Security teams faced a mix of mass exploitation attempts, espionage campaigns, and major takedowns this week, from 59 Linux kernel bugs to new backdoors, browser spyware, and AI-assisted phishing. The incidents show how attackers combine stolen access, trusted tools, and automation to stay inside networks longer.
Attackers spent the week turning familiar tools and routine workflows into entry points. Researchers and defenders reported a surge in GSocket abuse, browser-based spyware aimed at government portals, large-scale cryptocurrency laundering tied to the Binance theft, and dozens of Linux kernel flaws that opened paths to privilege escalation. Law enforcement seized criminal infrastructure, and vendors shipped fixes, but many of the cases hinged on the same weakness: dangerous activity disguised as normal access.
Linux flaws and living-off-the-land access
Microsoft reported 59 Linux kernel bugs uncovered through automated scanning, including 33 assigned CVEs and working root privilege escalation exploits for eight of them. One case, CVE-2026-64563, traces to a one-line state-reset bug in rhashtable. Microsoft said the flaw enabled stable local privilege escalation on Linux and affected Android with SELinux enforcing.
Microsoft also tracked a sharp rise in abuse of GSocket , an open-source remote access tool. Detections increased 356.2% from March through August 2026, with most activity tied to PHP web applications, cPanel hosts, and Apache servers. Education and research organizations saw the most targeting, followed by technology, communications, manufacturing, and government.
"Because GSocket relays traffic through a shared public network, there is no threat actor-owned IP address or domain to block," Microsoft said. The company urged defenders to hunt for deployment, persistence, privilege escalation, and outbound connections on affected hosts. Patching the original web vulnerability does not remove an attacker who already planted a backdoor.
Practical takeaway: Treat internet-facing Linux and web hosts as persistence targets. Audit for unexpected remote access tools, review cron jobs and startup scripts, and monitor outbound relay traffic after every emergency patch.
Espionage through browsers, cloud accounts, and AI agents
Palo Alto Networks Unit 42 detailed Falcon, a command and control framework that compromises victims by running malicious JavaScript inside browsers. Attackers placed the code in webmail portals and government applications across one Middle Eastern country and four Southeast Asian countries between March and May 2026. The framework stole passwords, emails, session cookies, and communications, and it delivered an implant called Antino that used Microsoft OneDrive for command and control.
"Operating entirely inside the browser context, attackers have used the framework to sideload malicious Chrome extensions and steal the following information: passwords, emails, session cookies, [and] communications," Unit 42 said. The targets included ministries of foreign affairs, defense, interior, and law enforcement agencies.
CloudSEK linked Silent Lynx to espionage against Central Asian governments and critical infrastructure from April to October 2026. An exposed server contained tooling, stolen data, and an AI agent the operator used to run intrusions. "The directory held the group's tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them," CloudSEK said.
Proofpoint described BluePhishing, a technique that tricks Microsoft Entra users into granting consent to malicious agent blueprints. The method extends OAuth consent abuse into the agent ecosystem, giving attackers tokens and access tied to the privileges assigned to those agents.
Practical takeaway: Harden browser and identity controls together. Restrict extension installs, review OAuth and agent consent grants, and alert on new application permissions in Microsoft Entra .
Ransomware, infostealers, and fraud campaigns
Kaspersky tracked Citrus, a Russian-speaking ransomware group that abused compromised contractor accounts to enter corporate Windows environments. The group used AI-generated PowerShell scripts, batch files, and commands, cleared logs, deleted tools after execution, and deployed a Sn00py-family ransomware variant written in Go that appended the .citrus extension.
"Citrus stands out for the way AI-generated content appears to support hands-on intrusion activity on compromised systems," said Stanislav Larinsky, a Kaspersky Security Services expert. Arctic Wolf reported a Grandoreiro campaign across Argentina, Chile, Colombia, Mexico, and Peru that used localized phishing lures and a domain generation algorithm to deliver a Delphi-based banking trojan.
Other campaigns showed the range of delivery methods. Zscaler found SEO poisoning pages impersonating Chocolatey and Microsoft Activation Scripts to spread Armorsteal. Akatsuki Legion tied RevStealer to trojanized Electron apps, hijacked YouTube channels, and game cheat lures. LevelBlue analyzed vibe-coded phishing kits built for device code phishing, and Palo Alto Networks Unit 42 observed indirect prompt injection across 26 domains designed to steer AI results toward scam sites.
Practical takeaway: Limit contractor access with least privilege and short-lived credentials. Train users to verify download sources for developer tools and AI apps, and monitor for unusual script execution on Windows endpoints.
Crypto laundering and law enforcement pressure
Elliptic traced the laundering of $6.43 billion stolen from Binance to North Korean threat actors using an automated, cross-chain process. Dr. Tom Robinson, Elliptic's founder and chief scientist, said the attackers used more than 20,000 wallets on 16 blockchains, at least 36 services, and at least 65,000 transactions. $3 billion remains in linked addresses, while the group moved funds through bridges, decentralized exchanges, lending vaults, liquid-staking services, coinjoins, and privacy pools. The attackers also created six meme coins on NEAR to move $430,000.
"Around $3.0 billion remains in addresses linked to the theft, mostly as ETH and BTC," Robinson said. North Korean spokesperson Kim Yo Jong denied the country's role in the attack.
Europol reported a coordinated action that disrupted infrastructure behind GootLoader, CastleRAT, and StealC. Authorities seized 235 servers and 257 domains and identified more than 6 million victim credentials tied to the criminal ecosystem.
Practical takeaway: Exchanges and financial platforms need automated transaction monitoring across chains. Organizations should reset credentials exposed in stealer logs and watch for follow-on account takeover attempts.
Several updates offered defenders concrete improvements. Microsoft added OAuth support for on-premises Exchange mailbox migrations, enabled NTLM signing changes to reduce relay attacks tied to CVE-2026-118737, and plans to require NTLM signing by default on Windows servers starting May 2027. PyPI introduced a security tab that shows release provenance and per-file attestations, helping developers verify where package files came from. Google DeepMind applied AlphaProof Code to libsignal , producing machine-checked proofs for key security properties of the Signal protocol implementation.
Meta expanded AI age-estimation technology to place more teens in Teen Account protections on Instagram. ControlPlane disclosed an 18-month exposure of a plaintext Entra ID client secret in a GitHub commit, a reminder that deleted secrets can persist in orphaned objects.
Practical takeaway: Adopt phishing-resistant authentication, enforce signing and provenance checks, and treat secret rotation as mandatory after any repository exposure. Strong defaults help, but teams still need visibility into who has access, what tools run on their systems, and where sensitive data moves.
Source : ThreatsDay: 59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories , by The Hacker News , The Hacker News , Nov 12, 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
