Monthly Security Quiz — Learn with Mangaby Dawnlight日本語

Monthly Security Quiz — Learn with Manga

November 2026

Information as of 2026-11-07. Details of ongoing investigations may change.

① Manga

Manga 1: The side-job offer
Four-panel manga. The hero gets a side-job offer, is told in an online interview to open an assignment file on a work computer, and stops to ask someone first.
  1. 1. Hero「A side-job offer? The pay looks great...」
  2. 2. Interviewer「My connection is bad, so I’ll turn off my camera.」
  3. 3. Interviewer「Here’s your assignment. Please open this file on your work computer.」
  4. 4. Hero「...On my work computer? Let me check with someone first.」
Manga 2: Check before you install
Four-panel manga. After talking to the boss, the hero compares the top ad result with the official site’s address and installs the software from the official site.
  1. 1. Boss「Never open files from people you don’t know on a work computer.」
  2. 2. Hero「I also need a tool for work... is the top result OK?」
  3. 3. Hero「Wait, this address isn’t the official site.」
  4. 4. Hero「I’ll get it from the official site. When in doubt, ask!」

② What to learn this month

Main

Fake job interviews and "assignment" files

  • Attackers pose as recruiters or business partners and ask you to run a file or program, calling it an "assignment," a "test," or a "bug fix."
  • Be careful with unexpectedly generous offers, requests to run something on a work computer, and requests to move to another chat app.
  • Do not run files or programs from people you don’t know on a work computer.
  • Check that the person is real through a separate channel, such as the contact details on the company’s official website.
  • If you ran it, or suspect an infection, disconnect the computer from the internet right away and report it to your boss or IT contact.
  • When you install software, make sure the page belongs to the maker or an official store. The top search results, including ads, are not always official. If unsure, ask your IT contact.

Sources

Topic

After a data leak: fake emails and passwords

  • In October, many organizations in Japan reported data leaks caused by unauthorized access. The National Police Agency warns about fake emails that pretend to come from the company that leaked the data.
  • If you get an email like "please reset your password," don’t use its link. Log in yourself from a bookmark or the official app.
  • Use long passwords, a different one for each service. The US NIST guideline (SP 800-63B-4) requires at least 15 characters when a password is the only login factor, and at least 8 when combined with multi-factor authentication.
  • Turn on multi-factor authentication. Japan’s national handbook recommends authenticator apps and USB security keys, and lists codes sent by SMS or email as "not recommended."
  • You generally don’t need to change passwords on a schedule. Change one right away if it may have leaked.

Sources

Topic

Ransomware: a record half-year, about 60% of victims are SMEs

  • According to Japan’s National Police Agency, 123 ransomware cases were reported in the first half of 2026, the most for any half-year since records began.
  • About 60% of the victim companies were SMEs. Being small does not mean you won’t be targeted.
  • In a survey of victims, about half of the intrusions came through VPN devices. Attackers get in through unpatched weaknesses or leaked IDs and passwords.
  • For owners and admin staff: check three things — keep VPN devices up to date, manage IDs and passwords properly, and take backups.
  • For employees: if something seems wrong — files won’t open, a strange ransom note appears — don’t try to fix it yourself. Report it to your boss or IT contact right away.

Sources

③ Quiz

④ This month’s cases

Binance theft (Oct 29, 2026)

  • A large amount of crypto assets was stolen from the major exchange Binance. Reported figures vary; the company’s co-CEO put it at about $6.34 billion.
  • According to the company, there were two entry points: an engineer who searched for an AI coding tool installed a tampered installer, and another engineer ran a coding assignment with hidden malware during fake job interviews.
  • The FBI has linked the attack to a North Korea-linked group. The company has pledged to cover customer losses.

Sources

Unauthorized access to GMO Internet’s cloud desktop service (found Oct 20, 2026)

  • The company confirmed that a third party had placed malicious programs on some customers’ server environments. It said 26,739 servers may be affected (not the number confirmed as breached).
  • The company said the attacker demanded money and that it consulted the police, and warned customers about suspicious messages exploiting the incident.

Sources

A wave of data leaks in Japan (Oct 2026)

  • From around September, several organizations in Japan reported personal data leaks caused by unauthorized access. On October 8 and 9, JPCERT/CC, the National Police Agency, IPA and others issued warnings one after another.
  • IPA asked businesses to check three things: apps exposed to the internet, external services in use, and the data they hold.

Sources

Joint advisory on a group using fake interviews (Sep 18, 2026)

  • Japan’s National Police Agency, the National Cybersecurity Office, the FBI and others issued a joint advisory on the North Korean group "WaterPlum" (Contagious Interview), which poses as recruiters and gets people to run malicious files during interviews or assignments.
  • From around December 2025 to July 2026, it compromised at least 30,000 PCs in more than 100 countries.

Sources