Cyber Threat Intel Daily Briefing — 2026-11-13

CYBER THREAT INTEL

DAILY BRIEFING · 2026-11-13 12:15 UTC · REPORT BRIEF-20261113-121519

OPEN // LE

01

Check Point warns of zero-day flaw exploited for root access

Check Point Software has released emergency hotfixes to address a high-severity flaw that hackers have been exploiting to gain root privileges and establish persistence on vulnerable devices since late October. […]

SRC: BleepingComputer Fri, 13 Nov 2026 05:44:22 -0500 https://www.bleepingcomputer.com/news/security/check-point-patches-zero-day-that-lets-hackers-get-root-access/

02

Citrix Patches 10 Critical NetScaler Vulnerabilities

Successful exploitation could lead to unexpected behavior or denial-of-service (DoS) conditions. The post Citrix Patches 10 Critical NetScaler Vulnerabilities appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 13 Nov 2026 09:36:56 +0000 https://www.securityweek.com/citrix-patches-10-critical-netscaler-vulnerabilities/

03

Microsoft confirms Windows activation failures after November updates

Microsoft has confirmed that this month's Patch Tuesday security updates are causing Windows activation and licensing failures with 0x80041008 error codes. […]

SRC: BleepingComputer Fri, 13 Nov 2026 04:36:18 -0500 https://www.bleepingcomputer.com/news/microsoft/microsoft-confirms-windows-activation-failures-after-november-updates/

04

OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools

Daybreak Red Team pentests web applications with AI agents, while Defense Factory investigates security findings and prepares patches. The post OpenAI Unveils Daybreak Red Team, Defense Factory Security Tools appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 13 Nov 2026 09:21:01 +0000 https://www.securityweek.com/openai-unveils-daybreak-red-team-defense-factory-security-tools/

05

Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins

An international police operation took down servers behind Gootloader, CastleRAT and StealC this week. Criminals used the three malware tools to gain access to computers, steal passwords, and launch ransomware attacks. Police also seized about 6.4 million stolen logins belonging to more than 40,000

SRC: The Hacker News Fri, 13 Nov 2026 16:25:03 +0530 https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html

06

Extortion Group Luna Moth Flits Into Law Firms a Second Time

The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.

SRC: DarkReading Thu, 12 Nov 2026 20:09:41 GMT https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time

07

SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users

A newly identified spying group used hacked equipment inside Asian mobile operators to intercept the calls and texts of selected people, mostly in Taiwan. Enea, a telecom and cybersecurity software company based in Stockholm, found the group's attack sources in at least six Asian countries and name

SRC: The Hacker News Fri, 13 Nov 2026 16:40:40 +0530 https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html

08

FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance

Also Thursday, the FBI blamed North Korea for a separate social engineering scheme that officials say resulted in the theft of $400 million worth of cryptocurrency. The post FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 13 Nov 2026 02:28:21 +0000 https://www.securityweek.com/fbi-says-us-seized-1-2-billion-worth-of-cryptocurrency-stolen-from-binance/

09

Cyber Experts Weigh In: How to Fight Artex & AntiFox

Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan in place right away.

SRC: DarkReading Thu, 12 Nov 2026 21:18:52 GMT https://www.darkreading.com/cybersecurity-operations/cyber-experts-fight-artex-antifox

10

US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance

The infrastructure, said to belong to APT38, contained footage used to fool victims over video calls. The post US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance appeared first on CyberScoop.

SRC: CyberScoop Fri, 13 Nov 2026 00:32:19 +0000 https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/

11

Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure

Investigators seized 235 servers and 257 domains, along with 6.4 million victim credentials as part of Operation Endgame. The post Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure appeared first on SecurityWeek.

SRC: SecurityWeek Fri, 13 Nov 2026 10:48:40 +0000 https://www.securityweek.com/law-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure/

12

The School Bomb Threats Came From Accounts Already in Stolen Data

Hudson Rock researchers found that two university addresses tied to Italy’s school bomb threats were in infostealer data. On 11 November, bomb-threat emails hit schools across Europe. ANSA, citing the Education Ministry, reported that about 6,000 Italian schools received them. Some evacuated, others

SRC: Security Affairs Thu, 12 Nov 2026 22:42:10 +0000 https://securityaffairs.com/202941/security/the-school-bomb-threats-came-from-accounts-already-in-stolen-data.html

13

Hackers compromise 4,800 GitHub accounts to steal cloud credentials

A new campaign dubbed 'wfx-loot' has unfolded on GitHub where threat actors used 4,837 compromised accounts to probe 61,764 repositories, open pull requests, and push secrets-stealing malware. […]

SRC: BleepingComputer Thu, 12 Nov 2026 17:25:30 -0500 https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/

14

Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams

Microsoft says failed server health checks disrupted Outlook and other Microsoft 365 services. The company is still investigating the cause and has disclosed no evidence of a cyberattack. The post Microsoft 365 Outage Disrupts Outlook, Exchange Online and Teams appeared first on SecurityWeek.

SRC: SecurityWeek Thu, 12 Nov 2026 20:55:30 +0000 https://www.securityweek.com/microsoft-365-outage-disrupts-outlook-exchange-online-and-teams/

15

Police arrest 354 suspects in dark web cybercrime crackdown

Authorities arrested 354 suspects in a joint international operation targeting vendors and buyers on the Archetyp, Nemesis, Tor2Door, Bohemia, and Kingdom dark web marketplaces. […]

SRC: BleepingComputer Fri, 13 Nov 2026 03:34:20 -0500 https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/

16

Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them. The post Rogue remote-access campaign spread through ScreenConnect add-on, researchers say appeared first on CyberScoop.

SRC: CyberScoop Thu, 12 Nov 2026 20:58:17 +0000 https://cyberscoop.com/connectwise-screenconnect-sckit-attack/

17

When an AI Agent Goes Wrong, Can You Stop It?

Suppose an AI agent is asked to sort support tickets and look up account details. A ticket contains instructions that lead the agent to export records to an unfamiliar destination. The agent can make the request because its identity has access to the records and its connected tools allow the action.

SRC: The Hacker News Fri, 13 Nov 2026 17:22:31 +0530 https://thehackernews.com/2026/11/when-ai-agent-goes-wrong-can-you-stop-it.html

18

New worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks

A new worm-like malware toolkit named SCKit was deployed in the recent ScreenConnect attacks targeting managed service providers (MSPs), designed to spread from infected customer devices to MSP technicians' computers and compromise additional managed networks. […]

SRC: BleepingComputer Thu, 12 Nov 2026 17:53:10 -0500 https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/

19

Microsoft Cloud Outage Hits Outlook, Teams, Copilot and AI Services

A Microsoft outage disrupted Outlook, Teams and Copilot, also breaking OpenAI and Anthropic connectors to Microsoft 365 accounts. Microsoft 365, Outlook and Teams went down for thousands of US users on Thursday, November 12. Reuters reported that the disruption also hit the connectors OpenAI’s and A

SRC: Security Affairs Thu, 12 Nov 2026 20:41:47 +0000 https://securityaffairs.com/202932/security/microsoft-cloud-outage-hits-outlook-teams-copilot-and-ai-services.html

20

Webinar: See How Identity Blind Spots Put Your SOC at Risk and How to Close Them

Security teams have more alerts, logs, and monitoring tools than ever. Yet when an attack happens, one simple question can still take too long to answer: Who or what is behind this activity, and what can they access? A suspicious login might belong to an employee. An unusual API call could come fro

SRC: The Hacker News Thu, 12 Nov 2026 23:37:15 +0530 https://thehackernews.com/2026/11/your-soc-sees-alert-but-does-it-know.html

[ SOURCE ] OpenPhish (18 indicator(s))