Tag: Security & Hacks

A critical vulnerability in Apple’s macOS Screen Sharing feature, identified as CVE-2026-65400, is being actively exploited by attackers to gain root access on Macs and deploy Monero cryptocurrency mining software. The Netherlands’ national cyber agency issued a warning this week regarding the active exploitation of this flaw.

The Dutch National Cyber Security Center (NCSC) reported that the vulnerability allows network-based attackers to bypass authentication, enabling them to slip through without valid credentials. Exploitation has been observed on systems where port 5900, the default port for Screen Sharing, is exposed to the internet. In these instances, attackers successfully gained root access, the highest level of control over a machine, and installed Monero mining programs.

The bug, which has a severity rating of 7.1 out of 10, is an authentication flaw stemming from faulty state management during the login process. It allows authentication attempts that should have been rejected to be accepted. Publicly available proof-of-concept code for this vulnerability is now circulating, which lowers the barrier for potential attackers.

Monero, a privacy-focused cryptocurrency, is frequently used in cryptojacking campaigns. In such schemes, hijacked machines are used to mine cryptocurrency for the attacker, who reaps the rewards while the victim bears the costs of electricity consumption and degraded system performance. The privacy features of Monero make its transactions harder to trace compared to more transparent cryptocurrencies like Bitcoin or Ethereum.

Apple has addressed the vulnerability by releasing patches for affected macOS versions. Updates are available for macOS Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1. Users who have not yet updated their systems, particularly those with Screen Sharing accessible from the open internet, remain exposed to this threat.

The NCSC advises users to apply Apple’s updates promptly and to avoid leaving Screen Sharing accessible from the internet, as this configuration provided the initial entry point for attackers.

Why This Matters

This incident highlights the immediate security risks posed by unpatched software and exposed network services. The exploitation of the macOS Screen Sharing vulnerability (CVE-2026-65400) for Monero mining demonstrates a persistent threat to users, underscoring the importance of timely security updates and secure network configurations. While the exact number of affected systems and the total value of Monero mined remain uncertain, the active exploitation is part of a broader trend of cyber schemes leveraging compromised devices for cryptocurrency profit.

Broader Context

The exploitation of the macOS Screen Sharing vulnerability for Monero mining occurs amidst a landscape of evolving cyber threats. Recent incidents include malware found in pirated software, malicious mobile apps, and compromised Python libraries, indicating a continuous effort by malicious actors to leverage compromised devices for financial gain. The use of Monero, a privacy coin, in these campaigns is driven by its features that make transactions harder to trace compared to other cryptocurrencies.

Hacker Offers French Tax Records for Sale, Exposing Hundreds of Thousands to Risk

A hacker is reportedly selling a vast trove of French tax records, potentially exposing over 678,000 individuals and businesses to phishing scams, identity theft, and targeted attacks. The compromised data allegedly originates from France’s tax authority, the DGFiP, and was stolen during a breach in June.

According to a report by French cybersecurity outlet FrenchBreaches, the hacker is seeking several thousand euros for the database. Jameson Loop, Chief Security Officer at Bitcoin security platform Casa, highlighted the severity of the breach on X, noting, “The French tax authority has been hacked, and 678K records leaked.”

FrenchBreaches detailed that the compromised database contains records for 392,867 individuals and 285,570 professionals. Among these are 26,805 individuals with reported tax incomes of at least $116,000, 386 individuals earning over $1.16 million, and eight individuals with incomes exceeding $11.6 million. The hacker is said to be offering the complete file for several thousand dollars.

A sample of the leaked data, as described by FrenchBreaches, includes names, birth dates, home and email addresses, phone numbers, income figures, withholding tax rates, family status, dependent information, and tax-sharing details.

In an update, FrenchBreaches stated, “The DGFiP officially confirms the intrusion in its information system.” The firm added that stolen credentials were used in late June to access and extract taxpayer data, and the full extent of affected individuals is still under investigation.

The attacker reportedly exploited stolen VPN credentials and an internal search tool to extract names, contact details, tax identification numbers, income figures, withholding rates, and family information before authorities could revoke access.

FrenchBreaches warned that the availability of such sensitive tax information could enable scammers to craft highly credible fraudulent messages, far more convincing than generic phishing emails.

This data leak occurs amidst a concerning rise in “wrench attacks,” a form of crime where perpetrators use violence or threats to extort cryptocurrency. In July, cybersecurity firm CertiK reported 52 such attacks globally in the first half of 2026, with 33 occurring in France. Earlier this month, Chainalysis reported 46 attacks through June, including 30 in France, resulting in over $30 million in stolen funds.

Chainalysis noted that “criminals have recognized that crypto holders are high-value targets because they possess wealth in an instantly and irreversibly transferable form.”

A data breach at Trezor’s shipping partner, ShipMonk, has exposed the personal information of approximately 13,700 customers, prompting a re-examination of the security considerations surrounding hardware cryptocurrency wallets. The incident underscores risks associated with the physical logistics and third-party vendor involvement in hardware wallet distribution, extending security concerns beyond the management of private keys.

Breach Details and Exposed Information
The breach, disclosed by Trezor on August 13, involved unauthorized access to ShipMonk systems that held customer order data. The exposed information includes names, phone numbers, and home addresses of recent Trezor customers. ShipMonk first notified Trezor about the unauthorized access on Monday, August 10. Importantly, Trezor has stated that its devices themselves were not compromised in this incident.

Re-evaluating Hardware Wallet Risks
In the wake of the breach, Binance founder Changpeng Zhao (CZ) highlighted what he described as a “real advantage” of software self-custody wallets. CZ argued that software wallets avoid the risks tied to shipping physical devices that link a user’s identity and address to their cryptocurrency holdings. He noted that while hardware wallets have specific advantages, this incident underscores a different risk profile compared to software alternatives like the Binance Web3 Wallet or Trust Wallet, which do not involve shipping physical products.

Broader Security Landscape and Expert Warnings
Security experts have warned that the exposed data could be used for sophisticated phishing attacks, social engineering, or even physical threats. Nick Neuman cautioned that the data could lead to targeted social engineering and potentially wrench attacks, while NaoX Protocol stated that exposed addresses could identify crypto holders for direct targeting. Trezor has advised its customers to be vigilant against potential phishing attempts via email, phone calls, or letters, and stressed the importance of never entering wallet backups online or sharing them.

This incident is not the first time Trezor has faced security concerns related to third-party vendors. In January 2024, a separate breach involving a Trezor third-party support vendor exposed contact details for around 66,000 users. Furthermore, the broader hardware wallet ecosystem has seen recent scrutiny. In mid-July, pseudonymous crypto investigator ZachXBT criticized hardware wallets as “complete garbage” for serious use, suggesting that a spare phone used solely for signing transactions might be a more secure alternative. Additionally, Galaxy Research has linked over $100 million in stolen Bitcoin to a firmware issue in older Coldcard devices.

Implications for Users
The ShipMonk breach underscores that the security of hardware wallets extends to the supply chain and data handling practices of their partners. The incident prompts a re-evaluation of the overall security model for self-custody, considering risks beyond the digital realm. Users are reminded to remain cautious and follow best practices for securing their cryptocurrency assets, regardless of the wallet type they choose.

Broader Context

Source materials place the factual news in this context: The incident involves a data breach at Trezor’s shipping partner, ShipMonk.

Scammers Target Crypto Firms, Stealing $11.8 Million Through Fake Job Offers

Scammers posing as recruiters for cryptocurrency companies have successfully defrauded victims of $11.8 million (S$15.1 million) by leveraging fake job offers to compromise their employers’ systems, according to a joint advisory issued by the Singapore Police Force and the Cyber Security Agency of Singapore.

The agencies detailed the modus operandi of the scam in a statement released on Friday. The scheme typically begins with a victim being approached on LinkedIn by an individual claiming to be a recruiter for a cryptocurrency firm. Communications then shift to email, where the scammer uses a spoofed domain that closely mimics a legitimate company’s address. The process often involves several interviews conducted via Google Meet, during which the interviewer consistently keeps their camera off.

Following the interviews, the victim is directed to a fake website to complete a technical coding assessment. Crucially, this assessment is performed on a company-issued device, leading the victim to unknowingly download malicious software.

This malware is designed to capture a session token, a string that allows a service to keep a user logged in. By presenting this token, which signifies an already authenticated session, the attackers bypass multi-factor authentication and gain access to the victim’s Bitbucket account, a platform used for storing and managing source code.

Once inside, the attackers can alter the employer’s software systems and access internal servers. The agencies stated that the compromised credentials are then used to circumvent transaction limits and approval checks, ultimately enabling the theft of funds. The advisory does not name any specific companies involved, disclose the destination of the stolen funds, or attribute the attacks to any particular group.

This tactic is not new, with researchers having previously identified a long-running operation dubbed “Contagious Interview.” This operation involves fake recruiters directing Web3 developers toward malicious code, including over 300 booby-trapped packages uploaded to the npm registry. Another group, known as TraderTraitor, has employed similar fake job offers to infiltrate corporate cloud systems rather than targeting individual cryptocurrency wallets, a strategy one researcher suggested is due to the concentration of funds within these systems. Other attackers have impersonated recruiters from prominent companies like Coinbase and Uniswap to trick targets into executing commands.

While some of these campaigns have been attributed to North Korean hackers, the underlying playbook is not exclusive to them. The Russian-speaking group Crazy Evil, for instance, established a fabricated Web3 company, ChainSeeker.io, and advertised blockchain analyst roles to lure applicants into downloading malware designed to drain their digital wallets.

The Singapore agencies have provided advice for both individuals and companies. Individuals are urged to verify recruiters through official channels, treat interviewers who refuse to turn on their cameras as a red flag, and never execute code from unverified sources. For organizations, the recommendations include securing API keys and internal credentials, strengthening multi-factor authentication, and monitoring for unfamiliar devices and unusual network activity. In cases where a compromise is suspected, the agencies advise isolating affected systems, revoking active sessions, resetting credentials, and reviewing access logs.

A data breach at ShipMonk, Trezor’s shipping partner, has exposed the personal information of 13,689 Trezor customers, the company disclosed on Thursday, August 13, 2026. The incident involved unauthorized access to systems containing customer names, phone numbers, email addresses, and home addresses for some affected individuals.

Trezor’s Core Security Remains Intact
Trezor stated that its own systems were not compromised, and crucially, no Trezor devices, private keys, or wallet backups were accessed. The breach affected customers who placed orders between May 10 and August 8 and had them shipped to the United States, United Kingdom, Sweden, Colombia, Brazil, Italy, or Portugal. Of the total affected, 11,742 customers had their full details exposed, while an additional 1,947 customers had their names, cities, and email addresses compromised.

Trezor attributed the limited scope of the data exposure to its policy requiring partners to delete or anonymize order data 90 days after delivery. In its 13 years of operation, Trezor has not previously experienced a breach that exposed customer phone numbers and shipping addresses. Customers who have not received a notification email from Trezor are reportedly not affected.

Broader Threat Landscape and Industry Precedents
This incident occurs against a backdrop of increasing security threats targeting cryptocurrency holders. Hardware wallet firms have recently warned of a surge in phishing attempts, exacerbated by significant exploits such as the Coldcard breach, which reportedly coincided with losses approaching $130 million. CertiK reported 52 physical attacks on crypto holders globally in the first half of 2026, an increase from 39 in the same period the previous year, with home invasions becoming the most common method.

The precedent set by a similar breach at rival Ledger in January 2020, where data from its e-commerce partner Global-e coincided with widespread phishing and threats against customers, underscores the potential downstream risks associated with third-party vendor data exposures. Some reports suggest that a portion of Bitcoin moved from long-term holder wallets following the Coldcard exploit originated from Ledger and Trezor owners seeking more secure multi-signature setups, according to Casa.

Trezor’s Mitigation Efforts
In response to such risks, Trezor is accelerating the rollout of an Anonymous Delivery option. This service will feature locker pickup, neutral packaging, generic sender details, and automatic deletion of shipping identifiers. The option is slated for implementation in the European Union by September and in the United States by the end of 2026.

Key uncertainties remain regarding the exact timeline of the unauthorized access to ShipMonk’s systems and the potential malicious use of the exposed customer data. Trezor advises customers to remain vigilant against phishing attempts and to never enter their wallet backup information online.

Why This Matters

The breach at Trezor’s shipping provider, ShipMonk, exposed personal data of Trezor customers, highlighting the persistent risks associated with third-party vendor security in the hardware wallet ecosystem. This incident underscores the evolving landscape of physical and digital threats targeting cryptocurrency holders, necessitating vigilance against phishing and physical attacks.

Broader Context

This factual news is placed within the context of increasing physical attacks on crypto holders and previous breaches at rival hardware wallet providers. The incident highlights the critical need for robust third-party vendor security and proactive customer protection measures, as demonstrated by Trezor’s introduction of an Anonymous Delivery option.

Whale Investor Suffers Second Major Crypto Heist, Losing Over $26 Million

A prominent cryptocurrency investor, known by the wallet address TLBL, has been hit by a second significant digital asset theft, losing more than $26 million. This latest incident follows a phishing attack two years ago that saw the same holder lose $24 million.

The recent exploit appears to stem from a compromised private key, raising critical questions for large-scale crypto holders about the efficacy of enhanced security measures when a wallet has already been a target.

On August 13, blockchain analytics firm Lookonchain reported that over $26 million in assets were drained from three wallets associated with TLBL. The firm indicated that the whale “appears to have had its private key compromised.” The stolen assets included aWBTC, DAI, WBTC, ETH, aUSDC, sDAI, USDS, cbBTC, and various other tokens.

Lookonchain’s analysis estimates the total value of assets lost across TLBL’s two major thefts to be approximately $50.3 million. The initial incident, occurring two years prior, involved the theft of 9,579 stETH, valued at $15.54 million, and 4,851 rETH, worth $8.51 million, through a phishing scheme.

The latest loss, however, differs in its apparent method. Security firm PeckShield stated the victim lost around $25.6 million, with significant portions including approximately $6.3 million in aWBTC, $5.1 million in DAI, $4.7 million in WBTC, and $2.6 million in ETH. PeckShield reported that the attacker had already converted a portion of the stolen funds into 20 million DAI and roughly 3,000 ETH, collectively valued at about $5.64 million, distributing them across four separate addresses.

Minor discrepancies in the reported figures between Lookonchain and PeckShield are attributed to variations in asset valuations used in their respective analyses. Nevertheless, both sources confirm a substantial draining of TLBL-linked wallets, with Lookonchain identifying a compromised private key as the likely cause.

In a separate development this week, Lookonchain also highlighted a smaller incident involving address poisoning. In this scenario, a victim inadvertently copied a wallet address directly from their transaction history without verification, subsequently sending funds to a lookalike address controlled by an attacker, resulting in a $100,000 loss. While distinct from the method used against TLBL, this case underscores a persistent vulnerability: crypto wallets remain a significant weak point in digital asset security.

TLBL’s second major loss occurs amidst a record-breaking period for cryptocurrency theft. A report by Blockaid, published on August 2, revealed that hackers stole $1.1 billion across 212 incidents in the first half of 2026. Privileged key misuse, the same category implicated in the TLBL incident, accounted for approximately $790 million of that total, representing about three-quarters of all funds stolen during that period.

Monthly incident counts saw a sharp rise, increasing from 18 in January to 57 in June. Blockaid also found that hackers linked to North Korea were responsible for roughly 55% of all funds stolen in the first half of the year, amounting to about $609 million. However, current data related to TLBL’s case does not specifically connect it to this group.

AI Accelerates Discovery of Critical Zoom Vulnerabilities

Artificial intelligence is rapidly streamlining the process of identifying significant security flaws. In a stark demonstration, a researcher has reportedly leveraged publicly available AI models to discover vulnerabilities within the video conferencing platform Zoom and construct a functional exploit in under 24 hours.

Dubbed “Zoomsday” in a report released Tuesday by Israeli cybersecurity firm A Security, the researcher utilized fewer than 20 AI prompts to uncover weaknesses in Zoom’s annotation tool. These flaws could allow an individual within a meeting to gain control of another participant’s device without any action from the victim.

“Once the malicious code is executing on the victim’s device, the threat actor can stealthily exfiltrate personal data, activate the microphone or camera for surveillance, or deploy additional malware,” A Security stated. “In a large conference call, this translates to a room full of potential targets accessible from a single message, leaving no one safe.”

According to A Security, the attack was successfully tested across Zoom’s applications for Windows, macOS, Linux, Android, and iOS. The firm characterized the exploit as “nation-state-grade,” emphasizing that developing such a tool previously demanded specialized expertise, extensive time, and substantial financial investment.

The identified vulnerabilities are cataloged as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415. CVEs serve as public identifiers for security weaknesses.

“Exploits of this nature are essentially weapons. Governments control their export, and criminal organizations are willing to pay millions for them,” the report noted. “Acquiring such capabilities has historically necessitated nation-state infrastructure, elite teams, and months of dedicated work.”

A Security further detailed that the exploit allows attackers to join or host meetings, target any participant, and compromise their machine with “no required action from the victim and no visual cue indicating the compromise.”

“The attack proved effective in both directions: a compromised presenter could reach every participant, and any participant could reach the presenter,” the firm explained.

A Security reported the initial flaw to Zoom on June 10, two days after its discovery. Zoom subsequently released patches between June 22 and July 20. However, users were still required to update their software, as Zoom’s server-side safeguards were insufficient to filter malicious messages within end-to-end encrypted meetings.

“As detailed on our Zoom Security Bulletin page, we have already addressed this issue,” a Zoom spokesperson told Decrypt. “We consistently advise users to maintain the latest version of Zoom to benefit from our most recent features and updates.”

This report emerges as AI tools are increasingly employed across the technology sector for bug detection, including the identification of 271 vulnerabilities in Mozilla Firefox in April and flaws within the Zcash network in May. Concurrently, AI models from OpenAI, Anthropic, and Meta have demonstrated the ability to bypass security measures and compromise other companies’ systems.

Bridge Exploited, Nearly $202,000 in XRP Drained

An attacker successfully drained nearly 200,000 XRP, valued at approximately $202,000, from an XRP Ledger bridge on August 9 by exploiting a vulnerability in its deposit-detection software, the project announced.

Tx, the entity operating the bridge that connects the Tx Chain and the XRP Ledger, stated in a post on X that a software flaw caused the bridge to incorrectly record transactions as XRP deposits even when no XRP had actually been received.

“The attacker exploited the bridge’s deposit-detection logic,” the company explained. “The bridge’s software mistakenly registered transactions that never actually delivered any XRP to the bridge as deposits, and subsequently minted bridged XRP on the Tx chain against them.”

Tx is a layer-1 blockchain ecosystem that was launched in March, combining the Coreum blockchain with Sologenic, a tokenization and trading platform built on the XRP Ledger.

The attacker leveraged these fraudulent deposits to create unbacked XRP on the Tx Chain. This unbacked XRP was then exchanged through the bridge for legitimate XRP.

According to Tx, the bridge underwent multiple internal and third-party audits prior to its deployment, but the vulnerability remained undetected.

XRPL, an independent XRP Ledger trading and analytics platform, determined that the bridge released approximately 199,916 XRP through 94 separate payments over a 97-minute period. Each transaction was authorized by 17 of the bridge’s 28 relayers, which are programs responsible for monitoring both blockchains and approving transfers.

XRPL’s analysis indicated that the relayers misinterpreted the attacker’s self-initiated transactions as legitimate deposits. The attacker then proceeded to withdraw the resulting unbacked balances through the bridge’s standard withdrawal process.

The analysis also refuted an initial assertion that the XRP had been siphoned off through “rippling,” an XRP Ledger feature used for transferring issued tokens across trust lines. XRPL clarified that native XRP cannot be moved via rippling.

“A widely circulated warning attributed the incident to ‘rippling’ and an account flag that was enabled by default. However, the ledger data indicates otherwise: each of those payments was signed by the bridge’s own multisig, and native XRP is incapable of being rippled,” XRPL stated. “By examining both public chains, the actual cause is identified as a relayer that mistook the attacker’s own self-payments for deposits.”

In a separate post on X, Reza Bashash, a principal at CoreNest Capital and co-founder of Sologenic and Coreum, detailed the attacker’s subsequent actions. He reported that the stolen XRP was converted to Ethereum, transferred to the Ethereum network via THORChain, and then sent in its entirety to the crypto mixer Tornado Cash, a move that significantly complicates tracing the funds.

Tx confirmed that it has halted the bridge, rectified the compromised code, initiated tracing of the stolen funds, and filed a complaint with the FBI’s Internet Crime Complaint Center. The company has also engaged blockchain forensics specialists and is collaborating with security partners.

“As we pursue all available legal avenues, we are concurrently evaluating all options for rectifying the situation for affected users,” Tx stated.

The bridge remains offline while Tx conducts a comprehensive security review. The project advised XRP holders that no action is required on their part and cautioned against any accounts or websites claiming to be able to recover the stolen funds.

The price of XRP has shown minimal reaction to the network issues. The Ripple-linked token continues to trade around the $1 mark, with a market capitalization of approximately $64 billion, having experienced a roughly 5.5% decline over the past 30 days.

Traders on Myriad, a prediction market developed by Decrypt’s parent company, currently anticipate that XRP will maintain its $1 price point for the remainder of the week.