ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Windows Hello for Business

0 mentions in 7 days · 1 in 30 days · 2 total · first seen · last

Search everything

Timeline

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

Huntress · 13d agoPhishing & fraud in the wild1

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker News · Aug 11, 2026VulnerabilityCVE-2026-34348

Related CVEs

  • CVE-2026-343486.5<1%
    Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
    Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
    · microsoft windows 10 1809 · microsoft windows 10 21h2—

Appears with

product Microsoft Entra ID 2organization SpecterOps 1organization Unit 42 1product Chrome 1product Google Password Manager 1product Joomla 1product Microsoft 365 1product Monday.com 1product YubiKey 1vendor Google 1vendor Huntress 1vendor Microsoft 1vendor Palo Alto Networks 1vendor Spur 1vendor Validin 1vendor VirusTotal 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.