The Financial Services Commission ordered Korean brokerages to reissue corporate access tokens by Monday after clipboard-stealing malware spoofed investor roadshow portals that sell-side teams use to distribute earnings previews during the blackout week.
How the campaign worked
KISA incident briefs describe trojans that replace copied meeting URLs with look-alike domains, then harvest one-time tokens when analysts paste credentials into fake login forms. At least four mid-tier brokerages reported suspicious token use from IP ranges in Southeast Asia, prompting the FSC to mandate rotation rather than waiting for quarterly audits.
Operational impact on research desks
Equity research teams paused external corporate access until new FIDO2 keys arrived by courier. Institutional sales said the timing hurts because many issuers hold virtual meetings while Seoul cash markets are closed, exactly when roadshow links circulate. Compliance officers must log each reissue in the FSC's incident portal with SHA256 hashes of affected binaries.
Investor protection angle
Retail clients were not the primary target, but the same malware families target mobile banking clipboards. Banks synchronized customer alerts with brokerage notices to avoid panic. KoFIA reminded members that corporate access tokens are not interchangeable with employee VPN cards, a common confusion during incident weekends.
What firms must file next
Brokerages submit root-cause letters by Wednesday detailing how long spoofed portals stayed live and whether threat intel was shared with the Korea Exchange. Failure to rotate tokens triggers on-site exams. For CIOs, the episode reinforces that roadshow convenience features need the same phishing-resistant keys mandated for retail login since 2024.
Threat intelligence sharing
KISA published YARA rules for the clipboard trojan family so smaller brokerages without dedicated SOCs can scan endpoints before Monday trading. The rules match Korean-language lure documents that mimic earnings preview decks, a social-engineering layer that fooled even trained analysts rushing during the holiday.
Cloud providers hosting spoofed roadshow sites received takedown notices within six hours, but attackers rotated to new domains faster than DNS blocks propagated. FSC staff said they may mandate registrar hold periods for finance-themed domains registered in the last 30 days.
Weekend trading safeguards
Overseas desks continued to publish research PDFs during Seoul cash closures, but links now expire after single use. IT teams reconfigured reverse proxies to block clipboard hooks on virtual desktop images, a stopgap until new tokens arrive. Hedge funds asked whether delayed research access constitutes material unfairness; FSC said fairness rules cover client distribution, not inter-dealer chat latency.
Smaller brokerages without 24-hour SOCs relied on KISA shared hosting blocklists to kill spoof domains; two firms still reported residual sessions Sunday morning, prompting an extension of the rotation deadline to Tuesday for firms under fifty billion won in equity capital.