[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmtK9NhUaPPx3DQLVDBf3ETO11xjMHKW6jtIGpBYmgQg":3},{"article":4,"iocs":48,"watch_terms":51,"solutions":52,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"38bf1f55-c945-438e-9428-511630f9adca","MetaMask says recent attack didn't affect wallet infrastructure","metamask-says-recent-attack-didn-t-affect-wallet-infrastructure-59e451","Cryptocurrency wallet provider MetaMask said a recent security incident has not affected MetaMask wallets or its wallet infrastructure. [...]","MetaMask has disclosed a security incident where a threat actor gained access to systems managing recipient addresses and diverted approximately 0.385 ETH in staking rewards. The company emphasized that this incident did not affect MetaMask wallets, wallet infrastructure, customers' staked principal, or withdrawal keys, and users' Secret Recovery Phrases and private keys remain secure. While some customers experienced temporary withdrawal delays and potential missed staking rewards, MetaMask is working to refund affected users and has secured the compromised systems.","MetaMask reports a security incident where a threat actor diverted staking rewards but did not compromise user funds.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmetamask-says-recent-attack-didnt-affect-wallet-infrastructure\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F06\u002FMetamask.jpg","2026-11-06T09:22:28+00:00","2026-11-06T10:00:25.731837+00:00",7,[17,20,23,26,28],{"name":18,"type":19},"MetaMask","product",{"name":21,"type":22},"Consensys","vendor",{"name":24,"type":25},"Ethereum","technology",{"name":27,"type":19},"Ledger",{"name":29,"type":19},"Binance","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,43],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49],{"type":34,"value":34,"context":50},"Malware installed by a Binance employee during a fake job interview.",[21,18,27],{"controls":53,"vendors":140},[54,82,111],{"slug":55,"name":56,"problem":57,"products":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":55,"product_name":79,"url":80,"description":81},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":83,"name":84,"problem":85,"products":86},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[87,95,103],{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","enterprise-security","Splunk Enterprise Security","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fenterprise-security.html","SIEM for detection, investigation and response, on premises or in the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-security-operations","Google Security Operations","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fsecurity-operations","Cloud SIEM and SOAR, formerly Chronicle.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","sentinel","Microsoft Sentinel","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-sentinel-siem","Cloud SIEM and automated response, built on Azure.",{"slug":112,"name":113,"problem":114,"products":115},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[116,124,132],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",[],{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":153},"metamask-staking-system-compromised-via-unauthorized-access-to-recipient-address-management","MetaMask Staking System Compromised via Unauthorized Access to Recipient Address Management","A threat actor gained unauthorized access to systems responsible for managing recipient addresses in MetaMask's staking infrastructure, allowing them to divert approximately 0.385 ETH in staking rewards. While core wallet infrastructure, private keys, and staked principal were unaffected, the breach highlights how even peripheral systems handling fund routing can be exploited for financial gain. The incident caused temporary withdrawal delays and missed rewards for some users, undermining trust even without a catastrophic loss. This matters because attackers increasingly target adjacent or supporting systems — not just core infrastructure — to intercept value flows with minimal footprint.",[146,147,148,149,150,151,152],"CIS Control 6: Access Control Management","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","DORA Article 9","MITRE ATT&CK T1565: Data Manipulation",{"DORA Article 9":154,"MITRE ATT&CK T1565: Data Manipulation":155,"NIST SP 800-53 SI-2: Flaw Remediation":156,"CIS Control 6: Access Control Management":157,"CIS Control 17: Incident Response Management":158,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":159,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":160},"As a financial services-adjacent platform handling user funds, MetaMask's incident illustrates the need for robust ICT security controls over systems that route or manage digital assets, as required by DORA Article 9 for resilience of financial entities.","The attacker manipulated recipient addresses to divert staking rewards, a classic data manipulation technique that integrity monitoring and change-detection controls could have detected and blocked in near real time.","If the compromise exploited a misconfiguration or unpatched vulnerability in the systems managing recipient addresses, timely flaw remediation processes mandated by SI-2 would have reduced the attack surface.","The attacker accessed systems managing recipient addresses, indicating insufficient restrictions on who could modify fund-routing configurations; CIS Control 6 mandates strict access control and least-privilege enforcement on sensitive systems.","MetaMask's response — securing compromised systems and committing to user refunds — reflects incident response practices; a pre-defined playbook for financial system breaches would have reduced user impact and response time.","Securing the compromised systems after the fact suggests pre-incident vulnerability management was insufficient; A.8.8 requires proactive identification and remediation of technical vulnerabilities before they are exploited.","The unauthorized access to address-management systems points directly to a failure in authenticating and authorizing who could alter payout destinations, which PR.AA requires organizations to rigorously control."]