GitHub Attack Escalates, Microsoft 365 Outage, New Ransomware & Zero-Day

Supply Chain & Cloud Incidents:

• Massive GitHub Supply Chain Attack Injects 'wfx' Stealer: The 'wfx-loot' campaign has compromised over 4,800 GitHub accounts, impacting 1,835 repositories, including those of major companies and government entities. Attackers are now stealing OIDC tokens and cloud credentials, using new reconnaissance techniques and exfiltrating data via Telegram. The compromise has extended to a Packagist package and a Go module.
• Widespread Microsoft 365 Outage Hits Millions: A global outage on November 12, 2026, disrupted Microsoft 365 services like Outlook, Teams, and Copilot for over 24 hours. The incident, caused by cascading server health check failures, was confirmed as not a cyberattack, with Microsoft working to restore services.
• Belarusian Cloud Provider ActiveCloud Hit by Ransomware: ActiveCloud experienced a significant ransomware attack on November 10, 2026, leading to widespread outages for its customers. The attack encrypted cloud infrastructure, impacting virtual servers, corporate email, and customer support systems for businesses in Belarus and Russia.

Critical Vulnerabilities & New Threats:

• Unpatched 'SignDrop' Windows Zero-Day Allows SYSTEM Privilege Escalation: A newly disclosed zero-day vulnerability, 'SignDrop,' in the Windows Common Log File System (CLFS) allows local attackers to escalate privileges to SYSTEM. The exploit leverages a previously implemented security mitigation, and a proof-of-concept is available for recent Windows versions.
• Critical Flaws in Red Hat Quay Enable Full Registry and Supply Chain Attack: Two critical vulnerabilities (CVE-2026-123710 and CVE-2026-110697) in Red Hat Quay allow for full supply chain compromise by injecting malicious container images. These flaws enable unauthenticated attackers to gain read/write access or low-privileged users to manipulate images across tenants.
• 'Neutrino' Ransomware Discovered Using Double-Extortion Tactics: A new ransomware family, 'Neutrino,' employs double-extortion by encrypting files and exfiltrating sensitive data. Attackers threaten to leak stolen information if the ransom is not paid, increasing pressure on victims.

Advanced Cyber Espionage:

• China-Nexus Group Uses Autonomous AI Framework for Cyber Espionage: A China-nexus threat actor utilized an AI penetration testing framework, Cairn, with large language models to conduct autonomous cyber espionage. Between August and September 2026, the group targeted organizations in the semiconductor, defense, and civil society sectors, automating reconnaissance, exploitation, and data retrieval.