IT Security News Roundup: 2026-11-13 Afternoon

IT Security News: Afternoon roundup, 2026-11-13

Summary

Friday's window was dominated by three threads: attacks that abuse trusted tools and services, from fake AI-site typos to a compromised GitHub account farm and a rogue Linux miner, and a steady run of infrastructure and vendor vulnerability disclosures, including Fortinet's near-100-fix release and Microsoft's record Patch Tuesday. State-linked activity also stands out, spanning Iran-linked sabotage of supermarket refrigerators, a China-nexus AI-assisted campaign against US defense firms, and telco intercepts in Asia. Together these show that defenders face pressure on both the edge of their networks and the software they trust, while spyware and cloud-confidentiality issues remind readers that some risks persist well beyond any single patch.

1. Europol and Spain coordinated a Referral Action Day against violent extremist and terrorist live-action role-playing in online gaming spaces, with specialised units from 16 countries taking part.
2. Apple is testing "person recognition" for its HomeView smart home device as a face-authentication alternative to FaceID, a technology that has not yet been tested in real-world use.
3. TypoPrompting researchers found 186 lookalike domains across 27 AI brands, including Claude and ChatGPT, where a mistyped address leads to fake verification pages and malware installers.
4. Fortinet issued 89 advisories covering close to 100 vulnerabilities, about 17 rated critical, including a FortiClient CORS flaw dubbed "Fortinet2Shell" that could allow code execution if a user visits a malicious page. Fortinet reports no active exploitation.
5. A Spyware accountability report shows victims of Predator, Pegasus and Graphite face multi-year legal battles, such as Greek journalist Thanasis Koukakis, who waited almost five years for a court ruling on his Predator infection.
6. US officials say the Gootloader malware was tied to at least 44 ransomware attacks costing victims about $29 million since 2018, detailed alongside a European anti-malware operation.
7. Microsoft Exchange Server 2016 and 2019 have reached end of support, leaving them permanently vulnerable, so administrators are urged to upgrade or migrate now.
8. A China-nexus actor used an AI tool in a campaign against US defense and semiconductor companies, while a separate campaign used a pen-testing framework to steal AWS credentials.
9. BrickLink, the LEGO resale marketplace, went offline after detecting unusual activity, and it has not said whether customer data was affected.
10. SANS found that about a third of industrial organizations suffered OT incidents, a record single-year jump in ICS/OT cyber incidents.
11. ArcticRAT is an Android malware family that gives attackers covert control of phones, steals banking data, and uses Grok AI to pull security codes out of stolen messages.
12. OpenAI began rolling out ChatGPT Wallet with American Express, Mastercard and Visa, letting agents pay with a stand-in card number so the user's real details stay hidden from both the agent and the merchant.
13. The Mior and Skyfall attacks let a malicious cloud host read data inside AMD SEV-SNP confidential VMs, and Mior can also alter VM memory and forge the attestation report. Both require control of the hypervisor.
14. Nvidia CEO Jensen Huang resigned days after admitting a romantic affair with an alleged Chinese spy, and CFO Colette Kress was named interim CEO.
15. France attributed sabotage of refrigeration controllers at around 700 supermarket sites to Shahid Kaveh, an IRGC-affiliated unit, causing food losses and fires. Check Point ties the activity to the CyberAv3ngers group's broader OT attacks, including on US water systems.
16. A "SignDrop" Windows zero-day, published by a disgruntled researcher, lets local users escalate to SYSTEM privileges, giving attackers full control of the machine.
17. SANSAR is a Linux cryptomining toolkit with a kernel rootkit and a modified NVIDIA monitoring library that reports 0% GPU use while miners run on three GPU hosts.
18. US federal agents used court orders to recover more Binance funds and keep chipping away at North Korean cryptocurrency-theft operations.
19. Enea linked the SilentAir and Liminal Panda campaigns to compromised Asian mobile operators, which were used to intercept calls and texts from Taiwanese users.
20. Microsoft patched a record 1,235 CVEs in its November Patch Tuesday, the latest in a series of very large monthly releases.
21. Elastic Security Labs analysed SANSAR, a Tor-based miner orchestrator paired with a kernel rootkit and a backdoor that retrieves its command-and-control address from Ethereum.
22. Kaspersky published a penetration-testing methodology for cloud platforms, highlighting gaps in how cloud environments are currently assessed.
23. Hackers compromised nearly 5,000 GitHub accounts in the wfx-loot campaign and used them to run malicious workflows that expose repositories and steal credentials.
24. Token Security describes an AI invoice-processing agent that could be manipulated by a malicious email into changing vendor bank details without triggering standard alerts, and outlines five agent security gaps.
25. The Have I Been Pwned entry for YouHack adds 7.16 million unique email addresses from a 2013 Russian-language forum breach, including 107k members' records with mostly unsalted MD5 hashes.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Not a game: Europol and partners target terrorist role-playing online
2. Apple’s HomeView Tries Face Authentication Without FaceID
3. New TypoPrompting Attacks Turn Mistyped AI Website Addresses Into Malware Installation Traps
4. Fortinet Releases Fixes for Nearly 100 Vulnerabilities Across Its Product Lineup
5. Predator, Pegasus and Graphite: Governments Accused of Spyware Abuse Face Little Accountability
6. DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018
7. Microsoft Exchange Server 2016 and 2019 enter their 'permanently vulnerable' era
8. China-nexus actor uses AI tool in campaign targeting US defense, semiconductor industries
9. LEGO’s BrickLink taken offline: What users should know
10. OT Incidents Hit a Third of Industrial Organizations, SANS Finds
11. New Android Malware Hides Hacker Activity While Stealing Banking Data
12. ChatGPT Wallet lets agents pay without seeing your card number
13. New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs
14. Nvidia’s Jensen Huang resigns, chipmaker names CFO Colette Kress as interim CEO
15. From Water Systems to Supermarket Refrigerators: Inside Shahid Kaveh and CyberAv3ngers’ OT Attacks
16. Windows 0-day dropped by disgruntled researcher hands hackers System rights
17. Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage
18. US cracks down on North Korean cryptocurrency-theft scheme, recovers more Binance funds
19. Hacked Asian Telcos Used to Intercept Taiwanese Calls and Texts
20. Microsoft Fixes 1235 Flaws in Another Record Patch Tuesday
21. 0% GPU utilization: How SANSAR hides Linux cryptomining
22. Cloud Penetration Testing Methodology
23. Hackers Turn Nearly 5,000 GitHub Accounts Into Supply Chain Attack Tools
24. How one AI agent exposed five critical enterprise security gaps
25. YouHack – 7,160,849 breached accounts