IT Security News Roundup: 2026-11-15 Morning

IT Security News: Morning roundup, 2026-11-15

Summary

In this batch, the most consequential thread was credential exposure spreading well beyond its original source. A key that Cursor had issued to Fireworks AI, exposed in a Fireworks breach, led to a data breach and a trojanized Claude Code extension, while AntiFox-linked intrusions showed stolen AWS credentials reaching production secrets. Both cases show AI tooling and cloud platforms serving as targets and as routes to deeper compromise. The coverage also included the human side of the problem, from leaked credentials and the personal liability security leaders face, and a macOS infostealer delivered through ClickFix lures. The lesson for defenders is that one leaked key or misconfigured application can cascade into broad exposure, so secrets hygiene and least-privilege access matter more than ever.

1. Cursor attributes a trojanized Claude Code extension on its marketplace to an access key it had issued to Fireworks AI, which Fireworks exposed in a breach. The attacker used the key to copy data, showing how a third party's leak can reach developer tooling.
2. A ZephrSec guide explains how to write red team reports that get acted on, covering executive summaries, findings, severity ratings, and translating technical work into business impact. It is practical advice for security teams rather than a news event.
3. A second write-up of the same incident frames it as a Cursor data breach: an attacker used the Fireworks AI access key, exposed by Fireworks, to copy data, and the same compromise produced a trojanized Claude Code extension on Cursor's marketplace.
4. In a Help Net Security weekly review, GitGuardian CEO Eric Fourrier argues that fear of blame pushes leaked-credential mistakes out of sight. He urges security leaders to be ready to brief CEOs on exposed keys.
5. SANS Internet Storm Center reports a Macfinger ClickFix campaign that delivers the DownTheDRAIN infostealer to macOS users. The lure relies on ClickFix-style tricks to get victims to run malicious steps themselves.
6. Physicists used laser flashes to organize tiny electrical regions inside a crystal, resolving a decades-old puzzle about its behavior. The alignment lasts only a trillionth of a second, but it could inform future information processing and storage.
7. Arctic Wolf Labs links the open-source AI pentest platform AntiFox to intrusions that stole AWS credentials and read production secrets, with Alibaba Cloud systems hosting AntiFox interfaces tied to the activity. It shows how an autonomous offensive AI tool can be abused.

Summaries written with AI from the linked source articles.

Sources in this roundup

Most-mentioned keywords

Sources

1. Cursor Says Stolen Fireworks AI Key Led to Trojanized Claude Code Extension Incident
2. Below the Waterline Stage 3 – Writing Red Team Reports Properly
3. Stolen Fireworks AI Key Led to Cursor Data Breach and Trojanized Claude Code Extension
4. Week in review: Secret stealer hits GitHub repos, Claude Code turned into remote-controlled implant
5. Macfinger ClickFix campaign sends DownTheDRAIN infostealer for macOS, (Fri, Nov 13th)
6. Physicists use laser light to unlock a crystal's hidden electrical powers
7. AntiFox AI Pentest Tool Linked to AWS Production Secret Theft