CYBERSECURITY NEWS RADAR

Stolen webcam clips of 900+ victims feed North Korea’s $400 million fake Zoom scheme

North Korean state hackers have stolen more than $400 million in cryptocurrency over the past 18 months by pulling targets into fake Zoom and...

How attackers turned a Teams meeting booking into a device code phishing trap

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into approving a device code sign-in. They got...

Suspected North Korean IT workers reached onboarding at companies with open data

Material Security followed suspected North Korean fake IT workers through the hiring pipelines of organizations it monitors and counted 27 personas that reached onboarding...

Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)

Introduction

ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th)

US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance

The infrastructure, said to belong to APT38, contained footage used to fool victims over video calls. The post US seizes North Korean hacking infrastructure,...

Getting Past the Post-Quantum Cryptography Discovery Phase

Most organizations haven't sorted out their cryptographic estate enough to even know where they'd start with post-quantum cryptography (PQC).

Cyber Experts Weigh In: How to Fight Artex & AntiFox

Cybercriminals using agentic pen-testing tools is a proverbial genie out of the bottle at this point, so enterprises need to get a defense plan...

Rogue remote-access campaign spread through ScreenConnect add-on, researchers say

ConnectWise disabled five third-party extensions across about 400 partner environments after researchers linked a worm-like toolkit to one of them. The post Rogue remote-access...

Extortion Group Luna Moth Flits Into Law Firms a Second Time

The cybercriminals are retargeting law firms that refused to pay its first ransom, with a social engineering con aimed at stealing Microsoft access tokens.

Don’t put Section 702 spying law renewal in defense bill, groups urge Hill leaders

CyberScoop is exclusively reporting on the letter to the Hill on the controversial snooping authorities under the Foreign Intelligence Surveillance Act. The post Don’t...

Trained to betray: How post-training supply chain attacks hijack coding agents

Microsoft Defender Research and the AI Red Team discuss how poisoned datasets and poisoned model checkpoints can trigger remote code execution and other malicious...

International operation dismantles malware networks, exposes 6.4 million stolen credentials

The Operation Endgame action dismantled the loaders, remote access trojans and infostealers that give ransomware gangs their way into corporate networks. The post International...

Attackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society Sectors

Our analysis of how attackers used the open-source Cairn AI agent framework to autonomously breach semiconductor, defense and civic targets. The post Attackers Use...

Another Way Police Are Locating People from Their Smartphones

Penlink’s Webloc is an application that locates people using information from the weather, gaming, email, and religious apps on their phone. It’s sold to...

Exploit Attempts for GPUStack Authentication Bypass (CVE-2026-102895), (Thu, Nov 12th)

CVE-2026-102895 is a trivial authentication-bypass vulnerability. GPUStack is also an attractive target. It is open-source software that manages clusters of GPUs, which are typically...

Inside an AI Attack Against a US Retailer

When hand-typed commands failed to breach a US retailer, the attacker turned to AI-generated scripts, achieving lateral movement in minutes.

CrowdStrike Named a Leader in the 2026 IDC MarketScape for Worldwide Augmented Identity Security Solutions

ISC Stormcast For Thursday, November 12th, 2026 https://isc.sans.edu/podcastdetail/10176, (Thu, Nov 12th)

Chinese AI Project Scouts Spies in Taiwan Chip Industry

The CCP built a Big Data system to scrape reams of information and learn about individuals abroad, to potentially target and exploit them. Think...

Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise

The package adds public-private cyber responders, an AI-focused team run by the economic ministry, and more leeway to use the government's new active cyber-defense...

ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know

Learn what Unit 42 discovered about attacker use of AI-powered red team tools, and how to mitigate these attacks. The post ARTEX and AI-Powered...

AIを活用したサイバー攻撃の増加を受け、日本がサイバーセキュリティへの緊急資金拠出を推進

この対策パッケージには、官民合同のサイバー対応チーム、経済省が主導するAI専門チーム、および政府の新たな能動的サイバー防衛権限の行使に関する裁量の拡大が含まれている。

The global socket: how threat actors are weaponizing GSocket for stealthy C2

Threat actors are deploying GSocket on compromised Linux servers to keep encrypted remote access after the original vulnerability is patched. Learn how to detect,...