{"id":"CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-","kind":"campaign","aliases":[],"related":[],"title":"GMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion","description":null,"summary":"GMO Internet's Onamae.com Desktop Cloud is a Windows virtual-desktop service used to run MT4/MT5 FX auto-trading tools. It was breached: GMO found malicious programs on customer servers on 2026-10-20 and shut down every plan on 2026-10-21. Up to 26,739 servers may be affected (GMO's upper bound). Trading and brokerage credentials stored on those servers were stolen and used for unauthorized trades at several brokers. GMO confirmed customer data was exfiltrated. The attacker demanded about JPY 8B ($50M) and threatened more trading across 70+ brokers, data leaks, and ransomware on customers' connected PCs. GMO refused to pay. After the 2026-10-27 deadline the attacker published data it says belongs to GMO and its customers. So far GMO has found no malware on the customer PCs it has analysed. How the attacker got in: unknown. At risk: anyone who used the service or stored credentials on it, and any PC that connected to it over RDP.","severity":"critical","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-27T09:05:19+00:00","products":[{"name":"Onamae.com Desktop Cloud","fixed":[],"vendor":"GMO Internet"},{"name":"MetaTrader 4/5","fixed":[],"vendor":"MetaQuotes"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Did anyone use Onamae.com Desktop Cloud? Check broker trade history and balances for trades you did not make since 2026-10-20. On PCs that connected over RDP, look for new Startup-folder entries and check whether drive or clipboard redirection was on.","fix":"Treat every credential saved on the service as compromised. Change MT4/MT5 and brokerage passwords from a device that never connected, end all active broker sessions, and turn on 2FA. Report unknown trades to the broker and to GMO (compensation claims open by 6 Nov). Scan and back up PCs that connected. Do not open the leaked data. Ignore 'loss recovery' offers, they are scams. The platform will not come back, so move to other infrastructure.","status":"open","published_at":null,"first_seen_at":"2026-10-27T09:05:19+00:00","triaged_at":"2026-10-27T09:05:19+00:00","updated_at":"2026-10-27T09:05:19+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':74B,83B,150B '-20':75B '-202610':19A '-21':84B '-27':151B '2026':73B,82B,149B '26':87B '4/5':35A '50m':16A,127B '70':133B '739':88B '8b':126B 'across':132B 'affect':92B 'analys':178B 'anyon':187B 'attack':122B,154B,181B 'auto':59B 'auto-trad':58B 'belong':159B 'bound':96B 'breach':8A,64B 'breached':29A 'broker':10A,114B,134B 'brokerag':99B 'campaign':36B 'cloud':4A,25A,33A,45B 'cmp':18A 'com':23A 'confirm':116B 'connect':141B,201B 'credenti':100B,194B 'custom':70B,117B,140B,164B,174B 'data':118B,135B,156B 'deadlin':152B 'demand':123B 'desktop':3A,24A,32A,44B,51B 'earli':38B 'early-warn':37B 'everi':79B 'exfiltr':120B 'extort':17A 'far':166B 'found':66B,169B 'fx':5A,26A,57B 'gmo':1A,21A,40B,65B,93B,115B,143B,161B,167B 'gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored':20A 'got':182B 'internet':41B 'jpi':125B 'leak':136B 'login':11A 'malici':67B 'malwar':171B 'may':90B 'metatrader':34A 'mt4/mt5':56B 'onamae':22A 'onamae.com':2A,31A,43B 'pay':146B 'pc':199B 'pcs':142B,175B 'plan':80B 'program':68B 'publish':155B 'ransomwar':138B 'rdp':205B 'refus':144B 'risk':186B 'run':55B 'say':158B 'server':71B,89B,104B 'servic':52B,191B 'sever':113B 'shut':77B 'stolen':106B 'store':9A,101B,193B 'stored':30A 'threaten':129B 'tool':61B 'trade':6A,15A,60B,97B,111B,131B 'trading':27A 'unauthor':14A,110B 'unknown':184B 'upper':95B 'use':12A,53B,108B,189B 'vdi':7A,28A 'virtual':50B 'virtual-desktop':49B 'warn':39B 'window':48B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:30:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-27T09:05:19+00:00","fetched_at":"2026-10-27T09:05:19+00:00","note":null}],"documents":[{"id":5798,"url":"https://news.ycombinator.com/item?id=50256265","title":"Onamae VDI hacked, customers reported unauthorized txs in their trading accounts","kind":"post","source":"hackernews","text":"Onamae VDI hacked, customers reported unauthorized txs in their trading accounts\nhttps://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand\n\n1 points, 0 comments on Hacker News","published_at":"2026-10-27T08:54:59+00:00","relation":"describes","confidence":null,"note":null},{"id":5801,"url":"https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand","title":"Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand","kind":"blog","source":"analyst","text":"GMO Internet's Onamae.com Desktop Cloud (Windows VDI for MT4/MT5 FX auto-trading) breached. GMO found malicious programs on customer servers 20 Oct 2026, stopped all plans 21 Oct; up to 26,739 servers possibly affected (ceiling). Trading/brokerage credentials stored on servers taken and used for unauthorized trades at several brokers. From 24 Oct GMO confirms customer info exfiltrated. Extortion email 21 Oct demanding ~JPY 8B ($50M), threatening more trades across 70+ brokers, leaks, ransomware on connected PCs. GMO refused; 27 Oct noon JST deadline passed; no malware found on analysed customer devices so far; attacker published claimed data. Entry vector undisclosed. Platform will not restart. Actions: rotate MT4/MT5 and broker passwords from a clean device, end all broker sessions, enable 2FA, review trade history, scan PCs that connected (review RDP drive/clipboard redirection, Startup-folder persistence), beware recovery scams. Sources: GMO reports 1-11, The Register, piyolog, Impress Watch.","published_at":"2026-10-27T01:30:07+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}