GBHackers
CompanyThreat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Malware reported by GBHackersTrojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
- Named in breach reports by GBHackersTRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
- Activity reported by GBHackersUnauthorised Codex and Claude Code relay service disables sandboxing at 12 organisations
Recent news
Trojanized Claude Code extension on Open VSX installs persistent SSH backdoor on developer machines
Researchers found that anthropic.claude-code version 2.1.313, obtained from Open VSX, had 66 lines of malicious JavaScript added to the legitimate extension bundle. The loader runs before the extension's normal code and sets up persistent SSH access to infected hosts. The issue has been traced to a compromise of the Cursor Marketplace, and Cursor briefly took the service down to remove the malware.
TRM Labs Says North Korea's TraderTraitor Stole About $6.36 Billion From Binance Wallets
GBHackers reports that TRM Labs attributes the theft of about $6.36 billion from Binance wallets to North Korea's TraderTraitor group. The funds were drained across ten blockchains on 29 October 2026. TRM Labs describes it as the largest crypto theft on record, about four times the $1.5 billion Bybit heist of February 2025.
Japan hit by wave of AI-assisted cyberattacks on businesses and government bodies
GBHackers, citing Bloomberg, reports a surge of AI-assisted intrusions in Japan that has exposed gaps in corporate and public-sector security. Dozens of incidents, ranging from brokerages to delivery firms, have made data leaks routine. The article says Japan's Ministry of Economy, Trade and Industry (METI) disclosed unauthorised activity on October 28, though the excerpt is cut off before giving details.
Unauthorised Codex and Claude Code relay service disables sandboxing at 12 organisations
Symantec's Threat Hunter Team identified an unauthorised relay service that installs the genuine OpenAI Codex and Anthropic Claude Code command-line tools and rewrites their configuration to disable sandboxing. It has affected 12 organisations since early 2026, mostly in mainland China. Because these AI coding agents can read files, write code and run commands, removing sandboxing widens what they can do on a host.