ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Falcon Device Control”

79 items

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 19Ransomware 13Exploit / PoC 10Industry 7Vulnerability 7Phishing & fraud 5Policy & legal 5Data breach 4Threat actor 3Advisory 2Tools 1Research 1AI safety & security 1AI tools & infra 1
SeverityAllcritical 33high 28medium 9low 0info 9

Top 10 Best Device Control & USB Security Tools in 2026

A 2026 scorecard ranks ten USB and device control tools, placing Safetica, Ivanti DeviceLock and DriveLock at the top.

The article compares ten device control and USB security tools using a weighted scorecard covering control granularity, platform coverage, DLP integration, operability and value. Safetica, Ivanti DeviceLock and DriveLock rank highest, with notes on cross-platform depth, Windows granularity and European compliance fit. The piece highlights ownership changes, including CoSoSys joining Netwrix and Digital Guardian joining Fortra, and stresses device control as part of Zero Trust and DLP strategies.

Cyber Security News · 6d agoIndustry

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.

Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.

The Hacker Newsupdated · 9d agofirst · 9d agoThreat actor in the wild 2 sources1

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.

Microsoft disclosed a campaign that sent over one million CEO-impersonation scam emails between August 3-5, 2026, targeting U.S. accounts payable departments with fake ServiceNow subscription invoices to induce ACH transfers, using generative AI to tailor templates. A second campaign detected since May 2026 uses passkey/MFA-themed voice phishing posing as the IT help desk, redirecting victims via SMS to counterfeit Microsoft sign-in pages and adversary-in-the-middle or device-code flows to hijack accounts. Post-compromise activity includes adding attacker-controlled authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection via REST APIs. Microsoft attributes initial access to Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (UNC6671, a BlackFile splinter operating the Helix extortion brand).

The Hacker News · 3d agoPhishing & fraud in the wild2

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputerupdated · 4h agofirst · 5d agoPhishing & fraud in the wild 9 sources

Exaforce extends its AI security tool to monitor more than just Claude

Exaforce AI Security extends beyond Claude to monitor OpenAI, Gemini, and Copilot agents using existing SOC telemetry, no new endpoint agents.

Exaforce expanded its June Claude Compliance API integration into Exaforce AI Security, adding monitoring for OpenAI, Gemini, Microsoft Copilot, and OAuth-connected AI apps. The tool inventories AI agents by correlating EDR, cloud, SaaS, and model-provider logs without new gateways or endpoint agents, and can respond by revoking sessions, deactivating API keys, isolating devices, or killing agent processes via existing controls. Analysts note the agentless approach lowers friction but lacks runtime inspection and inline blocking offered by competitors such as Palo Alto Prisma AIRS, SentinelOne Prompt AI Agent Security, and CrowdStrike Falcon Guardian. A March 2026 Cloud Security Alliance survey found 68% of organizations cannot distinguish human from AI-agent activity and 74% report AI agents receive excessive access.

CSO Online · 1d agoTools

Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts

Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.

Microsoft Security Research has tracked the campaign since May 2026: callers posing as IT helpdesk staff tell employees to urgently update passkeys, MFA, or SSO settings via domains such as add-passkey[.]com and contoso[.]add-passkey[.]com. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that yield credentials, session tokens, or OAuth tokens, after which attackers enroll their own MFA methods for persistence and run Microsoft Graph reconnaissance. They then collect SharePoint, OneDrive, and sometimes Exchange Online data at deliberately low rates (often under 1,000 files or messages per hour), with python-httpx seen in high-volume file access. Microsoft attributes initial access tradecraft to Storm-3121 and Storm-3032, linked respectively to ShinyHunters/Falcon and BlackFile/Helix extortion operations.

GBHackersupdated · 4h agofirst · 6d agoPhishing & fraud in the wild 9 sources1

Top 10 Best Server Security Solutions in 2026

Cyber Security News ranks 2026 server security platforms, favoring Trend Micro for hybrid estates, CrowdStrike for detection, Defender for Azure economics.

Cyber Security News published an editorial ranking of ten server security platforms for 2026, favoring Trend Micro for hybrid estates, CrowdStrike for detection quality, and Microsoft Defender for Servers for Azure-centric economics. The guide stresses that server security licensing differs (per server, per core, or per cloud-hour) and flags hypervisor protection as a commonly missed coverage gap.

Cyber Security News · 6d agoIndustry1

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News · 12d agoPolicy & legal