<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>ThreatNoir — Security Articles</title>
    <link>https://threatnoir.com</link>
    <description><![CDATA[Curated cybersecurity news and analysis]]></description>
    <language>en</language>
    <copyright>ThreatNoir 2026</copyright>
    <atom:link href="https://threatnoir.com/api/articles/feed.xml" rel="self" type="application/rss+xml"/>
    <lastBuildDate>Fri, 13 Nov 2026 21:33:27 GMT</lastBuildDate>
    <item>
      <title>FAA Ground Stop Issued Due to ‘Extraordinary Circumstances’</title>
      <link>https://threatnoir.com/article/faa-ground-stop-issued-due-to-extraordinary-circumstances-068aac</link>
      <guid isPermaLink="true">https://threatnoir.com/article/faa-ground-stop-issued-due-to-extraordinary-circumstances-068aac</guid>
      <pubDate>Fri, 13 Nov 2026 21:33:27 GMT</pubDate>
      <description><![CDATA[FAA grounds all US flights due to communications disruption; cyberattack not ruled out.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’</title>
      <link>https://threatnoir.com/article/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed-637417</link>
      <guid isPermaLink="true">https://threatnoir.com/article/fbi-flash-alert-says-artex-tool-automating-cyberattacks-at-machine-speed-637417</guid>
      <pubDate>Fri, 13 Nov 2026 21:32:00 GMT</pubDate>
      <description><![CDATA[FBI warns Artex AI tool automates cyberattacks at machine speed, targeting critical sectors.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>SCKit abuses ScreenConnect to deploy remote access and target technician sessions</title>
      <link>https://threatnoir.com/article/sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2</link>
      <guid isPermaLink="true">https://threatnoir.com/article/sckit-abuses-screenconnect-to-deploy-remote-access-and-target-technician-session-36ece2</guid>
      <pubDate>Fri, 13 Nov 2026 21:31:44 GMT</pubDate>
      <description><![CDATA[SCKit malware abuses ScreenConnect to gain unauthorized remote access and target IT technicians.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Researchers continue to find serious vulnerabilities in internet connected refrigerators</title>
      <link>https://threatnoir.com/article/researchers-continue-to-find-serious-vulnerabilities-in-internet-connected-refri-04d35e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/researchers-continue-to-find-serious-vulnerabilities-in-internet-connected-refri-04d35e</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:51 GMT</pubDate>
      <description><![CDATA[14 vulnerabilities in Dixell refrigeration units grant root access, with some under active exploitation.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure</title>
      <link>https://threatnoir.com/article/north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0</link>
      <guid isPermaLink="true">https://threatnoir.com/article/north-korea-s-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-6ebed0</guid>
      <pubDate>Fri, 13 Nov 2026 21:19:30 GMT</pubDate>
      <description><![CDATA[DOJ seizes $1.2B in crypto, disrupts North Korean hacker infrastructure and FaceStealer scheme.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>ARTEX and beyond: AI-enabled penetration testing platforms</title>
      <link>https://threatnoir.com/article/artex-and-beyond-ai-enabled-penetration-testing-platforms-d59fa8</link>
      <guid isPermaLink="true">https://threatnoir.com/article/artex-and-beyond-ai-enabled-penetration-testing-platforms-d59fa8</guid>
      <pubDate>Fri, 13 Nov 2026 20:57:13 GMT</pubDate>
      <description><![CDATA[AI-enabled penetration testing frameworks like ARTEX are being misused by threat actors to accelerate intrusions.]]></description>
      <category>Threat Intelligence</category>
    </item>
    <item>
      <title>This year’s bug count just passed 100K</title>
      <link>https://threatnoir.com/article/this-year-s-bug-count-just-passed-100k-9b8800</link>
      <guid isPermaLink="true">https://threatnoir.com/article/this-year-s-bug-count-just-passed-100k-9b8800</guid>
      <pubDate>Fri, 13 Nov 2026 20:52:17 GMT</pubDate>
      <description><![CDATA[The number of disclosed software vulnerabilities in 2026 has surpassed 100,000, more than double last year's total.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents</title>
      <link>https://threatnoir.com/article/city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc</link>
      <guid isPermaLink="true">https://threatnoir.com/article/city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc</guid>
      <pubDate>Fri, 13 Nov 2026 19:43:00 GMT</pubDate>
      <description><![CDATA[City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.]]></description>
      <category>Breaches</category>
    </item>
    <item>
      <title>Trezor confirms crypto-stealing implants in three wallets, releases fix</title>
      <link>https://threatnoir.com/article/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629</link>
      <guid isPermaLink="true">https://threatnoir.com/article/trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629</guid>
      <pubDate>Fri, 13 Nov 2026 19:38:36 GMT</pubDate>
      <description><![CDATA[Trezor confirms crypto-stealing implants in three Safe 5 wallets sold by CryptoBilis.]]></description>
      <category>Supply Chain</category>
    </item>
    <item>
      <title>Microsoft 365 Crawls Back to Life After a 24-Hour Outage</title>
      <link>https://threatnoir.com/article/microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92</link>
      <guid isPermaLink="true">https://threatnoir.com/article/microsoft-365-crawls-back-to-life-after-a-24-hour-outage-6b7a92</guid>
      <pubDate>Fri, 13 Nov 2026 19:08:57 GMT</pubDate>
      <description><![CDATA[Microsoft 365 outage affecting 70+ countries caused by bad network update, not cyberattack.]]></description>
      <category>Incident Response</category>
    </item>
    <item>
      <title>NYC to bar surveillance pricing as momentum for bans grows nationwide</title>
      <link>https://threatnoir.com/article/nyc-to-bar-surveillance-pricing-as-momentum-for-bans-grows-nationwide-1f0d7e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/nyc-to-bar-surveillance-pricing-as-momentum-for-bans-grows-nationwide-1f0d7e</guid>
      <pubDate>Fri, 13 Nov 2026 18:35:00 GMT</pubDate>
      <description><![CDATA[NYC bans surveillance pricing, allowing $1,000 fines per violation.]]></description>
      <category>Policy</category>
    </item>
    <item>
      <title>German military drone operations disrupted by cyberattack</title>
      <link>https://threatnoir.com/article/german-military-drone-operations-disrupted-by-cyberattack-6ce23a</link>
      <guid isPermaLink="true">https://threatnoir.com/article/german-military-drone-operations-disrupted-by-cyberattack-6ce23a</guid>
      <pubDate>Fri, 13 Nov 2026 17:31:56 GMT</pubDate>
      <description><![CDATA[German drone maker Quantum Systems hit by cyberattack targeting update server.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>University of Texas at Arlington warns personal information stolen during cyberattack</title>
      <link>https://threatnoir.com/article/university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2</link>
      <guid isPermaLink="true">https://threatnoir.com/article/university-of-texas-at-arlington-warns-personal-information-stolen-during-cybera-ff3fa2</guid>
      <pubDate>Fri, 13 Nov 2026 17:26:00 GMT</pubDate>
      <description><![CDATA[University of Texas at Arlington confirms personal information stolen in cyberattack claimed by Qilin ransomware.]]></description>
      <category>Breaches</category>
    </item>
    <item>
      <title>The Microsoft Outage Is a Warning for the World</title>
      <link>https://threatnoir.com/article/the-microsoft-outage-is-a-warning-for-the-world-aa3046</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-microsoft-outage-is-a-warning-for-the-world-aa3046</guid>
      <pubDate>Fri, 13 Nov 2026 17:15:54 GMT</pubDate>
      <description><![CDATA[Microsoft 365 outage impacts Outlook, Teams, and Copilot globally for a second day.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>The Green Agent POV: Formulating the Fix for an Internet-Facing Container with Sensitive Data Access</title>
      <link>https://threatnoir.com/article/the-green-agent-pov-formulating-the-fix-for-an-internet-facing-container-with-se-43a4d5</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-green-agent-pov-formulating-the-fix-for-an-internet-facing-container-with-se-43a4d5</guid>
      <pubDate>Fri, 13 Nov 2026 17:05:02 GMT</pubDate>
      <description><![CDATA[Green Agent tool identifies and formulates fixes for internet-facing containers with vulnerabilities and sensitive data]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>The Take-Home Test That Runs on Your Work Laptop: Inside the AccuraSoftHire Fake Interview Campaign</title>
      <link>https://threatnoir.com/article/the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52</link>
      <guid isPermaLink="true">https://threatnoir.com/article/the-take-home-test-that-runs-on-your-work-laptop-inside-the-accurasofthire-fake-2d9b52</guid>
      <pubDate>Fri, 13 Nov 2026 17:04:34 GMT</pubDate>
      <description><![CDATA[Fake interview campaign uses poisoned npm packages to deliver malware to developer machines.]]></description>
      <category>Threat Intelligence</category>
    </item>
    <item>
      <title>PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE</title>
      <link>https://threatnoir.com/article/postgresql-patches-52-flaws-including-22-year-old-bug-enabling-authenticated-rce-d8cc21</link>
      <guid isPermaLink="true">https://threatnoir.com/article/postgresql-patches-52-flaws-including-22-year-old-bug-enabling-authenticated-rce-d8cc21</guid>
      <pubDate>Fri, 13 Nov 2026 16:53:08 GMT</pubDate>
      <description><![CDATA[PostgreSQL patches 52 flaws, including a 22-year-old bug enabling authenticated RCE.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>German parliament passes law giving spy agencies hacking, sabotage powers</title>
      <link>https://threatnoir.com/article/german-parliament-passes-law-giving-spy-agencies-hacking-sabotage-powers-064bcd</link>
      <guid isPermaLink="true">https://threatnoir.com/article/german-parliament-passes-law-giving-spy-agencies-hacking-sabotage-powers-064bcd</guid>
      <pubDate>Fri, 13 Nov 2026 16:32:00 GMT</pubDate>
      <description><![CDATA[German parliament passes law granting spy agencies new hacking and sabotage powers.]]></description>
      <category>Policy</category>
    </item>
    <item>
      <title>Check Point gateways hacked via PHP2Shell to deploy VMware ESXi wiper</title>
      <link>https://threatnoir.com/article/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/check-point-gateways-hacked-via-php2shell-to-deploy-vmware-esxi-wiper-97c01e</guid>
      <pubDate>Fri, 13 Nov 2026 16:21:43 GMT</pubDate>
      <description><![CDATA[Check Point gateways exploited via PHP2Shell to deploy ESXi wiper in targeted attacks]]></description>
      <category>Breaches</category>
    </item>
    <item>
      <title>DOJ: Gootloader used in at least 44 ransomware attacks costing $29 million since 2018</title>
      <link>https://threatnoir.com/article/doj-gootloader-used-in-at-least-44-ransomware-attacks-costing-29-million-since-2-762fea</link>
      <guid isPermaLink="true">https://threatnoir.com/article/doj-gootloader-used-in-at-least-44-ransomware-attacks-costing-29-million-since-2-762fea</guid>
      <pubDate>Fri, 13 Nov 2026 15:59:00 GMT</pubDate>
      <description><![CDATA[DOJ details Gootloader's role in 44 ransomware attacks causing $29M in losses.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>New Mior and Skyfall Attacks Let Rogue Cloud Hosts Steal Secrets From AMD SEV-SNP VMs</title>
      <link>https://threatnoir.com/article/new-mior-and-skyfall-attacks-let-rogue-cloud-hosts-steal-secrets-from-amd-sev-sn-d93f5e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/new-mior-and-skyfall-attacks-let-rogue-cloud-hosts-steal-secrets-from-amd-sev-sn-d93f5e</guid>
      <pubDate>Fri, 13 Nov 2026 15:27:05 GMT</pubDate>
      <description><![CDATA[Two new attacks, Mior and Skyfall, allow malicious cloud hosts to steal data from AMD SEV-SNP protected VMs.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>New TypoPrompting Attacks Turn Mistyped AI Website Addresses Into Malware Installation Traps</title>
      <link>https://threatnoir.com/article/new-typoprompting-attacks-turn-mistyped-ai-website-addresses-into-malware-instal-28e90d</link>
      <guid isPermaLink="true">https://threatnoir.com/article/new-typoprompting-attacks-turn-mistyped-ai-website-addresses-into-malware-instal-28e90d</guid>
      <pubDate>Fri, 13 Nov 2026 15:24:38 GMT</pubDate>
      <description><![CDATA[TypoPrompting attacks exploit mistyped AI website addresses to deliver malware and hijackers.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>November Patch Tuesday: How to Sort Through the Patches</title>
      <link>https://threatnoir.com/article/november-patch-tuesday-how-to-sort-through-the-patches-dacc34</link>
      <guid isPermaLink="true">https://threatnoir.com/article/november-patch-tuesday-how-to-sort-through-the-patches-dacc34</guid>
      <pubDate>Fri, 13 Nov 2026 15:23:43 GMT</pubDate>
      <description><![CDATA[Microsoft's November Patch Tuesday addresses 1,252 CVEs, highlighting the need for strategic patching over a blanket]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.</title>
      <link>https://threatnoir.com/article/artex-attackers-adopted-this-ai-pentesting-tool-in-three-months-leaked-secrets-a-8d732f</link>
      <guid isPermaLink="true">https://threatnoir.com/article/artex-attackers-adopted-this-ai-pentesting-tool-in-three-months-leaked-secrets-a-8d732f</guid>
      <pubDate>Fri, 13 Nov 2026 15:22:30 GMT</pubDate>
      <description><![CDATA[Attackers are using the AI pentesting tool ARTEX, with leaked secrets providing the fastest entry.]]></description>
      <category>Threat Intelligence</category>
    </item>
    <item>
      <title>In Other News: New CISA Director Nominee, Connected Car Hacking, Baker Tilly Data Breach</title>
      <link>https://threatnoir.com/article/in-other-news-new-cisa-director-nominee-connected-car-hacking-baker-tilly-data-b-096388</link>
      <guid isPermaLink="true">https://threatnoir.com/article/in-other-news-new-cisa-director-nominee-connected-car-hacking-baker-tilly-data-b-096388</guid>
      <pubDate>Fri, 13 Nov 2026 15:20:00 GMT</pubDate>
      <description><![CDATA[Security news roundup includes crypto theft, Baker Tilly data breach, OpenAI agent issues, and Siemens advisory policy.]]></description>
      <category>Threat Intelligence</category>
    </item>
    <item>
      <title>Hackers Use SANSAR Linux Malware to Hide Crypto Mining by Faking 0% GPU Usage</title>
      <link>https://threatnoir.com/article/hackers-use-sansar-linux-malware-to-hide-crypto-mining-by-faking-0-gpu-usage-7ad699</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-use-sansar-linux-malware-to-hide-crypto-mining-by-faking-0-gpu-usage-7ad699</guid>
      <pubDate>Fri, 13 Nov 2026 15:09:45 GMT</pubDate>
      <description><![CDATA[Hackers use SANSAR Linux malware to hide crypto mining by faking 0% GPU usage.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>TSMC confirms employee data breach tied to cloud service provider</title>
      <link>https://threatnoir.com/article/tsmc-confirms-employee-data-breach-tied-to-cloud-service-provider-ccd63f</link>
      <guid isPermaLink="true">https://threatnoir.com/article/tsmc-confirms-employee-data-breach-tied-to-cloud-service-provider-ccd63f</guid>
      <pubDate>Fri, 13 Nov 2026 15:06:00 GMT</pubDate>
      <description><![CDATA[TSMC confirms employee data breach via cloud service provider, impacting current and former employees.]]></description>
      <category>Breaches</category>
    </item>
    <item>
      <title>How one AI agent exposed five critical enterprise security gaps</title>
      <link>https://threatnoir.com/article/how-one-ai-agent-exposed-five-critical-enterprise-security-gaps-b32ccd</link>
      <guid isPermaLink="true">https://threatnoir.com/article/how-one-ai-agent-exposed-five-critical-enterprise-security-gaps-b32ccd</guid>
      <pubDate>Fri, 13 Nov 2026 15:01:11 GMT</pubDate>
      <description><![CDATA[AI agent processing invoices exposed five critical enterprise security gaps.]]></description>
      <category>AI Security</category>
    </item>
    <item>
      <title>Fake GTA 6 download goes after Steam logins and crypto wallet data</title>
      <link>https://threatnoir.com/article/fake-gta-6-download-goes-after-steam-logins-and-crypto-wallet-data-8eb8c9</link>
      <guid isPermaLink="true">https://threatnoir.com/article/fake-gta-6-download-goes-after-steam-logins-and-crypto-wallet-data-8eb8c9</guid>
      <pubDate>Fri, 13 Nov 2026 15:00:59 GMT</pubDate>
      <description><![CDATA[Fake GTA 6 download link on Google Colab leads to WARDEN Stealer malware.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Hackers Use 2,700 Passwords to Break Into Microsoft SQL Servers and Deploy Remote Access Malware</title>
      <link>https://threatnoir.com/article/hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-use-2-700-passwords-to-break-into-microsoft-sql-servers-and-deploy-remot-8fab91</guid>
      <pubDate>Fri, 13 Nov 2026 14:54:56 GMT</pubDate>
      <description><![CDATA[Hackers exploit weak passwords to compromise Microsoft SQL Servers, deploying malware for crypto mining and remote]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Gootloader Malware Disrupted After Infecting 25,000 Computers</title>
      <link>https://threatnoir.com/article/gootloader-malware-disrupted-after-infecting-25-000-computers-93f9e8</link>
      <guid isPermaLink="true">https://threatnoir.com/article/gootloader-malware-disrupted-after-infecting-25-000-computers-93f9e8</guid>
      <pubDate>Fri, 13 Nov 2026 14:35:44 GMT</pubDate>
      <description><![CDATA[Gootloader malware operation disrupted, 100+ servers seized, 25,000 computers affected.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls</title>
      <link>https://threatnoir.com/article/fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f</link>
      <guid isPermaLink="true">https://threatnoir.com/article/fbi-says-north-korean-hackers-stole-over-400-million-in-crypto-using-deepfake-vi-d32b5f</guid>
      <pubDate>Fri, 13 Nov 2026 14:28:58 GMT</pubDate>
      <description><![CDATA[North Korean hackers stole over $400M in crypto using deepfake video calls.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>Ransomware attack on Belarusian cloud firm disrupts businesses for days</title>
      <link>https://threatnoir.com/article/ransomware-attack-on-belarusian-cloud-firm-disrupts-businesses-for-days-9b8698</link>
      <guid isPermaLink="true">https://threatnoir.com/article/ransomware-attack-on-belarusian-cloud-firm-disrupts-businesses-for-days-9b8698</guid>
      <pubDate>Fri, 13 Nov 2026 14:28:00 GMT</pubDate>
      <description><![CDATA[Belarusian cloud provider ActiveCloud hit by ransomware, disrupting services for days.]]></description>
      <category>Ransomware</category>
    </item>
    <item>
      <title>Citrix Patches 28 Security Vulnerabilities in NetScaler, Including a Critical Flaw in Default Installations</title>
      <link>https://threatnoir.com/article/citrix-patches-28-security-vulnerabilities-in-netscaler-including-a-critical-fla-fabc8a</link>
      <guid isPermaLink="true">https://threatnoir.com/article/citrix-patches-28-security-vulnerabilities-in-netscaler-including-a-critical-fla-fabc8a</guid>
      <pubDate>Fri, 13 Nov 2026 14:18:29 GMT</pubDate>
      <description><![CDATA[Citrix patches 28 NetScaler flaws including critical memory overflow affecting all default installations]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>FBI Disrupts North Korean FaceStealer Scheme Behind $400M Crypto Theft</title>
      <link>https://threatnoir.com/article/fbi-disrupts-north-korean-facestealer-scheme-behind-400m-crypto-theft-82acab</link>
      <guid isPermaLink="true">https://threatnoir.com/article/fbi-disrupts-north-korean-facestealer-scheme-behind-400m-crypto-theft-82acab</guid>
      <pubDate>Fri, 13 Nov 2026 14:17:17 GMT</pubDate>
      <description><![CDATA[FBI disrupts North Korean FaceStealer scheme, stealing over $400M in crypto.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>Hackers Use Fake Purchase Order Emails to Deliver XLoader Malware Through Malicious Word Documents</title>
      <link>https://threatnoir.com/article/hackers-use-fake-purchase-order-emails-to-deliver-xloader-malware-through-malici-fb620b</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-use-fake-purchase-order-emails-to-deliver-xloader-malware-through-malici-fb620b</guid>
      <pubDate>Fri, 13 Nov 2026 14:09:51 GMT</pubDate>
      <description><![CDATA[Hackers distribute XLoader malware via fake purchase order Word documents exploiting CVE-2017-11882.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers</title>
      <link>https://threatnoir.com/article/hackers-exploit-exposed-geovision-cctv-software-to-disable-defender-and-deploy-c-cfe37d</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-exploit-exposed-geovision-cctv-software-to-disable-defender-and-deploy-c-cfe37d</guid>
      <pubDate>Fri, 13 Nov 2026 14:05:30 GMT</pubDate>
      <description><![CDATA[Hackers exploit exposed GeoVision CCTV software to disable Defender and deploy cryptominers.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>GeoVision Camera Software Abused to Deploy XMRig Cryptominer</title>
      <link>https://threatnoir.com/article/geovision-camera-software-abused-to-deploy-xmrig-cryptominer-5493e9</link>
      <guid isPermaLink="true">https://threatnoir.com/article/geovision-camera-software-abused-to-deploy-xmrig-cryptominer-5493e9</guid>
      <pubDate>Fri, 13 Nov 2026 14:00:00 GMT</pubDate>
      <description><![CDATA[GeoVision camera software exploited to deploy XMRig cryptominer and disable Defender.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases</title>
      <link>https://threatnoir.com/article/trezor-confirms-hidden-implants-in-cryptobilis-sold-wallets-that-can-steal-recov-ea8f2c</link>
      <guid isPermaLink="true">https://threatnoir.com/article/trezor-confirms-hidden-implants-in-cryptobilis-sold-wallets-that-can-steal-recov-ea8f2c</guid>
      <pubDate>Fri, 13 Nov 2026 13:54:20 GMT</pubDate>
      <description><![CDATA[Trezor confirms implants in crypto wallets sold by CryptoBilis can steal recovery phrases.]]></description>
      <category>Malware</category>
    </item>
    <item>
      <title>Microsoft Struggles to Restore Email and Other Services in a Global Outage</title>
      <link>https://threatnoir.com/article/microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956</link>
      <guid isPermaLink="true">https://threatnoir.com/article/microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956</guid>
      <pubDate>Fri, 13 Nov 2026 13:47:42 GMT</pubDate>
      <description><![CDATA[Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.]]></description>
      <category>Incident Response</category>
    </item>
    <item>
      <title>Quantum Systems drones back in the air after malware scare</title>
      <link>https://threatnoir.com/article/quantum-systems-drones-back-in-the-air-after-malware-scare-7ac3b3</link>
      <guid isPermaLink="true">https://threatnoir.com/article/quantum-systems-drones-back-in-the-air-after-malware-scare-7ac3b3</guid>
      <pubDate>Fri, 13 Nov 2026 13:14:00 GMT</pubDate>
      <description><![CDATA[Quantum Systems drones grounded after malware found in QBase control software update.]]></description>
      <category>Supply Chain</category>
    </item>
    <item>
      <title>Apify Confirms Customer Data Accessed in Cyberattack</title>
      <link>https://threatnoir.com/article/apify-confirms-customer-data-accessed-in-cyberattack-854397</link>
      <guid isPermaLink="true">https://threatnoir.com/article/apify-confirms-customer-data-accessed-in-cyberattack-854397</guid>
      <pubDate>Fri, 13 Nov 2026 12:41:01 GMT</pubDate>
      <description><![CDATA[Apify confirms customer data accessed in cyberattack via compromised credentials.]]></description>
      <category>Breaches</category>
    </item>
    <item>
      <title>SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks</title>
      <link>https://threatnoir.com/article/silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/silentair-hackers-intercept-calls-sms-from-inside-mobile-networks-76848e</guid>
      <pubDate>Fri, 13 Nov 2026 12:20:28 GMT</pubDate>
      <description><![CDATA[SilentAir hackers exploit mobile network nodes to intercept calls and SMS, targeting Taiwan.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>CISA Adds Two Known Exploited Vulnerabilities to Catalog</title>
      <link>https://threatnoir.com/article/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-7b5dac</link>
      <guid isPermaLink="true">https://threatnoir.com/article/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-7b5dac</guid>
      <pubDate>Fri, 13 Nov 2026 12:00:00 GMT</pubDate>
      <description><![CDATA[CISA adds two new exploited vulnerabilities to its KEV Catalog.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks</title>
      <link>https://threatnoir.com/article/hackers-use-deepseek-and-glm-ai-agents-to-breach-10-organizations-in-autonomous-1e7126</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-use-deepseek-and-glm-ai-agents-to-breach-10-organizations-in-autonomous-1e7126</guid>
      <pubDate>Fri, 13 Nov 2026 11:56:24 GMT</pubDate>
      <description><![CDATA[Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>When an AI Agent Goes Wrong, Can You Stop It?</title>
      <link>https://threatnoir.com/article/when-an-ai-agent-goes-wrong-can-you-stop-it-ed1f4b</link>
      <guid isPermaLink="true">https://threatnoir.com/article/when-an-ai-agent-goes-wrong-can-you-stop-it-ed1f4b</guid>
      <pubDate>Fri, 13 Nov 2026 11:52:31 GMT</pubDate>
      <description><![CDATA[OWASP GenAI Security Project warns AI agents can exceed intended scope; proper containment requires pausing workflows,]]></description>
      <category>AI Security</category>
    </item>
    <item>
      <title>Unpatched Check Point Gateways Are Being Wiped exploiting PHP2Shell</title>
      <link>https://threatnoir.com/article/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell-80909b</link>
      <guid isPermaLink="true">https://threatnoir.com/article/unpatched-check-point-gateways-are-being-wiped-exploiting-php2shell-80909b</guid>
      <pubDate>Fri, 13 Nov 2026 11:35:05 GMT</pubDate>
      <description><![CDATA[Unpatched Check Point gateways were wiped after exploitation of PHP2Shell and privilege escalation flaws.]]></description>
      <category>Vulnerabilities</category>
    </item>
    <item>
      <title>Hackers Use Windows Named Pipes and SMB to Spread Malware Across Isolated Government Networks</title>
      <link>https://threatnoir.com/article/hackers-use-windows-named-pipes-and-smb-to-spread-malware-across-isolated-govern-4ab131</link>
      <guid isPermaLink="true">https://threatnoir.com/article/hackers-use-windows-named-pipes-and-smb-to-spread-malware-across-isolated-govern-4ab131</guid>
      <pubDate>Fri, 13 Nov 2026 11:30:35 GMT</pubDate>
      <description><![CDATA[StingyBasilisk group uses Windows named pipes and SMB to spread malware in isolated government networks.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>SilentAir Hijacks Asian Telecom Networks to Intercept SMS 2FA Codes and Spy on Taiwanese Users</title>
      <link>https://threatnoir.com/article/silentair-hijacks-asian-telecom-networks-to-intercept-sms-2fa-codes-and-spy-on-t-7f22b6</link>
      <guid isPermaLink="true">https://threatnoir.com/article/silentair-hijacks-asian-telecom-networks-to-intercept-sms-2fa-codes-and-spy-on-t-7f22b6</guid>
      <pubDate>Fri, 13 Nov 2026 11:10:40 GMT</pubDate>
      <description><![CDATA[SilentAir spies on Taiwanese users by hijacking Asian telecom networks to intercept SMS 2FA codes.]]></description>
      <category>Nation-state</category>
    </item>
    <item>
      <title>354 dark web vendors and buyers arrested in Operation TorNado</title>
      <link>https://threatnoir.com/article/354-dark-web-vendors-and-buyers-arrested-in-operation-tornado-6ec35e</link>
      <guid isPermaLink="true">https://threatnoir.com/article/354-dark-web-vendors-and-buyers-arrested-in-operation-tornado-6ec35e</guid>
      <pubDate>Fri, 13 Nov 2026 11:06:29 GMT</pubDate>
      <description><![CDATA[354 dark web vendors and buyers arrested in 14 countries during Operation TorNado.]]></description>
      <category>Threat Intelligence</category>
    </item>
  </channel>
</rss>