{"id":4157,"date":"2026-11-12T18:19:55","date_gmt":"2026-11-12T18:19:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=4157"},"modified":"2026-11-12T18:19:55","modified_gmt":"2026-11-12T18:19:55","slug":"59-linux-kernel-bugs-falcon-spyware-gsocket-backdoors-17-more-stories","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=4157","title":{"rendered":"59 Linux Kernel Bugs, Falcon Spyware, GSocket Backdoors + 17 More Stories"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 12, 2026<\/span><\/span>Hacking News \/ Cybersecurity News<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A search result isn’t always safe. An access request isn’t always harmless. And a familiar account doesn’t always mean a familiar person is using it. Simple things to remember. Yet a surprising amount of this week’s trouble starts right there.<\/p>\n

Attackers are using fake websites, stolen access, and trusted tools to get into places they shouldn’t be. AI is helping them build attacks faster, while also giving them new systems to target. Some intruders are staying hidden even after security holes are fixed. Others are moving stolen money through a maze of transactions. And researchers keep finding small coding mistakes that can cause much bigger problems. Different stories, but much of the trouble comes down to making something dangerous look normal.<\/p>\n

There is some good news, too. Criminal servers have been seized, and a few defenses are getting stronger. Still, plenty of things are going wrong in ways that shouldn’t be this easy. Here’s what turned up this week.<\/p>\n

\n <\/p>\n

The threats change every week. Subscribe, and we\u2019ll alert you<\/span> when each new ThreatsDay Bulletin is out.<\/p>\n<\/div>\n

\n
\n
    \n
  1. \n <\/p>\n
    \n North Korea’s crypto laundering network<\/span><\/p>\n

    \n The North Korean threat actors linked to the record-breaking theft of $6.43 billion from Binance are using a highly complex and clearly automated method to launder the illicit proceeds. \u00abSince the theft it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions,\u00bb Dr. Tom Robinson, Elliptic’s founder and chief scientist, said<\/a>. \u00abAround $3.0 billion remains in addresses linked to the theft, mostly as ETH and BTC. A negligible amount has likely been cashed out.\u00bb The attackers have also been observed creating six meme coins<\/a> on the NEAR blockchain network (FUK, OLCCL, MEILI, MMLI, DABI, and SINU) to launder a slice of the ill-gotten funds, passing through about $430,000 of the stolen cryptocurrency. The goal is to disguise the path of money and make it harder to trace where the assets eventually end up. Other tactics used to make funds tracing more difficult include moving between blockchains through bridges and cross-chain swap services, swapping between assets on DEXs, hopping through lending vaults and liquid-staking services, and mixing bitcoin through coinjoins, and ETH and SOL through the Privacy Cash privacy pool. The Binance breach is by no means the first to affect a major cryptocurrency exchange, but it is the biggest ever by magnitude. North Korean spokesperson Kim Yo Jong denied<\/a> the country’s role in the attack, calling it an \u00ababsurd\u00bb effort to \u00abdamage the international image of the DPRK.\u00bb\n <\/p>\n<\/p><\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  2. \n <\/p>\n
    \n GSocket detections surge 356%<\/span><\/p>\n

    \n Microsoft said it has observed multiple incidents in which threat actors deployed GSocket<\/a>, an open-source remote access tool, on internet-facing Linux servers to maintain access after the original vulnerabilities were addressed, turning a single web application compromise into persistent access. \u00abBecause GSocket relays traffic through a shared public network, there is no threat actor-owned IP address or domain to block,\u00bb Microsoft said<\/a>. \u00abDefenders should look for GSocket deployment, persistence, privilege escalation, and outbound connections on affected hosts, not treat application patching alone as complete remediation.\u00bb According to telemetry data, devices with GSocket-related detections increased 356.2% from March through August 2026, with most of them associated with PHP web applications, cPanel hosts, and Apache. The majority of targets of GSocket activity are in the education and research sector, followed by technology and communications, manufacturing, and government entities.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  3. \n <\/p>\n
    \n 235 servers seized in Europol takedown<\/span><\/p>\n

    \n Europol, along with global partners, has disrupted the criminal infrastructure behind GootLoader, CastleRAT, and StealC malware, seizing 235 servers and 257 domains. \u00abThe operation targeted ‘cybercrime-as-a-service’ models, where these tools enabled further crimes like ransomware attacks and data theft,\u00bb Europol said<\/a>. As part of the operation, authorities have identified over 6 million victim credentials. \u00abThe suspects were using these credentials, stolen from the victims after they infected them, to sell them and later be used for other cyber-attacks such as ransomware,\u00bb Europol added.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  4. \n <\/p>\n
    \n Browser-based espionage targets governments<\/span><\/p>\n

    \n A command and control (C2) framework called Falcon (aka XG or Xi\u00e0ng G\u0113) has been found compromising victims’ browsers by running malicious JavaScript. Falcon shares near-identical URL structures, payload delivery mechanisms and communication protocols with PeckBirdy, another JavaScript C2 framework that came to light early this year. It’s assessed that Falcon and PeckBirdy represent variants of the same core framework. \u00abAn actor leveraged Falcon to compromise visitors of webmail portals and government web applications by placing malicious JavaScript directly within these sites,\u00bb Palo Alto Networks Unit 42 said<\/a>. \u00abOperating entirely inside the browser context, attackers have used the framework to sideload malicious Chrome extensions and steal the following information: passwords, emails, session cookies, [and] communications.\u00bb Falcon has also been used to deliver an implant dubbed Antino, which uses Microsoft OneDrive as a C2 channel. The activity has targeted government entities in one Middle Eastern country and four Southeast Asian countries between March and May 2026. \u00abThe campaigns we observed targeted ministries of foreign affairs, defense and interior, and law enforcement agencies, consistent with strategic intelligence collection objectives,\u00bb Unit 42 said.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  5. \n <\/p>\n
    \n 59 Linux kernel bugs uncovered<\/span><\/p>\n

    \n Microsoft said its scan of a subset of Linux kernel subsystems from late May to mid-June 2026 unearthed 26,502 raw findings using MDASH, which subsequently formed the basis for 59 public upstream reports and 33 assigned CVEs. This includes working root privilege-escalation exploits for eight of those CVEs, such as CVE-2026-64563. \u00abCVE-2026-64563 is a one-line state-reset bug in rhashtable, the Linux kernel’s shared resizable hash table,\u00bb Microsoft said<\/a>. \u00abBecause callers trust the object pointers returned by a table walk, this small library flaw enabled a stable local privilege escalation on Linux — and affected Android with SELinux enforcing — without requiring special kernel configurations or user namespaces.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  6. \n <\/p>\n
    \n AI-assisted espionage in Central Asia<\/span><\/p>\n

    \n An exposed Silent Lynx server has uncovered cyber espionage operations targeting Central Asian governments and critical infrastructure from April to October 2026. \u00abThe directory held the group’s tooling alongside data from active intrusions into government and critical infrastructure organisations across the region, and the AI agent the operator relied on to run them,\u00bb CloudSEK said<\/a>. \u00abWe assess with medium confidence that the operator has a Kazakhstan nexus: the operation runs in Russian, and the operator’s own test traffic came from a residential Kazakh connection, which supports existing vendor assessments. The collection priorities, spanning transport, defence correspondence and resource ministries in neighbouring states, point to regional intelligence gathering rather than financial motive.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  7. \n <\/p>\n
    \n Contractor access fuels ransomware attacks<\/span><\/p>\n

    \n A new Russian-speaking ransomware group called Citrus<\/a> is targeting Windows systems in corporate environments. The attackers have been found to gain access through compromised contractor accounts and leverage AI-generated PowerShell scripts, batch files, and commands during later stages of the intrusion. In an attempt to reduce visibility, the threat actor removes tools and output files after execution, clears command history, and deletes event logs. The group also disguises tools and related artifacts with benign-looking names to make them appear legitimate by using a trusted brand name. The ransomware is a Sn00py-family ransomware variant written in Go. On Windows systems, the malware encrypts user files and appends the .citrus extension, while taking steps to hinder recovery and incident response. Kaspersky said the activity shares several similarities with Toy Ghouls. \u00abCitrus stands out for the way AI-generated content appears to support hands-on intrusion activity on compromised systems,\u00bb said Stanislav Larinsky, Kaspersky Security Services expert. \u00abIn the cases we investigated, the attackers combined third-party account access, privilege-escalation attempts and domain-wide deployment techniques. These incidents show how limited contractor access can become a path to broader compromise if it is not tightly controlled and continuously monitored.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  8. \n <\/p>\n
    \n Malicious AI agents exploit OAuth consent<\/span><\/p>\n

    \n Proofpoint has disclosed details of a new technique called BluePhishing that’s described as the \u00abnext evolution of OAuth consent abuse,\u00bb enabling bad actors to leverage agent identities like Microsoft Entra Agent ID for initial access. BluePhishing \u00absocially engineer[s] victims into granting consent to a malicious agent blueprint for initial access,\u00bb it said<\/a>. \u00abAnalogous to app consent phishing where attackers use client credentials to gain initial access to a tenant, BluePhishing extends this technique to the agent ecosystem. By exploiting gaps in visibility and governance around emerging AI agent adoption, attackers can abuse one-time consent links to create agent identities in target tenants, obtain access tokens, and operate with the privileges assigned to those agents.\u00bb\n <\/p>\n<\/p><\/div>\n

    \"\"<\/a><\/div>\n<\/li>\n
  9. \n <\/p>\n
    \n AI age checks expand worldwide<\/span><\/p>\n

    \n Meta has announced that it’s expanding its AI age-estimation technology globally to automatically place millions of teens in Teen Account protections on Instagram. \u00abWe use AI technology to find people we suspect to be teens, even if they use an adult birthday, and place them in Teen Account protections,\u00bb Meta said<\/a>. \u00abAs a result, millions more teens across the world who use Instagram will receive these built-in protections, even if they’ve misrepresented their age.\u00bb In Australia, Meta has opted to use Apple’s age-range signal as another method to help understand age.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  10. \n <\/p>\n
    \n OAuth support for Exchange migrations<\/span><\/p>\n

    \n Microsoft 365 Mailbox Replication Service (MRS) has added support for OAuth as an authentication method when migrating mailboxes between Microsoft 365 and an on-premises Exchange environment. \u00abOnce OAuth for MRS is configured, tenant administrators can create an OAuth migration endpoint and use it in migration batches or in onboarding and offboarding move jobs,\u00bb Microsoft said<\/a>. \u00abYou can use this method in both hybrid and non-hybrid organizations.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  11. \n <\/p>\n
    \n NTLM signing hardened against relay attacks<\/span><\/p>\n

    \n In more Microsoft-related news, the tech giant has incorporated additional protections into Windows starting November 10, 2026, that address CVE-2026-118737<\/a> (CVSS score: 8.1), a critical remote code execution flaw in Remote Procedure Call Runtime that could allow an unauthorized attacker to execute code over a network. \u00abThese updates represent the first phase of improvements to NTLM message signing,\u00bb Microsoft said<\/a>. \u00abThese changes help ensure that authenticated NTLM sessions always establish a cryptographic session key and negotiate real message signing, reducing exposure to relay attacks.\u00bb To that end, Windows servers will begin requiring NTLM signing by default starting May 2027.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  12. \n <\/p>\n
    \n Exposed cloud credentials lingered 18 months<\/span><\/p>\n

    \n Details have emerged about a now-patched security flaw affecting the Planning Inspectorate, an executive agency of the United Kingdom’s Ministry of Housing, Communities and Local Government (MHCLG). The issue involved a complete Microsoft Entra ID application credential that was committed in plaintext to a GitHub repository. \u00abAlthough removed from the branch, the commit was orphaned via a force push and remained retrievable via GitHub’s raw object CDN for 18 months,\u00bb ControlPlane said<\/a>. The client secret was deleted about 20 minutes after responsible disclosure on August 26, 2026.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  13. \n <\/p>\n
    \n Fake software sites spread infostealer<\/span><\/p>\n

    \n An SEO poisoning campaign is using fake websites impersonating the Chocolatey package manager and the Microsoft Activation Scripts (MAS) tool to distribute a Python-based malware called Armorsteal<\/a>. \u00abThe installer deployed a Python 3.11 runtime environment and three main components providing remote access, surveillance, and information stealing capabilities, with the Python code protected by Pyarmor,\u00bb Zscaler said<\/a>. \u00abThe remote access component communicates with a command-and-control (C2) server, downloads additional modules, and executes remote tasks. The surveillance component logs keystrokes, monitors the clipboard, captures screenshots, and displays fake cryptocurrency wallet notifications. The information stealing component targets browser data, Discord tokens, cryptocurrency wallets, seed phrases, saved passwords, SSH keys, and Steam data.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  14. \n <\/p>\n
    \n Localized phishing delivers banking trojan<\/span><\/p>\n

    \n A new Grandoreiro banking malware campaign is targeting users across Argentina, Chile, Colombia, Mexico, and Peru through country-specific phishing lures that are tailored to each region. \u00abThe campaign uses localized phishing lures, primarily in Spanish, with some observed using Portuguese even when targeting Spanish-speaking countries,\u00bb Arctic Wolf said<\/a>. \u00abThe phishing chain relies on recently registered domains and layered redirection to hinder detection. The final payload is retrieved through a Domain Generation Algorithm (DGA) seeded with the current date. The downloaded ZIP archive uses a deeply nested folder structure populated with two legitimate PE files and two benign PDF documents. A VBScript file located in the archive’s root directory acts as the primary payload, employing junk code and multiple layers of obfuscation before reconstructing and launching a Delphi-based loader.\u00bb The loader masquerades as a PDF reader and is used to fetch and run the banking trojan.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  15. \n <\/p>\n
    \n AI search results targeted by scam sites<\/span><\/p>\n

    \n Palo Alto Networks Unit 42 said it detected an indirect prompt injection (IDPI) campaign across 26 domains. \u00abThese are attempting black-hat Generative Engine Optimization (GEO) to game AI-powered search results,\u00bb Unit 42 said<\/a>. \u00abAlmost all of the 26 pages have very similar content, presenting as AI-powered digital asset trading platforms. These sites appear to be scam sites designed to collect user information. The injected prompt is set to be hidden from a regular web user but likely visible to an AI agent. These attacks intend to poison SEO and manipulate AI agents to eventually get users to visit these sites.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  16. \n <\/p>\n
    \n PyPI adds release verification signals<\/span><\/p>\n

    \n The Python Package Index (PyPI) has added a security tab to its project pages, giving developers easy access to security signals. \u00abThe new security tab communicates release provenance states and displays per-file attestations, giving you a dedicated place to verify where the release files came from,\u00bb PyPI said<\/a>. \u00abPyPI calculates each release’s provenance state by checking whether each release file has an attestation.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  17. \n <\/p>\n
    \n 100+ domains spread credential stealer<\/span><\/p>\n

    \n The information stealer known as RevStealer is being propagated as part of an \u00abindustrial-scale, financially motivated campaign\u00bb that uses game cheats and AI tools as lures. The payload is distributed through more than 100 interconnected domains, trojanized Electron applications masquerading as Anthropic’s Claude Opus 5, and hijacked YouTube distribution channels, per Akatsuki Legion. \u00abOnce executed, the malware performs a ten-point weighted sandbox-evasion scoring routine, decrypts an AES-256-CBC in-memory payload, and leverages fourteen indirect syscall wrappers and FNV-1a API hashing to bypass user-mode hooks before systematically harvesting credentials from browsers, password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop, and Minecraft; then exfiltrating the loot as streamed, encrypted typed records over HTTPS, with a resilient Polygon blockchain dead-drop resolver standing by as a fallback command-and-control channel,\u00bb the independent adversary research group said<\/a>.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  18. \n <\/p>\n
    \n AI infrastructure becomes an attack target<\/span><\/p>\n

    \n Threat actors have increasingly targeted AI orchestration platforms over the past few months, according to Sekoia. This is because \u00abthey concentrate API keys, enterprise data, and access to external tools,\u00bb it added<\/a>. This includes Flowise, which has been affected by multiple security flaws like CVE-2025-59528 and CVE-2026-41264. In one exploitation attempt recorded in August 2026, a suspected Chinese-speaking actor abused legitimate Flowise functionality to conduct automated reconnaissance and attempted to hijack the LLM agent to serve as an offensive analysis vector against external targets. \u00abThe attacker attempted to turn the AI agent into an interactive offensive assistant, submitting real-world reconnaissance data (Nightingale\/Redis infrastructure) to generate custom exploitation playbooks and target analysis,\u00bb Sekoia said.\n <\/p>\n<\/p><\/div>\n<\/li>\n

  19. \n <\/p>\n
    \n AI-built phishing kits multiply<\/span><\/p>\n

    \n LevelBlue has disclosed details of a family of phishing kits named BlackApex, DarkApex, SPY, XXX101-TOKEN, OGPARKER1, W1-TOKEN, and ALIBOBO-TOKEN that are used to facilitate device code phishing attacks using shared document lures. The findings once again demonstrate how AI can speed up the development of a convincing multi-brand phishing kit. \u00abAcross all of its lures, the source shows traits we associate with AI-generated code, whether from direct prompts to a language model or from a person working alongside an AI coding assistant,\u00bb LevelBlue said<\/a>. \u00abThe code, endpoints, and interface are the same across all of them. We cannot say whether these names reflect separate operators, resellers or customers of a single kit, but the pattern is consistent with a shared product being rebranded and redeployed.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n

  20. \n <\/p>\n
    \n AI verifies Signal security properties<\/span><\/p>\n

    \n Google’s DeepMind has introduced AlphaProof Code, which brings together human experts and AI agents to verify software and mathematically demonstrate that it works as intended. The multi-agent AI framework has been used to prove key security properties of libsignal<\/a>, the Signal protocol’s reference implementation, at the machine-code level. \u00abAlphaProof Code consists of a human-guided agent for writing Lean specifications of code, a formal semantics of AArch64 machine code, and a team of autonomous prover agents whose proofs are accepted only if Lean\u2019s kernel checks them against the approved specification,\u00bb DeepMind said<\/a>. \u00abApplied to libsignal, our agents generated about 6.5 million lines of machine-checked Lean proof code, resting on about 26,000 lines of trusted specifications and AArch64 semantics. The proofs cover Signal\u2019s post-quantum PQXDH handshake and Triple Ratchet, establishing forward secrecy, authentication, post-compromise security, and handshake secrecy.\u00bb\n <\/p>\n<\/p><\/div>\n<\/li>\n<\/ol>\n<\/section>\n<\/div>\n

    That’s the lot for this week. Some attacks were carefully planned. Others relied on old mistakes, trusted accounts, or someone clicking the wrong thing. AI is showing up on both sides, making attacks easier to build while helping researchers find problems faster. The tools keep changing, but attackers still seem happy to use whatever works.<\/p>\n

    The good news is that some of these threats are being stopped, and defenses are slowly catching up. The bad news is that fixing a bug, removing a file, or blocking an attacker doesn’t always mean the problem is gone. Sometimes the damage sticks around longer than anyone expects. Worth keeping in mind before the next batch of headlines arrives.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Nov 12, 2026Hacking News \/ Cybersecurity News A search result isn’t always safe. An access request isn’t always harmless. And a familiar account doesn’t always mean a familiar person…<\/p>\n","protected":false},"author":1,"featured_media":4158,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[104,809,3281,4141,1571,181,1030,187],"class_list":["post-4157","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-backdoors","tag-bugs","tag-falcon","tag-gsocket","tag-kernel","tag-linux","tag-spyware","tag-stories"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4157"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/4157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/4158"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}