2026 ranking places Exabeam first among nine UEBA platforms
The editorial list scores nine vendors, not ten, after the Exabeam–LogRhythm merger, with no lab testing.
18
Product
Microsoft Entra
- Mentions · 7d4
- Mentions · 30d10
- All mentions18
- First seenAug 18, 2026
- Last mentioned1d ago
Timeline
18 articles · newest firstStolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Token replay gave attackers Microsoft 365 access at 79 organizations
Huntress logged 497 successful sign-ins and over 200,000 failures from July 14 to September 22, 2026.
74
Microsoft 365 token-replay campaign hit 97 accounts at 79 organizations
Huntress logged 497 successful sign-ins and 48 rogue Entra devices between July 14 and September 22, 2026.
73
Hackers Use ConnectWise SkyKick Credentials to Access Microsoft 365, Halting Cloud Backups
Stolen ConnectWise Cloud Backup credentials accessed 162 Microsoft 365 tenants, forcing ConnectWise to halt backups.
78
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
Attackers used a compromised ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 tenants.
80
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Social Engineering Detection Moves Into the Live Conversation
Netarx launches live-conversation detection that rates callers green, amber, or red to catch deepfake social engineering.
30
Midnight Blizzard Uses Captive Portals to Deliver CornFlake RAT and Steal Traveler Credentials
Midnight Blizzard's Storm-2945 resumed hotel captive-portal attacks that deliver CornFlake and steal traveler credentials.
78
Microsoft Enables Windows 11 Backup Setting by Default for Organizations
Microsoft enables Windows 11 26H2 settings backup by default when the policy is left unconfigured.
44
Microsoft enables Windows settings backup by default for orgs
Microsoft now enables Windows settings backup by default on eligible Entra-joined Windows 11 26H2 devices.
31
TrustSink Attack Uses Rogue MFA Provider to Steal Microsoft Entra Passwords During Legitimate Logins
Varonis disclosed TrustSink, a post-compromise Entra technique that steals passwords via a rogue MFA provider.
62
Microsoft Entra TrustSink Attack Uses Rogue MFA Provider to Steal Passwords
Varonis disclosed TrustSink, a post-compromise Entra technique using a rogue MFA provider to steal passwords.
62
16-Year-Old Researcher Discovers Microsoft Authentication Bug Exposing 17.3 Trillion Records
A teenage researcher found Microsoft Titan accepted unsigned JWTs, enabling admin SQL against huge internal analytics stores.
64
What’s new in Microsoft Security: September 2026
Microsoft Security updates address AI agent governance, Zero Trust, and SOC foundation improvements with new data protection and management tools.
10
Microsoft integrates SOC capabilities with Defender for enterprises
Microsoft is previewing Defender ISOC, bundling SIEM into Microsoft 365 E5 and E7 without an extra license.
62
Top 10 Best Passwordless Authentication Solutions in 2026 [Ranked & Scored]
A 2026 ranking names Microsoft the top passwordless authentication option, ahead of Okta FastPass and Yubico.
20
Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)
Unit 42 reports actor TheHatman claims large-scale theft of Microsoft Entra credentials and provides mitigation guidance for credential attacks.
58
Appears with
- Microsoftvendor · 18
- Microsoft 365product · 7
- Microsoftorganization · 6
- Huntressorganization · 5
- Microsoft Graphproduct · 5
- Microsoft Defenderproduct · 3
- 1337 Services GmbHorganization · 3
- Midnight Blizzardthreat actor · 2
- Windows 11product · 2
- Microsoft Intuneproduct · 2
- Varonisorganization · 2
- CornFlakemalware · 2
- Exchange Onlineproduct · 2
- ChocoShellmalware · 2
- Storm-2945threat actor · 2
- Microsoft Sentinelproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.