Binance $6.3bn Heist Used an Internal AI Tool, UK Warns of AI Ransomware

This is the AI Security Brief for Thursday, November 5. An internal AI tool in a $6.3 billion crypto heist, a UK warning on AI-powered ransomware, and malware that ranks victims by value.

Binance has explained how attackers drained $6.3 billion from its hot wallets, according to The Guardian. A fake project director approached a wallet engineer on a real job site. During a sham second interview, he was tricked into installing malware. The attackers used that machine and an internal AI tool to take over a second developer's system. Binance says $2.85 billion was frozen or intercepted. For defenders, internal AI tools are part of the attack path. Treat them like any privileged system. And job offers are now a delivery channel.

The UK's National Cyber Security Centre says it's highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028. Think power stations, airports and hospitals. According to The Guardian, the agency says AI helps attackers scout targets, find weaknesses and write malicious code. It expects Russia and China to use AI routinely. Why does that matter to us? Well, the agency's chief executive points to AI finding weaknesses that have been tolerated for far too long. Your patch backlog is now a timeline.

Researchers have found a new Windows infostealer called VOLTA that uses large language models to sort its loot. According to The Hacker News, it uses Claude, Gemini and Kimi to rank a victim's stolen data by how much money it's worth. The stealing part is familiar. Passwords and cookies from Chromium browsers, Outlook profiles and Slack workspaces. The new part is triage. For defenders, the collection hasn't changed, so the basics still apply. Protect browser sessions, watch for cookie theft, and revoke tokens quickly after an infection.

Google's newest Gemini model leads benchmarks for finding, exploiting and patching vulnerabilities, according to The Hacker News. Google says it scored 88.2% on a benchmark for finding vulnerabilities and 54.8% on one for exploitation. Keep in mind, these are benchmark scores, not real-world results. Still, that skill set cuts both ways. A model that finds bugs for us can find them for a bad actor too. For defenders, plan on a shorter window between disclosure and exploitation, and look at where these models could speed up your own patching.

Attackers are dressing malware up as AI desktop apps. The Hacker News reports a campaign dubbed Yoba that builds fake GitHub projects claiming to be desktop apps for ChatGPT and Claude. What folks get instead is a malicious loader and a cryptocurrency miner. According to the report, the campaign abuses signed executables. Now, a signature tells you who signed the file. It doesn't tell you the file is safe. For defenders, publish a list of approved AI clients and block the rest. The bait is a model name that sounds new.

How do we lock down an AI coding agent? Well, Vinay Thakker, CTO of KloudStax, told Help Net Security that agents get their own identity. When an agent works for a person, it carries that person's identity too. It can only do what both are allowed to do, and the logs show both names. Write the command policy as an allowlist, enforced by the harness, not by asking the model to behave. For defenders, that means allowlists over blocklists, because a coding agent will always find the command you didn't think to forbid.

AI has reached most security operations centers. Prophet Security surveyed more than 250 CISOs, SOC leaders and practitioners. It found 40% of security teams use AI every day, and another 56% are testing it. Only 4% have no plans to adopt it. That's according to The Hacker News, in a piece asking whether your SOC is ready for AI agents. An agent sitting on messy data and undocumented processes makes the mess faster. For defenders, get your playbooks and data in order before you hand an agent the keys.

Three moves for this week. First, brief your engineers. Fake job interviews are a malware delivery channel, and internal AI tools need the same controls as any privileged system. Second, allowlist. Approved AI desktop clients only, and agent commands enforced by the harness. And then lastly, shrink your patch window. AI is making bugs much, much easier to find.

That's the brief. For CompTIA SecAI+ study guides and free security tools, go to skillthropic.com, and subscribe so you catch the next one on Monday.