{"category":"breach","changes":[{"body":null,"category":"breach","date":"2026-11-15","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/fbi-warns-artex-ai-hacking-tool-is-powering-global-cyberattacks/","status":"live","title":"FBI warns ARTEX AI hacking tool is powering global cyberattacks, including a ConnectWise supply-chain breach compromising Microsoft 365 customer environments","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":null,"category":"breach","date":"2026-11-15","incident":"maileva-la-poste-group-cyberattack-exposed-personal-data-of-22-million-people","incidentTitle":"Maileva (La Poste Group): cyberattack exposed personal data of ~22 million people","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/15/hack-at-french-postal-unit-exposes-22-million-peoples-data/","status":"live","title":"Maileva (La Poste Group): cyberattack exposed personal data of ~22 million people","url":"https://helix.ml/threat-watch/i/maileva-la-poste-group-cyberattack-exposed-personal-data-of-22-million-people"},{"body":null,"category":"breach","date":"2026-11-15","incident":"tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found","incidentTitle":"TSMC: seller claims 46,000 employee records for sale; TSMC says data matches a cloud provider","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/tsmc-employee-data-breach-linked-to-cloud-provider/","status":"live","title":"TSMC confirms employee data leaked online and links it to a cloud provider","url":"https://helix.ml/threat-watch/i/tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found"},{"body":"Member notice lists the exposed data (contact, profile, login IPs, hashed passwords, linked-account IDs, some private messages) and says CNIL and ICO were notified and a police complaint filed.","category":"breach","date":"2026-11-15","incident":"codingame-intruder-abused-an-internal-data-analysis-tool-to-copy","incidentTitle":"CodinGame: intruder abused an internal data-analysis tool to copy member databases; all passwords reset","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":null,"status":"live","title":"CodinGame emails all members: every account treated as affected, passwords reset, sessions revoked","url":"https://helix.ml/threat-watch/i/codingame-intruder-abused-an-internal-data-analysis-tool-to-copy"},{"body":null,"category":"breach","date":"2026-11-14","incident":"maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france","incidentTitle":"Maileva data breach: intruders accessed names and postal addresses of 22 million people in France","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://securityaffairs.com/203126/data-breach/data-breach-at-la-poste-subsidiary-maileva-affects-22-million-people-in-france.html","status":"closed","title":"La Poste announces theft of names and postal addresses of 22 million people from Maileva","url":"https://helix.ml/threat-watch/i/maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france"},{"body":null,"category":"breach","date":"2026-11-14","incident":"n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider","incidentTitle":"Expedia: n0n claims ~1B traveler records stolen via unnamed third-party data platform provider","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://securityaffairs.com/203062/cyber-crime/extortion-group-claims-theft-of-nearly-one-billion-expedia-traveler-records.html","status":"live","title":"n0n extortion group claims theft of ~1B Expedia traveler records via third-party provider","url":"https://helix.ml/threat-watch/i/n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider"},{"body":null,"category":"breach","date":"2026-11-14","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/us-disrupts-north-korean-campaign-behind-400-million-crypto-theft/","status":"live","title":"US government disrupts North Korean FaceStealer social engineering campaign behind $400M+ in stolen cryptocurrency","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-14","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"other","patchStatus":"unknown","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/14/statement-from-microsoft/","status":"live","title":"Microsoft issues apology statement, says broad recovery achieved and confirms outage was a technical issue unrelated to cyberattack or AI agents","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":null,"category":"breach","date":"2026-11-14","incident":"faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed","incidentTitle":"FAA: nationwide ground stop after ATC communications disruption; cause unknown, cyberattack not confirmed","kind":"other","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.securityweek.com/no-signs-of-hacking-in-faa-ground-stop-as-fbi-reportedly-probes-software-update/","status":"live","title":"Officials report no signs of hacking; FBI reportedly probes a software update as the cause of the FAA ground stop","url":"https://helix.ml/threat-watch/i/faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed"},{"body":"In a written reply to Cyberattaque.org (undated in the article), Maileva confirms the theft of first name, surname and postal address for 22 million people, says it notified the CNIL and filed a complaint, and says a judicial investigation is open.","category":"breach","date":"2026-11-13","incident":"maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france","incidentTitle":"Maileva data breach: intruders accessed names and postal addresses of 22 million people in France","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cyberattaque.org/maileva-docaposte-la-poste-cyberattaque/","status":"closed","title":"Maileva confirms theft of identity data for 22 million people","url":"https://helix.ml/threat-watch/i/maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france"},{"body":"As reported by The Record, the university says its investigation confirmed that personal information was stolen. It has not said what data was taken or whose. It is working to identify affected people and will contact them directly. MachForms remains offline, and the university is monitoring for further effects on its systems.","category":"breach","date":"2026-11-13","incident":"qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach","incidentTitle":"University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE)","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/university-of-texas-arlington-warns-data-breach","status":"live","title":"University confirms personal information stolen; MachForms taken offline","url":"https://helix.ml/threat-watch/i/qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach"},{"body":"Microsoft said it will publish a full report once its review is complete. No post-incident report was found in the sources checked.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"advisory","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.spokesman.com/stories/2026/nov/13/on-day-2-of-massive-outlook-outage-microsoft-moves/","status":"live","title":"Microsoft says it will publish a full post-incident report","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"At 21:44 UTC Microsoft said actions taken so far had not provided the anticipated relief, and it had no estimate for full recovery. Its 20:02 UTC update had promised another status update by 00:00 UTC on Saturday 14 November.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/saas/2026/11/13/microsofts-massive-m365-outage-stretches-past-27-hours-as-its-fixes-keep-failing/5309609","status":"live","title":"Microsoft: earlier fix did not work; no recovery ETA (21:44 UTC)","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"On Friday 13 November Microsoft said the incident was introduced by an issue during an earlier network capacity upgrade, and denied signs of cyberattack or rogue AI agents. Reported in KUOW and the Seattle Times. The same day Microsoft's own status text (reported by The Register) still described the underlying cause as unconfirmed.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.kuow.org/technology/2026-11-13/microsoft-says-outage-not-caused-by-ai-or-cyber-attack","status":"live","title":"Microsoft attributes outage to an earlier network capacity upgrade","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"Microsoft status update at 04:11 UTC: no indication this is the result of malicious activity. A second update at 05:46 UTC said Microsoft was not aware of any malicious activity causing the incident.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/saas/2026/11/13/microsofts-massive-m365-outage-stretches-past-27-hours-as-its-fixes-keep-failing/5309609","status":"live","title":"Microsoft: no indication of malicious activity (04:11 UTC)","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":null,"category":"breach","date":"2026-11-13","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/","status":"live","title":"Microsoft details SCKit, a toolkit abusing ScreenConnect to deploy unauthorized remote access and target technician sessions, with Defender XDR hunting guidance","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://securityaffairs.com/203012/cyber-crime/north-korea-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-infrastructure.html","status":"live","title":"DOJ details $1.2B seizure and says the same DPRK hackers are now targeting open-source developers","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/artex-ai-tool-fbi-flash-alert","status":"live","title":"FBI flash alert warns Artex automates intrusions from targeting to privileged access in under three hours","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":null,"category":"breach","date":"2026-11-13","incident":"faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed","incidentTitle":"FAA: nationwide ground stop after ATC communications disruption; cause unknown, cyberattack not confirmed","kind":"disclosure","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.securityweek.com/faa-ground-stop-issued-due-to-extraordinary-circumstances/","status":"live","title":"FAA nationwide ground stop after air traffic control communications disruption; cyberattack unconfirmed","url":"https://helix.ml/threat-watch/i/faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed"},{"body":"The Record reports ActiveCloud said main services were restored by Friday 13 November. Individual customers were still having problems, including with restoring some virtual machines.","category":"breach","date":"2026-11-13","incident":"ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days","incidentTitle":"Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and VM services for days","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://therecord.media/belarus-cloud-provider-activecloud-ransomware-attack","status":"live","title":"Main services restored; some customers still resolving individual issues","url":"https://helix.ml/threat-watch/i/ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days"},{"body":"The university's investigation confirmed that personal information was stolen. Scope, data types and affected individuals are not yet determined. MachForms is offline.","category":"breach","date":"2026-11-13","incident":"qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach","incidentTitle":"University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE)","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/university-of-texas-arlington-warns-data-breach","status":"live","title":"University says personal information was stolen in a cybersecurity incident","url":"https://helix.ml/threat-watch/i/qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines","status":"live","title":"JFrog exposes AccuraSoftHire fake-interview campaign behind the Binance theft; malicious npm packages from the task stayed installable for months","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.elastic.co/security-labs/threat-command/agentic-offensive-frameworks-detection-artex","status":"live","title":"Elastic Security Labs analysis groups ARTEX with CyberStrikeAI, Cairn, PentAGI and HexStrike agentic attack frameworks and publishes ES|QL hunts","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":null,"category":"breach","date":"2026-11-13","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/gootloader-ransomware-doj-details","status":"live","title":"DOJ details Gootloader's role in 44+ ransomware attacks costing $29M since 2018","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/fbi-says-north-korean-hackers-stole.html","status":"live","title":"FBI attributes $400M+ in crypto stolen via FaceStealer deepfake video-call social engineering over 18 months","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":"Elastic Security Labs publishes its analysis of the four-account AWS intrusion (authors Samir Bousseaden, Bryan Porras Blanch, Terrance DeJesus). Six Elastic detection rules fired on the activity.","category":"breach","date":"2026-11-13","incident":"cyberstrikeai-ai-agent-aws-intrusion-four-aws-accounts-ai-agent-ran-56-api-calls-in-141ms-across-8-identities-over-16-da","incidentTitle":"AWS: intruder from a CyberStrikeAI host used 8 identities across 4 accounts over 16 days (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.elastic.co/security-labs/threat-command/cyberstrikeai-aws-cloudtrail-intrusion","status":"live","title":"AWS: intruder from a CyberStrikeAI host used 8 identities across 4 accounts over 16 days (no CVE)","url":"https://helix.ml/threat-watch/i/cyberstrikeai-ai-agent-aws-intrusion-four-aws-accounts-ai-agent-ran-56-api-calls-in-141ms-across-8-identities-over-16-da"},{"body":null,"category":"breach","date":"2026-11-13","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/202997/cyber-crime/gootloader-malware-disrupted-after-infecting-25000-computers.html","status":"live","title":"DOJ/law enforcement disrupt Gootloader: 100+ servers taken down, domains seized, 25,000 infected computers cleaned","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-13","incident":"warden-stealer-fake-gta-6-pc-installer-steals-steam-roblox-credentials-browser-data-and-crypto-wallets","incidentTitle":"WARDEN Stealer: Fake GTA 6 PC installer — steals Steam/Roblox credentials, browser data and crypto wallets","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/fake-gta-6-download-scam/","status":"live","title":"WARDEN Stealer: Fake GTA 6 PC installer — steals Steam/Roblox credentials, browser data and crypto wallets","url":"https://helix.ml/threat-watch/i/warden-stealer-fake-gta-6-pc-installer-steals-steam-roblox-credentials-browser-data-and-crypto-wallets"},{"body":null,"category":"breach","date":"2026-11-13","incident":"uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026","incidentTitle":"UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/13/crackdown-on-uk-medical-record-snooping-after-staff-reported-sneaking-300-times-this-year/","status":"live","title":"ICO puts NHS executives on notice, demanding personal assurances after 300+ medical record snooping reports","url":"https://helix.ml/threat-watch/i/uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found","incidentTitle":"TSMC: seller claims 46,000 employee records for sale; TSMC says data matches a cloud provider","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/tsmc-confirms-employee-data-breach-cloud-provider","status":"live","title":"TSMC confirms employee data breach tied to a cloud service provider; no TSMC systems compromised","url":"https://helix.ml/threat-watch/i/tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.darkreading.com/cybersecurity-operations/attackers-binance-breach-targeted-weakness-missing-controls","status":"live","title":"Analysis: Binance breach attackers exploited known weaknesses and missing controls, deploying sweeper contracts to evade security limits","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated","incidentTitle":"Apify: compromised credential used to reach internal systems and some customer accounts","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/apify-confirms-customer-data-accessed-in-cyberattack/","status":"live","title":"Apify confirms intruder accessed customer accounts and obtained personal information or stored data","url":"https://helix.ml/threat-watch/i/apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated"},{"body":null,"category":"breach","date":"2026-11-13","incident":"uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026","incidentTitle":"UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/record-number-of-cyber-incidents-reported-to-uk-regulator","status":"live","title":"UK ICO reports record number of cyber incidents in 2026, driven by data extortion and AI-enabled attacks","url":"https://helix.ml/threat-watch/i/uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026"},{"body":null,"category":"breach","date":"2026-11-13","incident":"silentair-asian-telecom-ss7-diameter-signaling-compromise-state-linked-actor-hijacked-mobile-networks-to-intercept-sms-2","incidentTitle":"SilentAir: state-linked SS7/Diameter abuse diverts calls and SMS, intercepts 2FA codes; Taiwan primary","kind":"disclosure","patchStatus":"unknown","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/silentair-hijacks-asian-telecom.html","status":"live","title":"SilentAir: Asian telecom SS7/Diameter signaling compromise — state-linked actor hijacked mobile networks to intercept SMS 2FA codes and spy on Taiwan targets","url":"https://helix.ml/threat-watch/i/silentair-asian-telecom-ss7-diameter-signaling-compromise-state-linked-actor-hijacked-mobile-networks-to-intercept-sms-2"},{"body":null,"category":"breach","date":"2026-11-13","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://thehackernews.com/2026/11/operation-endgame-takes-down-gootloader.html","status":"live","title":"Operation Endgame: seized logins figure rises to 6.4M across 40,000+ victims","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-13","incident":"operation-tornado-archetyp-nemesis-tor2door-bohemia-kingdom-dark-web-markets-354-vendors-buyers-arrested-in-14-country-c","incidentTitle":"Operation TorNado: Archetyp, Nemesis, Tor2Door, Bohemia, Kingdom dark web markets — 354 vendors/buyers arrested in 14-country crackdown","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/europol-dark-web-arrests-cybercrime/","status":"live","title":"Europol confirms 354 arrests across 14 countries in Operation TorNado targeting buyers and vendors of five already-seized dark web markets","url":"https://helix.ml/threat-watch/i/operation-tornado-archetyp-nemesis-tor2door-bohemia-kingdom-dark-web-markets-354-vendors-buyers-arrested-in-14-country-c"},{"body":null,"category":"breach","date":"2026-11-13","incident":"uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026","incidentTitle":"UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/11/13/crackdown-on-uk-medical-record-snooping-after-staff-reported-sneaking-300-times-this-year/5309421","status":"live","title":"UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026","url":"https://helix.ml/threat-watch/i/uk-nhs-medical-record-snooping-ico-demands-assurances-after-300-insider-access-reports-in-2026"},{"body":null,"category":"breach","date":"2026-11-13","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.securityweek.com/law-enforcement-disrupts-gootloader-castlerat-and-stealc-infrastructure/","status":"live","title":"Operation Endgame expands: 235 servers and 257 domains seized, 6.4M victim credentials recovered in Gootloader/CastleRAT/StealC disruption","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":"HIBP loaded the CastleRAT dataset that Europol supplied: about 179.7k affected email addresses, with about 893k unique passwords seen more than 3 million times across accounts used on infected computers. The passwords are searchable through Pwned Passwords. This is the notification leg of the Operation Endgame takedown.","category":"breach","date":"2026-11-13","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://haveibeenpwned.com/Breach/CastleRAT","status":"live","title":"Have I Been Pwned loads CastleRAT dataset: about 179.7k email addresses with passwords","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/fbi-north-korean-fake-zoom-calls/","status":"live","title":"FBI: FaceStealer scheme stole $400M+ in crypto over 18 months using fake Zoom/Teams calls with webcam footage of 900+ prior victims","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"device-code-phishing-via-fake-teams-scheduler-microsoft-365-construction-firm-employee-tricked-into-approving-attacker-s","incidentTitle":"Microsoft 365: device code phishing via fake Teams scheduler gave attacker a session at one construction firm","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/microsoft-teams-device-code-phishing/","status":"live","title":"Device code phishing via fake Teams scheduler: Microsoft 365 — construction firm employee tricked into approving attacker session token","url":"https://helix.ml/threat-watch/i/device-code-phishing-via-fake-teams-scheduler-microsoft-365-construction-firm-employee-tricked-into-approving-attacker-s"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.securityweek.com/fbi-says-us-seized-1-2-billion-worth-of-cryptocurrency-stolen-from-binance/","status":"live","title":"FBI confirms $1.2B Binance crypto seizure and separately attributes a $400M crypto theft to a North Korean social engineering scheme","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://cyberscoop.com/us-seizes-north-korea-hacking-infrastructure-binance/","status":"live","title":"US seizes APT38 infrastructure used for deepfake video-call social engineering tied to the $1.2B Binance crypto theft","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":"Per the same secondary report, an archive appeared on 12 November that looks like an extract of the claimed data: 11 folders of email addresses, with some date ranges suggesting historical data. Not independently verified, and n0n has not described it as a sample.","category":"breach","date":"2026-11-12","incident":"n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider","incidentTitle":"Expedia: n0n claims ~1B traveler records stolen via unnamed third-party data platform provider","kind":"exploitation","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://twoscotsabroad.com/830-million-loyalty-rows-claimed-expedia-admits-a-supplier-was-breached/","status":"live","title":"Archive appears on the dark web that looks like an extract of the claimed data","url":"https://helix.ml/threat-watch/i/n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider"},{"body":"Expedia said it is aware of a supply-chain attack reported by security researchers, that attackers compromised a third-party data platform provider and reached its systems, and that it contained the issue once aware and brought in external cybersecurity experts. It did not name the provider, n0n, the claimed figures, or what data, if any, was taken. The statement's full wording was not retrieved; the Skift page text cut off mid-sentence. The statement that its platforms remain safe for travelers and partners is in Skift's summary and secondary coverage, not in the visible statement text.","category":"breach","date":"2026-11-12","incident":"n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider","incidentTitle":"Expedia: n0n claims ~1B traveler records stolen via unnamed third-party data platform provider","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://skift.com/2026/11/12/expedia-confirms-cyberattack-through-third-party-vendor/","status":"live","title":"Expedia tells Skift attackers reached its systems via a compromised third-party data platform provider","url":"https://helix.ml/threat-watch/i/n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider"},{"body":"Ransomware.live logs the University of Texas at Arlington as a Qilin victim, discovered 12 November 2026 at 06:50 UTC, with an estimated attack date of 12 November (a tracker estimate, not a university statement). The listing includes a leak screenshot image; no sample contents were reviewed.","category":"breach","date":"2026-11-12","incident":"qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach","incidentTitle":"University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.ransomware.live/id/VGhlIFVuaXZlcnNpdHkgb2YgVGV4YXMgYXQgQXJsaW5ndG9uQHFpbGlu","status":"live","title":"Qilin leak-site listing logged for UT Arlington","url":"https://helix.ml/threat-watch/i/qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach"},{"body":"Outage begins on Thursday 12 November at around 18:00 UTC, per The Register's account of Microsoft's status updates. Affected services include Exchange Online and connected Microsoft 365 workloads; the start time is reported as 18:26 UTC by a third-party writeup, which we did not verify against Microsoft's own incident record.","category":"breach","date":"2026-11-12","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/saas/2026/11/13/microsofts-massive-m365-outage-stretches-past-27-hours-as-its-fixes-keep-failing/5309609","status":"live","title":"Exchange Online and connected services go down (about 18:00 UTC)","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"Zimperium zLabs published its ArcticRAT analysis: 78 samples, 42 droppers, 21 C2 IPs (17 in the technical section). Stolen SMS and app lists go to the Grok API for triage. No victim counts published.","category":"breach","date":"2026-11-12","incident":"arcticrat-android-users-crypto-stealer-evolved-into-ai-powered-rat-with-full-device-control-and-financial-data-profiling","incidentTitle":"ArcticRAT: Android users — crypto stealer evolved into AI-powered RAT with full device control and financial data profiling","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.darkreading.com/mobile-security/arcticrat-cybercrime-gang-profiles-victim-finances-ai","status":"live","title":"Zimperium zLabs publishes ArcticRAT analysis: AI-assisted second variant","url":"https://helix.ml/threat-watch/i/arcticrat-android-users-crypto-stealer-evolved-into-ai-powered-rat-with-full-device-control-and-financial-data-profiling"},{"body":"Onliner reports SelfMail fully restored and most E-Cloud virtual machines available in normal mode by 12 November. The company website was still not fully functional and showed a banner about the attack. ECP was unavailable as of 11 November, with no later status reported.","category":"breach","date":"2026-11-12","incident":"ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days","incidentTitle":"Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and VM services for days","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://tech.onliner.by/2026/11/12/activecloud-sboi","status":"live","title":"SelfMail fully restored; most E-Cloud VMs back; company website still down","url":"https://helix.ml/threat-watch/i/ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days"},{"body":"Caixa Seguridade's notice to the market, dated 12 November 2026, reports a cybersecurity incident at its subsidiary Caixa Vida e Previdência. Names and CPF tax IDs from its registration database were exposed.","category":"breach","date":"2026-11-12","incident":"caixa-seguradora-data-breach-exposes-pii-of-all-7-6m-insurance-customers","incidentTitle":"Caixa Vida e Previdência: intrusion copies registration database covering 7.6M active clients (names, CPF)","kind":"disclosure","patchStatus":"unknown","severity":"high","sourceUrl":"https://filemanager-cdn.mziq.com/published/3972906b-e50b-4f74-ab74-4d0d32125d11/9567a559-d20a-486e-a7ae-5c6bbc030c5e","status":"live","title":"Caixa Vida e Previdência: intrusion copies registration database covering 7.6M active clients (names, CPF)","url":"https://helix.ml/threat-watch/i/caixa-seguradora-data-breach-exposes-pii-of-all-7-6m-insurance-customers"},{"body":"Enea updated its SilentAir / LIMINAL PANDA report on 2026-11-12 to add a Key Takeaways section summarising the findings. Taiwan is stated as the primary target but not the only one; SilentAir-related sources were observed in at least six Asian countries and targeted a dozen more countries and territories.","category":"breach","date":"2026-11-12","incident":"silentair-asian-telecom-ss7-diameter-signaling-compromise-state-linked-actor-hijacked-mobile-networks-to-intercept-sms-2","incidentTitle":"SilentAir: state-linked SS7/Diameter abuse diverts calls and SMS, intercepts 2FA codes; Taiwan primary","kind":"other","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.enea.com/insights/the-enemy-within-tracking-liminal-panda-and-silentair-through-mobile-networks/","status":"live","title":"Enea adds Key Takeaways section to its report","url":"https://helix.ml/threat-watch/i/silentair-asian-telecom-ss7-diameter-signaling-compromise-state-linked-actor-hijacked-mobile-networks-to-intercept-sms-2"},{"body":"StepSecurity publishes its ARTEX roundup (byline 2026-11-12). It draws on other researchers' reports and its own analysis, and says ARTEX appeared on GitHub on 2026-07-26 and the upstream repository came down on 2026-10-08.","category":"breach","date":"2026-11-12","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.stepsecurity.io/blog/artex-ai-pentesting-tool-attackers-leaked-secrets","status":"live","title":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":"The attacker claims to have downloaded 2026 exam papers from a printing provider's internal file servers, to have sold copies to students statewide, and to have used a legal services firm's email details to distribute them. The firm denies any involvement and says it found no evidence of unauthorized access to its email systems. VCAA disputes the printer claim. None of these claims is confirmed.","category":"breach","date":"2026-11-12","incident":"vcaa-website-hack-year-12-exam-papers-stolen-and-distributed-to-students","incidentTitle":"VCAA website hacked; attacker claims 2026 VCE exam papers stolen and sold, VCAA disputes it","kind":"other","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.thedailyaus.com.au/news/vcaa-website-hacked-12-11-2026","status":"live","title":"Attacker claims 2026 exam papers were taken from a printer's file servers and sold (unverified, disputed)","url":"https://helix.ml/threat-watch/i/vcaa-website-hack-year-12-exam-papers-stolen-and-distributed-to-students"},{"body":"The Education Minister, Gabrielle Williams, rejected the attacker's claims and said VCE exams will continue as normal. The article reports that the VCAA referred the incident to Victoria Police for investigation; this is reported speech, and I found no police statement.","category":"breach","date":"2026-11-12","incident":"vcaa-website-hack-year-12-exam-papers-stolen-and-distributed-to-students","incidentTitle":"VCAA website hacked; attacker claims 2026 VCE exam papers stolen and sold, VCAA disputes it","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.thedailyaus.com.au/news/vcaa-website-hacked-12-11-2026","status":"live","title":"Education Minister: VCE exams continue as normal; incident reported as referred to Victoria Police","url":"https://helix.ml/threat-watch/i/vcaa-website-hack-year-12-exam-papers-stolen-and-distributed-to-students"},{"body":"The PCPD says it received a data-breach notification from SOGO on 12 November 2026 and has opened an investigation. It estimates the incident may affect about 820,000 members' personal data. This is an estimate, not a confirmed count.","category":"breach","date":"2026-11-12","incident":"hong-kong-sogo-data-breach-exposes-personal-data-of-up-to-820-000-loyalty-members","incidentTitle":"SOGO Hong Kong: unauthorized access to membership system may affect about 820,000 members' data","kind":"advisory","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.dimsumdaily.hk/sogo-hong-kong-says-820000-members-hit-by-data-leak/","status":"live","title":"PCPD receives SOGO breach notice, opens investigation, estimates about 820,000 members affected","url":"https://helix.ml/threat-watch/i/hong-kong-sogo-data-breach-exposes-personal-data-of-up-to-820-000-loyalty-members"},{"body":"The US DOJ released its Operation TorNado announcement (press release No. 26-1351) on 2026-11-12. Europol's headline reports 354 dark web vendors and buyers arrested across 14 countries, with the operation running May 2025 to October 2026.","category":"breach","date":"2026-11-12","incident":"operation-tornado-archetyp-nemesis-tor2door-bohemia-kingdom-dark-web-markets-354-vendors-buyers-arrested-in-14-country-c","incidentTitle":"Operation TorNado: Archetyp, Nemesis, Tor2Door, Bohemia, Kingdom dark web markets — 354 vendors/buyers arrested in 14-country crackdown","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/police-arrest-354-vendors-buyers-in-global-cybercrime-crackdown/","status":"live","title":"Europol and US DOJ announce Operation TorNado: 354 arrests in 14 countries, 132 in the US","url":"https://helix.ml/threat-watch/i/operation-tornado-archetyp-nemesis-tor2door-bohemia-kingdom-dark-web-markets-354-vendors-buyers-arrested-in-14-country-c"},{"body":"Huntress's SOC identified and contained a single device code phishing incident at one construction-sector company. The post describes the lure chain, the AES-256-GCM encrypted kit, the MFA retry logic and the residential callback proxy in New Orleans. It states the compromised account had no MFA enrolled.","category":"breach","date":"2026-11-12","incident":"device-code-phishing-via-fake-teams-scheduler-microsoft-365-construction-firm-employee-tricked-into-approving-attacker-s","incidentTitle":"Microsoft 365: device code phishing via fake Teams scheduler gave attacker a session at one construction firm","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.huntress.com/blog/crafty-microsoft-teams-booking-flow-disguises-device-code-phishing","status":"live","title":"Huntress publishes its write-up of the Teams booking device code phishing incident","url":"https://helix.ml/threat-watch/i/device-code-phishing-via-fake-teams-scheduler-microsoft-365-construction-firm-employee-tricked-into-approving-attacker-s"},{"body":"TSMC's Form 6-K (signed by its CFO) says some current and former employee data was made available on an external website without authorization. The information was verified to match data in a cloud service provider's system services and is unrelated to TSMC operations or customer data. TSMC says it has found no evidence its systems were compromised and is notifying affected personnel. It has engaged the cloud vendor, the relevant investigating authorities and a third-party cybersecurity agency. The provider is not named; no count or field list is given.","category":"breach","date":"2026-11-12","incident":"tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found","incidentTitle":"TSMC: seller claims 46,000 employee records for sale; TSMC says data matches a cloud provider","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.sec.gov/Archives/edgar/data/1046179/000104617926000800/a20261112statementregardin.htm","status":"live","title":"TSMC 6-K: employee data on an external website, matching a cloud provider's systems; no evidence of own-system compromise","url":"https://helix.ml/threat-watch/i/tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found"},{"body":"EfficientIP Research Labs published the original research on 2026-11-12. Help Net Security reported it on 2026-11-13 (the existing timeline row's source is that Help Net article and should be repointed to the EfficientIP post, which the timeline-fix schema cannot do).","category":"breach","date":"2026-11-12","incident":"clickfix-fake-zillow-pages-netsupport-rat-targets-apartment-hunters-via-fake-rental-review-verification-pages","incidentTitle":"ClickFix fake Zillow pages: NetSupport RAT targets apartment hunters via fake rental-review verification pages","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/13/fake-zillow-clickfix-netsupport-rat/","status":"live","title":"ClickFix fake Zillow pages: NetSupport RAT targets apartment hunters via fake rental-review verification pages","url":"https://helix.ml/threat-watch/i/clickfix-fake-zillow-pages-netsupport-rat-targets-apartment-hunters-via-fake-rental-review-verification-pages"},{"body":"Hudson Rock reports that an Egyptian university address appears in a Vidar infostealer record dated 2021-10-01, and a Taiwanese university address appears in AlienTXTBASE, an aggregated collection that Hudson Rock dates to more than a year before the threats. Hudson Rock does not claim the accounts sent the emails or name a group. The 6,000-school figure is a separate claim and is recorded as its own update. The primary Hudson Rock post was not located; this is reported via SecurityAffairs.","category":"breach","date":"2026-11-12","incident":"european-bomb-hoax-campaign-via-hijacked-university-agency-email-accounts-schools-airports-newsrooms-targeted","incidentTitle":"European bomb hoax campaign via hijacked university/agency email accounts — schools, airports, newsrooms targeted","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://securityaffairs.com/202941/security/the-school-bomb-threats-came-from-accounts-already-in-stolen-data.html","status":"live","title":"Hudson Rock: two university email addresses found in older infostealer records; no link to the emails shown","url":"https://helix.ml/threat-watch/i/european-bomb-hoax-campaign-via-hijacked-university-agency-email-accounts-schools-airports-newsrooms-targeted"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/new-worm-like-sckit-malware-targets-msps-in-screenconnect-attacks/","status":"live","title":"Worm-like 'SCKit' toolkit identified in ScreenConnect MSP attacks, spreading from customers to technicians to new networks","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":"The FBI's FLASH describes a chain that starts with an already-compromised victim's messaging account. The operators invite the victim's contacts to a Calendly-scheduled call, send a typo-squatted imitation of a Zoom or Teams link shortly before the start, and play recorded footage of the victim. They then claim a broken audio setup and direct the target to an update prompt, script or pasted command, which installs a browser cookie harvester, keyloggers, screen capturers and a backdoor. The target's webcam is recorded from the moment they click the link. The FBI seized more than 900 victim webcam videos and reports deepfakes of crypto and Web3 figures as a secondary tactic. It also reports a near-miss in which a JavaScript library maintainer was lured into a fake Teams call; the operators then used the maintainer's access to create malicious dependencies, and the compromise was caught quickly. It recommends joining only through official clients with an invite code, keeping the webcam off until the inviter is confirmed, not running scripts or pasting code during a call, confirming meetings through another channel, and reporting to IC3 with the keyword FaceStealer.","category":"breach","date":"2026-11-12","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"advisory","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.ic3.gov/CSA/2026/261112.pdf","status":"live","title":"FBI FLASH AC-111226-MS: FaceStealer lure chain, malware set and recommendations","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":"LEGO said it took BrickLink offline after identifying unusual activity, that securing the site and protecting members came first, and that the site will not come back until the company fully understands what happened. Quoted by Euronews, which attributes the original to Jay's Brick Blog; we could not fetch that page, so the date is the report date.","category":"breach","date":"2026-11-12","incident":"bricklink-lego-marketplace-week-long-outage-after-unusual-activity-suspected-security-incident","incidentTitle":"BrickLink (Lego marketplace) — week-long outage after 'unusual activity', suspected security incident","kind":"advisory","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.euronews.com/2026/11/12/lego-shop-bricklink-downed-by-unusual-activity-on-its-website","status":"live","title":"LEGO statement: BrickLink offline after identifying unusual activity","url":"https://helix.ml/threat-watch/i/bricklink-lego-marketplace-week-long-outage-after-unusual-activity-suspected-security-incident"},{"body":"DOJ announces court authorization to seize or restrain more than $1.2 billion tied to the Binance theft. The FBI and DOJ also announce disruption of cloud infrastructure used in the FaceStealer scheme, which took more than $400 million in crypto over 18 months.","category":"breach","date":"2026-11-12","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/stolen-binance-crypto-recovered-doj-facestealer-disrupted","status":"live","title":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":"Press reports say sellers on DarkForums and BreachForums offered the records for 3 BTC with a one-week deadline. The count and size are the sellers' claims. TSMC's 6-K the same day says the data matches a third-party cloud provider's records and that it found no evidence its own systems were compromised.","category":"breach","date":"2026-11-12","incident":"tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found","incidentTitle":"TSMC: seller claims 46,000 employee records for sale; TSMC says data matches a cloud provider","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/12/tsmc-has-reportedly-leaked-the-personal-data-of-46000-employees-but-emphasized-that-no-evidence-of-intrusion-was-found-in-the-system/","status":"live","title":"Sellers claim 46,000 TSMC employee records (6.9GB) offered for 3 BTC; TSMC says the data matches a cloud provider","url":"https://helix.ml/threat-watch/i/tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://cyberscoop.com/connectwise-screenconnect-sckit-attack/","status":"live","title":"Researchers link rogue remote-access campaign to a worm-like ScreenConnect add-on; ConnectWise disabled five third-party extensions across ~400 partner environments","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":"ReliaQuest Threat Research publishes its write-up on Luna Moth re-targeting law firms. The attackers use a vishing call and screen share to get a Copilot Microsoft Graph bearer token copied from developer tools into a paste site, then replay it and download files through Microsoft Graph.","category":"breach","date":"2026-11-12","incident":"luna-moth-token-theft-vishing-campaign-law-firms-attackers-socially-engineer-microsoft-graph-access-tokens-to-exfiltrate","incidentTitle":"Luna Moth: vishing victims hand over Microsoft Graph tokens to exfiltrate law-firm files","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.darkreading.com/data-privacy/extortion-luna-moth-law-firms-second-time","status":"live","title":"Luna Moth: vishing victims hand over Microsoft Graph tokens to exfiltrate law-firm files","url":"https://helix.ml/threat-watch/i/luna-moth-token-theft-vishing-campaign-law-firms-attackers-socially-engineer-microsoft-graph-access-tokens-to-exfiltrate"},{"body":null,"category":"breach","date":"2026-11-12","incident":"bricklink-lego-marketplace-week-long-outage-after-unusual-activity-suspected-security-incident","incidentTitle":"BrickLink (Lego marketplace) — week-long outage after 'unusual activity', suspected security incident","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/11/12/lego-marketplace-bricklink-in-pieces-after-unusual-activity-takes-it-offline-for-almost-a-week/5309425","status":"live","title":"BrickLink (Lego marketplace) — week-long outage after 'unusual activity', suspected security incident","url":"https://helix.ml/threat-watch/i/bricklink-lego-marketplace-week-long-outage-after-unusual-activity-suspected-security-incident"},{"body":null,"category":"breach","date":"2026-11-12","incident":"whitearmor-ransomware-maersk-lf-logistics-legacy-system-data-breach-5m-extortion-100gb-claimed-stolen","incidentTitle":"Maersk: legacy-system breach confirmed; WhiteArmor claims ~100GB stolen and demands $5M","kind":"victim","patchStatus":"unknown","severity":"medium","sourceUrl":"https://therecord.media/shipping-giant-maersk-says-recent-incident-affected-legacy-system","status":"live","title":"Maersk confirms recent cyber incident affected a legacy system","url":"https://helix.ml/threat-watch/i/whitearmor-ransomware-maersk-lf-logistics-legacy-system-data-breach-5m-extortion-100gb-claimed-stolen"},{"body":null,"category":"breach","date":"2026-11-12","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://cyberscoop.com/operation-endgame-malware-takedown-gootloader-stealc-europol/","status":"live","title":"Operation Endgame dismantles more malware networks and exposes 6.4M stolen credentials; StealC servers taken down a second time via Virtualine bulletproof hosting link","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/sckit-malware-targets-screenconnect.html","status":"live","title":"ConnectWise confirms breaches at ~50 ScreenConnect customers; SCKit toolkit shows attackers exploited patched flaw CVE-2026-84869, not a new vulnerability","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":"Per Unocoin's update: it will rebuild its entire server infrastructure from the ground up rather than restore the existing environment, estimated at approximately 4-5 working days, and has not yet established the root cause or the full sequence of events.","category":"breach","date":"2026-11-12","incident":"unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings","incidentTitle":"Unocoin: compromised infrastructure halts all services; unexplained BitGo outflows under review","kind":"status","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://blog.unocoin.com/unocoin-update-9-nov-2026/","status":"live","title":"Unocoin plans a full server rebuild, estimated at 4-5 working days","url":"https://helix.ml/threat-watch/i/unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings"},{"body":"Per Unocoin's update: on 12 November it identified outgoing transactions from one ETH address in its BitGo wallet infrastructure, which it had used to fund ERC-20 tokens. It escalated to BitGo, which is investigating. Unocoin says its BitGo accounts remain frozen and it cannot yet see all potentially unintended transactions across its BitGo wallets, because of change addresses and the limits of blockchain checks.","category":"breach","date":"2026-11-12","incident":"unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings","incidentTitle":"Unocoin: compromised infrastructure halts all services; unexplained BitGo outflows under review","kind":"exploitation","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://blog.unocoin.com/unocoin-update-9-nov-2026/","status":"live","title":"Outgoing transactions identified from one ETH address in Unocoin's BitGo wallet infrastructure","url":"https://helix.ml/threat-watch/i/unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings"},{"body":"Reported by BleepingComputer, not in Apify's public notice: a sample of impacted accounts shows API tokens and Apify Proxy passwords rotated; a customer letter warned that 2FA codes may have been exposed and advised a 2FA reset while assuring customers passwords are safe; the article says active sessions were reset. These specifics are unconfirmed by the vendor's public notice.","category":"breach","date":"2026-11-12","incident":"apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated","incidentTitle":"Apify: compromised credential used to reach internal systems and some customer accounts","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/","status":"live","title":"BleepingComputer reports token and proxy-password rotation and a 2FA reset advisory","url":"https://helix.ml/threat-watch/i/apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated"},{"body":"Apify's 12 November 17:16 CET update says it has notified customers whose personal information or stored data was accessed, with details in the email they received. If a customer received no email, Apify says it has not identified that account as affected so far, and it will contact any additional customers directly if that changes.","category":"breach","date":"2026-11-12","incident":"apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated","incidentTitle":"Apify: compromised credential used to reach internal systems and some customer accounts","kind":"victim","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://status.apify.com/incidents/sxd1dj5j6749","status":"live","title":"Apify notifies customers whose personal information or stored data was accessed","url":"https://helix.ml/threat-watch/i/apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated"},{"body":"Apify's 12 November update says it rotated various critical internal secrets, revoked some OAuth connections as a precaution (its investigation has not found these could be used as an attack vector), and notified the relevant authorities. It says a post-mortem will follow remediation.","category":"breach","date":"2026-11-12","incident":"apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated","incidentTitle":"Apify: compromised credential used to reach internal systems and some customer accounts","kind":"status","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://status.apify.com/incidents/sxd1dj5j6749","status":"live","title":"Apify rotates critical internal secrets and notifies authorities","url":"https://helix.ml/threat-watch/i/apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated"},{"body":null,"category":"breach","date":"2026-11-12","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/12/police-dismantle-gootloader-castlerat-stealc-malware-infrastructure/","status":"live","title":"Europol and nine countries seize hundreds of servers and domains in Operation Endgame takedown of Gootloader, CastleRAT and StealC","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":"SOGO Hong Kong reported unauthorized access to its membership system. The PCPD estimates about 820,000 members may be affected; the count is not confirmed.","category":"breach","date":"2026-11-12","incident":"hong-kong-sogo-data-breach-exposes-personal-data-of-up-to-820-000-loyalty-members","incidentTitle":"SOGO Hong Kong: unauthorized access to membership system may affect about 820,000 members' data","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/12/hong-kong-sogo-data-breach-puts-personal-information-of-820000-members-at-risk/","status":"live","title":"SOGO Hong Kong: unauthorized access to membership system may affect about 820,000 members' data","url":"https://helix.ml/threat-watch/i/hong-kong-sogo-data-breach-exposes-personal-data-of-up-to-820-000-loyalty-members"},{"body":null,"category":"breach","date":"2026-11-12","incident":"unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings","incidentTitle":"Unocoin: compromised infrastructure halts all services; unexplained BitGo outflows under review","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://databreaches.net/2026/11/12/unocoin-goes-dark-as-81000-wallets-show-zero-holdings/","status":"live","title":"Unocoin: unauthorized server access disables logins, 81,000 wallets show zero holdings","url":"https://helix.ml/threat-watch/i/unocoin-unauthorized-server-access-disables-logins-81-000-wallets-show-zero-holdings"},{"body":null,"category":"breach","date":"2026-11-12","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/police-dismantles-gootloader-castlerat-stealc-malware-infrastructure/","status":"live","title":"Europol and nine-country partners dismantle Gootloader, CastleRAT and StealC infrastructure, seizing hundreds of servers and domains","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-12","incident":"cairn-ai-pentest-framework-chinese-speaking-attackers-autonomously-breached-10-orgs-via-ai-driven-intrusions","incidentTitle":"Cairn AI pentest framework: Chinese-speaking attackers autonomously breached 10 orgs via AI-driven intrusions","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.helpnetsecurity.com/2026/11/12/cairn-autonomous-ai-cyberattacks/","status":"live","title":"Cairn AI pentest framework: Chinese-speaking attackers autonomously breached 10 orgs via AI-driven intrusions","url":"https://helix.ml/threat-watch/i/cairn-ai-pentest-framework-chinese-speaking-attackers-autonomously-breached-10-orgs-via-ai-driven-intrusions"},{"body":null,"category":"breach","date":"2026-11-12","incident":"apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated","incidentTitle":"Apify: compromised credential used to reach internal systems and some customer accounts","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/apify-rotates-api-tokens-prompts-2fa-resets-after-breach/","status":"live","title":"Apify breach: unauthorized access to internal systems, API tokens and 2FA rotated","url":"https://helix.ml/threat-watch/i/apify-breach-unauthorized-access-to-internal-systems-api-tokens-and-2fa-rotated"},{"body":null,"category":"breach","date":"2026-11-12","incident":"european-bomb-hoax-campaign-via-hijacked-university-agency-email-accounts-schools-airports-newsrooms-targeted","incidentTitle":"European bomb hoax campaign via hijacked university/agency email accounts — schools, airports, newsrooms targeted","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/europe-hoax-email-threats","status":"live","title":"European bomb hoax campaign via hijacked university/agency email accounts — schools, airports, newsrooms targeted","url":"https://helix.ml/threat-watch/i/european-bomb-hoax-campaign-via-hijacked-university-agency-email-accounts-schools-airports-newsrooms-targeted"},{"body":"Europol says victim data tied to CastleRAT will be made available via Have I Been Pwned, with DIVD, CheckjeHack, NoMoreLeaks, Sekoia, The Shadowserver Foundation and NL-NCSC, so that people whose credentials were stolen can be alerted.","category":"breach","date":"2026-11-12","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"other","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks","status":"live","title":"CastleRAT victim data to be made available for notification","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.theregister.com/security/2026/11/12/hackers-exploiting-screenconnect-plugin-flaw-to-spread-malware-across-hundreds-of-pcs/5309361","status":"live","title":"ConnectWise disables third-party extensions in 400 environments as hunters uncover a ScreenConnect plugin auth flaw that may bypass MFA and is being exploited to spread malware","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"breach","date":"2026-11-12","incident":"operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials","incidentTitle":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC; 6M+ stolen credentials identified","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/12/europol-operation-endgame-malware-takedown/","status":"live","title":"Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC recovers 6M+ stolen credentials","url":"https://helix.ml/threat-watch/i/operation-endgame-europol-takedown-of-gootloader-castlerat-and-stealc-recovers-6m-stolen-credentials"},{"body":null,"category":"breach","date":"2026-11-12","incident":"silent-lynx-ai-agent-espionage-campaign-central-asian-governments-and-railways-spied-on-via-exposed-server","incidentTitle":"Silent Lynx AI-agent espionage campaign — Central Asian governments and railways spied on via exposed server","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/kazakhstan-hackers-central-asia","status":"live","title":"Silent Lynx AI-agent espionage campaign — Central Asian governments and railways spied on via exposed server","url":"https://helix.ml/threat-watch/i/silent-lynx-ai-agent-espionage-campaign-central-asian-governments-and-railways-spied-on-via-exposed-server"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://databreaches.net/2026/11/12/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/","status":"live","title":"ConnectWise confirms active ScreenConnect campaign, disables five third-party extensions amid ongoing MSP attacks","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"breach","date":"2026-11-12","incident":"ai-assisted-intrusion-unnamed-us-retailer-attacker-used-llm-generated-powershell-to-revive-stalled-attack-harvest-creden","incidentTitle":"US retailer intrusion: AI-written PowerShell revived blocked attack, took Orion-held secrets (no CVE)","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/12/inside-an-ai-attack-against-a-us-retailer/","status":"live","title":"Symantec details the September AI-assisted intrusion at a US retailer where LLM-generated commands enabled lateral movement","url":"https://helix.ml/threat-watch/i/ai-assisted-intrusion-unnamed-us-retailer-attacker-used-llm-generated-powershell-to-revive-stalled-attack-harvest-creden"},{"body":null,"category":"breach","date":"2026-11-12","incident":"aic-cybersecurity-incident-personal-data-of-4-064-healthcare-and-community-care-employees-possibly-accessed","incidentTitle":"AIC cybersecurity incident: personal data of 4,064 healthcare and community care employees possibly accessed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/12/sg-aic-hit-by-cybersecurity-incident-personal-data-of-over-4000-healthcare-and-community-care-employees-possibly-affected/","status":"live","title":"AIC cybersecurity incident: personal data of 4,064 healthcare and community care employees possibly accessed","url":"https://helix.ml/threat-watch/i/aic-cybersecurity-incident-personal-data-of-4-064-healthcare-and-community-care-employees-possibly-accessed"},{"body":null,"category":"breach","date":"2026-11-12","incident":"notion-customer-ai-chat-transcripts-exposed-via-fireworks-ai-breach-llmjacking-linked","incidentTitle":"Notion: AI chat transcripts in Fireworks AI breach dataset, to be treated as exposed (LLMJacking-linked)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.securityweek.com/notion-customer-data-compromised-in-fireworks-ai-hack/","status":"live","title":"Notion: customer AI chat transcripts exposed via Fireworks AI breach (LLMJacking-linked)","url":"https://helix.ml/threat-watch/i/notion-customer-ai-chat-transcripts-exposed-via-fireworks-ai-breach-llmjacking-linked"},{"body":null,"category":"breach","date":"2026-11-12","incident":"ai-assisted-intrusion-unnamed-us-retailer-attacker-used-llm-generated-powershell-to-revive-stalled-attack-harvest-creden","incidentTitle":"US retailer intrusion: AI-written PowerShell revived blocked attack, took Orion-held secrets (no CVE)","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.darkreading.com/cyberattacks-data-breaches/inside-ai-attack-us-retailer","status":"live","title":"US retailer intrusion: AI-written PowerShell revived blocked attack, took Orion-held secrets (no CVE)","url":"https://helix.ml/threat-watch/i/ai-assisted-intrusion-unnamed-us-retailer-attacker-used-llm-generated-powershell-to-revive-stalled-attack-harvest-creden"},{"body":null,"category":"breach","date":"2026-11-12","incident":"claude-code-memory-store-c2-exfil-technique-anthropic-claude-code-stolen-api-keys-turn-agent-into-remote-controlled-impl","incidentTitle":"Claude Code: memory stores as C2 let stolen API keys drive a remote implant (lab PoC, no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/12/stolen-claude-api-keys-remote-controlled-implant/","status":"live","title":"Claude Code: memory stores as C2 let stolen API keys drive a remote implant (lab PoC, no CVE)","url":"https://helix.ml/threat-watch/i/claude-code-memory-store-c2-exfil-technique-anthropic-claude-code-stolen-api-keys-turn-agent-into-remote-controlled-impl"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.securityweek.com/hackers-deploy-malware-in-fresh-screenconnect-campaign/","status":"live","title":"Fresh ScreenConnect campaign exploits a vulnerability in a legitimate extension to bypass authentication and deploy malware","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"breach","date":"2026-11-12","incident":"gsocket-abuse-linux-web-servers-threat-actors-deploy-open-source-relay-tool-for-stealthy-persistent-c2-after-rce-patchin","incidentTitle":"GSocket: threat actors keep persistent relay-based C2 on Linux web servers after RCE patching","kind":"exploitation","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-plant-gsocket-on-linux-servers-for-persistent-access/","status":"live","title":"Multiple threat actors abusing GSocket for persistent C2 on Linux servers after patching initial-access RCE","url":"https://helix.ml/threat-watch/i/gsocket-abuse-linux-web-servers-threat-actors-deploy-open-source-relay-tool-for-stealthy-persistent-c2-after-rce-patchin"},{"body":null,"category":"breach","date":"2026-11-12","incident":"whitearmor-ransomware-maersk-lf-logistics-legacy-system-data-breach-5m-extortion-100gb-claimed-stolen","incidentTitle":"Maersk: legacy-system breach confirmed; WhiteArmor claims ~100GB stolen and demands $5M","kind":"victim","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.securityweek.com/maersk-confirms-data-theft-amid-5-million-extortion-attempt/","status":"live","title":"Maersk confirms data theft amid WhiteArmor's $5M extortion claim of ~100GB stolen","url":"https://helix.ml/threat-watch/i/whitearmor-ransomware-maersk-lf-logistics-legacy-system-data-breach-5m-extortion-100gb-claimed-stolen"},{"body":null,"category":"breach","date":"2026-11-12","incident":"cyberattack-on-epuap-poland-government-services-platform-taken-offline-as-precaution-after-attack","incidentTitle":"Cyberattack on ePUAP: Poland — government services platform taken offline as precaution after attack","kind":"other","patchStatus":"unknown","severity":"medium","sourceUrl":"https://securityaffairs.com/202895/security/poland-takes-its-national-e-government-platform-offline-after-a-cyberattack.html","status":"live","title":"Poland keeps ePUAP offline after stopping the cyberattack, disrupting access to public services","url":"https://helix.ml/threat-watch/i/cyberattack-on-epuap-poland-government-services-platform-taken-offline-as-precaution-after-attack"},{"body":null,"category":"breach","date":"2026-11-12","incident":"ai-agent-impersonation-credential-stuffing-online-marketplace-tier-1-telecom-bots-spoof-ai-agents-user-agents-for-bulk-l","incidentTitle":"Online login flows: credential stuffing disguised as AI agents and desktop browsers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.helpnetsecurity.com/2026/11/12/bots-ai-agent-impersonation/","status":"live","title":"AI-agent impersonation credential stuffing: online marketplace \u0026 Tier 1 telecom — bots spoof AI agents/user agents for bulk login attacks (no CVE)","url":"https://helix.ml/threat-watch/i/ai-agent-impersonation-credential-stuffing-online-marketplace-tier-1-telecom-bots-spoof-ai-agents-user-agents-for-bulk-l"},{"body":null,"category":"breach","date":"2026-11-12","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"victim","patchStatus":"unknown","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/screenconnect-attacks-target-at-least.html","status":"live","title":"ScreenConnect rogue-client campaign scales to at least 288 endpoints across 48 organizations; ConnectWise disables five third-party extensions","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"breach","date":"2026-11-12","incident":"emudhra-emsign-ca-key-compromise-8-more-intermediate-cas-revoked-after-buggy-python-key-transfer-script","incidentTitle":"eMudhra/emSign CA key compromise — 8 more intermediate CAs revoked after buggy Python key-transfer script","kind":"other","patchStatus":"partial","severity":"high","sourceUrl":"https://www.theregister.com/security/2026/11/12/disgraced-former-ca-emudhra-blames-buggy-script-for-hopelessly-weak-certificates/5309244","status":"live","title":"eMudhra blames buggy script and lack of HSM hardware for weak certificates","url":"https://helix.ml/threat-watch/i/emudhra-emsign-ca-key-compromise-8-more-intermediate-cas-revoked-after-buggy-python-key-transfer-script"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/breach/changes.json","json":"https://helix.ml/threat-watch/c/breach/feed.json","llms":"https://helix.ml/threat-watch/c/breach/llms.txt","page":"https://helix.ml/threat-watch?c=breach","rss":"https://helix.ml/threat-watch/c/breach/feed.xml"},"generatedAt":"2026-11-15T21:13:19Z","site":"https://helix.ml/threat-watch"}