slow

The Chief Information Security Officer of Slow Fog, 23pds, stated that the data breach at Coinbase has been confirmed, but it has not yet been confirmed whether passwords or funds have been stolen. Hackers obtained contact information for over 70,000 users.

According to Slow Fog's disclosure, its security personnel discovered that the script udeskApi.2026-10-16.cached.js related to the Udesk customer service system was implanted with a malicious loader during routine threat intelligence checks. This loader hides the address through hexadecimal encoding and asynchronously loads the remote script deeps.js (sourced from udeskqlobal[.]com, note that the domain name starts with the letter q). This script reads accessible Cookies, localStorage, and sessionStorage on the page, intercepts form and login/authentication requests, and sends data to udeskqlobal[.]com/c.php. Attackers may use this to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site's rules, and unmatched pages may also be affected.According to Slow Fog's analysis, this script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning the recharge page every 200 milliseconds and replacing identified recharge addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. At the same time, the script manipulates the clipboard API, replaces copy buttons, and intercepts copy events, making users see and copy tampered addresses. If users transfer funds to this address, the money will flow into the attacker's address.

According to a report by Reuters, the Bank of Korea warned that if large American technology companies slow down their capital expenditures in the field of artificial intelligence next year, South Korea's semiconductor exports could decrease by $50 billion to $100 billion compared to previous forecasts. The Bank of Korea simulated this scenario in a written response submitted to National Assembly member Ahn Doo-hyeon, assuming a 10% drop in the unit price of South Korean semiconductor products.In this scenario, South Korea's GDP growth rate in 2027 would be reduced by about 0.4 percentage points, and the current account surplus would be far below the previously estimated $430 billion. South Korea's chip exports account for about half of the country's total exports. Capital expenditures by Amazon, Google, Microsoft, Meta, and Oracle are expected to increase from $40 billion last year to $80 billion this year, reaching $110 billion next year.The Bank of Korea pointed out that there is still significant uncertainty regarding AI demand trends and the cycle of the memory chip industry. If technology giants cut back on investments in AI infrastructure, South Korea's chip exports and overall economic growth could be impacted.

According to Slow Fog monitoring, Yapeswap suffered an attack, resulting in a loss of approximately $21,900. The root of the incident lies in the WorkersUnion governance mechanism, where the quorum requirement is zero, allowing a proposal that received only about 0.000055% voting support to transfer the feeToSetter authority of YapeFactory to the attacker.The attacker subsequently deployed a malicious Registry contract, causing latestVault() to return a forged vault address, while vaults() still listed the real vault. YapePair accounted for the deposits to be transferred as farm assets, but did not receive redeemable shares, ultimately leading to a loss of funds. This incident involves contracts such as YapeFactory, YapePair, and YapeWrapper.

According to Slow Fog's Yu Xian monitoring, users should promptly update their iPhone and iPad systems and be vigilant about certain installed apps being poisoned by DarkSword.DarkSword mainly targets iPhone cryptocurrency users for pinpoint attacks and coin theft, exploiting iOS-related vulnerabilities to break through the sandbox and steal various passwords and other private data from the Keychain, as well as local wallet private key files, memos, and other private data.

Slow Fog released a threat intelligence report stating that they recently received user feedback about a GitHub repository named sol-live, which disguises itself as a Solidity interview practice project. However, it hides commands in the .vscode/settings.json file to download and execute remote scripts, which may trigger malicious payloads when users start the project with custom terminal configurations.Slow Fog's analysis shows that the related malicious payloads can collect browser login databases, wallet extension storage, and macOS Keychain files. They also have the capability to scan and upload local files, execute remote commands, provide interactive Shell access, and monitor the clipboard. In macOS and Linux environments, the malicious terminal configuration must be actively initiated by the user to execute; the attack chain on Windows has not been confirmed due to issues with quote handling.

SlowMist released a security alert stating that NEM suffered an attack, resulting in a loss of approximately $821,920. The root cause lies in NemTokenV2 recording the tokens transferred to the liquidity pool (LP) as sell volume without verifying the exchange settlement.The attacker exploited this vulnerability, executing the transfer, calling skim() to clear the incoming tokens, and calling flushLpSellRecycle() a total of 42 times, destroying the original reserves of the liquidity pool and lowering the NEM reserve balance, and then selling the remaining NEM at an inflated price to withdraw USDT.

Slow Fog Security Warning states that PHP released a security announcement on October 20, disclosing two serious security vulnerabilities that could lead to remote code execution (RCE), numbered CVE-2026-109618 and CVE-2026-109619, both with a CVSS v4 score of 9.2. Currently, the PHP official has not released a fix patch, and the specific affected versions and exploitation conditions are yet to be confirmed.According to existing information, the PHP official plans to release a security update on October 21 at 14:00 UTC (22:00 Beijing time). Slow Fog recommends that relevant institutions promptly check the PHP versions in their servers and business systems, focusing on PHP services exposed to the public network, and upgrade in a timely manner after the patch is released; systems that cannot be upgraded temporarily should restrict access sources and take isolation measures if necessary.

Netflix's third-quarter earnings exceeded Wall Street expectations, but it is expected that revenue growth will slow for the fourth consecutive quarter, with fourth-quarter revenue projected at $13.4 billion, below analyst forecasts. Netflix attributes the revenue shortfall to its advertising business, expecting that segment's revenue to be $300 million less than the company's original expectations.After the earnings report was released, Netflix's stock price fell by as much as 7%.

According to The Wall Street Journal, Musk ordered to slow down the service speed of "Starlink" in the Ukraine region.

According to Slow Fog's Yu Xian monitoring, Qubic Wallet may have leaked most of its private keys, which can be restored through 6 connections.

The security organization SlowMist has released an in-depth threat intelligence report on the DarkSword Trojan backend and iOS attack chain. The report tracks the evolution of this attack infrastructure and reveals its high danger to cryptocurrency asset users.According to SlowMist's analysis, after the relevant exploit code was made public in March 2026, DarkSword-PROV2 appeared on GitHub in July, and its attack infrastructure was observed to be operational by late September.The SlowMist team not only tracked its online infrastructure but also correlated its management panel with public GitHub repositories, dissecting the exploit code, delivery chain, and post-compromise capabilities. The report highlighted several key findings of this attack framework: a highly automated complete attack pipeline that integrates vulnerability delivery, device and data collection, data theft, and cryptocurrency wallet fund aggregation functions.The extensive and deep data theft capabilities of this toolkit target not only keychains, files, and information but also specifically cryptocurrency wallet data, with the ability to decrypt wallet data and aggregate funds. Although the toolkit claims to support iOS 13 and above, code analysis confirms that its actual effective exploit window is concentrated in the iOS 18.6--18.7.2 and iOS 26--26.1 version ranges. The publicly available vulnerability components have been weaponized and integrated into a deployable attack framework, significantly lowering the threshold for launching complex iOS attacks.In response to this threat, SlowMist has provided clear security recommendations. Users should keep their iOS systems updated and avoid clicking on untrusted links, as merely opening a malicious page in the Safari browser could trigger vulnerabilities. If a device has accessed suspicious landing pages, users should consider their mnemonic phrases and private keys as compromised and must create new wallets and transfer assets using a clean device that has never accessed that page.Additionally, users should thoroughly check for abnormal transactions and token authorizations across various chains and immediately revoke unnecessary authorizations.

The Bank for International Settlements (BIS) published a working paper titled "Are Stablecoins and Bank Deposits Substitutes?" The study is based on weekly data from the United States from January 2019 to June 2025. After controlling for factors such as Bitcoin prices, government bond yields, and financial market conditions, it was found that the rise in bank deposit rates is associated with a slowdown in the growth rate of stablecoin market capitalization.According to the benchmark model estimates, a 1 basis point (0.01 percentage point) increase in the average deposit rate corresponds to a reduction of about 3 percentage points in the cumulative growth rate of stablecoin market capitalization over the following ten weeks, from an average level of approximately 15% to around 12%, rather than a decline in market capitalization. The response of USDC is stronger than that of USDT.The authors note that the study cannot conclude that the total amount of bank deposits or lending decreases, and the sample only covers one cycle of high interest rates. The views in the paper belong to the authors and do not necessarily represent the position of the BIS or its member central banks.

Slow Mist stated that a fraudulent "Ledger firmware update" campaign is exploiting the recent Ledger supply chain incident to carry out attacks. The phishing page is highly realistic, including a fake "Genuine check" page, device selection interface, and "Update Now" button. Slow Mist reminds users not to update Ledger devices through website links and not to enter recovery phrases anywhere.

According to the Financial Times, Mark Zuckerberg stated that Meta Platforms (META.O) has reached the "cutting edge" of artificial intelligence and rejected calls to slow down development.

The Chief Information Security Officer of Slow Mist Security, 23pds, stated that if the modification of the Ledger device's PCB is indeed as described by former Mt. Gox CEO Mark Karpelès, the attacker would possess a considerable level of technical skill.23pds mentioned that the possible attack process involves the wallet generating a mnemonic phrase within a secure element and displaying it on the screen for the user to write down. A malicious module could obtain the displayed content through screen data lines such as SPI, record the complete mnemonic phrase, and then send the data to the attacker via LTE/eSIM. The secure element can prevent the private key from being directly read or exported, but it cannot stop external modules from accessing the information currently displayed on the screen. He noted that the above analysis is based on the premise that the PCB has indeed been modified in the described manner, and the relevant attack paths and hardware implantation still require independent verification.Mark Karpelès previously stated that a Ledger hardware wallet he received was suspected of being implanted with a spy module. The device came from Malaysia, the outer packaging was intact with shrink wrap, and the implant was hidden in the position where the screen originally had a cushion, containing LTE communication components, an antenna, eSIM, and a microcontroller connected to the Ledger SPI bus, capable of analyzing the characters displayed to the user and sending relevant data after the mnemonic phrase setup is completed.

The Chief Information Security Officer of Slow Fog, 23pds, tweeted that public WiFi itself does not steal coins. The losses are caused by phishing pages opened by fake WiFi and the actions of users themselves signing transactions or importing private keys. What websites are accessed and what operations are performed after connecting are the core factors that determine whether asset losses occur.Previously, X user Xiaoyu_184CM tweeted that after connecting to free WiFi at Singapore Airport, a wallet that had not been used for a month had 3.7 BNB transferred away. Binance founder CZ responded that he has always advised against connecting to public WiFi, but merely connecting to WiFi does not lead to wallet theft, and asked if there were any other operations in between. Crypto KOL AB KuaiDong speculated that someone might have specifically set up free WiFi or modified the router, and Xiaoyu indicated that he felt this was likely the case.

According to Slow Mist's Yu Xian monitoring, phishing attacks targeting FOMO's web bookmarks are emerging.Such phishing webpages lure users into completing fake human verification, dragging malicious JavaScript code into the browser's favorites and saving it as a bookmark. After the user clicks on this bookmark 2 to 3 times, the previously logged-in FOMO account will be hijacked by the attacker, and the encrypted assets within the account will be immediately stolen.

Slow Fog issued a security alert stating that the Aave V3 Loop Safe Module has a security vulnerability, allowing attackers to forge Safe authentication and execute arbitrary modules, stealing approximately 114.09 ETH from two Safe multi-signature wallets.Attackers bypassed authentication by forging a Safe that always returns true and executed module transactions using a router and calldata that could be arbitrarily controlled, transferring weETH and Aave collateral. After repaying approximately 1300 WETH in debt, the attackers unlocked the collateral.