| Article<\/th> | D\u00e9tail<\/th><\/tr><\/thead> | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Chainstack<\/td> | Attacked Oct 26; customer account database accessed, including password hashes; customers told to rotate node credentials (per SecurityWeek)<\/td><\/tr> | ||||||||||||||||||
| WorkOS<\/td> | Found Oct 30; internal sales\/support app; CRM and support data affected; no evidence application data was accessed (per WorkOS)<\/td><\/tr> | ||||||||||||||||||
| Trigger.dev<\/td> | Nov 1; environment variables exposed for a subset of organizations; exploit blocked (per Trigger.dev)<\/td><\/tr> | ||||||||||||||||||
| Northflank, CommandCode<\/td> | Listed by SecurityWeek; details not confirmed in our review<\/td><\/tr> | ||||||||||||||||||
| Wiz<\/td> | Same keys used by several actors; first misuse within 30 minutes in two cases<\/td><\/tr><\/tbody><\/table><\/figure>\n\n![\"Diagram](\"https:\/\/cyber.mag212.com\/wp-content\/uploads\/2026\/11\/mag212-2026-11-05-fig-key.jpg\") What each company says<\/h2>\n\nWorkOS<\/strong> identified unauthorized access on October 30 to an internal application used by its sales and customer-facing teams. It says the affected data is CRM and support information: business contacts, account histories, notes from sales calls, support conversations and customer Slack threads, and product usage. It says there is no evidence that WorkOS application data or production services were affected, and that the attackers used AI-based offensive tooling. Its advice to customers is to watch for phishing that uses those real details.<\/p>\n\n Trigger.dev<\/strong> says an exploit gave an attacker access to environment variables for a subset of organizations on November 1, that the exploit has been blocked, and that affected account owners were emailed mitigation steps. It does not say which variables were exposed.<\/p>\n\n Chainstack<\/strong>, attacked on October 26, had a customer account database accessed, including organization names, account holder names, emails and password hashes, according to SecurityWeek. Node credentials may also have been exposed, and customers were told to rotate them.<\/p>\n\n Wiz found that several threat actors used the same stolen keys, which suggests they are being sold, and in two cases the first unauthorized activity came within 30 minutes of the credentials being exposed. Wiz links the surge to LLM-jacking: running AI workloads on stolen tokens or reselling access. SecurityWeek also reports that multiple companies link the open-source Artex AI pentest framework to some of these attacks and to Storm-0940, a Chinese threat group. We could not confirm whether this is the same “ARTEX” tooling India’s CERT-In names in its Crafty Falcon advisory.<\/p>\n\n Ask each platform vendor where your secrets are stored, who inside the vendor can read them, and how quickly they will tell you about a breach. Prefer short-lived, workload-scoped credentials over long-lived keys in environment variables, and treat any third party that holds your keys as part of your attack surface.<\/p>\n\n Based on WorkOS’s statement, the affected data was CRM and support information, not application data or secrets. The main risk is targeted phishing. Follow any direct instructions WorkOS sends you.<\/p>\n\n In two cases Wiz saw the first misuse within 30 minutes of exposure. Rotate first, then investigate.<\/p>\n\n Some are reportedly linked to the Artex framework and Storm-0940, but a single actor behind all of them has not been established.<\/p>\n\n |