Huntress: compromised camera software used to enter corporate networks
September and October cases show CMS.exe launching a reverse shell and sideloading DLLs through a copied WpcMon.exe.
62
Organization
Huntress
- Mentions · 7d12
- Mentions · 30d81
- All mentions148
- First seenAug 12, 2026
- Last mentioned2d ago
Timeline
148 articles · newest firstHuntress post says attackers turn MDM into remote access
The provided page is mostly site navigation; the article body describing the MDM technique is not included.
22
Camera software used to sideload malware on Windows
Huntress saw a suspected reverse shell and one shared command server across several customers, with no CVE identified.
68
Camera software intrusions drop reverse shells and sideloaded DLLs
Huntress tied September and October cases to one C2 after CMS.exe launched a user-writable reverse shell and relocated WpcMon.exe.
68
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
32
Compromised camera software used to deploy malware, Huntress says
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
64
Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Storm-0940 targeted 2,250 Microsoft 365 tenants with stolen ConnectWise credentials
Microsoft says the ARTEX agent framework drove the campaign; Huntress rates the AI claim lower from its own telemetry.
78
Storm-0940 abused ConnectWise backup credentials in Microsoft 365
Microsoft says more than 2,250 tenants were targeted; Huntress confirmed hundreds of sign-ins but not data theft or ARTEX use.
78
Huntress post looks at a ConnectWise attack
The supplied page is site navigation, so method, victims, and whether a flaw was used are not stated.
28
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
73
Stolen Microsoft 365 sessions replayed at 79 organizations
Huntress counted 497 successful sign-ins and over 200,000 failures from July 14 to September 22, with inbox rules hiding mail.
76
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Token-spraying campaign hits Microsoft 365 accounts for email fraud
Huntress counted at least 200,000 login attempts and 497 successful sign-ins from July to September 2026.
74
M365 token spray and replay campaign hits 79 organizations
Huntress saw 497 successful sign-ins and more than 200,000 failed attempts from July 14 to September 22, 2026.
74
PHP patches two critical unauthenticated RCE flaws
CVE-2026-109618 and CVE-2026-109619 score 9.2; a leaked PoC and reported exploitation attempts followed a broken embargo.
88
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
ClickFix campaign uses Windows finger to install Lumma
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
64
Amazon-themed ClickFix uses finger.exe to deliver stealers
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
66
Leaked PHP2Shell flaws may allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.
80
PHP to ship emergency fixes for two critical RCE flaws rated 9.2
Only branches 8.2 through 8.5 can be patched; affected versions and exploit details remain unconfirmed.
82
ConnectWise Cloud Backup API secret used against Microsoft 365 tenants
Huntress saw malicious sign-ins across almost 1,000 Entra tenants, with more than 300 appearing to succeed.
78
ConnectWise resets Cloud Backup credentials after unauthorized access
Huntress saw vendor-credential sign-ins from 144.172.64.128, then Global Administrator grants and new secrets on two tenants.
78
ConnectWise suspends Cloud Backup after supply-chain credential attack
Huntress saw unauthorized sign-ins in 162 Microsoft 365 tenants after attackers used the backup app’s permissions.
78
Siemens Software Center DLL flaw exploited in Romulus ClickFix attacks
CVE-2026-110936 let attackers side-load DLLs beside a signed Software Center build; version 4.0.9.8 fixes it.
76
ConnectWise suspends Cloud Backup after attackers abuse Microsoft 365 access
Huntress saw the stolen app credential sign into at least 162 Microsoft 365 tenants on October 15; earlier tokens may still work.
78
ConnectWise suspends cloud services after M365 tenant access
Huntress says a Cloud Backup client assertion reached 162 Microsoft 365 tenants on October 15–16.
78
ConnectWise backup credential used to enter Microsoft 365 tenants
Huntress reported suspicious sign-ins across 162 organizations; ConnectWise disabled seven app identities and three cloud services.
76
ConnectWise takes cloud services offline after Microsoft 365 access
Unauthorized access to Cloud Backup application identities was found after October 15; restoration timing and any data theft remain unconfirmed.
78
Stolen ConnectWise app credentials used against Microsoft 365 tenants
Seven application identities were disabled and Cloud Backup suspended; Huntress saw about 300 successful sign-ins.
78
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
ConnectWise suspends Cloud Backup after unauthorized app-identity access
Huntress says a stolen Cloud Backup Microsoft 365 API secret was used in customer tenants.
78
ConnectWise disables cloud apps after Microsoft 365 tenant access
Seven application identities were disabled October 17; Huntress says a later wave against 16 tenants failed.
80
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
Hackers abused ConnectWise Cloud Backup identities to access at least 162 Microsoft 365 tenants.
82
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
78
Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts
Attackers used a stolen ConnectWise Cloud Backup secret to access 173 Microsoft 365 tenants.
85
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
62
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
Huntress says abused ConnectWise Cloud Backup credentials accessed at least 162 Microsoft 365 tenants.
84
Related CVEs
by mentions- CVE-2026-10513482%10.0Unauthenticated OS Command Injection in AhsayCBS
- CVE-2026-10513379%6.9Improper authentication in Ahsay AhsayCBS API
- CVE-2026-8621815%10.0Pre-Auth Static Code Injection RCE in N-able N-central (Exploited in the Wild)
- CVE-2026-86207<1%7.7Authentication bypass in N-able N-central internal APIs before 2026.3 HF 3
- CVE-2026-86206<1%6.9Access Control Filter Bypass in N-able N-central Exposes Internal APIs
- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
Appears with
- Microsoftvendor · 56
- Huntressvendor · 45
- Microsoft 365product · 29
- ConnectWisevendor · 25
- Microsoftorganization · 14
- CISAorganization · 11
- ConnectWise Cloud Backupproduct · 10
- OpenAIorganization · 10
- AhsayCBSproduct · 9
- Windowsproduct · 9
- Microsoft Entra IDproduct · 8
- XMRigmalware · 8
- Ahsayvendor · 8
- Cloud Managementproduct · 8
- Akirathreat actor · 7
- SaaS Securityproduct · 7
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.