Malware planted on Onamae.com Desktop Cloud; 26,739 servers flagged
Original title: Hackers Plant Malware on Onamae.com Cloud Servers, 26,739 Systems Potentially Affected
GMO shut every Desktop Cloud plan after October 20, and OANDA warned MT4 and MT5 logins may have been viewed.
GMO Internet said attackers accessed Onamae.com Desktop Cloud and installed malicious programs in some customer environments. On October 21 it began rolling shutdowns of every Desktop Cloud plan from 4:00 a.m. Japan time, naming 26,739 potentially affected servers, with no restoration date. Onamae.com has not confirmed personal-data leakage or named the malware. OANDA Japan warned on October 22 that MetaTrader 4 and MetaTrader 5 login IDs and passwords used on Desktop Cloud may have been viewed, without confirming unauthorized trades.
Unconfirmed: Infection count, data access inside customer servers, malware type, and attacker identity are unconfirmed.
- GMO confirmed the malicious installations on October 20, 2026.
- 26,739 is a count of potentially affected servers, not verified infections.
- The notice gives no malware name, access vector, hashes, or domains.
- Onamae.com said it does not retain payment or credit-card details.
- Desktop Cloud is used to run automated foreign-exchange trading software.
Impact: Malware on customer servers; stored data and trading logins may have been viewed
| Product | Affected |
|---|---|
| GMO Internet Onamae.com Desktop Cloud | all plans |
- 1.Change authentication stored or used on Desktop Cloud servers, including reused passwords elsewhere.
- 2.Change OANDA My Page and MT4/MT5 passwords, enable two-factor authentication, and review trading history.
- 3.Treat emails or calls asking for passwords or card details as phishing.
- Vendors
- GMO Internet
- Organizations
- Onamae.comOANDA Japan
- Countries
- Japan
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onamae.com | Hackers gained unauthorized access to Onamae.com Desktop Cloud. They installed malicious programs in custome |
From the original article
2 min read at gbhackers.com
Hackers gained unauthorized access to Onamae. com Desktop Cloud. They installed malicious programs in customer server environments, prompting the Japanese provider to suspend services across all plans.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.