Daily Cybersecurity News – November 14, 2026

What happened

North Korean state-linked hackers stole more than $400 million in cryptocurrency over the past 18 months by luring targets into fake Zoom and Microsoft Teams calls that play stolen webcam footage of earlier victims. The FBI names the scheme FaceStealer, has seized more than 900 of those recordings, and on November 12 warned crypto and web3 workers plus open-source maintainers.

The activity is tied to the group tracked as Sapphire Sleet, BlueNoroff and APT38. Attackers compromise victims' Telegram, LinkedIn, Slack or Discord accounts, message contacts with Calendly invites, then send lookalike meeting links (such as uu01webzoom[.]us). Inside the call they play recorded video of the real contact, claim audio problems, and walk the target through an update, script or terminal command. That installs cookie harvesters, keyloggers, screen capturers and backdoors while the webcam has been recording since the link was clicked. In some cases the group waited months to more than a year for wallet balances to grow before draining them. They have also targeted open-source maintainers and begun using deepfakes.

Who is affected

Crypto and web3 workers, open-source maintainers (including JavaScript/npm and Rust crates), and anyone whose devices hold crypto wallets, seed phrases, employer network access or code repositories.

The scheme has already produced hundreds of victim recordings that fuel further lures, expanding the pool of potential targets.

Why it matters

State actors are industrializing social engineering by recycling real victim video and waiting patiently for high-value payouts. Each successful infection supplies the familiar face for the next call, creating a self-reinforcing campaign.

Open-source maintainer targeting raises supply-chain risk for widely downloaded libraries. Builders and operators holding keys or seeds on everyday devices face silent, delayed theft that standard endpoint tools may miss until funds move.

How it could have been prevented

Leave the webcam off until you can see, hear and speak live with the person who invited you. Join only through the official Zoom or Teams app using an invite code, and confirm the meeting over a second channel such as a phone call.

Never run scripts or paste commands to "fix" a meeting app. Keep only small balances in browser-extension wallets and store no recovery phrases or private keys on devices. If compromise is suspected, create a new wallet on a clean device and move funds immediately.

What happened

The FBI issued a flash alert on the open-source AI platform Artex, which cybercriminals and nation-state actors are using to automate multiple phases of intrusions at machine speed, from reconnaissance through data exfiltration. Some attacks progress from initial targeting to privileged access in under three hours.

Released in August on GitHub by the account Autumn-27 (linked to Chinese engineer Li Puhua, who later stated the tool was abused and removed the repo), Artex continues via forks, archives and a commercial version. It turns any large language model into an agent that converts high-level goals into executable commands with minimal human input. Chinese models such as DeepSeek dominate observed attacker use. Censys found over 1,600 publicly exposed consoles. It has been linked to attacks on financial institutions in South Korea and Japan, a ConnectWise supply-chain incident involving Chinese actors, large-scale AI credential theft, and deepfake KYC bypasses.

Who is affected

Organizations across financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal sectors worldwide.

Any environment reachable by automated AI-driven reconnaissance and exploitation, plus operators of exposed Artex consoles.

Why it matters

The framework lowers the skill bar for complex, multi-target operations and dramatically shortens dwell time from hours or days to under three hours. Sustained, low-intervention campaigns become practical for both criminals and state groups.

Defenders face faster, more scalable attacks that blend AI inference with traditional techniques, including credential theft that funds further AI use.

What happened

Attackers used a fake Microsoft Teams meeting scheduler to trick an employee at a construction company into completing a device-code sign-in, obtaining a valid session token before Huntress SOC detected the incident.

Device-code phishing abuses a legitimate Microsoft flow: the attacker initiates sign-in, receives a short code, and convinces the victim to enter it on Microsoft's real device-login page. The victim may complete MFA, unknowingly approving the attacker's session and handing over access tokens. The lure arrived from a typosquatted domain via a Google share link that hid the attacker domain, showed an executive headshot, and presented the code as a "Booking Reference" with a countdown. The kit was delivered as AES-256-GCM ciphertext to evade non-JavaScript scanners, included MFA-error fallbacks that restarted the flow, and routed the final login through a residential proxy.

Who is affected

Microsoft 365 and Teams users, particularly in enterprises that allow device-code authentication. Organizations whose staff receive unexpected meeting or partnership booking requests.

Any account that can complete an interactive device-code flow is potentially exposed.

Why it matters

The attack rides genuine Microsoft pages and can satisfy MFA, defeating many traditional phishing filters and user training that focus on fake login sites. Session tokens grant broad account access without repeated password prompts.

Builders and operators must treat unexpected device-code prompts as high-risk and monitor for anomalous sign-in patterns.

How it could have been prevented

Treat unexpected device-code prompts as suspicious. Where business needs allow, restrict or closely monitor device-code authentication with conditional access policies.

Deploy phishing-resistant MFA. Scrutinize unfamiliar device sign-ins and watch interactive sign-in logs for programmatic user agents such as python-requests or node. After compromise, hunt for rogue MFA methods, unknown devices, unauthorized app consents, suspicious mailbox rules and outbound mail.

What happened

CISA added a high-severity UnrealIRCd flaw, CVE-2026-114713 (CVSS 8.6), to its Known Exploited Vulnerabilities catalog on November 13 after confirmed active exploitation. The issue is improper neutralization of delimiters in the labeled-response module.

In UnrealIRCd 6.0.0 before 6.2.7.1, the module fails to escape the IRCv3 "label" message tag when echoing replies. Any user on a network with two or more linked servers can inject server-to-server commands that run with server authority. Project maintainer Bram Matthys released 6.2.7.1 to fix it (and other issues found with AI assistance); exploitation began the day after the hotfix. He called it the most critical UnrealIRCd issue in 15 years. Federal agencies face a November 16 remediation deadline under BOD 26-04.

Who is affected

Operators of UnrealIRCd IRC servers running versions 6.0.0 through 6.2.7.0, especially those with linked multi-server networks.

Any IRC network exposing the labeled-response functionality to untrusted users.

Why it matters

Successful exploitation yields command execution with server/IRCOp privileges, enabling full server takeover, lateral movement across linked servers, or further malware delivery. Active exploitation immediately after disclosure leaves unpatched instances highly exposed.

IRC infrastructure often supports communities, gaming or internal chat; compromise can cascade to connected users and systems.

How it could have been prevented

Upgrade immediately to UnrealIRCd 6.2.7.1 or later. If patching is delayed, deploy the maintainer-recommended spamfilter workaround.

Monitor logs for anomalous server-to-server commands and restrict network linking where possible. Federal civilian agencies must meet the November 16 deadline.

What happened

Two newly detailed attacks, Mior and Skyfall, allow a malicious host to read data inside AMD SEV-SNP-protected virtual machines that are designed to keep even the cloud operator out. Mior can also modify VM memory and forge the signed attestation report that proves which software the VM runs.

Both require control of the hypervisor; Mior additionally needs BIOS/UEFI control and a PCIe device such as a GPU. Researchers at ETH Zurich demonstrated them in lab tests on AMD EPYC processors. Mior targets SEV-SNP startup: it redirects Platform Security Processor writes intended for the Reverse Map Table to attacker-controlled GPU memory, leaving critical RMP entries uninitialized so the hypervisor can later rewrite protections, enable debugging, and use PSP debug commands to read or write VM memory (succeeded in all 1,000 trials). It can also swap attestation measurements. AMD released SEV firmware for Mior and microcode for Skyfall dated August 12, with platform firmware planned for server vendors in November (Skyfall) and December (Mior).

Who is affected

Cloud customers and operators running confidential VMs protected by AMD SEV-SNP on EPYC server CPUs (Zen 5 confirmed; Zen 3 and Zen 4 potentially affected). Workloads that rely on hardware isolation from the host.

Providers whose hypervisors or BIOS could be compromised, plus embedded AMD platforms later.

Why it matters

The attacks break the core security promise of confidential computing: that a VM's memory and attestation remain protected even from a malicious or compromised host. Forged attestations undermine remote verification of trusted execution.

Organizations placing sensitive data or keys in SEV-SNP VMs on untrusted infrastructure must treat host compromise as a direct data-exposure risk until firmware is applied.

How it could have been prevented

Obtain and apply the latest SEV firmware, microcode and platform BIOS updates from AMD and your server vendor as they become available (November-December timeline for many platforms).

Confirm ciphertext-hiding and other SEV-SNP options are correctly configured, monitor vendor advisories, and prefer providers that rapidly roll out these fixes. Ordinary non-confidential VMs gain nothing new from these attacks.

What happened

Trezor confirmed that three Safe 5 hardware wallets purchased from reseller CryptoBilis contain a hidden implant: an extra circuit board that reads the recovery phrase from the screen and transmits it over the mobile network to attacker servers. The company analyzed one device in its lab and identified the others from owner photos; no funds losses have been reported so far.

The implant sits between the main board and screen, leaves the wallet firmware and Secure Element untouched, captures the phrase (and any passphrase) during backup creation or restore, encrypts the data, and retries until it can phone home. Firmware 2.13.1 (released for Safe 7, Safe 5, Safe 3 and Model T) blocks the known implants from capturing new data, but cannot protect phrases already stolen. CryptoBilis was an official Southeast Asia reseller until October 9; a similar implant campaign hit Ledger devices sold by the same reseller.

Who is affected

Anyone who bought a Trezor Safe 5 (or potentially other models) from CryptoBilis since March, including via its Tokopedia and Shopee stores.

Owners unsure of purchase origin should also treat the devices as suspect.

Why it matters

A physical supply-chain implant defeats the core value of a hardware wallet by stealing the seed at the moment it appears on screen. Attackers can later drain funds at leisure without further interaction.

The incident, paired with the parallel Ledger cases, shows that even official resellers can be vectors and that firmware updates alone do not erase prior captures.

How it could have been prevented

If you bought from CryptoBilis since March, move all funds to a brand-new wallet generated on a clean device with a fresh recovery phrase. Do not restore the old phrase anywhere. Contact Trezor Support for a replacement; keep the suspect device and do not open or weigh it.

Update to firmware 2.13.1 or later. Buy only from highly trusted channels, never share a recovery phrase, and beware of scammers impersonating support.

What happened

An international law-enforcement operation under Operation Endgame this week took down servers and infrastructure used by the Gootloader loader, CastleRAT remote-access trojan and StealC infostealer. Police seized approximately 6.4 million stolen logins belonging to more than 40,000 victims, plus 235 servers and 257 domains overall.

Gootloader spreads via SEO-poisoned fake legal documents on compromised WordPress sites, drops additional malware (especially ransomware), and has been linked by the U.S. Justice Department to at least 25,000 infections and $28.8 million in ransomware losses across 44 U.S. victims (German authorities cite far higher global figures). Operators sold access to ransomware groups. CastleRAT (known since 2025) enables full remote control; StealC steals credentials and had already been hit in June before operators rebuilt, partly on bulletproof hosting later dismantled. No arrests were announced in this wave; Dutch police continue pursuing a main Gootloader suspect.

Who is affected

Tens of thousands of victims whose credentials were stolen, organizations hit by follow-on ransomware, and owners of the hundreds of compromised WordPress sites used for Gootloader distribution.

Users of the affected malware families and anyone whose email appears in the seized CastleRAT data.

Why it matters

The takedown disrupts a major malware ecosystem that converts initial access into ransomware and credential theft at scale. Removing loaders, RATs and stealers raises costs for criminals and temporarily reduces attack volume.

Operators have rebuilt before, so the relief is partial; the public Check-your-hack service and site-cleanup actions give victims concrete recovery paths.