GMO Onamae Desktop Cloud breach: trading logins stolen, unauthorized trades
Teaser from the source
GMO Internet’s Onamae Desktop Cloud, a Windows VPS service used for FX and stock trading tools, was breached: attackers planted malicious programs, took customer data stored on the servers (including trading-account logins saved in tools like MT4/MT5), and customers reported unauthorized trades. All plans (up to 26,739 servers) were shut down on Oct 21, the attacker is extorting GMO and on Oct 27 published what it claims is GMO and customer data (GMO is still verifying it and warns against visiting the leak site; no ransomware attack had been seen by 13:55 JST), and GMO will not restart the old platform; it is paying every customer 5,000 yen and its CEO says it will compensate losses from unauthorized trades in full, even where brokers refuse refunds.
This is the RSS-feed teaser. Read the full article at the original source.
Read at pwn.watchMore on Desktop
Other advisories
- MediumCVE-2026-53495Docker Desktop: Schwachstelle ermöglicht Denial of Service
- HighCVE-2026-55889Flatpak Xdg-desktop-portal: Sicherheitslücke
- HighCVE-2026-55888Flatpak Xdg-desktop-portal: Pfadüberschreitung (Path Traversal)
- Not ratedosv:CVE-2026-55888XDG Desktop Portal: Arbitrary file access via SaveFiles "files" option path traversal
- HighCVE-2026-55888Flatpak Xdg-desktop-portal: Pfadüberschreitung (Path Traversal)
- HighCVE-2026-55889Flatpak Xdg-desktop-portal: Sicherheitslücke
- Not ratedosv:CVE-2026-55889XDG Desktop Portal: Drag-and-drop and copy-paste theft via predictable FileTransfer key
- MediumCVE-2026-114606Jgraph Drawio-desktop: Pfadüberschreitung (Path Traversal)
Other news entries
- Japanese virtual desktop cloud hacked so hard it asks to be bannedNewsThe Register — Security
- Kali Linux 2026.3 released with 6 new tools, desktop updatesNewsBleepingComputer
- Kali Linux 2026.3 released with 7 new tools, desktop updatesNewsBleepingComputer
- Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affectedNewsBleepingComputer
- Microsoft fixes classic Outlook bug that hid Copilot buttonsNewsBleepingComputer
- Docker Desktop: Schwachstelle ermöglicht Denial of ServiceVulnerabilityBSI CERT-Bund
- Microsoft fixes bug causing Windows black screens, Explorer crashesNewsBleepingComputer
- Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click ThreatNewsDark Reading
Source: https://pwn.watch/i/onamae-desktop-cloud-malware-oct