November 9, 2026 Emerging Threats Weekly
This week’s briefing covers:
00:00 – Intro
00:47 [SUPPLY CHAIN] Trojanized Claude Code Extension Exposed Cursor Developers to Persistent SSH Access
Microsoft published a technical analysis after malicious Claude Code extension versions 2.1.312 and 2.1.313 were distributed through Cursor’s marketplace for approximately 11 hours on October 29. Cursor estimated that no more than 5,000 users could have received an affected build. Microsoft confirmed that the Visual Studio Marketplace and official Anthropic npm package were unaffected.
03:52 [AI] Agentic Offensive Frameworks Move from Experimentation into Active Intrusions
Google Threat Intelligence Group and Mandiant reported on October 30 that threat actors are using open-source agentic penetration-testing frameworks during real intrusions. The observed tools included ARTEX, PentAGI, CAIRN and Hexstrike, as well as customized orchestration systems.
08:37 [VULNERABILITY] Ivanti Connect Secure Zero-Day Chain Reached Root on Patched Gateways
CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30, one day after Ivanti expanded its Connect Secure advisory and released fixes for both flaws. The vulnerabilities had been exploited as part of a chain with CVE-2026-104935, an authentication-bypass vulnerability disclosed earlier in October.
11:41 [CAMPAIGN] Refrigeration Controller Attacks Disrupt Retailers Across Europe
Supermarkets and other food businesses across multiple European countries reported refrigeration disruptions on November 2 after attackers remotely changed controller settings. Confirmed or suspected incidents affected locations in Belgium, Sweden, Ireland, Estonia, Luxembourg, the Netherlands, Finland and other countries.
14:52 [CAMPAIGN] TraderTraitor Combined Fake Recruitment and Malicious Developer Tools in Binance Heist
The FBI attributed the theft of more than $6 billion in virtual assets from Binance on or about October 29 to North Korea's TraderTraitor activity. Binance's November 3 incident reporting described a multi-stage operation that developed over several months rather than a single wallet exploit.
Dive deeper:
Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report
Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services
Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto
Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist
Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber
Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports
Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber
#krollcyber #threatintelligence #cyberthreats