According to the report, the attack started when an employee from Binance’s wallet developer team downloaded an AI tool in June that had been tampered with. The crypto exchange detected the compromise, replaced the device, and changed credentials. But the employee’s role, and that of others on the wallet team, was exposed to the hacker. A second software engineer was targeted in September.
The engineer was seeking a new job and downloaded a “malicious code repository” onto his computer after interviewing for what he thought was a legitimate role. The interview process included a virtual meeting with the CEO of a fictitious company.
On October 20, the attacker used the compromised computer plus an internal AI tool to gain control of the wallet developer’s system and that of a second wallet developer on that team.
On 29 October, the attacker used the second wallet developer’s computer, using stolen credentials from the first wallet developer, and triggered a malicious script to launch the attack.
I’m sorry who applies for a job on their corporate laptop? Apart from the fact that no one should be downloading anything onto a corporate device that isn’t sanctioned you have no idea how monitored the device is. If you apply for a job and then you don’t get it you don’t want your current company knowing that you’re looking to leave.
The most rudimentary of operational security would have prevented this. How fitting that it’s a crypto company.
most people do not care about “rudimentary operational security” and get way too comfortable using corporate devices as their own. Besides it’s not like employees particularly care about what happens to their employer.