Spoofed KuCoin security emails direct users to Overlord remote access software
GCSA examined phishing emails impersonating KuCoin and identified an Overlord remote access client in the Windows download. Windows and two macOS samples shared a callback address. GCSA says KuCoin enabled DMARC quarantine for ku.com after disclosure. The number of infections and any losses remain unknown.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- KuCoin users who got the fake security email, especially those who entered credentials or ran its Windows or macOS download.
- KuCoin · Phishing · Malware · DMARC
- In the wild
- Yes
- GCSA examined delivered phishing mail and confirmed an Overlord Windows payload.
What happened
The lure presented an urgent account warning from a supposed KuCoin security center. GCSA found that the visible sender was security@ku.com, while SPF and DKIM authenticated the attacker’s ku-security[.]com domain. The missing DMARC record on ku.com meant the domain had published no quarantine or reject policy for mail that failed alignment. GCSA reports that KuCoin enabled quarantine after being notified.
The fake site offered Windows and macOS downloads. GCSA confirmed the Windows sample as an Overlord client through static analysis. The Windows, macOS arm64 and macOS amd64 samples contained the same remote callback. The remote-access risk comes from running the download. GCSA’s report establishes phishing delivery and malware distribution. Whether recipients ran the files, lost funds or had their accounts accessed remains unknown. The evidence concerns impersonation of KuCoin’s sender identity. The report does not establish access to KuCoin infrastructure.
Crime-scene timeline
Oct 29, 2026
GCSA finds ku.com without DMARC
The researchers found that SPF and DKIM passed for the delivery domain, which differed from the domain displayed in From.
Nov 5, 2026
GCSA publishes sample analysis and KuCoin response
GCSA identifies the Windows download as Overlord and reports that KuCoin confirmed the configuration issue and enabled a quarantine policy for ku.com.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- GCSA original investigationPrimaryDocuments delivered phishing mail, sender alignment, the fake download page, Windows static analysis, callbacks across three samples and the response GCSA received from KuCoin.
- KuCoin account security guidancePrimaryExplains anti-phishing codes, official verification and account safeguards. This is general guidance.