Ex-FBI Agent Steals $2.5M in Crypto, Grok App Data Exposures and More Cybersecurity News - ForkLog
A former FBI agent has pleaded guilty to stealing nearly $2.5 million in cryptocurrency from wallets whose keys the bureau collected during 35 criminal investigations, the US Department of Justice announced.
Yaroch, 37, had served in the FBI’s Boston field office since 2017 on a team countering an unnamed state. In February 2025, he moved to the counterintelligence and espionage division and gained access to systems storing cryptocurrency information.
Prosecutors said Yaroch made about 100 transfers: he took coins from investigation subjects, from entities acting on behalf of hostile countries, and from at least one FBI address. He exchanged the stolen funds for other cryptocurrencies to conceal their origin.
From November 2025 to January 2026, the ex-agent spent about $93,000 on credit card payments, a car, and other loans. He planned to fund a new life abroad with the rest: on ChatGPT’s advice, to buy a vineyard in Portugal.
On June 15, he issued a power of attorney to local lawyers to obtain a tax number and scheduled a move for September. Prosecutors said his actions jeopardized investigations into criminal groups and foreign adversaries of the United States.
Sentencing is set for March 4, 2027, and Yaroch faces up to 20 years in prison.
Swarm Desktop Update Compromised
Malware disguised as the Swarm Desktop app and the bee-js library stole crypto wallet keys and opened remote access for attackers, researchers at Socket found.
Swarm is a decentralized data storage network in the Ethereum ecosystem developed by the Ethersphere team. Swarm Desktop runs a node on a user’s computer, and bee-js lets developers embed Swarm into third-party software.
Attackers used stolen build-system secrets and two compromised GitHub accounts. On November 9, the infected bee-js 13.3.0 was available on npm—the main package registry for JavaScript—for about 75 minutes.
The Swarm Desktop 0.56.2 build remained on GitHub for more than eight hours, and the built-in auto-updater offered it to Windows and Mac users throughout that time. The Mac distribution was signed with a developer certificate and notarized by Apple.
The malware exfiltrated the node’s key file and its configuration, where the password is stored in plain text. That’s enough to drain all funds from the node, including staked coins. The program also planted backdoors.
On macOS and Linux it pulled a command-and-control server address from a smart contract on Ethereum, while on Windows it installed the ScreenConnect remote access client. Ethersphere revoked the malicious versions and released a fixed Swarm Desktop 0.56.3.
Reinstalling does not remove the spyware modules, so Socket advises assuming all secrets are compromised and moving assets to a new wallet from a clean computer. There have been no theft reports so far.
The infected bee-js builds were downloaded about ten times, and Swarm Desktop no more than 65 times including researcher downloads. Socket links the attack to the group behind the SleepyDuck trojan.
Grok App Data Exposures
On November 10, Claroc researchers published a report on 35,578 public projects built with Grok. They found service or personal data in roughly one in ten.
On August 19, SpaceXSI opened the Grok Build feature to all subscription tiers of its chatbot. A user describes an app, game, or website, and Grok assembles a working version and publishes it at a grok.me domain address.
Researchers gathered links via passive DNS services that store historical lookups. Of 43,551 resources found, 37,571 were live, and 94.7% were accessible without authentication.
When publishing, Grok offers three visibility options: only the author, anyone with the link, or anyone on the internet. In the paid account Claroc tested, the second option was the default.
Such links can be discovered through the same methods the researchers used, effectively making the app public. Among the findings were tests and scans of an intensive care unit patient, a list of more than 3,500 employees of a hospital network, and a database of over 1,000 truck drivers with personal email addresses.
There were also 24 apps by X and SpaceXSI employees in public view, including a confidential advertising proposal from X to a US federal agency and SpaceXSI’s onboarding plan listing internal systems.
The company removed those but did not touch others’ projects. SpaceXSI said content published in Grok remains private until the author shares it, and employees have “Only me” set by default. Claroc has already contacted three affected organizations.
Related
