The Red Thread Weekly Wrapup: Issue #30
Friday, November 6, 2026
Categories: IT Risk Management | Information Security | Penetration Testing
From October 30 to November 5, 2026
In Issue #29, I wrote that the score is not the risk; this week’s incidents show why access itself has become a commodity, stolen through trusted channels and resold for someone else’s use.
Four Firms, One Phone Call
The Globe and Mail reported a coordinated voice-phishing campaign against four of Canada’s largest law firms: McCarthy Tetrault, Bennett Jones, Borden Ladner Gervais, and Davies Ward Phillips & Vineberg. Callers posed as internal IT staff on phone calls and Microsoft Teams, then directed employees to fraudulent sign-in pages designed to bypass multi-factor authentication. The Globe and Mail reported at least seven compromised employee accounts and access to thousands of client files, including revenue reports, mandate descriptions, and privileged client information.
McCarthy Tetrault said the incident began October 22, involved unauthorized access to certain files containing client information, and prompted the firm to begin contacting affected parties on October 25. It also said it engaged CrowdStrike. Reports have put the number of stolen files at around 31,000, but the firm has not confirmed that count.
Separately, California disclosures describe August social-engineering incidents at two U.S. firms. Baker McKenzie reported that two users were deceived on August 14 and 17; a limited number of files were taken, and no additional accounts were compromised. Troutman Pepper Locke said an employee was deceived on August 7 into sending client-matter documents to an unauthorized person, while the firm’s systems were not accessed. Both firms are offering 24 months of credit monitoring.
For executives, the lesson is direct: a multi-factor prompt cannot protect an employee who believes the caller is IT. Verification, not a general appeal to vigilance, is the control. I’ve written more about that distinction in why technical verification matters in risk management.
One Vendor, Forty-Nine Front Doors
Two third-party incidents this week show how one trusted provider can extend exposure across many organizations. Amadeus, the travel-technology provider, said attackers used credentials assigned to a system account to view passenger reservation data in a booking display environment. The reported access period stretched from August 2023 to September 2026: roughly three years.
Airlines have disclosed affected records in sequence: Cathay Pacific reported about 53,000 bookings; Japan Airlines, about 92,000 customers, including Japan Transocean Air; Singapore Airlines, about 46,000 booking records; and Malaysia Airlines said customer data processed through Amadeus may have been affected. The exposed information generally included names, booking references, and itineraries. A smaller subset included passport numbers and contact details. The airlines said payment data was not exposed and their own systems were not breached.
In Japan, email-marketing provider YMIRLINK’s October 26 update on its Cuenote FC platform breach raised the cumulative exposure to roughly 51.63 million records across 49 client systems, with 16 more systems still under investigation. That is a record count, not a count of unique people. Clients notifying customers include JR group companies Express Yoyaku and smartEX, Resona-group banks, and honto. The vendor attributed the breach to a software-library vulnerability and stolen staff credentials, and warned about phishing emails impersonating its domain.
Your fourth party is part of your exposure. A SOC 2 report from a vendor cannot tell you whether a particular account has been quietly reading data for years. That is the gap I examine in the vendor transparency trap.
The Market for Stolen Keys
Wiz Research called it Black October: at least nine AI developer platforms disclosed incidents during the month, Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Brev (NVIDIA), Trigger.dev, and Chainstack were later added to the public list. There is no single vulnerability linking these incidents. What Wiz found in common was attackers searching for stored environment variables, especially keys that grant access to AI services. Zeabur announced it is shutting down because of its incident. OpenCode and CommandCode attributed their incidents to attempts at distillation, using stolen access to copy the outputs of leading models.
After a Wiz alert, Northflank disclosed an incident on October 30 and told customers to assume all stored environment variables had been decrypted and to rotate every secret immediately. Wiz traced two stolen enterprise Amazon Bedrock keys from theft to abuse. The first unauthorized test call followed the vendor breach within 30 minutes. Days of low-volume validity checks came next, followed by roughly 800,000 calls over 30 hours in one case and about 1.7 million over 13 hours in the other. Wiz estimated the combined usage was likely worth more than $100,000 at list price. It also documented open resale hubs advertising discounted access to leading AI models, paid in cryptocurrency.
For a board, the important shift is that a stolen key is not necessarily an incident that ends when it is revoked. It is inventory that can be tested, priced, and sold. I explore the business implications of AI access in my guide to agentic AI security.
When the Delivery Channel Is the Attack
Cursor found tampered copies of the Anthropic.claude-code extension, versions 2.1.312 and 2.1.313, in its own extension marketplace. The versions were available for roughly 11 hours on October 29. When loaded, the code collected system information, added an attacker-controlled SSH key labeled svc-telemetry to authorized_keys, and set up persistent reverse SSH tunnels. Microsoft published a technical breakdown; Cursor removed the versions and published detection guidance.
Tensorlake disclosed that attackers took over a maintainer account on October 8 and published a malicious 0.5.144 release of its npm SDK, designed to steal developer credentials. It was live for about 100 minutes. In a separate case, GitHub’s advisory for malicious npm package @atlisp/mcp 1.12.14 told anyone who installed it to treat the machine as fully compromised.
The update channel an organization trusts is part of its attack surface. Eleven hours, or even 100 minutes, can be enough to plant persistence before anyone knows to look.
The Rest of the Patch List
On October 30, CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog: CVE-2026-118527, involving predictable identifiers that enable file uploads, and CVE-2026-111357, involving missing authentication for a critical function. Researchers report attackers chaining them with CVE-2026-104935 to reach unauthenticated code execution as root. Fixes are available in Connect Secure 25.1.1.3 and 22.8R2.6. WordPress Core CVE-2026-119977, a time-of-check/time-of-use race condition in the upgrade process, was added November 3 after WordPress 7.1.4 fixed it. Apple CVE-2024-27834, involving improper authentication across multiple products, was added November 4.
Canada’s cyber security agency now reports in-the-wild exploitation of Oracle E-Business Suite CVE-2026-101767, an unauthenticated takeover flaw in Application Object Library patched October 20. These are not abstract maintenance items: I’d use scanning versus testing to help distinguish finding known weaknesses from validating what an attacker can actually do.
The Takeaway
This week, I’m less interested in whether a credential might leak than in who will be shopping for it when it does. Verify the requester, limit what each vendor account can reach, and treat every stored secret as something with a resale price. If this is on your executive agenda, I’m open to comparing notes.
Comments