CISO Daily Briefing – November 14, 2026

Executive Summary

North Korea’s FaceStealer campaign turns hijacked contacts and stolen webcam video into fake meetings that spread like a worm. The FBI ties it to $400M+ in theft, so verify video-call requests out of band now. Microsoft shows that poisoned fine-tuning data can backdoor coding agents beyond the reach of prompt filters, and the Mior and Skyfall attacks break AMD SEV-SNP attestation, the trust anchor for confidential AI. A 24-hour Microsoft 365 outage took down Copilot and Defender XDR together, and Singapore’s personal-agent advisory leaves bring-your-own-agent policy to employers.

FaceStealer: Deepfake Meetings as an Intrusion Worm

CRITICAL

North Korean operators hijack trusted contacts’ accounts, stage fake Zoom/Teams calls with stolen webcam video and deepfakes, then trick victims into running malware. FBI links it to $400M+ in theft.

Each victim’s accounts and recorded video become the lure for the next
ClickFix “audio fix” is user-executed — bypasses exploit defenses
Require out-of-band verification; block look-alike meeting domains

Trained to Betray: Backdoored Coding Agents

HIGH

Microsoft shows that poisoning ~1% of fine-tuning data or a shared open-weight checkpoint makes coding agents misuse shell tools on benign triggers — 78% to 95% success, transferring across harnesses.

Backdoor lives in weights — prompt-injection filters won’t see it
Poisoned models still score well on benchmarks
Enforce tool policy at the execution boundary, outside the model

Mior & Skyfall Break AMD SEV-SNP Attestation

HIGH

Two new attacks let a malicious cloud host read (and with Mior, write) confidential VM memory and forge attestation — undermining the trust anchor behind “confidential AI” inference.

Mior: 1,000/1,000 success; forges launch measurements
Fixes are host-side firmware/BIOS — tenants can’t patch
Reject attestations below the fixed TCB version

M365 Outage: Copilot and Defender Fail Together

HIGH

Incident MO1550821 degraded Exchange, Teams, SharePoint, Copilot and Defender XDR at once, so many organizations lost their AI assistant and security visibility in the same window.

Productivity, AI and SOC tooling shared one failure domain
Admin center and service notices were also impaired
Root cause still preliminary; no final post-incident review

Singapore’s Personal AI Agent Baseline and BYOA

MEDIUM

A joint CSA Singapore/GovTech/IMDA advisory sets a government baseline for personal AI agents and tells users to ask their employer before connecting work accounts.

Least access, one-time approvals, no passwords/OTPs to agents
Users stay liable for agent actions
Most enterprises have no bring-your-own-agent policy

Overnight Research Output

FaceStealer: Deepfake Video Meetings as a Self-Propagating Intrusion Chain

CRITICAL URGENCY

Summary: On November 12 the FBI (FLASH AC-111226-MS) and the Justice Department disclosed FaceStealer, a BlueNoroff/UNC1069 operation tied to more than $400 million in cryptocurrency theft. Attackers use hijacked Telegram, LinkedIn, Slack and Discord accounts to invite contacts to imposter meetings on typosquatted domains, play genuine stolen webcam footage (AI deepfakes are an emerging supplement), and deliver a ClickFix-style “audio fix”. The FBI seized 900+ victim recordings and reports a near-miss against a major JavaScript library maintainer. Dwell time before theft can exceed a year.

Key Sources:

FBI — FaceStealer Cryptocurrency Theft Scheme

The Hacker News — FBI Says North Korean Hackers Stole $400M+

The Record — DOJ seizure and FaceStealer takedown

Arctic Wolf Labs — Still in the Meeting: BlueNoroff Six Months On

Why This Matters: Video-call identity is now a frontline control for every organization, not just crypto firms. Mandate out-of-band verification for meeting-driven requests, restrict meeting links to approved domains, detect paste-and-run execution, and treat any confirmed exposure as persistent access with stolen secrets.

Read Full Research Note

Trained to Betray: Post-Training Supply Chain Backdoors in Coding Agents

HIGH URGENCY

Summary: Microsoft Security Research and the AI Red Team found that 90 poisoned conversations in a ~9,000-sample fine-tuning set produced unsafe tool calls in about 78% of trials, triggered by ordinary requests such as “create project documentation.” Poisoned open-weight checkpoints reached 84.1%–94.8% success on unseen repositories, and the companion Kerkoporta paper reports up to 96.2%. A short RL phase restores coding utility while leaving the backdoor intact, and downstream fine-tuning weakens but does not reliably remove it.

Key Sources:

Microsoft Security Blog — Trained to Betray

arXiv — Kerkoporta: Structured-Output Backdoors in Reasoning Coding Agents

arXiv — Backdoor Persistency in LLM Agent Post-Training

Why This Matters: Teams fine-tuning their own coding agents or adopting community checkpoints cannot prove a model is clean. Require dataset and checkpoint provenance, but rely on least-privilege tools, sandboxing, approval gates and full tool-call logging as the primary control.

Read Full Research Note

Mior and Skyfall: Malicious Hosts Break AMD SEV-SNP Confidential VMs

HIGH URGENCY

Summary: ETH Zurich and Google researchers disclosed two independent SEV-SNP attacks that need no physical access. Mior (CVE-2026-0462, AMD-SB-3059) gives a hypervisor arbitrary read/write to confidential VM memory and lets a malicious guest present a benign launch measurement. Skyfall (CVE-2026-40671, AMD-SB-3061) leaks register state through VMRUN error handling and recovered a disk-encryption key. AMD platform fixes target November and December 2026 and reach customers via OEM BIOS updates, leaving a patch-lag window.

Key Sources:

The Hacker News — New Mior and Skyfall Attacks

ETH Zurich — Mior: Breaking AMD SEV-SNP with Device-as-Memory (CCS ’26)

ETH Zurich & Google — SKYFALL paper

Why This Matters: Confidential GPU inference anchors on a CPU confidential VM. On unpatched hosts, both the AI workload and the attestation evidence used to release keys are untrustworthy. Ask providers for firmware timelines and tighten attestation policy to the fixed TCB.

Read Full Research Note

When the Assistant and the Alarm Go Dark Together: M365 Outage Lessons

HIGH URGENCY

Summary: Starting November 12, a capacity failure in Exchange Online cascaded into a worldwide Microsoft 365 incident affecting Outlook, Teams, SharePoint, Microsoft 365 Copilot and Defender XDR, with Defender for Office 365, Purview and Intune also reported (BleepingComputer). Microsoft attributed it to servers failing health checks and overloading the remainder, with no indication of malicious activity. Recovery ran past 24 hours. Organizations that consolidated AI, collaboration and detection in one tenant lost all three together.

Key Sources:

BleepingComputer — Massive Microsoft 365 outage disrupts Outlook, Teams, Copilot

Control Plane — What Caused the Microsoft 365 Outage

ENISA — How Dependencies Weaken Our Digital Resilience

Why This Matters: Map shared dependencies rather than vendors. Plan for the detection plane failing alongside the systems it protects, test out-of-band communications, define degraded-mode behavior for AI agents, and fold the event into DORA/NIS2-style concentration assessments.

View Full Research Note

Governments Set a Baseline for Personal AI Agents: Singapore and the BYOA Gap

MEDIUM URGENCY

Summary: The 6 November joint advisory AD-2026-015 recommends limiting agent access, keeping consequential actions under one-time approval, understanding data and memory use, defending against hidden instructions, and planning for compromise. It states users remain responsible for what their agents do. Personal agents reach corporate SaaS through ordinary OAuth consent and saved credentials, usually invisible to admin consoles, and CSA survey data shows 82% of organizations already found unknown agents in the past year.

Key Sources:

Cyber Security Agency of Singapore — Advisory AD-2026-015

MediaNama — Singapore urges users to limit AI agents’ account access

IMDA — Model AI Governance Framework for Agentic AI

Why This Matters: Regulators are pushing the work-account decision back to employers. Publish a personal-agent policy, inventory OAuth grants and tokens held by agents, and require sanctioned agents to be identifiable, scoped and revocable.

View Full Research Note

Notable News & Signals

SignDrop: Unpatched Windows CLFS Zero-Day Exploit Published

A public exploit released on Patch Tuesday lets a standard user reach SYSTEM via CLFS and potentially disable EDR; November updates do not fix it.

Source: Daily Security Review

PHP2Shell Exploitation Continues

Exploitation of CVE-2026-109618/109619 is confirmed in the wild, including chaining into PAN-OS firewall attacks; reliability varies by deployment, so prioritize patching exposed PHP.

Source: BleepingComputer

UnrealIRCd CVE-2026-114713 Under Active Attack

Maintainers report exploitation of a labeled-response escaping flaw that lets ordinary users run IRCOp commands; upgrade to 6.2.7.1.

Source: SecurityOnline

Implanted Trezor Wallets Sold via CryptoBilis

Trezor urges buyers from reseller CryptoBilis since March 2026 to move funds to a new seed after a reported cellular implant, following a similar Ledger case.

Source: Trezor

Topics Already Covered (No New Action Required)

Cairn / CL-STA-1238 autonomous intrusions (Unit 42): “Fifty Dollars per Breach,” “Agentic Intrusion Goes Retail,” “State-Level Tempo for Everyone” and the 13 Nov Frontier Ready brief
AntiFox AWS credential theft: “AntiFox in the Wild” (12 Nov)
wfx-loot: 4,800 hijacked GitHub accounts: “The wfx Campaign” (12 Nov)
Apache HTTP Server HTTP/2 RCE: CVE-2026-119618 note (12 Nov)
N-central “4EverAble2Shell” zero-days: “Able2Shell” (10 Nov)
SCKit / ScreenConnect MSP attacks: “SCKit and Rogue ScreenConnect Clients” (13 Nov)
ARTEX AI red-teaming tools: ARTEX notes (6 Nov)
Agent Name Service (Linux Foundation): “Anchoring Agent Identity in DNS”
OCC Bulletin 2026-54 agentic AI examiner framework: Covered 13 Nov
EU AI Act Article 50 watermarking: Covered 29 Jul and 21 Sep
ENISA State of Cybersecurity / CRA reporting platform: Covered 10 Nov

← Back to Research Index