Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts

South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A compromised page could infect a system running a vulnerable AnySign4PC version without a prompt or

According to South Korean authorities and multiple security firms, a state-sponsored watering‑hole campaign abused trusted domestic websites to exploit vulnerable versions of AnySign4PC, a certificate-based financial security product widely used in Korean online banking, and silently install SIGNBT or COPPERHEDGE backdoors without any user interaction.[1][2][3] The underlying issue is a buffer‑overflow remote code execution vulnerability in AnySign4PC versions 1.1.4.4–1.1.4.6, enabling malware to be injected into legitimate Microsoft processes and used for espionage, covert access, and data theft in financial environments.[1][2][4][9] From a RealGround perspective, this highlights a high‑severity financial software supply chain and endpoint security risk that can directly impact AI‑enabled fintech systems relying on compromised banking endpoints or their transaction data. Organizations should assess where financial security tools integrate with AI agents or decision logic, harden update and dependency management, and ensure AI workflows treat data from such endpoints as potentially untrusted, using secure-agent design and rigorous business logic audits to prevent downstream mis