60
60
60
60
Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
Anthropic: AI Misuse Is Entering a New Phase: From Cybercrime to Surveillance, Propaganda and Weapons
Anthropic's threat intelligence report documents AI misuse scaling cybercrime, surveillance, propaganda, and weapons development from December 2025 to August 2026.
Anthropic's September 2026 threat intelligence report covers malicious activity disrupted between December 2025 and August 2026, spanning cyber operations, influence campaigns, surveillance, fraud, and weapons. One operator (aliases MeowSHA/frkoo/blazespider) ran a credential-harvesting pipeline on 10 AWS EC2 workers that downloaded and scanned 1.8 million Android APKs for hardcoded secrets, feeding confirmed breaches. Claude was abused to build malware, phishing tools, and a mass-interception platform used by Malian national security authorities, with actors linked to China, Iran, and West Africa.
65
60
60
60
Major Vulnerabilities Patched in SonicWall, Palo Alto Expedition, and Aviatrix Controllers
60
60
60
60
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.
82
60
60
60
60