Microsoft's AI Debt, FBI Names Binance Hackers, Amadeus Spreads

Full transcript

Alex: Good morning, and welcome to Daily Tech News for Sunday, November first. I am Alex.

Jordan: And I am Jordan. It is the morning after a brutal month for tech stocks, and the first day of a week that could decide whether October was a pullback or something bigger. Today we have Microsoft borrowing big to keep building A I, the F B I officially naming the culprits behind the largest crypto heist ever, and an airline data breach that just keeps growing.

Alex: Let us start with Microsoft, because this one tells you how expensive the A I race has become. Microsoft has gone back to the bond market for the first time since twenty seventeen, raising at least twenty-five billion dollars. The deal was split into ten tranches, with maturities running from two years all the way out to twenty sixty-six, and it drew more than one hundred fifteen billion dollars in orders. That is more than four times what was on offer.

Jordan: And the timing is the story. Microsoft had just told investors it spent forty-five point two billion dollars on capital projects in the September quarter, and that it expects to spend more than fifty billion dollars in the December quarter alone. That puts its calendar year spending at roughly one hundred seventy billion dollars.

Alex: Right, and Microsoft is not alone here. Across the industry, hyperscalers and data center developers have already raised more than three hundred thirteen billion dollars in investment grade bonds this year, nearly triple last year's total. Microsoft can borrow cheaply, but the fact that even Microsoft is tapping the bond market tells you cash flow alone is no longer covering the build-out.

Jordan: The formal paperwork says the money is for general corporate purposes, including capital spending, working capital, acquisitions, and debt repayment. So it is not earmarked dollar for dollar for A I. But nobody is pretending otherwise. The data centers and the chips inside them are where the money is going, and investors spent October asking whether all of that spending will pay off.

Alex: Which brings us to our second story, and it is a follow-up to the biggest story we covered yesterday. The F B I has now officially attributed the Binance heist to TraderTraitor, a North Korea aligned hacking group. This is the first official American attribution, after private researchers had already pointed the same way.

Jordan: For anyone catching up, Binance disclosed on October twenty-ninth that hackers drained about six point three billion dollars, the largest crypto theft ever, most of it in about twenty minutes. The F B I says investigators have watched the stolen funds being converted mainly into Ether, and it is working with the Secret Service and the Internal Revenue Service criminal investigation unit to trace the money.

Alex: And there is a practical update for customers. Binance has restarted Bitcoin withdrawals and begun restoring other crypto withdrawals in phases, starting with fifteen networks including Bitcoin, Ethereum, B N B Chain, Solana, and Dogecoin. The exchange says it has now covered about ninety-five percent of the stolen assets, using its user protection fund, its futures insurance fund, and its own treasury, and it has set aside about six point three four billion dollars to cover the loss. Customers, Binance says, will not bear the financial impact.

Jordan: The bigger picture is uncomfortable. This was the climax of what some security researchers are calling Black October, a month of A I assisted intrusions hitting everything from government agencies to major companies. And that leads directly into our security segment, because the tools are getting scarier.

Alex: Cisco Talos reported on October thirty-first that a piece of malware called VOLTA does something new. After stealing information from a victim, it sends a structured bundle of that stolen data to an A I model to assess the victim's assets and security posture. Researchers found a fallback chain involving three different models, so if one refuses or fails, the next one picks it up.

Jordan: Separately, Chainalysis disclosed a breach carried out with what it calls offensive agentic techniques. Customer names, email addresses, user identifiers, and organizational role labels were accessed. The company says its investigation found no evidence that investigation content, credentials, or session tokens were exposed, but the phrasing matters. Attackers are not just using chatbots to write phishing emails anymore. They are using agents to do the work.

Alex: CrowdStrike reported something similar at scale. A China backed group it calls Vapor Panda reportedly used an agentic A I penetration testing tool to compromise one hundred forty sensitive targets in eleven days, as part of a campaign against more than two hundred organizations in at least fourteen countries. Put those three reports together, and the pattern is clear. The same agent technology companies are racing to sell is also lowering the bar for attackers.

Jordan: Our third story is a breach of a very different kind, and it is still spreading. Malaysia Airlines said on Sunday that some of its customers may have been affected by a cybersecurity incident at Amadeus, its reservation technology provider. Malaysia Airlines says its own systems were not breached, and it has seen no evidence that financial information was accessed, but the information involved may cover anything processed between August twenty twenty-three and September of this year.

Alex: The reason this keeps growing is that Amadeus sits underneath so many airlines. Cathay Pacific says about fifty-three thousand bookings were affected. Japan Airlines says ninety-two thousand customers were affected, and for about two thousand of them the records also included passport numbers, frequent flyer numbers, emails, and phone numbers. All Nippon Airways puts its number at up to thirty-seven thousand eight hundred passengers. Korean Air, Asiana, and the German carrier Condor have also reported impact.

Jordan: And Amadeus still has not said how many of its airline customers were hit in total. The company says it became aware of a vulnerability affecting a travel booking display environment, and that unauthorized access ran for more than three years before it was caught. If you flew on one of these airlines in that window, roughly August twenty twenty-three through September twenty twenty-six, it is worth assuming your booking details could be among the exposed data until your airline says otherwise. Watch for phishing messages that use real booking details. That is exactly the kind of message that looks convincing.

Alex: A quick look ahead before we wrap. Apple reports earnings after the bell on Monday, and its shares have recently touched an all-time high, so there is very little room for a miss. Advanced Micro Devices reports on Tuesday, which will be another read on the chip sector after Intel's brutal week. And the midterm elections are Tuesday as well, with the monthly jobs report closing out the week on Friday.

Jordan: So here is the takeaway. Microsoft borrowing twenty-five billion dollars is not a sign of weakness on its own. It is a sign of how much this A I build-out costs, even for the richest companies in the world. The Binance attribution turns a shocking theft into a geopolitical story, with North Korea allegedly funding its weapons programs from stolen crypto. And the Amadeus breach is a reminder that the weakest link in your data is often a vendor you have never heard of, holding your information for years.

Alex: That is Daily Tech News for Sunday, November first. We will be back tomorrow morning with what Apple actually says, and what it means for the rest of tech. Have a good Sunday.

Jordan: See you tomorrow.