57
57
57
57
57
60
57
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
Microsoft Security Research is tracking active cloud-based intrusions, observed since May 2026, that begin with helpdesk impersonation calls and SMS lures urging urgent passkey, MFA, or SSO updates. The lures lead to adversary-in-the-middle phishing or device-code authentication flows that capture credentials and session tokens or grant actor access, after which the actors add authentication methods, conduct Microsoft Graph reconnaissance, and download SharePoint and OneDrive content via REST APIs. Phishing domains embed victim organization names as subdomains (e.g., contoso.add-passkey[.]com), are often registered with Nicenic, and go operational within hours. Microsoft advises revoking sessions and removing unauthorized authentication methods for confirmed compromises.
76
UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data
Google and Mandiant attribute vishing-based SaaS data extortion attacks to UNC6671, now operating under the Redact, Pink, Helix, and Falcon brands.
Google Threat Intelligence Group and Mandiant track extortion group UNC6671, which uses vishing calls impersonating IT help desks to lure employees to adversary-in-the-middle phishing pages that capture credentials, MFA tokens, and session tokens. The group then registers adversary-controlled MFA devices, pivots through identity providers into Microsoft 365, Okta, and other SaaS applications, and runs automated Python and PowerShell exfiltration scripts. UNC6671 has rotated through extortion brands including BlackFile, Redact, Pink, Helix, and Falcon, and Google tracked over $10.6 million in Bitcoin payments between January 7 and May 12, 2026, with initial demands exceeding $3 million. The actor has hit dozens of organizations in North America, Australia, and the UK, shifting toward high-value financial and legal firms in July 2026.
78
North Korean Hackers Deploy New Linux Espionage Toolkit
Rapid7 says North Korea-aligned actors use a new Linux espionage toolkit (ted HAProxy backdoor, CurlRAT) against South Korean automotive and media targets.
Rapid7 reports a stealthy Linux framework comprising a custom HAProxy backdoor ('ted'), trojanized system binaries (agetty, atd, crond, polkitd, sshd), an SSH keylogger, and CurlRAT that polls C&C every 12 hours. Initial access came via a Groupware login portal flaw, with credential harvesting enabling lateral movement to internal systems. The toolkit supports long-term surveillance, HTTP traffic interception/injection, and drive-by downloads, likely in use since late 2024. Infrastructure and artifacts overlap Operation SyncHole, suggesting Lazarus or APT37 involvement.
72
China-linked Fire Ant Hides Inside Trusted Infrastructure
China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.
Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.
74
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
60
57
57
57
57
57
57
60
57
57
57
57
57
57