IT Security News Roundup: 2026-11-13 Overnight

IT Security News: Overnight roundup, 2026-11-13

Summary

Friday's overnight window was dominated by three threads: attacks that turn trusted tooling against its users, the ScreenConnect and MSP compromises, and a string of cloud, certificate and infrastructure incidents. AI features many of these stories, from autonomous pentest tools being abused to AI-driven threats driving the case for resilience and emergency funding. Taken together, they show how a small foothold, whether a rogue remote-access client, a stolen cloud credential or a mishandled signing key, can cascade across customers and providers, which is why the defensive lessons here reach well beyond any single vendor.

1. Japan is adding emergency cybersecurity funding, including public-private cyber responders and an AI-focused team run by the economic ministry, as AI-assisted breaches rise. The package also gives authorities more room to use the government's new active cyber-defense powers.
2. Baker Tilly is notifying clients that a data breach at a third-party provider exposed personal information about them and their dependents. The incident is a reminder that vendor compromises can reach clients who never dealt with the attacker directly.
3. A ClickFix campaign is delivering the DownTheDRAIN infostealer to macOS users. Victims are tricked into running malicious commands themselves, a technique that bypasses many traditional download defenses.
4. Arctic Wolf Labs linked the open-source AI pentest platform AntiFox to real intrusions involving AWS credential theft and production secret access. Attackers compromised an IIS server, planted a web shell and then used valid AWS identities to read Secrets Manager values.
5. A Chinese APT is reportedly exploiting the SS7 and Diameter telecom protocols to spy on targets, alongside an Apache remote code execution bug, a cyberattack on Brazil's largest port and Europol takedowns of three malware operations.
6. A major Microsoft 365 outage that began on November 12 spread into November 13, disrupting Exchange Online, Teams, SharePoint, Copilot and Defender XDR users. Microsoft said connectivity problems could affect users in any region.
7. Darkreading argues that most organizations have not yet mapped their cryptographic estate well enough to know where to start with post-quantum cryptography migration. The article frames discovery as the real first hurdle.
8. Unit 42 describes how attackers are using AI-powered red team tools, and sets out defensive measures to counter that misuse. The research shows offensive AI tooling moving from testing into real attack workflows.
9. The FBI says it seized about $1.2 billion in cryptocurrency stolen from Binance and blamed North Korea for a separate social engineering scheme worth $400 million. The seized infrastructure is said to belong to APT38.
10. Red Hat's Advanced Cluster Security for Kubernetes 5 adds vulnerability management for Red Hat Enterprise Linux virtual machines running on OpenShift. Security teams can now assess VM and container vulnerabilities in one place.
11. The SANS Internet Storm Center published its Friday Stormcast podcast episode for November 13, 2026, giving daily threat-activity commentary. The entry carries no detailed text in the source.
12. ConnectWise is investigating an active campaign that abuses compromised ScreenConnect environments to push rogue remote-access clients to MSP customer devices. It has disabled five third-party extensions across about 400 partner environments as a precaution.
13. The OpenSourceMalware Show episode 29 features Jared Wray, maintainer of Keyv and Cachable, discussing his experience at the center of the ChainDrop software supply chain attack. It is a first-hand account from a maintainer caught in the incident.
14. Malware-Traffic-Analysis.net documented a SmartApeSG ClickFix campaign that delivers the CNCmachineRMS remote access trojan. The post itself has no text preview in the source, so the details come from the headline.
15. Certificate authority eMudhra revoked eight more intermediate CA certificates after an investigation found improper handling of private keys during certificate generation. The follow-up expands the impact of its earlier security incident.
16. Google says its Gemini-powered smart glasses stop recording when the outward-facing light is covered or tampered with, and add face redaction, data-handling limits and app restrictions. The safeguards were shaped by bystander research on being filmed without knowledge.
17. Darkreading argues that an organization's ability to recover quickly from disruption will become a competitive advantage as AI-driven threats grow. The piece treats resilience as a business issue, not just an IT one.
18. Security Affairs reports that Arctic Wolf observed attackers using AntiFox, a Chinese-language agentic pentest platform, against IIS servers and AWS accounts. It notes that such frameworks chain attack steps together with little human effort.
19. Help Net Security reports that PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 security vulnerabilities and over 140 other bugs, and that PostgreSQL 14 reaches end of support. Most of the flaws are memory errors or type confusion.
20. CrowdStrike is bringing enterprise browser security into its Falcon platform. The product announcement has no detailed text in the source.
21. EfficientIP Research Labs traced a ClickFix campaign that uses fake Zillow apartment-review pages to install NetSupport RAT on Windows machines. Renters searching for apartments are the targeted audience.
22. A Darkreading piece argues that adversaries are turning the vulnerability ecosystem against defenders. The source text is limited to the headline and summary.
23. CrowdStrike is extending its Agentic SOC to detect and stop insider threats posed by AI agents. The source has no detailed text, so the scope is taken from the headline.
24. N-able took its N-central platform offline after discovering 33 flaws. The remediation details are not included in the source text.
25. Bomb threats against schools reportedly came from accounts already present in stolen data. The source text is limited to the headline.
26. A new worm-like malware called SCKit is targeting MSPs in ScreenConnect attacks. The source text is limited to the headline.
27. A CVE-2026-100307 advisory describes missing authorization on the external management API in mcp-gateway-registry, enabling privilege escalation to registry administrator. Organizations running that registry should prioritize patching.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Japan Pushes Emergency Funding for Cybersecurity as AI-Assisted Breaches Rise
2. Baker Tilly notifies clients of data breach at third-party provider
3. Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)
4. AntiFox AI Pentest Tool Linked to AWS Production Secret Theft
5. Risky Bulletin: Chinese APT exploits SS7, Diameter to spy on targets
6. Massive Microsoft 365 Outage Impacts Exchange Online, Teams, SharePoint, Copilot, and Defender XDR Users
7. Getting Past the Post-Quantum Cryptography Discovery Phase
8. ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
9. FBI Says US Seized $1.2 Billion Worth of Cryptocurrency Stolen From Binance
10. Introducing Red Hat Advanced Cluster Security for Kubernetes 5: Bring Red Hat Enterprise Linux virtual machines into vulnerability management
11. ISC Stormcast For Friday, November 13th, 2026 https://isc.sans.edu/podcastdetail/10178, (Fri, Nov 13th)
12. Active ScreenConnect attacks breach MSPs, impact dozens of organizations
13. The OpenSourceMalware Show #29
14. US seizes North Korean hacking infrastructure, $1.2 billion in cryptocurrency stolen from Binance
15. 2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT
16. eMudhra revokes 8 more CA certificates after private key mishap
17. Google smart glasses privacy features cover wearers and the people around them
18. AI Raises the Stakes for Cyber Resilience
19. AI Pentest Tool AntiFox Abused To Steal AWS Credentials
20. New Falcon Cloud Security Innovations Secure the Cloud AI Runs On
21. PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14
22. CrowdStrike Brings Enterprise Browser Security to the Falcon Platform
23. Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters
24. How Adversaries Are Turning the Vulnerability Ecosystem Against Defenders
25. CrowdStrike Extends the Agentic SOC to Detect and Stop Agent Insider Threats