---
id: "CMP-202610-gmo-onamae-com-desktop-cloud-fx-trading-vdi-breached-stored-"
kind: "campaign"
aliases: []
title: "GMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion"
severity: "critical"
cvss: null
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Onamae.com Desktop Cloud", "fixed": [], "vendor": "GMO Internet"}, {"name": "MetaTrader 4/5", "fixed": [], "vendor": "MetaQuotes"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-10-27T09:05:19+00:00"
updated_at: "2026-10-27T09:05:19+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-27T09:05:19+00:00"}]
---

# GMO Onamae.com Desktop Cloud (FX trading VDI) breached: stored broker logins used for unauthorized trades, $50M extortion

GMO Internet's Onamae.com Desktop Cloud is a Windows virtual-desktop service used to run MT4/MT5 FX auto-trading tools. It was breached: GMO found malicious programs on customer servers on 2026-10-20 and shut down every plan on 2026-10-21. Up to 26,739 servers may be affected (GMO's upper bound). Trading and brokerage credentials stored on those servers were stolen and used for unauthorized trades at several brokers. GMO confirmed customer data was exfiltrated. The attacker demanded about JPY 8B ($50M) and threatened more trading across 70+ brokers, data leaks, and ransomware on customers' connected PCs. GMO refused to pay. After the 2026-10-27 deadline the attacker published data it says belongs to GMO and its customers. So far GMO has found no malware on the customer PCs it has analysed. How the attacker got in: unknown. At risk: anyone who used the service or stored credentials on it, and any PC that connected to it over RDP.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :Onamae.com Desktop Cloud affected ? fixed ?
- :MetaTrader 4/5 affected ? fixed ?

## How to check

Did anyone use Onamae.com Desktop Cloud? Check broker trade history and balances for trades you did not make since 2026-10-20. On PCs that connected over RDP, look for new Startup-folder entries and check whether drive or clipboard redirection was on.

## Fix

Treat every credential saved on the service as compromised. Change MT4/MT5 and brokerage passwords from a device that never connected, end all active broker sessions, and turn on 2FA. Report unknown trades to the broker and to GMO (compensation claims open by 6 Nov). Scan and back up PCs that connected. Do not open the leaked data. Ignore 'loss recovery' offers, they are scams. The platform will not come back, so move to other infrastructure.

## Timeline

- 2026-10-27T09:05:19+00:00 analyst

## Documents

- [describes] Onamae VDI hacked, customers reported unauthorized txs in their trading accounts https://news.ycombinator.com/item?id=50256265
- [describes] Onamae.com Desktop Cloud breach: GMO virtual desktop service hacked, FX trading accounts compromised, $50M extortion demand https://helix.ml/threat-watch/i/onamae-com-desktop-cloud-breach-gmo-virtual-desktop-service-hacked-fx-trading-accounts-compromised-50m-extortion-demand

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_