By Govind Rammurthy, CEO & MD, eScan
The two biggest cyberattacks of 2026 are following a pattern, and it begins not with a breach of a firewall or a zero-day exploit, but with something much more ordinary. A message on a job platform. An invitation to interview. A link to join a meeting.
In April 2026, the Axios supply-chain attack that threatened millions of developer environments worldwide began when a threat actor, later identified as North Korea’s UNC1069 group, spent weeks building a fabricated company and a trusted relationship with a single open-source maintainer, before steering him toward a fake Microsoft Teams meeting that compromised his machine.
The $6.3 billion breach of Binance in October 2026, the largest crypto theft ever, began when a Binance engineer took a seemingly legitimate job interview, eventually was asked to download a “assignment” repository and unknowingly ran malware that allowed attackers to broaden their access.
Both attacks were linked by investigators to North Korean state-sponsored actors. Both took months of patient preparation. Both began on a note so unremarkable that the victim had no reason for suspicion. And both ended with damage so severe that they raised serious concerns across their respective industries.
The evolution from phishing to performance
For years, cybersecurity awareness training taught people to look for the obvious signals: the misspelled domain, the generic greeting, the suspicious attachment. Those warnings remain valid, but they describe a threat landscape that has fundamentally moved on. What Axios and Binance demonstrate is that the most dangerous attacks now look nothing like attacks at all. They look like opportunities.
The attacker no longer needs to trick someone into clicking a suspicious link in a cold email. They build a relationship first. They create a convincing LinkedIn page, a verified company, a Slack workspace with real activity and real-looking colleagues. They conduct a first-round interview with a personable HR representative. They build trust over days or weeks. And then, at precisely the right moment, they introduce the payload, disguised as a reasonable step in a legitimate process: download this assignment, update this tool before the meeting begins, run this setup script to get the repository working.
The technical deception, when it finally arrives, is almost secondary. The real work has already been done by the time the malware executes.
The foreground and the background
Here is what I believe deserves much closer examination, drawing from both incidents. When an attacker conducts a live video interview with a target, two things can be happening simultaneously, one visible and one not, one in the foreground & other in the background.
In the foreground, the target is engaged in a credible, face-to-face conversation. Their attention is fully occupied. Their guard is contextually lowered because a human relationship is unfolding in real time. Any unusual process activity, any unexpected network connection, any background operation on their machine is likely not to be noticed precisely because they are actively engaged in something that feels entirely legitimate.
In the background, the attacker’s second operator could be using the access already established, by a prior download or a prior compromise, to quietly move through the target’s machine. Reading files, mapping credentials, identifying which colleagues have access to what systems, understanding the architecture of the internal environment. The video call is not just a lure. It is cover. It is like what we watch in the movies – keep a kidnapper on a phone call, while the location of the caller can be traced by the police. Except, here it is the other way around. The good guys are kept occupied, while the villains are busy scouting through the endpoint system.
This is consistent with the Binance timeline. The attacker compromised Engineer B in September, then used the access to pivot to Engineer A’s credentials in October by exploiting an internal AI tool. That lateral movement required time and concealment. A video call in the foreground would be one way to provide both. This remains a logical inference rather than a confirmed detail of either incident, but it fits the pattern precisely and the industry should take it seriously.
The endpoint is always the crime scene
What connects Axios and Binance at a technical level is not the sophistication of the final exploit but the simplicity of the entry point. In both cases, a trusted employee on a seemingly normal machine executed something they were given reason to trust, and the endpoint security in place did not stop it.
In the Binance incident, the malware employed obfuscation techniques that bypassed the installed endpoint protection. In Axios, the ClickFix technique bypassed automated defences entirely by making the victim execute the command themselves, so the security tool saw a legitimate user action, not an attack.
This is the uncomfortable truth that both incidents force into view. Endpoint security that purely relies on signature matching and known-bad patterns is structurally blind to this class of attack. What is needed is behavioural monitoring that asks not “does this match a known threat” but “is this machine doing something it has never done before?”
A clipboard monitor that inspects content before execution would have caught the Axios ClickFix. An egress monitor that flags unexpected outbound connections would have caught the Binance RAT’s first call home. Neither requires knowledge of the specific malware. Both require watching behaviour rather than matching signatures.
The pattern is the warning
Axios began with a fake Teams meeting. Binance began with a fake job interview. The next attack in this series will begin with something equally trivial: a survey invitation, a conference registration, a software update prompt, a form to fill out before a webinar. The entry point will be chosen because it is the one thing the target will not question.
The defence cannot be “teach people not to fall for it.” Nation-state operators who spend months profiling a target and constructing a believable world around them will eventually find the moment that works. The defence has to be at the endpoint, watching what actually happens on the machine after the human has made their decision, and stopping the chain before it reaches anything that matters.
Both incidents prove that the chain can be stopped. It just has to be stopped early, quietly, and automatically, long before anyone realises the interview was never real.