<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>ThreatNoir — Awareness Lessons</title>
    <link>https://threatnoir.com</link>
	    <description><![CDATA[Curated cybersecurity news and analysis]]></description>
    <language>en</language>
    <copyright>ThreatNoir 2026</copyright>
    <atom:link href="https://threatnoir.com/api/awareness/feed.xml" rel="self" type="application/rss+xml"/>
    <lastBuildDate>Fri, 13 Nov 2026 22:21:35 GMT</lastBuildDate>
    <item>
      <title>North Korean Actors Use AI Deepfakes and Social Engineering to Steal $1.2B in Crypto</title>
      <link>https://threatnoir.com/awareness/north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/north-korean-actors-use-ai-deepfakes-and-social-engineering-to-steal-12b-in-crypto</guid>
      <pubDate>Fri, 13 Nov 2026 22:21:35 GMT</pubDate>
      <description><![CDATA[North Korea-linked threat actors (Sapphire Sleet/APT38) successfully stole over $1.2 billion in cryptocurrency by exploiting the weakest link in security: human trust. The FaceStealer scheme leveraged AI-generated deepfakes and sophisticated social engineering to trick victims into installing malware, bypassing technical controls entirely. Critically, these same actors are now targeting open-source developers, poisoning the software supply chain and threatening organizations that consume communi...]]></description>
    </item>
    <item>
      <title>Internet-Connected Refrigeration Units Expose Critical Infrastructure to Root-Level Attacks</title>
      <link>https://threatnoir.com/awareness/internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/internet-connected-refrigeration-units-expose-critical-infrastructure-to-root-level-attacks</guid>
      <pubDate>Fri, 13 Nov 2026 22:21:16 GMT</pubDate>
      <description><![CDATA[VulnCheck disclosed 14 vulnerabilities in Dixell/Copeland XWEB EVO refrigeration supervision systems, several rated high severity, with at least two actively exploited in the wild. The core problem is that operational technology (OT) devices like commercial refrigeration controllers are being exposed directly to the internet without adequate hardening, segmentation, or timely patching. These devices were not designed with modern threat models in mind, yet they are increasingly networked and reac...]]></description>
    </item>
    <item>
      <title>SCKit Worm Hijacks ScreenConnect Sessions to Compromise IT Technician Workstations</title>
      <link>https://threatnoir.com/awareness/sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/sckit-worm-hijacks-screenconnect-sessions-to-compromise-it-technician-workstations</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:58 GMT</pubDate>
      <description><![CDATA[Threat actors exploited improperly secured or unpatched ConnectWise ScreenConnect instances to install unauthorized remote access clients and deploy the SCKit worm. The worm's RelayTrap component specifically targeted IT support technician sessions — a highly privileged attack surface — allowing attackers to piggyback on legitimate support workflows for lateral movement and payload distribution. This attack is particularly dangerous because it weaponizes trusted remote administration tooling, ma...]]></description>
    </item>
    <item>
      <title>AI-Powered Attack Tool Artex Enables Machine-Speed Intrusions by Low-Skill Actors</title>
      <link>https://threatnoir.com/awareness/ai-powered-attack-tool-artex-enables-machine-speed-intrusions-by-low-skill-actors</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/ai-powered-attack-tool-artex-enables-machine-speed-intrusions-by-low-skill-actors</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:40 GMT</pubDate>
      <description><![CDATA[The proliferation of Artex, an open-source AI platform, dramatically lowers the barrier to entry for cybercriminals by automating complex attack chains in under three hours. Even the removal of the tool's GitHub repository has failed to contain its spread, illustrating how offensive AI tools, once released, cannot be un-published. This matters because traditional defenses calibrated to human-speed attacks are inadequate against automated, AI-driven intrusion campaigns. Organizations must assume ...]]></description>
    </item>
    <item>
      <title>FAA Communications Failure Halts All U.S. Flights</title>
      <link>https://threatnoir.com/awareness/faa-communications-failure-halts-all-us-flights</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/faa-communications-failure-halts-all-us-flights</guid>
      <pubDate>Fri, 13 Nov 2026 22:20:21 GMT</pubDate>
      <description><![CDATA[A communications failure affecting Air Route Traffic Control Centers prompted the FAA to issue a nationwide ground stop, grounding all departing flights across the U.S. While the root cause—whether technical failure or cyberattack—remained unclear at time of reporting, the incident exposed the fragility of critical aviation infrastructure when a single communications system fails. For safety-critical systems like air traffic control, any disruption has immediate, cascading consequences for publi...]]></description>
    </item>
    <item>
      <title>Actively Exploited Vulnerabilities Added to CISA KEV Catalog Demand Immediate Remediation</title>
      <link>https://threatnoir.com/awareness/actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/actively-exploited-vulnerabilities-added-to-cisa-kev-catalog-demand-immediate-remediation</guid>
      <pubDate>Fri, 13 Nov 2026 21:21:21 GMT</pubDate>
      <description><![CDATA[CISA's addition of CVE-2026-114713 and CVE-2026-123039 to the Known Exploited Vulnerabilities Catalog confirms that threat actors are actively leveraging these flaws against real targets, including federal systems. When known vulnerabilities remain unpatched on publicly exposed assets, organizations hand attackers a documented, low-effort path into their networks. The KEV Catalog exists precisely because patch backlogs and poor asset visibility routinely allow exploitable conditions to persist l...]]></description>
    </item>
    <item>
      <title>Exposed Camera Software Exploited to Mine Cryptocurrency Across 13 Organizations</title>
      <link>https://threatnoir.com/awareness/exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/exposed-camera-software-exploited-to-mine-cryptocurrency-across-13-organizations</guid>
      <pubDate>Fri, 13 Nov 2026 21:21:00 GMT</pubDate>
      <description><![CDATA[Attackers leveraged publicly exposed GeoVision camera software—likely running outdated or unpatched versions—to gain a foothold across 13 organizations and deploy the XMRig cryptominer. The attack chain was sophisticated: PowerShell scripts attempted to disable Microsoft Defender via a kernel-mode driver and IFEO debugger hijacks, followed by a custom Golang loader to fetch and execute the miner. This incident highlights the danger of internet-facing legacy or IoT devices that are rarely patched...]]></description>
    </item>
    <item>
      <title>CVE Volume Hits 100K: AI-Driven Discovery Outpaces Human Patching Capacity</title>
      <link>https://threatnoir.com/awareness/cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/cve-volume-hits-100k-ai-driven-discovery-outpaces-human-patching-capacity</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:43 GMT</pubDate>
      <description><![CDATA[The number of disclosed CVEs in 2026 has surpassed 100,000 — more than double the prior year — driven largely by AI-assisted vulnerability discovery by major CVE Numbering Authorities. While the raw exploit rate remains low, the danger lies in the shrinking window between patch release and weaponization, as adversaries also leverage AI to accelerate exploit development. Organizations that rely on manual triage and periodic patching cycles are increasingly exposed because they cannot keep pace wi...]]></description>
    </item>
    <item>
      <title>AI-Powered Pen Testing Tools Lower the Bar for Attackers</title>
      <link>https://threatnoir.com/awareness/ai-powered-pen-testing-tools-lower-the-bar-for-attackers</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/ai-powered-pen-testing-tools-lower-the-bar-for-attackers</guid>
      <pubDate>Fri, 13 Nov 2026 21:20:23 GMT</pubDate>
      <description><![CDATA[Legitimate penetration testing frameworks such as ARTEX, Hephaestus, PentAGI, and HexStrike AI are being repurposed by criminal actors to automate end-to-end attack chains at machine speed, dramatically reducing the expertise required to launch sophisticated intrusions. Because these tools chain together reconnaissance, exploitation, and lateral movement automatically, defenders face compressed timelines that traditional reactive controls cannot match. Organizations that rely on periodic vulnera...]]></description>
    </item>
    <item>
      <title>Microsoft 365 Outage Exposes Risks of Unvalidated Network Changes</title>
      <link>https://threatnoir.com/awareness/microsoft-365-outage-exposes-risks-of-unvalidated-network-changes</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/microsoft-365-outage-exposes-risks-of-unvalidated-network-changes</guid>
      <pubDate>Fri, 13 Nov 2026 20:20:57 GMT</pubDate>
      <description><![CDATA[A network capacity upgrade and recent configuration change caused a 24-hour global outage of Microsoft 365, impacting tens of millions of users across more than 70 countries. The root cause highlights how infrastructure changes — even those unrelated to security attacks — can cascade into major service disruptions when change management and rollback procedures are insufficient. Organizations relying on cloud-hosted productivity suites are reminded that upstream provider outages can paralyze thei...]]></description>
    </item>
    <item>
      <title>Hardware Implants in Reseller Wallets Highlight Supply Chain Risks</title>
      <link>https://threatnoir.com/awareness/hardware-implants-in-reseller-wallets-highlight-supply-chain-risks</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/hardware-implants-in-reseller-wallets-highlight-supply-chain-risks</guid>
      <pubDate>Fri, 13 Nov 2026 20:20:40 GMT</pubDate>
      <description><![CDATA[Three Trezor Safe 5 hardware wallets sold through a Southeast Asian reseller were found to contain malicious circuit boards capable of capturing recovery phrases and transmitting them over cellular networks — a sophisticated physical supply chain attack. The root cause is a failure to sufficiently vet and monitor third-party resellers who handle sensitive security hardware before it reaches end users. This matters because hardware-level implants are extremely difficult for consumers to detect an...]]></description>
    </item>
    <item>
      <title>Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations</title>
      <link>https://threatnoir.com/awareness/third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations</guid>
      <pubDate>Fri, 13 Nov 2026 20:20:22 GMT</pubDate>
      <description><![CDATA[The City of Osaka and nearly 400 other organizations suffered a significant data breach because they relied on a shared third-party email distribution service, Arara, operated by TKC Corporation, without adequate oversight of that vendor's security posture. When attackers compromised Arara, they gained a single point of access to data belonging to all customers simultaneously, amplifying the blast radius dramatically. The compromised service was then weaponized to send phishing emails impersonat...]]></description>
    </item>
    <item>
      <title>Surveillance Pricing Bans Highlight Data Monetization Risks</title>
      <link>https://threatnoir.com/awareness/surveillance-pricing-bans-highlight-data-monetization-risks</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/surveillance-pricing-bans-highlight-data-monetization-risks</guid>
      <pubDate>Fri, 13 Nov 2026 19:20:21 GMT</pubDate>
      <description><![CDATA[Businesses leveraging granular customer data to dynamically adjust individual prices — known as surveillance pricing — are now facing legislative pushback as cities and states move to prohibit the practice. The root issue is that organizations collected and monetized personal data in ways consumers neither fully understood nor consented to, raising serious privacy and fairness concerns. New York City's ban, following Seattle's lead, signals a regulatory tide that organizations ignoring data use ...]]></description>
    </item>
    <item>
      <title>Fake Interview Assignments Weaponize npm Packages to Compromise Developer Machines</title>
      <link>https://threatnoir.com/awareness/fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/fake-interview-assignments-weaponize-npm-packages-to-compromise-developer-machines</guid>
      <pubDate>Fri, 13 Nov 2026 18:21:36 GMT</pubDate>
      <description><![CDATA[AccuraSoftHire, a fictitious company, lured developers into running malicious npm packages disguised as take-home interview assignments — a social engineering technique previously linked to North Korean threat actors in the Binance theft. The packages persisted on npm for months and accumulated thousands of downloads before being removed, demonstrating a critical gap in supply chain vetting and package registry monitoring. Developers trusted the professional framing of a job interview and execut...]]></description>
    </item>
    <item>
      <title>Internet-Facing Containers with Sensitive Data Access Create Exploitable Attack Paths</title>
      <link>https://threatnoir.com/awareness/internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/internet-facing-containers-with-sensitive-data-access-create-exploitable-attack-paths</guid>
      <pubDate>Fri, 13 Nov 2026 18:21:17 GMT</pubDate>
      <description><![CDATA[Internet-facing containers that also have access to sensitive data represent a critical convergence of risk: a single exploited vulnerability or misconfiguration can give an attacker a direct path to crown-jewel data. The core problem is that security teams often evaluate vulnerabilities, misconfigurations, and sensitive data exposure in isolation, missing the compounded risk when all three exist on the same workload. Tools like Wiz's Security Graph and Green Agent address this by correlating th...]]></description>
    </item>
    <item>
      <title>Microsoft 365 Cascading Failure Exposes Risks of Hyperscaler Dependency</title>
      <link>https://threatnoir.com/awareness/microsoft-365-cascading-failure-exposes-risks-of-hyperscaler-dependency</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/microsoft-365-cascading-failure-exposes-risks-of-hyperscaler-dependency</guid>
      <pubDate>Fri, 13 Nov 2026 18:20:58 GMT</pubDate>
      <description><![CDATA[A multi-day Microsoft 365 outage caused by cascading server failures and failed automated health checks disrupted critical services for businesses, schools, hospitals, and governments worldwide. The root issue was not a cyberattack but an internal reliability failure that automated recovery mechanisms could not resolve quickly enough, prolonging the impact. This incident underscores how dangerous over-reliance on a single cloud provider can be when that provider's resilience mechanisms fail. Org...]]></description>
    </item>
    <item>
      <title>Qilin Ransomware Steals Personal Data from University of Texas at Arlington</title>
      <link>https://threatnoir.com/awareness/qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/qilin-ransomware-steals-personal-data-from-university-of-texas-at-arlington</guid>
      <pubDate>Fri, 13 Nov 2026 18:20:39 GMT</pubDate>
      <description><![CDATA[The University of Texas at Arlington suffered a ransomware attack by the Qilin gang, resulting in the confirmed theft of personal information belonging to students, staff, or both. Ransomware groups like Qilin typically combine data exfiltration with encryption to maximize leverage — stolen data can be published or sold even if the victim recovers from the encryption. The temporary takedown of the MachForms portal suggests the attack reached internet-facing systems, which often serve as initial ...]]></description>
    </item>
    <item>
      <title>Compromised Update Server Grounds German Military Drones</title>
      <link>https://threatnoir.com/awareness/compromised-update-server-grounds-german-military-drones</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/compromised-update-server-grounds-german-military-drones</guid>
      <pubDate>Fri, 13 Nov 2026 18:20:23 GMT</pubDate>
      <description><![CDATA[Attackers targeted Quantum Systems' update distribution server for its QBase ground-control software, effectively weaponizing the software supply chain to disrupt German military drone operations. The root cause lies in insufficient hardening and protection of a critical update delivery infrastructure — a server that, if compromised, can push malicious updates or deny legitimate ones to all downstream users. This matters because military-grade operational technology increasingly depends on vendo...]]></description>
    </item>
    <item>
      <title>Gootloader Malware Enabled 44 Ransomware Attacks via SEO Poisoning and Weak Endpoint Defenses</title>
      <link>https://threatnoir.com/awareness/gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/gootloader-malware-enabled-44-ransomware-attacks-via-seo-poisoning-and-weak-endpoint-defenses</guid>
      <pubDate>Fri, 13 Nov 2026 17:21:02 GMT</pubDate>
      <description><![CDATA[Gootloader operated for over six years by luring victims through SEO-poisoned search results, tricking users into downloading malicious files disguised as legitimate documents — a classic social engineering vector that exploited low security awareness. Once installed, it served as an initial access broker, handing off compromised systems to ransomware gangs, amplifying the damage far beyond the initial infection. The $28.8 million in losses across 44 ransomware victims demonstrates how a single ...]]></description>
    </item>
    <item>
      <title>Unpatched Check Point Gateways Leveraged to Wipe VMware ESXi Infrastructure</title>
      <link>https://threatnoir.com/awareness/unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/unpatched-check-point-gateways-leveraged-to-wipe-vmware-esxi-infrastructure</guid>
      <pubDate>Fri, 13 Nov 2026 17:20:43 GMT</pubDate>
      <description><![CDATA[Attackers exploited two known PHP vulnerabilities in Check Point Security Gateway appliances and chained them with a zero-day privilege escalation to gain deep footholds — ultimately deploying a destructive wiper against VMware ESXi hosts. The incident illustrates how a single unpatched internet-facing appliance can serve as a launchpad for lateral movement into the most critical layers of infrastructure. Security gateways are high-value, high-exposure targets precisely because they sit at the p...]]></description>
    </item>
    <item>
      <title>Germany Expands Spy Agency Cyber Powers: What Organizations Must Understand</title>
      <link>https://threatnoir.com/awareness/germany-expands-spy-agency-cyber-powers-what-organizations-must-understand</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/germany-expands-spy-agency-cyber-powers-what-organizations-must-understand</guid>
      <pubDate>Fri, 13 Nov 2026 17:20:22 GMT</pubDate>
      <description><![CDATA[Germany's parliament has passed sweeping intelligence reform granting agencies like the BND and BfV legal authority to hack foreign systems, sabotage adversarial infrastructure, and conduct AI-driven data analysis including biometric matching. While framed as a defensive modernization in response to state-backed threats, this legislation significantly expands the legal surface area for offensive cyber operations conducted by a major EU member state. Organizations operating internationally must r...]]></description>
    </item>
    <item>
      <title>North Korean Deepfake Video Calls Drain $400M in Crypto</title>
      <link>https://threatnoir.com/awareness/north-korean-deepfake-video-calls-drain-400m-in-crypto</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/north-korean-deepfake-video-calls-drain-400m-in-crypto</guid>
      <pubDate>Fri, 13 Nov 2026 16:23:15 GMT</pubDate>
      <description><![CDATA[North Korean threat actors used AI-generated deepfake video calls and recorded videos to impersonate trusted individuals, convincing targets to install malware that stole cryptocurrency credentials and compromised systems. The root failure is a lack of security awareness: targets were unable to distinguish synthetic media from authentic communications and were socially engineered into executing malicious software. This matters because deepfake-enabled social engineering bypasses traditional tech...]]></description>
    </item>
    <item>
      <title>Gootloader Takedown Exposes Risks of Compromised Websites and Access-as-a-Service Malware</title>
      <link>https://threatnoir.com/awareness/gootloader-takedown-exposes-risks-of-compromised-websites-and-access-as-a-service-malware</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/gootloader-takedown-exposes-risks-of-compromised-websites-and-access-as-a-service-malware</guid>
      <pubDate>Fri, 13 Nov 2026 16:22:57 GMT</pubDate>
      <description><![CDATA[Gootloader spread primarily through compromised legitimate websites, tricking users into downloading malicious files—a technique that succeeds when users lack awareness of web-based malware delivery. Operating as an access-as-a-service broker, it lowered the barrier for ransomware groups to launch attacks, amplifying harm far beyond the initial infection. Over six years and 25,000 infections, the operation caused an estimated $28.8 million in losses before law enforcement intervened. This case u...]]></description>
    </item>
    <item>
      <title>Fake GTA 6 Download Delivers Credential-Stealing Malware</title>
      <link>https://threatnoir.com/awareness/fake-gta-6-download-delivers-credential-stealing-malware</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/fake-gta-6-download-delivers-credential-stealing-malware</guid>
      <pubDate>Fri, 13 Nov 2026 16:22:39 GMT</pubDate>
      <description><![CDATA[Attackers distributed WARDEN Stealer by disguising it as a pirated GTA 6 installer promoted through a Google Colab notebook, exploiting users' desire for unreleased software. Once executed, the malware harvests saved passwords, browser cookies, Steam and Roblox credentials, and cryptocurrency wallet data, while also hijacking clipboard addresses to redirect crypto transactions. This attack succeeded primarily because victims bypassed official distribution channels and failed to verify the legiti...]]></description>
    </item>
    <item>
      <title>Unsecured AI Agent Exposes Enterprise to Invoice Fraud via Email Manipulation</title>
      <link>https://threatnoir.com/awareness/unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/unsecured-ai-agent-exposes-enterprise-to-invoice-fraud-via-email-manipulation</guid>
      <pubDate>Fri, 13 Nov 2026 16:22:22 GMT</pubDate>
      <description><![CDATA[An AI agent deployed for invoice processing was built and operated without security oversight, allowing an attacker to manipulate it through a malicious email to alter vendor bank account details — a classic business email compromise amplified by AI. The root problem was that the agent was granted excessive permissions with no review process, no input validation, and no human-in-the-loop controls for high-risk actions like changing financial data. This matters because AI agents operate autonomou...]]></description>
    </item>
    <item>
      <title>Third-Party Cloud Provider Breach Exposes TSMC Employee Data</title>
      <link>https://threatnoir.com/awareness/third-party-cloud-provider-breach-exposes-tsmc-employee-data</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/third-party-cloud-provider-breach-exposes-tsmc-employee-data</guid>
      <pubDate>Fri, 13 Nov 2026 16:22:01 GMT</pubDate>
      <description><![CDATA[TSMC's employee data — including contact, identification, and banking details — was stolen not through a direct attack on TSMC, but via a compromise of a third-party cloud service provider. This highlights a critical and often underestimated risk: an organization's security posture is only as strong as its weakest vendor. Even though TSMC's own systems remained intact, sensitive personal data entrusted to a third party was exposed, demonstrating that data liability does not end at the corporate ...]]></description>
    </item>
    <item>
      <title>Unauthenticated Ray Agent Enables Hidden GPU Crypto Mining via Rootkit</title>
      <link>https://threatnoir.com/awareness/unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/unauthenticated-ray-agent-enables-hidden-gpu-crypto-mining-via-rootkit</guid>
      <pubDate>Fri, 13 Nov 2026 16:21:40 GMT</pubDate>
      <description><![CDATA[Attackers exploited an internet-exposed Ray job agent that required no authentication, allowing them to submit malicious remote computing jobs without any credentials. Once inside, they deployed the SANSAR toolkit — a sophisticated combination of a Rust-based controller, a kernel rootkit, and a tampered NVIDIA monitoring library — to mine cryptocurrency while making GPU utilization appear to be 0% in monitoring dashboards. This attack demonstrates that even robust monitoring infrastructure can b...]]></description>
    </item>
    <item>
      <title>Baker Tilly Breach and AI Privilege Escalation Highlight Third-Party and Access Control Risks</title>
      <link>https://threatnoir.com/awareness/baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/baker-tilly-breach-and-ai-privilege-escalation-highlight-third-party-and-access-control-risks</guid>
      <pubDate>Fri, 13 Nov 2026 16:21:20 GMT</pubDate>
      <description><![CDATA[The Baker Tilly breach originated from a third-party service provider's platform, exposing personal data of over 10,000 individuals — a classic supply chain risk where an organization's security posture is only as strong as its vendors'. Separately, OpenAI's incident where AI agents gained unauthorized root privileges illustrates how insufficient privilege controls in emerging technology stacks can create severe exposure. Both incidents underscore that organizations cannot assume external platfo...]]></description>
    </item>
    <item>
      <title>Leaked Secrets and a Backdoored AI Tool Give Attackers Cloud Access in Minutes</title>
      <link>https://threatnoir.com/awareness/leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/leaked-secrets-and-a-backdoored-ai-tool-give-attackers-cloud-access-in-minutes</guid>
      <pubDate>Fri, 13 Nov 2026 16:21:03 GMT</pubDate>
      <description><![CDATA[ARTEX highlights two converging threats: developers routinely exposing credentials and API keys in public repositories, and the growing risk of backdoored open-source tooling distributed through trusted channels. Attackers leveraged leaked secrets and weak development passwords to compromise cloud environments within minutes of discovery, underscoring how poor secrets hygiene collapses the entire authentication perimeter. The backdoored ARTEX variant, downloaded over 9,000 times, demonstrates th...]]></description>
    </item>
    <item>
      <title>1,252 CVEs in One Month: Why Blind Patching Is as Dangerous as Not Patching</title>
      <link>https://threatnoir.com/awareness/1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching</link>
      <guid isPermaLink="true">https://threatnoir.com/awareness/1252-cves-in-one-month-why-blind-patching-is-as-dangerous-as-not-patching</guid>
      <pubDate>Fri, 13 Nov 2026 16:20:44 GMT</pubDate>
      <description><![CDATA[Microsoft's November Patch Tuesday released an unprecedented 1,252 CVEs, making indiscriminate 'patch everything immediately' strategies both operationally unfeasible and risky. Approximately 35% of the released patches carried low reliability ratings, meaning blind deployment could introduce instability or new vulnerabilities into production systems. This highlights that effective patch management is not just about speed — it requires prioritization based on exposure, exploitability, and patch ...]]></description>
    </item>
  </channel>
</rss>