CVE-2025-59528

Multiple active threat campaigns were observed in November 2026, including North Korean actors laundering $640 million stolen from Binance through complex blockchain transactions and meme coins. Microsoft reported a surge in GSocket backdoor usage on Linux servers, enabling persistent access via public relay networks. Falcon browser-based spyware, linked to PeckBirdy, was used to steal credentials and session data from government webmail portals in the Middle East and Southeast Asia. A new ransomware group, Citrus, leveraged AI-generated scripts and contractor access to deploy Sn00py-family ransomware. Additionally, Proofpoint identified BluePhishing, a new OAuth abuse technique targeting Microsoft Entra AI agent consent. RevStealer malware expanded its distribution through over 100 domains and trojanized AI tools, stealing credentials and cryptocurrency data.