Threat reportThreat IntelligenceTL-2026-4861
Infostealer Logs Expose Binance Corporate Identities Linked to Okta, Kibana, Git and JetBrains Access
Infostealer Logs Expose Binance Corporate Identities Linked (TL-2026-4861) is a medium-severity tracked intrusion set, first published 2026-10-30. It has no confirmed attribution, affects Okta Okta tenants (Binance), maps to 10 MITRE ATT&CK techniques (T1005, T1078, T1213.003), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4861
- Threat ID
- TL-2026-4861
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
How Infostealer Logs Expose Binance Corporate Identities Linked works
Flare Research analyzed 219 stealer logs (Feb 2022 - Oct 2026) containing 74 distinct @binance.com usernames and 58,846 nested records (credentials, cookies, files). Corporate identities appeared alongside developer and monitoring tools, including one identity across Okta, Kibana, Git and JetBrains, indicating device compromise, credential theft and session token exfiltration risk.
On 2026-10-30 Flare Research (Assaf Morag) published an analysis of historical infostealer logs that match the Binance corporate domain, written in the context of the Binance security incident disclosed 2026-10-29/30. The dataset comprises 219 stealer logs spanning February 2022 to October 2026, holding 74 distinct @binance.com usernames and 58,846 nested records (credentials, cookies, files and authentication artifacts). Three views were reported: binance.com URL with any username (407 credential records, 187 logs, 87 usernames); binance.com URL plus an @binance.com username (22 records, 22 logs, 7 usernames); and any @binance.com username across all destinations (356 records, 219 logs, 74 usernames).
Focusing on 168 credential records covering 35 distinct @binance.com usernames in 49 log entries, the identities were associated with: Kibana (51 records, 3 logs, 15 usernames, 16 username-host pairs), Binance Okta tenants (49 records, 29 logs, 15 usernames, 18 pairs), LastPass (22 records, 11 logs, 1 username, 1 pair), Google identity (20 records, 13 logs, 7 usernames), private-network IPs (9 records, 3 logs), JetBrains (6 records, 3 logs, 1 username), Microsoft identity (5 records, 5 logs), Git (3 records, 3 logs, 1 username) and an AWS load balancer (3 records, 3 logs). One identity appeared across Okta, Kibana, Git and JetBrains, illustrating how a single compromised endpoint can link corporate sign-in with development and monitoring tooling. The 22 LastPass records collapse to one username-host pair, so raw counts overstate exposure. One repeated collection contained 16 distinct @binance.com usernames.
Important caveats from the source: the findings do not establish that the credentials are valid, that the usernames belong to employees, or that the logs are connected to the Binance incident. The source names no malware family, threat actor, CVE or IOC. For context, public reporting (CyberInsider, HackRead) states the Binance incident (about 2026-10-29 20:05 GMT) had an estimated $6.3B impact with roughly $3B frozen, that a compromised DevOps engineer's laptop was an entry point to a service container used to submit unauthorized withdrawals, that no wallet private keys were reported compromised, and that TRM Labs and Chainalysis attributed the incident to TraderTraitor (DPRK-linked). That attribution applies to the incident, not to the stealer logs analyzed by Flare, and no link between the two is established, so this record leaves actor attribution as Unknown.
Defender relevance: stealer logs carry session cookies and tokens, so a password reset alone does not invalidate stolen sessions. Flare recommends validating exposure (identity, services, record dates, credential types), reviewing authentication logs for unauthorized access, isolating the affected endpoint, revoking sessions and refreshing tokens, resetting credentials and rotating exposed secrets, limiting persistent privileges, enforcing phishing-resistant MFA and requiring extra authorization for sensitive actions. Flare also reports processing over 1 million stealer logs per week with a minimum of about 1% containing corporate IT access.
MITRE ATT&CK techniques used in TL-2026-4861
Collection
T1005 Data from Local System; T1213.003 Code Repositories
Initial Access
Credential Access
T1528 Steal Application Access Token; T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
lateral-movement
Impact
Affected products and versions in Infostealer Logs Expose Binance Corporate Identities Linked
- Okta — Okta tenants (Binance)
Vulnerable versions: Credentials/sessions exposed via stealer logs; not a product flaw - Elastic — Kibana
Vulnerable versions: Credentials exposed via stealer logs; not a product flaw - JetBrains — JetBrains accounts/tooling
Vulnerable versions: Credentials exposed via stealer logs; not a product flaw - LastPass — LastPass
Vulnerable versions: Credentials exposed via stealer logs; not a product flaw - Google/Microsoft/AWS — Google identity, Microsoft identity, AWS load balancer
Vulnerable versions: Credentials exposed via stealer logs; not a product flaw
Remediation for Infostealer Logs Expose Binance Corporate Identities Linked
Immediate actions
- Validate each exposed identity: confirm owner, affected services, record dates and credential types
- Review Okta, Google, Microsoft, Kibana, Git and JetBrains authentication logs for unauthorized or anomalous sign-ins
- Isolate and investigate the endpoint that produced the stealer log
- Revoke active sessions and refresh tokens; a password change alone does not invalidate stolen cookies or tokens
- Reset credentials and rotate exposed secrets, including any stored in password managers
Workarounds
- Restrict access to Kibana and internal monitoring tools to managed devices and trusted networks
- Separate privileged DevOps identities from everyday browsing profiles
Longer-term hardening
- Enforce phishing-resistant MFA (FIDO2/passkeys) for identity providers and developer tooling
- Limit persistent privileges and require additional authorization for sensitive actions
- Monitor stealer-log and dark-web sources for corporate domain exposure
- Shorten session and token lifetimes and bind sessions to device posture
Weaknesses (CWE) in Infostealer Logs Expose Binance Corporate Identities Linked
Timeline of Infostealer Logs Expose Binance Corporate Identities Linked
- Earliest of the 219 analyzed stealer logs containing @binance.com identities (dataset spans Feb 2022 - Oct 2026)
- BleepingComputer/Flare article describes the stealer-log supply chain (logs resold on markets and Telegram; ~1% of logs contain corporate IT access)
- Binance security incident occurs (~20:05 GMT) with estimated $6.3B impact; unauthorized withdrawals submitted from a service container; withdrawals suspended and ~$3B frozen
- Flare Research publishes analysis of 219 stealer logs, 74 distinct @binance.com usernames and 58,846 nested records linking corporate identities to Okta, Kibana, Git and JetBrains
- TRM Labs and Chainalysis reportedly attribute the incident to TraderTraitor (DPRK-linked); not linked to the analyzed stealer logs
- Binance discloses preliminary findings: a compromised DevOps engineer's laptop may have been an entry point; SAFU and company funds to cover losses
Sources cited for Infostealer Logs Expose Binance Corporate Identities Linked
- Beyond the Binance Attack: How Stealer Logs Can Link Corporate Sign-Ins to Developer and Monitoring Tools (Flare, Assaf Morag)
- Binance links $6.3 billion security incident to compromised laptop (CyberInsider)
- Binance Probes DevOps Engineer's Hacked Laptop After $6.3B Theft (HackRead)
- Binance Says DevOps Laptop May Have Been the Entry Point in $6.3bn Incident (Disruption Banking)
- Binance freezes $3B after security incident, suspends withdrawals (Fox Business)
- $6.3 billion Binance hack is largest crypto theft on record (CNBC)
- Dissecting the Dark Web Supply Chain: Stealer Logs in Context (BleepingComputer, sponsored by Flare)
Detection coverage for TL-2026-4861
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4861 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.