In October 2026, a massive cybersecurity breach struck “Onamae.com Desktop Cloud,” a major Windows Virtual Private Server (VPS) platform operated by Japan’s GMO Internet Group, triggering the forced emergency shutdown of 26,739 virtual machines. Because this service was overwhelmingly used by individual investors running MetaTrader (MT4/MT5) Expert Advisors (EAs) around the clock, financial credentials stored on these servers were compromised, placing live forex and securities accounts at acute risk of unauthorized trading and asset drain. With the emergence on October 27 of the adversary portal CORONAMNG.STORE, GMO and cybersecurity agencies have issued urgent alerts. This actionable guide provides the six immediate defensive steps every affected user must execute.

The Anatomy of the Threat: Compromised Endpoints, Not Broken Brokers

A vital distinction for affected traders is understanding that brokerage houses themselves were not compromised:

• What Occurred: Attackers breached the Windows virtual machines hosted on Onamae.com, scraping locally cached MT4 connection tokens, saved browser passwords, and desktop plaintext credential notes.
• The Imminent Danger: Using legitimate stolen credentials, threat actors can authenticate directly into broker trading interfaces, liquidating accounts through unauthorized trades or forging illicit withdrawal requests.

Strict Warning: Never Navigate to “CORONAMNG.STORE”

Identified on October 27, CORONAMNG.STORE is a weaponized external domain operated by the threat actors to showcase stolen data and enforce extortion demands.

• High Malware Infection Risk: Merely visiting the portal exposes endpoints to malicious drive-by download payloads designed to hijack local computers.
• Secondary Recovery Scams: Fraudulent actors are impersonating law firms and recovery agencies, falsely offering to “check whether your credentials appear on CORONAMNG.STORE.” Never follow unsolicited links.

Six Immediate Defensive Steps for Traders

1. Reset Broker Passwords from an Uncompromised Secondary Device

Do not execute password updates from computers previously connected to the compromised VPS. Use a clean smartphone connected to cellular data or an independent device to change credentials across all trading platforms.

2. Request Global Session Termination (Revoke Active Logins)

A password reset does not always terminate preexisting active trading sessions. Access your broker portal to terminate active sessions or contact customer support directly to request an immediate, forced disconnect across all endpoints.

3. Audit Trade Logs and Verified Withdrawal Destinations

Review recent transaction histories for unrecognized order executions and verify that linked beneficiary bank account numbers have not been altered.

4. Enforce Hardware or Software Two-Factor Authentication (2FA)

Immediately activate mandatory 2FA via authentication apps (e.g., Google Authenticator) across all trading and email accounts to thwart credential stuffing attempts.

5. Execute Comprehensive Antivirus Scans on Local Terminals

Perform a full, deep scan on any local workstation that previously established Remote Desktop Protocol (RDP) sessions with the compromised VPS environment to detect possible clipboard-bridged payloads.

6. Eradicate Password Re-use Across Secondary Accounts

Rotate passwords on email addresses, cloud storage, and personal services that shared identical credentials with the compromised VPS environment.