Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
72
Product
SharePoint
- Mentions · 7d4
- Mentions · 30d17
- All mentions51
- First seenAug 11, 2026
- Last mentioned2d ago
Timeline
51 articles · newest firstStorm-2603 disabled security tools before deploying Warlock
Researchers say the group hit a water utility, a telecom, a regional government and a university after SharePoint access.
74
2026 buyer’s guide ranks 12 secure file-sharing platforms
The guide scores Microsoft, Egnyte, Box, Nextcloud, Kiteworks and others on governance, encryption and deployment, not on a new incident.
18
Stolen login tokens used to hijack Microsoft 365 accounts at 79 organizations
Huntress counted 497 successful sign-ins and more than 200,000 failures from July 14 to September 22, 2026.
74
Box tops a 2026 ranking of secure file-sharing platforms
The editorial list scores ten vendors on governance, usability, encryption, compliance evidence and pricing, with no lab testing.
18
Microsoft Patches Two Dozen RCE Flaws in Office
Microsoft patched about two dozen high-severity Office remote-code-execution flaws, none known exploited.
74
Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.
80
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
82
October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days
Microsoft's October 2026 Patch Tuesday fixes 1,413 flaws, including an exploited Windows Shell zero-day.
88
October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days
Microsoft's October Patch Tuesday fixes 1,407 CVEs, including an exploited Windows Shell Mark-of-the-Web bypass.
84
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft's October 2026 Patch Tuesday fixes 1,415 flaws, including 85 critical, with one Windows Shell bug exploited in the wild.
76
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
28
Cohere pitches North 2 as the enterprise AI control room that works with any model
Cohere pitches North 2 as a model-agnostic control room for enterprise AI agents with human approval.
48
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold's free Community Edition IGA tool adds Microsoft 365 sharing reviews and identity event auditing.
16
Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
Warlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
80
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Proofpoint says UNK_CondorFiltration password-sprayed 5,700 Microsoft 365 accounts and breached seven MFA-less service accounts in Chile.
74
How US SOCs and MSSPs Can Use Threat Intelligence to Detect Phishing Infrastructure Earlier
ANY.RUN says OAuth device-code phishing jumped 483.7% in H1 2026.
46
CISA Warns of Microsoft SharePoint Code Injection Vulnerability Exploited in Attacks
CISA added actively exploited SharePoint code-injection flaw CVE-2026-65660 to the KEV catalog, with federal fixes due September 28.
82
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
Attackers are exploiting patched Microsoft SharePoint flaw CVE-2026-65660, which CISA added to KEV.
82
SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild
CISA listed actively exploited SharePoint RCE and MikroTik RouterOS flaws in the KEV catalog.
88
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited SharePoint and MikroTik RouterOS flaws to the Known Exploited Vulnerabilities catalog.
80
Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws
Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.
60
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)
WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.
80
Secure enterprise sharing with access reviews for Microsoft 365
tenfold-sponsored article warns Microsoft 365 file sharing often outlives its purpose and pitches its identity governance platform for access reviews.
12
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
58
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
78
Most Organizations Skip Permissions Reviews Before Deploying AI Tools
Syskit survey of 327 US/UK IT leaders finds 76% deployed M365 AI tools but only 43% reviewed permissions and oversharing risk first.
38
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
66
Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
72
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
76
New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs
ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.
56
September 2026 Patch Tuesday forecast: All we need is more time
September 2026 Patch Tuesday forecast expects record CVE volume after August's 398 fixes, with SharePoint flaws CVE-2026-55040 and CVE-2026-63520 actively exploited.
45
Microsoft’s Biggest Patch Tuesday: 974 CVEs, 2 Zero-Days and 20 Wormable Bugs
Microsoft's record September 2026 Patch Tuesday fixes 974 CVEs, including two exploited Windows privilege-escalation zero-days and 20 wormable bugs.
88
Microsoft Patches Record 974 Vulnerabilities, Including Two Exploited Zero-Days
Microsoft's September 2026 Patch Tuesday fixes a record 974 CVEs, including two Windows zero-days exploited in the wild for privilege escalation.
85
Microsoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days
Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.
88
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
60
IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
68
Related CVEs
by mentions- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-656608%8.8Authenticated Code Injection RCE in Microsoft SharePoint Server
- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2026-635203%8.1Unauthenticated RCE in Microsoft SharePoint Server
- CVE-2026-505223%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-628151%9.8Use-after-free RCE in Microsoft MsQuic via crafted network packets
- CVE-2026-628781%9.8Unauthenticated Stack Buffer Overflow RCE in Windows DNS (CVE-2026-62878)
- CVE-2026-561641%9.8Missing Authentication in Microsoft SharePoint Server Allows Privilege Escalation
Appears with
- Microsoftvendor · 48
- OneDriveproduct · 21
- Microsoftorganization · 20
- Microsoft 365product · 18
- Googlevendor · 8
- Windowsproduct · 8
- Exchange Serverproduct · 7
- CISAorganization · 6
- Microsoft Graphproduct · 6
- Exchange Onlineproduct · 5
- Microsoft Teamsproduct · 5
- Rapid7vendor · 4
- Azureproduct · 4
- Exchangeproduct · 4
- Entra IDproduct · 4
- Googleorganization · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.