What to look out for today
- Binance/crypto-themed fraud: expect an uptick in emails, calls and social messages using the “largest crypto heist” headlines to trick staff into sharing credentials, approving withdrawals, or “verifying” wallets/accounts.
- “Urgent GitLab/password reset” impersonation: attackers often piggyback on stories about attempted break-ins to send fake security alerts, fake MFA resets, or fake IT tickets to capture logins.
- Knock-on invoice/payment change attempts: fraudsters may use these headlines to add urgency (“we’ve been compromised”, “new secure bank details”, “move funds to safe account”).
Why this matters to smaller businesses
Even if you don’t use Binance or run GitLab yourself, criminals reuse big news stories as believable cover for phishing and payment diversion. SMEs and charities are attractive targets because a single finance login, email account or admin session can be enough to steal money or access sensitive data.
Warning signs
- Messages claiming “your account is at risk” that push you to log in via a link or scan a QR code.
- Requests to disable MFA, “re-enrol” MFA, or approve an unexpected sign-in.
- Phone calls (or Teams/WhatsApp messages) insisting on an urgent transfer to “protect funds” or “complete compliance checks”.
- “Security incident” notices that come from non-standard sender domains, or are sent to non-IT staff (finance/admin) who wouldn’t normally get platform alerts.
- Any request to change supplier bank details that bypasses your normal process.
How attackers may exploit the situation
- Brand impersonation: fake Binance “case updates”, “refunds”, or “account recovery” workflows to steal credentials or get victims to approve transactions.
- Credential harvesting: fake “GitLab security reset” pages (or fake internal IT messages) to capture passwords and MFA codes.
- Business email compromise (BEC): once inside email, criminals target your finance process with payment changes, urgent invoice chasing, or “new account details” requests.
What to do today
- Brief finance and admin staff (5 minutes): no payment changes or “protect funds” transfers based on email/calls alone—use a trusted callback number.
- Lock down admin access: ensure MFA is enabled for email, finance, and any code/dev platforms; remove dormant accounts.
- Check alert routing: confirm who receives security alerts for key services (email, accounting, payroll, cloud, source control) and that alerts go to the right people.
- Rehearse the “verify before you pay” step: enforce dual approval for unusual payments and supplier bank changes.
Ask your IT provider
- Do we have phishing-resistant MFA options (or at least strong MFA) on email and key admin accounts, and is it enforced?
- What’s our process if a staff member entered credentials into a fake login page—who do they call, and what gets revoked/reset first?
- Are there controls to detect or block impossible travel / suspicious sign-ins for our email and cloud services?
- Do we have a documented supplier bank-change verification process, and can you help us implement it in practice?
Patch watch - only one short paragraph, and only if relevant
Separately, there is reporting about attackers attempting to exploit critical issues in developer tooling and infrastructure (including GitLab). If you run self-hosted platforms, ensure your IT team/provider is monitoring vendor security advisories and applying updates promptly—these systems often sit close to sensitive data and credentials.
One action today
Send a same-day note to finance/admin: “No payment or bank-detail changes from email/calls—always verify via a trusted callback and require dual approval for unusual transfers.”
Related Actions On Cyber resource
Actions On Cyber checklist: Payment change & invoice fraud (BEC) verification steps
Sources
- FBI links $6.3 billion Binance crypto heist to North Korean hackers (BleepingComputer)
- FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist (The Hacker News)
- Alpine Linux rebuilds GitLab after attempted RCE attack (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.