The Financial Services Commission told securities firms to invalidate and reissue corporate access tokens used by institutional sales desks after Korea Internet & Security Agency analysts tied a clipboard-stealing malware strain to at least nine brokerage workstations this week. The order, published Friday during Hangul Day market closures, gives firms until Monday morning to rotate credentials without waiting for the cash equity reopen.
Attackers reportedly lured broker-dealer staff with fake compliance PDFs that copied one-time passwords from the Windows clipboard and forwarded them to relay servers in Hong Kong. No customer retail passwords were implicated, but internal research portals and block-trading chat rooms were exposed long enough for attackers to download client position summaries.
Remediation steps
FSC examiners require hardware-backed FIDO keys for any terminal that can query large-holder lists, plus network segmentation so research databases are unreachable from email clients. Firms must file incident timelines by Tuesday, including whether tokens were reissued over the holiday weekend.
Smaller brokerages complained about token inventory shortages; the Financial Security Institute said it will loan spare keys from a shared pool if vendors cannot ship until next week.
Why clipboard malware now
Security researchers said the campaign coincided with phishing waves that followed finance-sector credential dumps earlier in October. Clipboard stealers are old, but they work when traders multitask across chat, email, and pricing terminals without rebooting sessions.
Institutional investors asked for confirmation that their anonymity flags in sales-trader systems were not visible during the exposure window. Brokerages are sending individualized letters; regulators have not announced fines yet.
Retail spillover
Although retail logins were not the primary target, the FSC used the moment to remind discount brokers about the ASAP fraud-sharing platform launched during the month-long cyber alert. Holiday staffing should not delay token rotations, the letter stressed — markets may be closed, but attackers are not.
Investor relations
Listed holding companies asked compliance officers to confirm whether research leaks touched forward guidance. Brokerages said no material nonpublic earnings data left the firewall, but clients want signed attestations before Tuesday’s reopen.
Cloud vendors that host block-trading chat logs offered forensic snapshots over the weekend; regulators will compare timestamps with token reissue logs to see if any session stayed open on stolen credentials.
Desk notes
Traders and officials interviewed Friday said the Hangul Day calendar compresses decisions that normally spread across two cash sessions, making derivatives and policy announcements louder than usual. Several sources asked not to be named because their institutions bar holiday comments to media.
Consumer groups urged clearer app disclosures before Tuesday’s Kospi reopen, when portfolio screens will jump from frozen marks to live auction prints. Schools reopening next week add another layer of flu and travel risk that intersects with the policy moves described above.