Search: “Microsoft Entra”

Microsoft patches critical Entra ID vulnerability (CVE-2026-69836)

Microsoft patched critical Entra ID RCE CVE-2026-69836 (CVSS 10.0), fully mitigated server-side with no customer action; no in-the-wild exploitation confirmed.

Microsoft patched CVE-2026-69836, a critical (maximum CVSS 10.0) unauthenticated remote code execution flaw in Entra ID caused by deserialization of untrusted data over a network. Entra ID, formerly Azure Active Directory, is Microsoft's cloud identity service verifying logins and controlling access to Microsoft 365, Azure, and connected third-party apps. The flaw was discovered by Microsoft Principal Security Engineer Robert Fitzpatrick and fully mitigated server-side, requiring no customer action. Microsoft initially reported the bug as exploited, but later changed the status to 'no' and confirmed the vulnerability was not exploited in the wild.

Help Net Security·Aug 24, 06:16 UTC · 23d agoVulnerabilityCVE-2026-69836

GhostCode Abuses Microsoft Entra Device Enrollment to Maintain Access After Token Revocation

eSentire exposes GhostCode, a device-code phishing kit that abuses Microsoft Entra device enrollment to persist even after stolen tokens are revoked.

eSentire's Threat Response Unit observed GhostCode campaigns in late August 2026, using BEC-style social engineering that impersonated procurement staff, including BJ's Wholesale Club, via Salesforce contact forms. Victims received password-protected HTML lures disguised as a FlipBook document portal, with junk-data padding, HTML comment injection, and AES-256-GCM encrypted redirects gated by anti-bot checks. The kit exploits the OAuth 2.0 device authorization grant, prompting victims to approve real Microsoft device-code sign-ins with MFA. Within 78 seconds of approval, attackers registered three Entra devices and obtained a Primary Refresh Token, so rogue device registrations persist even after session token revocation.

GBHackers·13:41 UTC · 7h agoPhishing & fraud in the wild

Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution

Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.

Microsoft disclosed CVE-2026-69836, a CVSS 10.0 remote code execution flaw in Entra ID caused by deserialization of untrusted data, and said the issue was fully mitigated on the service side with no customer action required. The security bulletin initially marked the flaw as exploited, but Microsoft corrected the status to not exploited in the wild on August 21, 2026. Microsoft credited principal security engineer Robert Fitzpatrick with the discovery. The article also recalls the Lazarus Group's exploitation of Windows WinSock AFD zero-day CVE-2026-68820 (CVSS 7.0) in the Operation Dream Job campaign.

The Hacker News·Aug 21, 19:56 UTC · 26d agoVulnerabilityCVE-2026-69836CVE-2026-688201

Microsoft Entra ID is removing an extra MFA hurdle for Windows Hello and macOS PSSO users

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Phishing & fraud1

Microsoft security advisory – September 2026 monthly rollup (AV26-896) – Update 1

Canada's Cyber Centre relays Microsoft's September 2026 rollup; CISA added exploited zero-days CVE-2026-85880 and CVE-2026-81963 to KEV.

Advisory AV26-896 from the Canadian Centre for Cyber Security summarizes Microsoft's September 2026 monthly security rollup, listing affected products across Windows, Office, .NET, Azure, Exchange and SQL Server. It notes Microsoft confirmed CVE-2026-81963 and CVE-2026-85880 have been exploited. On September 8, 2026, CISA added both CVEs to its Known Exploited Vulnerabilities catalog, and administrators are urged to apply the updates.

Canadian Centre for Cyber Security·Sep 8, 19:03 UTC · 8d agoAdvisory in the wildCVE-2026-81963CVE-2026-858801

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Microsoft links ShinyHunters- and Helix-affiliated actors to passkey-themed vishing and device-code phishing that compromises Microsoft 365 accounts and steals cloud data.

Microsoft attributes passkey- and SSO-themed social engineering activity, observed since May 2026, to Storm-3121 (linked to ShinyHunters and Falcon) and Storm-3032 (tied to BlackFile members now operating as Helix). Attackers impersonate corporate IT help desks by phone or SMS, urging fake passkey, MFA, or SSO updates and directing victims to adversary-in-the-middle phishing pages or device-code authentication flows that yield credentials, session tokens, and OAuth tokens. Post-compromise behavior includes Microsoft Graph enumeration of users, SharePoint, and OAuth grants, plus persistence via attacker-controlled MFA methods. Google Threat Intelligence tracks related activity as UNC6671, linked to the BlackFile, Helix, Falcon, Pink, and Redact extortion gangs.

BleepingComputer·updated 14:54 UTC · 6h ago·first Sep 11, 17:26 UTC · 5d agoPhishing & fraud in the wild 9 sources

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker News·Aug 11, 12:45 UTC · Aug 11, 2026VulnerabilityCVE-2026-34348

Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 18)

Unit 42 reports actor TheHatman claims large-scale theft of Microsoft Entra credentials and provides mitigation guidance for credential attacks.

Palo Alto Networks Unit 42 published an updated threat brief on mitigating large-scale credential attacks. In August 2026, the actor TheHatman claimed to have stolen a large volume of credentials from organizations' Microsoft Entra tenants. The brief outlines defensive guidance for organizations facing large-scale credential attacks. The theft claims originate from the actor and the post focuses on mitigation steps.

Palo Alto Unit 42·Aug 18, 19:05 UTC · 29d agoThreat actor in the wild

12 Best CIEM Tools Compared (2026): Features & Pricing

Buyer's guide compares twelve CIEM tools; Microsoft discontinued Entra Permissions Management, while Tenable (Ermetic), CyberArk, and Wiz lead the 2026 scorecard.

The scorecard evaluates twelve cloud infrastructure entitlement management vendors on permission analytics depth, JIT enforcement, non-human identity coverage, pricing predictability, and bundle leverage. Tenable (Ermetic) leads at 4.70, followed by CyberArk and Wiz, while Microsoft's retirement of Entra Permissions Management (CloudKnox) forces existing customers into migration cycles. Pricing structures span per-identity, per-resource, per-workload, credit-based, and quote-based models.

GBHackers·updated 09:52 UTC · 11h ago·first 07:37 UTC · 13h agoIndustry 14 sources

Jenkins Security Advisory 2026-09-02

Jenkins releases a security advisory affecting Jenkins Core, update-center2, and 17 plugins including GitLab, SAML, LDAP, Microsoft Entra ID, and Script Security.

Jenkins published its September 2, 2026 security advisory covering Jenkins Core, the update-center2 tool, and 17 plugins, including widely deployed ones such as GitLab, SAML, LDAP, Microsoft Entra ID, Script Security, SonarQube Scanner, and Pipeline: Groovy Libraries. The announcement text does not include CVE identifiers, affected version ranges, or any statement about active exploitation. Jenkins plugin advisories typically bundle fixes for issues like stored XSS, CSRF, and missing permission checks. Administrators running any of the listed components should update them via the Jenkins update center.

Jenkins Security Advisories·Sep 2, 12:00 UTC · 14d agoAdvisory1

ZDI-26-629: Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

Zero Day Initiative disclosed an unauthenticated information disclosure vulnerability (CVSS 5.8) in Microsoft Azure Entra ID's OAuth device code grant flow.

ZDI published advisory ZDI-26-629 describing an information disclosure vulnerability in Microsoft Azure Entra ID related to the OAuth device code grant. Remote attackers can disclose sensitive information without authentication. ZDI assigned a CVSS 3.1 score of 5.8; no CVE identifier is listed in the advisory text.

ZDI Published Advisories·Sep 9, 05:00 UTC · 7d agoAdvisory1

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.

Google Threat Intelligence Group detailed three suspected Russian espionage clusters, UNC6293, UNC7005 (Storm-2945), and UNC5976, targeting academia, aerospace, defense, governments, and think tanks in Europe, the US, Ukraine, and Armenia. UNC6293, assessed as a sub-cluster of APT29/Ice Relic, conducted OAuth and application-specific password phishing while impersonating State Department officials. UNC5976 registered file-sharing-themed domains hosting fake OAuth login pages and deployed a malicious Excel plugin codenamed HEADRUSH, while UNC7005 abused WhatsApp device linking to hijack accounts and record victims' audio and video.

The Hacker News·Aug 21, 14:54 UTC · 26d agoThreat actor in the wild

Product showcase: Enpass Password Manager breaks away from the proprietary cloud model

Help Net Security·Aug 10, 00:00 UTC · Aug 10, 2026Industry

Week in review: Salesforce and ServiceNow portals exposed for 17 months, exploited Metabase 0-day

Weekly digest: exploited Metabase zero-day breached Framework; Salesforce/ServiceNow portals read for 17 months; Microsoft patched 400+ flaws.

Help Net Security's week in review aggregates top stories: a 'City-Forum' campaign tracked by Reco has been pulling records from Salesforce and ServiceNow portals worldwide for 17 months, and Framework suffered a breach via an exploited Metabase zero-day exposing customer contact and IP data. It also covers Microsoft's August 2026 Patch Tuesday fixing 400+ flaws including exploited zero-day CVE-2026-68820, Cisco's fix for exploited firewall DoS bug CVE-2026-20349 (added to CISA KEV), and a second N-able N-central hotfix for actively exploited CVE-2026-18577. Other items include GitHub expanding Dependabot malware alerts to eight package ecosystems and EU AI Act enforcement beginning on 2 August 2026.

Help Net Security·Aug 16, 00:00 UTC · Aug 16, 2026Industry in the wildCVE-2026-18577CVE-2026-68820CVE-2026-203491

Microsoft Patch Tuesday, September 2026 Security Update Review

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, including 113 critical and two actively exploited Windows privilege escalation flaws.

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities, its largest release ever, including 113 critical and 860 important, covering Windows HTTP.sys, Hyper-V, Entra ID, Exchange Server, Office, DNS, and more. Two zero-days are confirmed exploited in the wild: CVE-2026-81963 (Windows Update Stack EoP) and CVE-2026-85880 (ALPC heap overflow), both letting authenticated attackers gain SYSTEM privileges. Notable criticals include an Entra ID authentication bypass (CVE-2026-62916) and multiple Windows DNS Server and Office remote code execution flaws.

Qualys ThreatPROTECT·Sep 9, 12:23 UTC · 7d agoVulnerability in the wildCVE-2026-81963CVE-2026-85880CVE-2026-58599+27 CVEs

The September 2026 Security Update Review

ZDI's September 2026 Microsoft update review lists two already-exploited Windows EoP zero-days and dozens of critical RCEs across Office, SQL Server, and Windows services.

The review catalogs Microsoft's September 2026 fixes, marking CVE-2026-85880 (Windows ALPC) and CVE-2026-81963 (Windows Update Stack) as already exploited elevation-of-privilege issues. It also lists critical RCE flaws in Office, Word, Excel, PowerPoint, Outlook, SQL Server, Windows DNS, DHCP and Failover Cluster, plus graphics component RCEs. Azure-side fixes include Entra ID, Copilot Studio, Azure AI Language and Azure AD B2C elevation-of-privilege flaws.

Zero Day Initiative Blog·Sep 8, 18:32 UTC · 8d agoAdvisory in the wildCVE-2026-85880CVE-2026-81963CVE-2026-70352+27 CVEs1

The 12 Best Endpoint Detection & Response (EDR) Solutions, Compared and Priced

An editorial scorecard ranks 12 EDR platforms, with CrowdStrike and SentinelOne tied at 8.6/10 and telemetry retention identified as the hidden cost driver.

An editorial comparison scores twelve EDR platforms on detection, response, analyst burden, pricing transparency, and coverage. CrowdStrike and SentinelOne tie at 8.6/10, with Microsoft Defender for Endpoint close behind at 8.5 and described as effectively free in Microsoft 365 E5 estates. The guide argues that telemetry retention, not per-endpoint price, drives real cost, with fully-priced quotes frequently diverging 2-3x from headline rates. Managed detection offerings, including Cynet's bundled 24/7 SOC, factor into the buyer-fit rankings.

GBHackers·Sep 9, 07:46 UTC · 7d agoIndustry 2 sources

Impersonating IT support: how threat actors turn a remote session into enterprise-wide access

Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.

Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.

Microsoft Security Blog·Sep 2, 22:51 UTC · 13d agoThreat actor in the wild

Brinqa acquires PlexTrac to bring validated remediation to exposure management

Brinqa acquired PlexTrac to add pentest-driven validation of remediation, claiming the largest standalone unified exposure management vendor with 3,000+ customers.

Brinqa acquired PlexTrac to add offensive-security-driven validation that remediation actually worked, aiming to close the continuous threat exposure management loop from prioritization through verified fixes. Brinqa says the combination makes it the largest standalone vendor in unified exposure management, serving more than 3,000 customers across 57 countries, with PlexTrac continuing as a standalone product. Brinqa cited 164% year-over-year new-bookings growth in 2025 and inclusion in Gartner's inaugural Magic Quadrant for Exposure Assessment Platforms.

Help Net Security·Aug 19, 00:00 UTC · 28d agoIndustry

Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic

Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.

Kaspersky reported new components in the Cavern (Cav3rn) C2 framework, used by Iranian MOIS-affiliated Cavern Manticore (with overlaps to MuddyWater and OilRig's Lyceum) against Israeli entities, monitored since December 2025. The new GoogleService.dll module performs DNS A-record queries to choose between direct HTTPS and a Google Apps Script relay per transaction, with the DNS infrastructure able to rotate the Google deployment ID; Kaspersky also found an inter-component broker (rnp.dll) and linked the framework's plugin-based pivot to late April 2026. Separately, Group-IB and Kaspersky detailed HOLLOWGRAPH, a .NET NativeAOT DLL first seen in the wild June 7, 2026, that uses Microsoft 365 calendar events via the Graph API as two-way dead drops dated May 13, 2050, with DNS tunneling refreshing Entra ID credentials. DarkAtlas also reported APT42's TAMECAT modular surveillance framework delivered via LNK masquerading as PDFs in spear-phishing targeting the nuclear energy sector in April-May 2026, with the group using generative AI to accelerate operations.

The Hacker News·Aug 18, 12:12 UTC · 29d agoThreat actor

Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data

Microsoft details two campaigns: million-email CEO impersonation ACH fraud and passkey-themed vishing that hijacks Microsoft cloud accounts for data theft and extortion.

Microsoft disclosed a campaign that sent over one million CEO-impersonation scam emails between August 3-5, 2026, targeting U.S. accounts payable departments with fake ServiceNow subscription invoices to induce ACH transfers, using generative AI to tailor templates. A second campaign detected since May 2026 uses passkey/MFA-themed voice phishing posing as the IT help desk, redirecting victims via SMS to counterfeit Microsoft sign-in pages and adversary-in-the-middle or device-code flows to hijack accounts. Post-compromise activity includes adding attacker-controlled authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and mailbox collection via REST APIs. Microsoft attributes initial access to Storm-3121 (linked to ShinyHunters and Falcon extortion) and Storm-3032 (UNC6671, a BlackFile splinter operating the Helix extortion brand).

The Hacker News·Sep 13, 10:11 UTC · 3d agoPhishing & fraud in the wild2

Jenkins security advisory (AV26-877)

Canada's Cyber Centre relayed a Jenkins advisory (AV26-877) covering core and numerous plugin vulnerabilities fixed in 2.568.3/2.580.

The Canadian Centre for Cyber Security published advisory AV26-877 for the Jenkins security advisory dated September 2, 2026. Affected products include Jenkins releases other than 2.568.3 and 2.580, plus plugins such as GitLab, LDAP, Microsoft Entra ID, SAML, Script Security, Pipeline Build Step, and others. Administrators are encouraged to review the linked advisory and apply necessary updates.

Canadian Centre for Cyber Security·Sep 3, 13:54 UTC · 13d agoAdvisory

CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks

CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.

CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.

GBHackers·06:04 UTC · 15h agoAdvisory

Open-source secrets scanning tool Sift hunts credentials in Microsoft 365, Slack, and Jira

Stratus Security open-sourced Sift, a CLI secrets scanner covering Active Directory, SharePoint, Teams, Slack, Jira, and Confluence, outperforming Snaffler in benchmarks.

Stratus Security released Sift, a free open-source command line tool that hunts passwords, API keys, and sensitive data across local disks, Windows shares, Active Directory, SharePoint, OneDrive, Teams, Slack, Jira, and Confluence. In the firm's benchmarks, Sift scanned 250,000 files in 10.61 seconds versus Snaffler's 25.48 and averaged 92 MiB memory versus Snaffler's 337 MiB. Optional false-positive filtering runs through a local language model via Ollama, and scans write checkpoints so interrupted runs resume. The tool found thousands of credentials in Jira ticket comments that prior pentesting had missed.

Help Net Security·Sep 2, 00:00 UTC · 14d agoTools

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.

Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.

The Hacker News·updated Sep 7, 15:51 UTC · 9d ago·first Sep 7, 15:39 UTC · 9d agoThreat actor in the wild 2 sources1

Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days

Microsoft's September 2026 Patch Tuesday fixes a record 966 flaws, including two Windows zero-days actively exploited to gain SYSTEM privileges.

Microsoft's September 2026 Patch Tuesday addresses a record 966 vulnerabilities, including 105 rated Critical, 81 of them remote code execution bugs. Two zero-days were actively exploited: a Windows Update Stack link-following flaw and a Windows ALPC heap-based buffer overflow, both allowing local elevation to SYSTEM privileges. The ALPC flaw was reported by Volexity and Proofpoint researchers, while the Update Stack flaw was credited to Romain Deperne and the Microsoft Threat Intelligence Centre. Microsoft shared no details on how the flaws were exploited in attacks.

BleepingComputer·Sep 8, 18:18 UTC · 8d agoAdvisory in the wildCVE-2026-69805CVE-2026-58649CVE-2026-69806+27 CVEs1

LastPass enhancements improve visibility, governance, and control

LastPass releases SaaS monitoring enhancements, Mobile Smart Scanner, and auto-enrolled dark web monitoring across its password management products.

LastPass announced enhancements to SaaS Monitoring and SaaS Protect in its Business Max offering, including Persistent Monitoring that keeps visibility active through the browser extension even when users are signed out, fully released as of July. It launched Mobile Smart Scanner to convert printed, handwritten, or screenshot passwords into vault credentials, and began phasing in automatic enrollment of all consumer accounts in dark web monitoring. The company also completed its transition to a Unified Admin Console, added company-wide onboarding links, and passed SOC 2 and ISO 27001/27701 audits with zero findings for the second consecutive year.

Help Net Security·Sep 1, 00:00 UTC · 15d agoTools

Nearly 22,000 Microsoft Exchange servers remain exposed to critical security flaw (CVE-2026-62911)

About 22,000 Microsoft Exchange servers remain unpatched against critical auth bypass CVE-2026-62911 as a working exploit circulates online.

CVE-2026-62911 is a critical authentication bypass by capture-replay in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over the network, with a CVSS score of 8.0. Microsoft patched the flaw on August 11, 2026, but Shadowserver Foundation scans show roughly 22,000 servers unpatched, with the US (6,200) and Germany (5,100) leading; BSI reports 85% of on-premises Exchange servers in Germany are still vulnerable. The Netherlands' NCSC-NL flagged that a working exploit is circulating, and Exchange 2016/2019 require the Extended Security Updates program for fixes.

Help Net Security·Sep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-62911CVE-2026-428971

BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations

CloudSEK found the BigBear 2.0 phishing-as-a-service platform bypassed MFA at 258 organizations and captured over 5,000 Microsoft 365 credentials.

CloudSEK researchers gained administrator access to the BigBear 2.0 phishing-as-a-service control panel and found it had exfiltrated 5,137 credential records, including 474 completed MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies across 3,331 victim IPs in 40+ countries. The Evilginx2-based AitM proxy intercepts credentials and authenticated session cookies, and custom JavaScript interferes with FIDO2/WebAuthn to force weaker authentication. The panel is leased to at least five affiliate operators via Telegram exfiltration bots, and geo-matched residential proxies cover 69 countries to evade detection.

BleepingComputer·Sep 7, 15:39 UTC · 9d agoPhishing & fraud in the wild1

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security Blog·Sep 3, 16:00 UTC · 13d agoPhishing & fraud in the wild1

Top 10 Best Cloud Access Security Broker (CASB) Solutions in 2026

2026 CASB guide ranks Netskope first for depth and Microsoft Defender for Cloud Apps for Microsoft estates, as standalone CASB fades into SSE.

Buyer's guide covers ten CASB products across four enforcement modes: API, forward proxy, reverse proxy and log-based discovery. Netskope leads on SaaS activity context depth, while Microsoft Defender for Cloud Apps wins on Microsoft 365 E5 estate economics. The guide argues standalone CASB purchases have largely disappeared into SSE platforms and increasingly overlap with SSPM.

Cyber Security News·Sep 15, 06:24 UTC · 1d agoTools

Hackers Use AI-Assisted CEO Emails to Trick Finance Teams Into Sending $50,000 Payments.

Microsoft tracked a million-message AI-assisted BEC campaign impersonating executives with fake ServiceNow invoices to steal ~$50,000 ACH payments.

Microsoft detected over one million messages in a BEC campaign running August 3-5, using AI-assisted phishing templates, executive impersonation, and fabricated ServiceNow subscription invoices to trick finance teams into authorizing fraudulent ACH payments of roughly $50,000. The US received 87.7% of volume. Attackers used lookalike domains like service-nowinc[.]com registered just days before delivery, with no compromise of ServiceNow itself. Telltale signs included verbose HTML comments, uniform formatting, and inconsistent forwarded-message headers.

GBHackers·updated Sep 11, 13:38 UTC · 5d ago·first Sep 11, 07:43 UTC · 5d agoPhishing & fraud in the wild 2 sources

Microsoft Patch Tuesday Update September 2026 – 974 Vulnerabilities Fixed, Including 2 Zero-Days

Microsoft's September 2026 Patch Tuesday fixes 974 vulnerabilities across Windows and Office, including two actively exploited Windows privilege-escalation zero-days.

Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities spanning Windows, Office, SQL Server, SharePoint, Exchange, Azure, and developer tools. Two Windows zero-days are confirmed exploited in attacks: CVE-2026-85880, a Windows ALPC elevation-of-privilege flaw, and CVE-2026-81963, a Windows Update Stack privilege-escalation flaw involving link following. The release also includes Critical fixes for Windows Secure Kernel Mode, VBS Enclave, Excel, and Word.

Cyber Security News·Sep 8, 17:46 UTC · 8d agoVulnerability in the wildCVE-2026-85880CVE-2026-81963CVE-2026-83939+15 CVEs1

New Phishing Campaign Abuses Windows Mshta.exe to Steal Credentials and Secrets

Fortra researchers track an active phishing campaign targeting Spanish speakers that abuses mshta.exe to run HTA payloads for reconnaissance and credential theft.

Fortra's FIRE team says a phishing campaign active since June 2026 targets Spanish-speaking users with invoice ('Facturación') and judicial ('Aviso Judicial') lures, many sent via libero.it/italiaonline.it infrastructure with SCL:-1 markings to bypass anti-spam. Clicking embedded links delivers an HTA launcher executed via mshta.exe, which hides its window off-screen, builds dynamic C2 URLs, and performs reconnaissance using WMI, PowerShell, and environment-variable inspection. A second-stage JavaScript dropper uses HTML smuggling to reconstruct a Base64-encoded ZIP in the browser, delivering a 7-Zip self-extracting executable disguised as a Firefox installer; staged design allows later delivery of credential stealers or ransomware. Defenders are urged to block archivogratuito[.]online and shortener domains goo[.]su, abrir[.]link, and abre[.]ai, and to restrict mshta.exe execution via AppLocker or ASR rules.

GBHackers·Sep 12, 06:16 UTC · 4d agoPhishing & fraud in the wild1

McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen

A seller offers 1.7 million McDonald's employee records allegedly taken from its Azure tenant via compromised credentials; an 8,000-row sample verifies as genuine.

A forum seller named TheHatman posted an 8,000-row sample of McDonald's employee directory data, claiming a 1.7 million-record haul pulled directly from the company's Azure tenant using compromised credentials. Ransomnews analysis found authentic Entra ID export artifacts, including genuine domains, tenant-internal addresses, encoding errors, and truncated HR fields, but could not verify the data's age or the 1.7 million figure. The same seller listed nine datasets in 16 days covering about 3.6 million records across McDonald's, Vodafone, Gap, hotels, and IT outsourcers, suggesting infostealer-driven credential resale. No passwords or hashes appear in the sample, so the primary risk is social engineering.

Security Affairs·Aug 17, 07:58 UTC · Aug 17, 2026Data breach in the wild1

Microsoft security advisory – August 2026 monthly rollup (AV26-804) – Update 2

Canada's Cyber Centre updated advisory AV26-804 relaying Microsoft's August 2026 monthly rollup of vulnerabilities across .NET and Azure products.

The Canadian Centre for Cyber Security advisory AV26-804, updated August 27, 2026, relays Microsoft's August 2026 monthly security rollup originally issued August 11. Affected products include .NET 8.0, 9.0, and 10.0 on Linux, macOS, and Windows, plus many Azure services. Listed Azure components include Azure Kubernetes Service, Azure SQL Database, Azure Service Bus, Azure Active Directory, Azure Logic Apps, and Azure Monitor Agent.

Canadian Centre for Cyber Security·Aug 27, 17:23 UTC · 20d agoAdvisory1

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.

CrowdStrike is tracking Slim Spider, a previously undocumented financially motivated group attacking Brazilian financial institutions since at least March 2026. The actor used custom Bash scripts to steal temporary cloud credentials, exfiltrated digital asset custody secrets, and used Foundry's cast tool to derive Ethereum wallet addresses, while deploying Go-based backdoor MikeDor and an implant impersonating Brazil's SPI instant payment infrastructure. Slim Spider also pivoted to Azure DevOps and Kubernetes clusters and used panels including NEXUS // Scanner, Painel de Emails Entra ID, and Painel Pix for reconnaissance and unauthorized Pix transfers. Separately, Google Threat Intelligence Group and Mandiant disclosed Breeze Comet (CL-CRI-1163), a Portuguese-speaking group since 2024 that breaches Brazilian payment infrastructure to run fraudulent Pix, Boleto, and STR transactions.

The Hacker News·Sep 8, 16:20 UTC · 8d agoThreat actor in the wild

Protecting organizations from AI-assisted executive impersonation and invoice fraud

Microsoft tracked a campaign of over one million AI-crafted CEO-impersonation emails seeking ~$50,000 ACH payments with fabricated ServiceNow invoices.

Between August 3 and 5, Microsoft detected a campaign of more than one million fraud emails, 87.7% of them targeting US enterprise users, sent through multiple third-party email delivery service accounts. The actor impersonated CEOs, CFOs, and presidents of targeted companies, urging accounts payable staff to process an ACH payment of nearly $50,000. Lures layered executive impersonation, lookalike domains, a fabricated ServiceNow 'Annual Subscription' invoice personalized to the recipient, and forged forwarded email threads; Microsoft found no evidence ServiceNow or the referenced executives were compromised. Microsoft observed indicators consistent with generative AI-assisted template creation, while leftover inconsistencies such as missing forwarding headers and mismatched display names gave defenders detection cues.

Microsoft Security Blog·Sep 10, 17:23 UTC · 6d agoPhishing & fraud1

Your Cloud Security Checklist Doesn't Work the Way You Think It Does

Intruder's 2026 Cloud Security Index found misconfiguration risk profiles differ sharply across AWS, Azure, and Google Cloud across 3,000 organizations.

Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud for its 2026 Cloud Security Index. Weak IAM controls and missing logging affected 80-98% of accounts regardless of provider, while exposed services ranged from 76% on AWS to just 8% on Google Cloud. Top issues included S3 buckets without HTTPS enforcement (87% of AWS accounts), Entra ID users without MFA (55% of Azure accounts), and missing OS Login MFA (77% of Google Cloud accounts). Weak IAM prevalence rose with organization size, from 87% at SMEs to 98% at large enterprises, and midmarket organizations took the longest to remediate at 35 days on average.

The Hacker News·Sep 7, 11:45 UTC · 9d agoResearch

The 12 Best Antivirus (Endpoint Protection) Software for Business, Compared and Priced

GBHackers compares 12 business antivirus products on detection, EDR depth, pricing, and platform coverage, ranking CrowdStrike and Bitdefender joint top at 8.8.

The roundup scores 12 enterprise endpoint protection vendors across detection, EDR depth, management, pricing transparency, and platform coverage. CrowdStrike and Bitdefender tie at 8.8, with Microsoft Defender for Endpoint scoring 8.5 and noted as effectively free for Microsoft 365 E5 licensees. The piece also flags that Kaspersky cannot legally be sold in the US and that Panda and Webroot now sit under WatchGuard and OpenText respectively.

GBHackers·Sep 8, 10:24 UTC · 8d agoIndustry 2 sources1