 · United States · Source: The Hacker News
  Ahmad Umar Agha, a Syrian hacker linked to the Syrian Electronic Army, was sentenced to 42 months in prison for a hacking conspiracy that targeted Western news outlets and caused a massive market drop. The conspiracy was led by members of Syria's former president's inner circle.
• Decrease in Potentially Vulnerable PHP URLs in Italy30 Oct 2026 · Italy · Source: National agency CERT (IT)
  CERT-AGID reports a drop to 1.7% in potentially vulnerable PHP versions among Italian IPA URLs, from 650 to 382. This suggests ongoing updates, but server-level verification is needed to confirm security improvements.
• Critical Authorization Bypass Flaw Exploited in Drupal Commerce Core30 Oct 2026 · Worldwide · Source: The Hacker News
  Hackers are actively exploiting a critical authorization bypass vulnerability in Drupal Commerce Core affecting versions up to 3.3.13. This flaw allows unauthorized access in the shopping cart module, posing risks to online stores using affected versions.
• Binance Security Breach Impacts $6.3 Billion in Assets, $3 Billion Frozen30 Oct 2026 · Worldwide · Source: The Hacker News
  Binance experienced a security breach affecting $6.3 billion in assets, with nearly $3 billion frozen on-chain. Tether and Circle have frozen over $2.3 billion in related assets to contain the incident.
• New phishing sites impersonate marketplaces to steal credentials30 Oct 2026 · Worldwide · Source: gacs.app
  New phishing domains impersonating marketplaces or services have been flagged, harvesting credentials and payment details. Avoid clicking unsolicited links to these fake shops to protect your information.
• Phishing Emails Impersonate Trust Wallet to Steal Crypto Credentials30 Oct 2026 · Switzerland · Source: swisscybersecurity.net
  Phishing emails falsely claim a Trust Wallet data breach and urge users to click a link to secure their wallets. The link leads to a fake site designed to steal recovery phrases and private keys, risking crypto wallet theft.
• nad[.]fun exploited with multiple contract drains on Monad29 Oct 2026 · Worldwide · Source: Community reports
  Multiple attacks reported on the nad[.]fun platform. On-chain transactions show drains via specific txs on Monad testnet/mainnet, with funds bridged out. Attacker wallet 0x6f9438a135620c90532594fc192e3b49d9977881 identified along with references to V1 curve and V1/V2 contracts. Users shared security update with exact transaction links for the two separate drain incidents.
• Polymarket frontend supply-chain attack drains ~$2.6M29 Oct 2026 · Worldwide · Source: Community reports
  Attackers compromised a third-party Real User Monitoring script (DebugBear RUM) loaded on Polymarket's international site. The malicious JS (cdn[.]debugbear[.]com/C7xcKKrjUnXK[.]js) read localStorage auth data, hijacked React internals to create sell orders and signed DepositWallet batches via the user's own signer and Polymarket's relayer. Drained ~28.6M POL (~$2.6M) to attacker 0x3F99139F1C5854b
• Ongoing CryptoBilis Ledger drainer activity29 Oct 2026 · Worldwide · Source: Community reports
  Attackers behind the CryptoBilis Ledger supply-chain compromise (affecting ~1,486 addresses, ~$95M stolen) continue moving funds, including 2,000+ ETH (~$4.6M) into Tornado Cash on Oct 29. $13.8M moved in past 48h with some frozen. Victims received tampered devices from the Southeast Asian reseller that exfiltrated seeds.
• Tampered Ledger hardware wallets in Singapore29 Oct 2026 · Singapore · Source: Community reports
  Singapore police reported at least two victims lost ~$2.7M from Ledger hardware wallets bought at retail stores that contained malicious components or pre-set recovery phrases known to the seller. Wallets were drained after users funded them. Ledger suspended sales via certain Asian resellers. Users should only buy directly from manufacturer and generate their own seed phrase.
• HTX phishing emails from goenumerate[.]com29 Oct 2026 · Worldwide · Source: Community reports
  Scammers are sending emails from noreply[at]goenumerate[.]com claiming a support ticket and urging users to refresh documents or click links. The domain has no affiliation with HTX exchange; official support uses htxsupport[at]htx-inc[.]com. Victims risk account compromise or credential theft by engaging.
• Malaysian man jailed for providing bank accounts to scam syndicate29 Oct 2026 · Singapore · Source: Community reports
  A 28-year-old Malaysian man was sentenced to 8 months in jail for letting a scam syndicate use 17 of his Singapore bank accounts to move nearly S$4 million. Part of larger money mule operations facilitating scams.
• Romance scam ring using fake forex/crypto platforms in Vietnam29 Oct 2026 · Vietnam · Source: Community reports
  Vietnamese police raided a Chinese-led scam operation in a rented hotel that targeted Taiwanese and Chinese victims with romance scams leading to fake forex, stock, crypto trading, and sports betting platforms (using USDT). Avoided local victims to reduce detection. 118 arrested, $2M losses estimated.
• CryptoBilis Ledger Drainer still moving stolen funds29 Oct 2026 · Worldwide · Source: Community reports
  The CryptoBilis Ledger drainer stole $95.35M from 1,486 addresses between Oct 7-9. $30.44M remains in tagged addresses with only $10M frozen; attacker moved another $13.84M in the past 48 hours. Ongoing on-chain activity reported by Arkham Intelligence.
• Coinbase customer data exposed via Amplitude vendor29 Oct 2026 · Worldwide · Source: Community reports
  Coinbase confirmed contact data (likely emails/phone) of some users was exposed in a breach at third-party analytics provider Amplitude. No core systems breached and funds safe, but increases risk of targeted phishing and fake support scams impersonating Coinbase.
• Metro ExpressLanes phishing text messages29 Oct 2026 · United States · Source: Community reports
  Southern California Metro warns ExpressLanes customers about phishing text messages. Customers are advised not to respond to the suspicious texts attempting to collect personal or payment information.
• BINI management warns against impersonation of member Gwen29 Oct 2026 · Philippines · Source: Community reports
  Management of Filipino group BINI states it may take legal action against an online user creating and spreading fabricated messages that impersonate member Gwen. This is an impersonation scam targeting fans.
• Ongoing QUBIC crypto phishing and fake giveaway warnings29 Oct 2026 · Worldwide · Source: Community reports
  Crypto recovery account issues safety notice for QUBIC token holders to watch for phishing links, fake giveaways, and suspicious requests to connect wallets. Users are told to independently verify all transactions and avoid untrusted sites.
• Fraudulent job ads impersonating Securities Commission Malaysia29 Oct 2026 · Malaysia · Source: Community reports
  Securities Commission Malaysia warns of fake job advertisements circulating on social media that impersonate the SC. The scams instruct recipients to scan QR codes, click links or share personal information. All legitimate vacancies are only posted on official SC channels.
• SiriusXM phishing emails from handwrittenresults[.]com29 Oct 2026 · Worldwide · Source: Community reports
  Threat intelligence researcher reports phishing emails pretending to be SiriusXM subscription renewals originating from handwrittenresults[.]com domain. Victims are advised to only use their known official account login and avoid any links in the suspicious emails.
• Fake support and cloned sites impersonating crypto platforms29 Oct 2026 · Worldwide · Source: Community reports
  Scammers create fake websites with slightly altered domains and impersonate official support via unexpected DMs requesting seed phrases, passwords, or wallet access. Recent breach waves (e.g. SK finance names, Bithumb external attack) lead to KYC data used for follow-on phishing. Verify sources directly; never click unsolicited links.
• Ongoing Ethereum address poisoning attacks draining USDT29 Oct 2026 · Worldwide · Source: Community reports
  Scammers plant lookalike addresses (matching first 4 + last 6 chars) in victims' wallet transaction history via tiny transfers. Users copy-paste from history and send funds (e.g. 50K USDT lost in one recent case). Tools like Poison Check and Scam Sniffer detect fakes by comparing against history. One victim lost 100K USDT after 66 days.
• Fake claim and airdrop sites draining crypto wallets29 Oct 2026 · Worldwide · Source: Community reports
  Ongoing wave of AI-generated fake claim/airdrop websites that trick users into connecting wallets and signing malicious approvals disguised as 'verify wallet'. Part of broader 2026 losses exceeding $2.6B mostly from social engineering rather than exploits. Recommendations include using separate wallets, revoking approvals, and pre-sign checks.
• Brushing scam with malicious QR codes or links in unsolicited packages29 Oct 2026 · Worldwide · Source: Community reports
  Scammers send cheap unsolicited packages ('brushing') to real addresses to generate fake verified buyer reviews using the recipient's name. Packages may contain QR codes or links that lead to phishing, malware, or identity theft schemes. Advice: keep the package but avoid scanning codes or clicking links; monitor accounts.
• EIP-7702 wallet drains targeting sven.eth and others29 Oct 2026 · Worldwide · Source: Community reports
  Multiple wallets drained in the last 15 hours using EIP-7702 signature-based attacks with an 84-second signature window. One victim sven.eth lost $22.7K (though 9.58 ETH was returned shortly after). 119 wallets remain connected to the drainer contract; 133 drains observed. Common in current 2026 wave of approval and signature drains.
• Predict[.]fun prediction market wallet drains29 Oct 2026 · Worldwide · Source: Community reports
  Between Oct 22-27, ~29 user accounts on Predict[.]fun (BNB Chain prediction market) were drained of ~400k USDT total. No smart contract exploit; team attributes it to a compromised third-party API/docs site. Users likely approved malicious transactions via the hacked site. Team promising refunds; warns of follow-on fake refund phishing sites and fake support accounts.
• Predict[.]fun users reportedly suffered wallet drains before Season 1 end29 Oct 2026 · Worldwide · Source: Community reports
  Users of predict[.]fun (prediction market on Binance) reported wallet drains totaling around $300k shortly before Season 1 conclusion. Funds were bridged to ETH and sent to Tornado Cash; suspected to target embedded/in-app wallets. Older reports from previous day but discussed in last 6h.
• Ghanaian twins and American woman admit to $1.16B romance scam29 Oct 2026 · Worldwide · Source: Community reports
  Report on Ghanaian twins and an American woman who admitted to a large-scale romance scam worth KSh 1.16 billion (hundreds of millions USD). They face up to 20 years in prison. This is a news report on an admitted past scam, not a new active one.
• Begoña Gómez denounces PP for AI-generated impersonation video29 Oct 2026 · Spain · Source: Community reports
  Begoña Gómez (wife of Spanish PM) is filing a complaint against the PP political party for identity theft and impersonation using an AI-generated video. This is a political deepfake impersonation case reported in Spanish media and posts today.
• US charges 6 in Africa-based crypto romance scam from Madagascar29 Oct 2026 · Worldwide · Source: Community reports
  US authorities charged six suspects for operating a crypto romance scam from Madagascar. Victims were lured into fake NFT investment platforms, leading to their crypto wallets being drained. This is a law enforcement update on an existing operation, not a new active campaign.
• Fake Trezor Suite and DefiLlama apps via ads drain wallets29 Oct 2026 · Worldwide · Source: Community reports
  Fake Trezor Suite app promoted through Google ads caused $510k in losses. Separately, a fake DefiLlama iOS app also drained at least one wallet. Victims are advised to only download wallet software directly from official vendor sites, avoiding sponsored search results.
• $MOTHADO pump[.]fun rug with bundled wallets29 Oct 2026 · Worldwide · Source: Community reports
  Newly graduated pump[.]fun memecoin $MOTHADO flagged as scam: one bundle of 9 wallets completed the bonding curve, over 6 red flags, and 204 out of 2259 traders flagged as suspicious. Market cap reached ~$364k before detection.
• Fake Crypto Pro Switzerland site steals seeds29 Oct 2026 · Worldwide · Source: Community reports
  Phishing campaign impersonating 'Crypto Pro Switzerland' promoted on X, YouTube, and Telegram directs users to a fake site where entering seed phrases allows full wallet drainage. The malicious domain is flare[.]linkeportalnet[.]com.

🔔 Scam alerts

Check a suspicious message now →