Cybersecurity briefing — November 13, 2026.

FBI warns of North Korean fake video calls used to steal cryptocurrency

The FBI says a scheme it calls FaceStealer has stolen more than $400 million in cryptocurrency over 18 months and that it seized recordings of more than 900 victims. Attackers reportedly hijack contacts’ accounts, lure targets into fake Zoom or Teams meetings, then use instructions presented during the call to install malware that can steal credentials and monitor devices. The FBI advises verifying invitations through another channel and not running scripts or commands to fix meeting software.

What changed The group has added deepfakes of prominent crypto figures to its impersonation methods, but recordings of actual victims still dominate the scheme.

Why it matters For open-source maintainers, the damage can extend beyond their own devices: stolen access was used to create malicious dependencies for a widely downloaded JavaScript library, although that attempt was stopped.

Stolen GitHub credentials used to seed secret-stealing malware across repositories

Aikido says a threat actor has pushed a credential-stealing payload into tens of thousands of repositories since November 10, using stolen GitHub credentials. The malware reportedly ran in more than 1,800 repositories and exfiltrated GitHub Actions secrets and cloud credentials. Aikido named the campaign wfx-loot.

Why it matters Affected teams face exposure beyond repository contents: theft of automation secrets and cloud credentials creates a potential route into connected infrastructure. The reported execution count distinguishes confirmed theft from payload placement alone.

Check Point reports in-the-wild exploitation of PHP2Shell and privilege-escalation flaws

Check Point Research says attackers exploited PHP2Shell to gain initial access to Check Point Security Gateways, then used a local privilege-escalation vulnerability to obtain root privileges and establish persistence. The company says it observed compromises of a couple dozen unpatched systems in one region and that fixes had been available since October 23. Check Point says affected customers were notified.

What changed Fixes were available on October 23, one week before the reported attack; attackers subsequently compromised a couple of dozen systems that remained unpatched.