Cybersecurity researchers have uncovered a fresh wave of cyber threats involving sophisticated cryptocurrency laundering operations, Linux kernel vulnerabilities, browser-based espionage, ransomware attacks and malicious artificial intelligence (AI) tools.

The latest developments also reveal how cybercriminals are exploiting trusted software platforms, compromised contractor accounts, stolen credentials and AI-powered technologies to expand their operations and evade security detection.

In one major development, North Korean-linked hackers accused of stealing $6.43 billion from Binance are reportedly using more than 20,000 cryptocurrency wallets across 16 blockchain networks to conceal the stolen assets.

Elsewhere, Microsoft has reported a 356.2 per cent increase in devices associated with GSocket-related detections, while Europol has dismantled criminal infrastructure linked to three malware operations, seizing 235 servers and 257 internet domains.

Other discoveries include 59 reported Linux kernel vulnerabilities, a browser spyware framework targeting government institutions, an AI-assisted espionage campaign against Central Asian governments and a new phishing technique designed to trick Microsoft Entra users into granting malicious AI agents access to cloud environments.

The developments were highlighted in the November 12, 2026 edition of The Hacker News’ weekly ThreatsDay cybersecurity bulletin.

Here are the major cybersecurity developments reported this week.

North Korean Hackers Use Thousands of Wallets to Launder $6.43 Billion in Stolen Binance Cryptocurrency

North Korean-linked cybercriminals accused of carrying out the record-breaking $6.43 billion cryptocurrency theft from Binance are reportedly employing an extensive and automated laundering operation to conceal the stolen funds.

According to Dr Tom Robinson, founder and chief scientist at blockchain analytics firm Elliptic, the attackers have used more than 20,000 cryptocurrency wallets across 16 blockchain networks, alongside at least 36 services and approximately 65,000 transactions.

An estimated $3 billion remains in cryptocurrency addresses associated with the theft, primarily in Ethereum (ETH) and Bitcoin (BTC), while only a negligible portion is believed to have been converted into cash.

Investigators also discovered that the attackers created six meme coins on the NEAR blockchain, identified as FUK, OLCCL, MEILI, MMLI, DABI and SINU, to facilitate the movement of some of the stolen cryptocurrency.

Approximately $430,000 in stolen digital assets reportedly passed through these tokens.

The criminals are also using blockchain bridges and cross-chain swapping services to transfer funds between networks, while converting cryptocurrencies through decentralised exchanges, lending platforms and liquid-staking services.

Additional concealment techniques include Bitcoin CoinJoin transactions and the use of Privacy Cash, a privacy pool associated with Ethereum and Solana transactions.

These methods are designed to complicate blockchain investigations and make it harder for authorities to establish the final destination of the stolen funds.

The Binance incident is reportedly the largest cryptocurrency exchange theft by financial magnitude.

However, North Korean spokesperson Kim Yo Jong has denied the country’s involvement, describing the accusations as an absurd attempt to damage the international reputation of the Democratic People’s Republic of Korea.

GSocket Attacks Increase by 356.2% as Hackers Target Linux Servers

Microsoft has warned about a significant increase in attacks involving GSocket, an open-source remote access tool increasingly abused by cybercriminals to maintain persistent access to compromised Linux servers.

Researchers identified multiple incidents in which attackers installed GSocket on internet-facing Linux systems after exploiting vulnerabilities in exposed applications.

Even after organisations patched the original security weaknesses, the attackers retained access through the previously installed remote access tool.

One major challenge for defenders is that GSocket routes communications through a shared public network, making it difficult to identify and block a specific attacker-controlled IP address or domain.

Microsoft’s telemetry indicates that devices generating GSocket-related detections increased by 356.2 per cent between March and August 2026.

The activity has been particularly associated with PHP-based web applications, cPanel-hosted environments and Apache servers.

Educational and research institutions have emerged as the most frequently affected sector, followed by technology and communications companies, manufacturing organisations and government entities.

Microsoft advised security teams to investigate possible GSocket installations, persistence mechanisms, privilege escalation activities and suspicious outbound connections.

The company stressed that patching the original vulnerability alone does not guarantee that a compromised server has been fully secured.

Europol Seizes 235 Servers and 257 Domains in Major Malware Crackdown

Europol and international law enforcement partners have dismantled infrastructure associated with GootLoader, CastleRAT and StealC malware operations.

The coordinated operation resulted in the seizure of 235 servers and 257 internet domains used to support criminal activities.

According to Europol, the investigation targeted cybercrime-as-a-service operations that provide tools and infrastructure used by other criminals to conduct ransomware attacks, steal information and compromise computer systems.

Authorities also identified more than six million stolen victim credentials.

Investigators said the credentials were collected from infected victims and subsequently offered for sale, allowing other cybercriminals to reuse the information in additional attacks.

The operation represents another major international effort to disrupt the infrastructure supporting organised cybercrime.

Falcon Browser Spyware Targets Government Emails and Passwords

Cybersecurity researchers have uncovered a sophisticated command-and-control framework known as Falcon, also identified as XG or Xiàng Gē, which compromises internet browsers through malicious JavaScript code.

The framework reportedly shares almost identical URL structures, payload delivery methods and communication protocols with another JavaScript-based command-and-control system called PeckBirdy.

Researchers believe both frameworks may represent different versions of the same underlying technology.

According to Palo Alto Networks’ Unit 42 research team, attackers injected malicious JavaScript into government web applications and webmail portals to compromise visitors.

Operating directly within browser environments, Falcon has been used to install malicious Chrome extensions and collect sensitive information, including passwords, emails, session cookies and private communications.

The framework has also been deployed to deliver a malicious implant called Antino, which uses Microsoft OneDrive as its command-and-control communication channel.

Investigators linked the campaigns to government institutions in one Middle Eastern country and four Southeast Asian countries between March and May 2026.

The targeted organisations included foreign affairs ministries, defence institutions, interior ministries and law enforcement agencies.

Researchers believe the selection of targets indicates an intelligence-gathering operation rather than an ordinary financially motivated cybercrime campaign.

Microsoft Discovers 59 Linux Kernel Vulnerabilities

Microsoft researchers have disclosed 59 security vulnerabilities affecting various Linux kernel components following an extensive security assessment conducted between late May and mid-June 2026.

The investigation used Microsoft’s MDASH scanning technology to examine selected Linux kernel subsystems, generating 26,502 initial findings.

Further analysis resulted in 59 publicly reported security issues, 33 of which received Common Vulnerabilities and Exposures (CVE) identifiers.

Researchers also developed working root privilege-escalation exploits for eight of the identified vulnerabilities.

One notable discovery was CVE-2026-64563, involving a one-line state-reset error in the Linux kernel’s resizable hash table, known as rhashtable.

Microsoft explained that the programming error could allow attackers with local access to exploit object pointers returned during table operations and obtain elevated privileges.

The vulnerability also affects Android devices, including systems operating with SELinux enforcement enabled.

Researchers noted that exploitation does not require unusual kernel configurations or user namespaces.

The discovery highlights how relatively small programming errors within fundamental operating system components can create serious security consequences.

Silent Lynx Uses AI Agent to Steal More Than 2,000 Tajik Government Documents

Cybersecurity researchers have uncovered an espionage operation linked to a group identified as Silent Lynx, which reportedly targeted government institutions and critical infrastructure across Central Asia between April and October 2026.

The investigation followed the discovery of an exposed server containing the group’s hacking tools, information collected during active intrusions and an AI agent reportedly used by the operators to manage their activities.

According to cybersecurity firm CloudSEK, the operation involved the theft of more than 2,000 Tajik government documents.

The compromised information and targeting patterns suggest an interest in government communications, transportation infrastructure, defence correspondence and natural resource ministries across neighbouring countries.

CloudSEK assessed with medium confidence that the operators had connections to Kazakhstan.

The assessment was based partly on the Russian-language operating environment and test traffic originating from a residential internet connection in Kazakhstan.

Researchers believe the operation was primarily driven by regional intelligence-gathering objectives rather than financial gain.

Citrus Ransomware Group Exploits Contractor Accounts and AI-Generated Scripts

A newly identified Russian-speaking ransomware group known as Citrus is targeting corporate Windows environments by exploiting compromised contractor accounts and using AI-generated scripts during cyberattacks.

Researchers discovered that the attackers use PowerShell scripts, batch files and command-line instructions to conduct activities after gaining access to victims’ systems.

The group also employs VLESS tunnels and other techniques to maintain communications while attempting to reduce the chances of detection.

To conceal their activities, the attackers delete tools and output files after execution, clear command histories and remove Windows event logs.

They also disguise malicious programmes and associated files using names that resemble legitimate software and trusted brands.

The ransomware belongs to the Sn00py family and is written in the Go programming language.

Once executed, it encrypts files on compromised Windows computers and appends the .citrus extension to affected files.

The malware also incorporates measures intended to complicate recovery efforts and security investigations.

Kaspersky researchers observed similarities between Citrus and another cybercriminal operation known as Toy Ghouls.

According to Kaspersky Security Services expert Stanislav Larinsky, the group stands out because of its use of AI-generated content to support hands-on intrusion activities.

The findings highlight the risks associated with poorly controlled third-party accounts, particularly when contractors possess access to sensitive corporate systems.

BluePhishing Attack Tricks Microsoft Entra Users Into Giving Malicious AI Agents Cloud Access

Cybersecurity company Proofpoint has disclosed a new phishing technique called BluePhishing, which exploits weaknesses in the way organisations manage permissions and identities associated with AI agents.

The technique represents an evolution of OAuth consent phishing, a method in which attackers manipulate users into authorising malicious applications to access cloud services.

BluePhishing extends the approach to AI agent identities, including Microsoft Entra Agent ID.

Attackers reportedly use deceptive consent links to persuade victims to approve malicious AI agent blueprints.

Once permission is granted, the attackers can create unauthorised agent identities within targeted cloud environments, obtain access tokens and operate using the privileges assigned to those agents.

Proofpoint warned that insufficient visibility and governance around the adoption of AI agents could create opportunities for attackers to exploit these permissions.

The development highlights a growing security challenge as organisations introduce autonomous AI systems capable of interacting with business applications and accessing sensitive corporate information.

Meta Expands AI-Powered Age Detection Across Instagram

Meta has announced plans to expand its artificial intelligence-based age estimation technology globally to provide additional protection for teenagers using Instagram.

The technology is designed to identify users believed to be under 18, even when their registered accounts contain false adult birth dates.

Once identified, affected accounts can automatically receive Instagram’s Teen Account protections.

Meta said the expansion would enable millions of additional teenagers worldwide to benefit from built-in safety restrictions.

In Australia, the company has also opted to use Apple’s age-range signal as another method of estimating users’ ages.

The initiative forms part of Meta’s broader effort to strengthen age-related protections across its social media platforms.

Microsoft Introduces OAuth Authentication for On-Premises Exchange Mailbox Migrations

Microsoft has introduced support for OAuth authentication within its Microsoft 365 Mailbox Replication Service (MRS), enabling organisations to use the authentication method when transferring mailboxes between Microsoft 365 and on-premises Exchange environments.

Under the new arrangement, tenant administrators can configure OAuth migration endpoints and use them when creating migration batches.

The functionality also supports onboarding and offboarding mailbox migration operations.

Microsoft confirmed that the authentication method is available to both hybrid and non-hybrid organisational environments.

The development provides administrators with another authentication option when managing enterprise email migrations.

Microsoft Strengthens NTLM Signing Protection Against Relay Attacks

Microsoft has introduced additional Windows security protections designed to strengthen NTLM message signing and reduce exposure to authentication relay attacks.

The changes, which began rolling out on November 10, 2026, also address CVE-2026-118737, a vulnerability affecting the Remote Procedure Call Runtime.

The flaw carries a CVSS severity score of 8.1 and could allow an unauthorised attacker to execute code remotely over a network.

Microsoft described the latest improvements as the first phase of a broader effort to strengthen NTLM message signing.

The protections are designed to ensure authenticated NTLM sessions establish cryptographic session keys and negotiate genuine message signing.

Microsoft also announced that Windows servers will begin requiring NTLM signing by default from May 2027.

The changes are intended to make it more difficult for attackers to exploit authentication relay techniques against vulnerable systems.

Exposed Microsoft Entra ID Credentials Remained Accessible for 18 Months

A security weakness affecting the United Kingdom’s Planning Inspectorate has been disclosed after researchers discovered that sensitive Microsoft Entra ID application credentials had been exposed in a public GitHub repository.

The Planning Inspectorate operates as an executive agency under the UK’s Ministry of Housing, Communities and Local Government.

According to security researchers at ControlPlane, a complete application credential had been committed to a repository in plaintext.

Although the exposed credential was subsequently removed from the active branch, the original Git commit remained accessible as an orphaned object following a force push.

Researchers said the information remained retrievable through GitHub’s raw object content delivery network for approximately 18 months.

The exposed client secret was eventually deleted around 20 minutes after responsible disclosure on August 26, 2026.

The incident highlights the risks associated with accidentally publishing sensitive authentication information in software development repositories, even when the original files are later removed.

Fake Chocolatey and Microsoft Activation Websites Distribute Armorsteal Malware

Cybersecurity researchers have identified an SEO poisoning campaign using fraudulent websites impersonating the Chocolatey package manager and Microsoft Activation Scripts (MAS) to distribute an information-stealing malware called Armorsteal.

The malware is written in Python and is delivered through fake software download pages designed to attract users searching for legitimate tools.

According to security researchers at Zscaler, the malicious installer deploys a Python 3.11 runtime environment alongside three primary components responsible for remote access, surveillance and information theft.

The Python code is protected using Pyarmor, a tool that makes software code more difficult to inspect.

The remote access component communicates with a command-and-control server, downloads additional modules and executes instructions received from the attackers.

The surveillance component records keystrokes, monitors clipboard activity, captures screenshots and displays fraudulent cryptocurrency wallet notifications.

Meanwhile, the information-stealing component targets browser information, Discord authentication tokens, cryptocurrency wallets, recovery seed phrases, saved passwords, SSH keys and Steam-related data.

The campaign demonstrates how cybercriminals are exploiting search engine rankings and fake software websites to distribute malicious programmes to unsuspecting users.

Grandoreiro Banking Trojan Targets Users Across Latin America

A new campaign involving the Grandoreiro banking malware has been identified targeting computer users in Argentina, Chile, Colombia, Mexico and Peru.

The attackers are using region-specific phishing messages, primarily written in Spanish, although some campaigns have also employed Portuguese-language messages against Spanish-speaking countries.

According to Arctic Wolf, the operation relies on recently registered internet domains and multiple redirection stages to make detection more difficult.

The final malware payload is retrieved through a Domain Generation Algorithm (DGA) that uses the current date as part of its generation process.

Victims are directed to download ZIP archives containing deeply nested folders, legitimate executable files and harmless PDF documents designed to make the package appear genuine.

A VBScript file hidden within the archive serves as the primary execution component.

The script uses junk code and several layers of obfuscation before reconstructing and launching a Delphi-based loader.

The loader disguises itself as a PDF reader before downloading and executing the actual banking malware.

Hackers Manipulate AI Search Results to Promote Fake Investment Platforms

Palo Alto Networks’ Unit 42 researchers have identified a campaign involving indirect prompt injection across 26 websites designed to manipulate AI-powered search results.

The operation uses black-hat Generative Engine Optimisation (GEO) techniques to influence how AI-powered search systems identify and recommend online platforms.

Researchers discovered that nearly all the affected websites contained similar material promoting supposedly AI-powered digital asset trading services.

However, the websites were suspected scam platforms designed to collect personal information from visitors.

The malicious instructions were hidden from ordinary website visitors but potentially visible to AI agents processing the pages.

Researchers warned that the technique could poison information used by AI systems and manipulate automated agents into recommending fraudulent investment platforms.

The development highlights emerging security risks associated with AI-powered search engines and automated browsing assistants.

PyPI Introduces New Security Tab to Help Developers Verify Software Releases

The Python Package Index (PyPI) has introduced a redesigned security section on its project pages to help developers assess the authenticity and security information associated with software releases.

The new security tab provides information about release provenance and displays attestations for individual files.

The feature enables developers to examine where software packages originated and whether their release files have verifiable attestations.

PyPI determines the provenance status of each release by checking the available attestations associated with its files.

The addition is expected to make software supply-chain verification more accessible to developers and users who rely on Python packages.

RevStealer Malware Spreads Through More Than 100 Domains and Fake AI Tools

An information-stealing malware known as RevStealer is being distributed through an extensive cybercriminal network involving more than 100 interconnected domains.

According to research group Akatsuki Legion, the financially motivated campaign uses game cheats and AI-related software as lures to trick victims into downloading malicious applications.

The distribution network also includes trojanised Electron applications impersonating Anthropic’s Claude Opus 5 and compromised YouTube channels used to promote malicious downloads.

Once executed, RevStealer performs a series of sandbox-evasion checks before decrypting an AES-256-CBC encrypted payload directly in memory.

The malware also employs indirect system-call techniques and API hashing to evade security monitoring mechanisms.

Its information-stealing capabilities target browser credentials, password managers, cryptocurrency wallets, Steam, Roblox, Battle.net, EA Desktop and Minecraft.

The stolen information is transmitted through encrypted HTTPS communications.

Researchers also identified a Polygon blockchain-based dead-drop mechanism that can serve as a backup command-and-control resolution channel.

The campaign demonstrates how cybercriminals are exploiting the popularity of AI tools, gaming software and online content distribution platforms to expand malware infections.

Cybercriminals Increasingly Target AI Infrastructure and Orchestration Platforms

Cybersecurity firm Sekoia has warned that threat actors are increasingly targeting AI infrastructure because these platforms often contain valuable API keys, enterprise information and access to external services.

One platform attracting attention is Flowise, an AI orchestration tool that has been affected by several security vulnerabilities, including CVE-2025-59528 and CVE-2026-41264.

In an exploitation attempt recorded in August 2026, a suspected Chinese-speaking threat actor abused legitimate Flowise functionality to conduct automated reconnaissance.

The attacker also attempted to manipulate a large language model agent into functioning as an offensive security assistant against external targets.

According to Sekoia, the intruder supplied real-world reconnaissance information involving Nightingale and Redis infrastructure to the AI agent in an effort to generate customised exploitation strategies and target assessments.

Researchers warned that AI orchestration platforms could become attractive entry points for cybercriminals because of the sensitive credentials, information and external system permissions they may hold.

AI-Assisted Phishing Kits Make It Easier for Hackers to Target Multiple Brands

Security researchers at LevelBlue have identified several phishing kits believed to have been developed with assistance from artificial intelligence coding tools.

The kits, identified as BlackApex, DarkApex, SPY, XXX101-TOKEN, OGPARKER1, W1-TOKEN and ALIBOBO-TOKEN, are being used to facilitate device-code phishing attacks through fraudulent shared-document invitations.

Researchers observed that the different kits share similar source code, communication endpoints and interface designs.

The findings suggest that AI tools may have helped cybercriminals develop convincing phishing platforms capable of impersonating multiple brands.

LevelBlue noted that the code contains characteristics associated with AI-generated programming, whether produced through direct prompts to language models or through collaboration between developers and AI coding assistants.

Although researchers could not establish whether the different names represent separate operators, resellers or customers of a single service, the similarities suggest a shared phishing product being repeatedly rebranded and deployed.

Google DeepMind Uses AI to Verify Security of Signal Messaging Protocol

Google DeepMind has introduced AlphaProof Code, an artificial intelligence framework designed to combine human expertise with autonomous AI agents to verify software correctness through mathematical proofs.

The technology has been used to verify important security properties of libsignal, the reference implementation of the Signal messaging protocol.

Researchers said the system was able to examine the software at the machine-code level and establish formal proofs concerning its security guarantees.

AlphaProof Code combines human-guided agents responsible for writing Lean specifications, formal semantics for AArch64 machine code and autonomous proving agents.

According to Google DeepMind, the system generated approximately 6.5 million lines of machine-checked Lean proof code, supported by about 26,000 lines of trusted specifications and machine-code semantics.

The verification covered important security features of Signal’s post-quantum PQXDH handshake and Triple Ratchet protocols.

These included forward secrecy, authentication, post-compromise security and handshake secrecy.

The development demonstrates how AI can be applied not only to discover software vulnerabilities but also to mathematically verify whether important security properties are correctly implemented.

Cybersecurity Threats Continue to Evolve as AI Expands Attack Opportunities

The latest developments demonstrate how cybercriminals are combining traditional hacking techniques with artificial intelligence, stolen credentials, compromised infrastructure and trusted software tools.

While some attacks depend on newly discovered vulnerabilities, others exploit weaknesses that organisations have failed to address, including exposed credentials, poorly monitored contractor accounts and excessive permissions granted to automated systems.

The growing use of AI is also creating a complicated security environment in which the same technology can assist cybercriminals in developing phishing campaigns and malware while helping researchers identify vulnerabilities and verify software security.

The successful Europol operation against malware infrastructure provides evidence that coordinated law enforcement action can disrupt major criminal networks.

However, the GSocket findings show that removing an original vulnerability does not necessarily eliminate an attacker’s access, while the Planning Inspectorate incident demonstrates how sensitive credentials can remain exposed long after developers believe they have been removed.

For organisations, the message is clear: cybersecurity cannot depend solely on installing updates, blocking suspicious websites or detecting unusual network activity.

Continuous monitoring, proper identity management, secure software development, credential protection and regular security assessments remain essential to reducing the risk of increasingly sophisticated attacks.