30
30
30
30
30
The Top 4 Threats We Found by Investigating Every Alert for a Quarter
Prophet Security's quarterly threat report finds identity attacks made up roughly half of confirmed malicious activity, with stolen authenticated sessions bypassing conditional access controls.
Between May 1 and July 31, 2026, Prophet Security investigated every alert in customer environments immediately on arrival; about 7% of completed investigations were confirmed malicious. Direct account/session attacks made up roughly 18% of confirmed activity, with replayed authenticated sessions bypassing conditional access since no re-authentication occurs. Infostealer activity affected about a quarter of investigated organizations, mostly delivered via browsers through compromised websites, malicious ads, sponsored search results and ClickFix fake CAPTCHA gates, with payloads including Lumma Stealer, Vidar, HijackLoader and AsyncRAT. Credential phishing was the largest category at about 28%, with adversary-in-the-middle relays revealed by seconds-long MFA approvals from distant countries and MFA fatigue attacks exploiting automatic unlock policies.
52
Appdome joins Microsoft Intelligent Security Association to better defend against increasing threats
30
30
30
Microsoft Investigating Microsoft 365 Copilot Access Issues Under Incident CP1470554
Microsoft is investigating a Microsoft 365 Copilot access disruption tracked as incident CP1470554, with no root cause or recovery timeline published.
Microsoft is investigating reports that users cannot open Microsoft 365 Copilot or encounter errors when interacting with it, tracked under Service Health incident CP1470554 in the Microsoft 365 admin center. The company has not disclosed a root cause, affected regions, or estimated recovery time. It follows several distinct Copilot availability failures between late August and September 10, including an authentication-configuration outage and a Copilot Chat configuration fault. Microsoft says the issue is not a breach or cyberattack and directs tenant admins to the Service Health Dashboard.
22
30
30
30
30
50
CISA Shares 17 Techniques Used by Hackers to Compromise Active Directory
CISA and five international agencies publish joint guidance detailing 17 techniques attackers use to compromise Microsoft Active Directory environments.
CISA, NSA, and the Australian Signals Directorate's ACSC, with contributions from Canadian, UK, and New Zealand cyber centers, released technical guidance on 17 Active Directory attack techniques. It covers AD Domain Services, AD Certificate Services, and AD Federation Services, including Kerberoasting, DCSync, Golden Ticket, Golden SAML, Skeleton Key, and Shadow Credentials. The guidance recommends treating domain controllers, CAs, AD FS servers, and Entra Connect systems as Tier 0 assets with phishing-resistant MFA, Kerberos pre-authentication enforcement, and disabling NTLM/SMBv1.
52
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.
SpecterOps released CDP-Enable-BOF, an x64 Beacon Object File that activates Chrome DevTools Protocol inside running chrome.exe or msedge.exe processes on Windows, exposing cookies, history, saved passwords, and authenticated sessions without administrator rights. It calls Chromium's StartRemoteDebuggingServer on the browser UI thread to stay reliable under CFG, TLS, and CET, and was tested on Chrome 147 and Edge 147. The technique builds on work by DeathFlamingo and Cedric Van Bockhaven; Google had hardened remote debugging in Chrome 136 after attackers used it to steal cookies post-App-Bound Encryption. Defenders can watch Sysmon Event IDs 8 and 10 for injection into browser processes.
45
2026 Cyber Insurance Trends Report: What's Changed and What You Need to Know
Huntress survey: CIRCIA reporting mandates now live, BEC claims exceed ransomware, exfiltration-heavy attacks cost twice as much, premiums rising.
Huntress's 2026 cyber insurance trends report, based on its own survey, finds 79% of respondents carry cyber insurance while 58% report shrinking coverage over five years. New CIRCIA federal reporting mandates and EU NIS2 requirements are reshaping policies, business email compromise now drives more claims than ransomware, and data exfiltration has replaced encryption as the dominant ransomware tactic at roughly twice the cost. After three years of declining premiums, rates are climbing again, and most businesses now refuse to pay ransoms.
30
30
30
30
30
30
ChatGPT advanced account security adds passkeys and hardware keys
OpenAI launches Advanced Account Security for ChatGPT and Codex, replacing passwords with passkeys or hardware keys and disabling email/SMS recovery.
The opt-in setting disables password sign-in plus email and SMS account recovery for ChatGPT and Codex accounts, allowing only passkeys, hardware security keys, and user-held recovery keys, with shortened sessions and automatic exclusion of enrolled accounts' conversations from model training. OpenAI partnered with Yubico to offer discounted bundles of the YubiKey C Nano and C NFC, while any FIDO2/WebAuthn-compliant key or software passkey is supported, mirroring standards adopted by Google, Microsoft, and GitHub. Individual members of Trusted Access for Cyber using the most permissive models must enable the setting from June 1, 2026, or their organizations can attest to phishing-resistant authentication in their single sign-on.
45
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Huntress maps AD RMS architecture and recon paths, setting up an offline key-extraction attack against its unrotatable 255-year root key.
Huntress's multi-part research examines Active Directory Rights Management Services, Microsoft's enterprise DRM role that still ships in Windows Server 2025 despite migration guidance favoring Azure Information Protection. Part 1 covers the trust model and how an ordinary domain account can locate RMS clusters and read rights-policy templates. Part 2 will detail four independent paths for extracting the Server Licensor Certificate (SLC) private key via service-group membership and the configuration database, enabling fully offline decryption of protected documents. The SLC certificate is valid from 2002 to 2258 and has no key-rotation mechanism, so a stolen key decrypts protected content indefinitely.
55
30
AWS limits AI agents’ data access, even when manipulated
AWS detailed propagating user authorization context through Bedrock AgentCore so downstream services enforce access controls even if the agent is manipulated via prompt injection.
AWS described an architecture for Amazon Bedrock AgentCore where user tokens and department claims are validated at runtime and propagated to DynamoDB, Bedrock Knowledge Bases, and Salesforce. Downstream services enforce authorization themselves, so a prompt-injected or buggy agent cannot retrieve data the user is not entitled to see. AWS demonstrated the pattern with a CRM use case separating Sales and Finance access and recommends IAM-backed knowledge bases for stricter isolation.
48
30
30
CISA Warns Hackers Exploit 17 Active Directory Techniques to Gain Control of Enterprise Networks
CISA and Five Eyes agencies issued joint guidance detailing 17 Active Directory attack techniques like Kerberoasting and DCSync, with hardening and detection advice.
CISA, the NSA, and cyber agencies from Australia, Canada, the UK, and New Zealand released joint guidance on September 15 covering 17 techniques attackers use to compromise Active Directory, including AD CS, Certificate Services, and Federation Services attacks. Named techniques include Kerberoasting, AS-REP roasting, password spraying, DCSync, NTDS.dit dumping, Golden and Silver Tickets, Golden SAML, and Skeleton Key. Recommendations include minimizing SPN accounts, enforcing AES encryption, disabling NTLM, account lockout thresholds of five attempts, phishing-resistant MFA, and Tier 0 prioritization. The guide also lists Windows event IDs 4769, 4768, 4625, 4771, and 2889 for detecting Kerberoasting and password spraying on domain controllers.
50
30
ConnectSecure helps MSPs automate Microsoft 365 security remediation
ConnectSecure launches Microsoft 365 Auto Remediation and AI-powered Training Assessments to help MSPs automate M365 security fixes and compliance training.
ConnectSecure's platform now automates remediation of supported Microsoft 365 security findings through conditional access policies, covering gaps such as missing MFA enforcement, legacy authentication and risky sign-ins. A new AI-assisted Training Assessments module generates, assigns and measures security assessments with configurable difficulty, pass thresholds and multilingual support. The previously announced Patch 360 patch management capability, including pilot-first validation, staged rollouts and rollback, is also now available.
22
Top 10 Best Endpoint Encryption Software in 2026
A 2026 roundup of ten endpoint encryption products argues the engines are solved and buyers should choose management layers like Intune, Sophos, or Trellix.
The guide ranks ten endpoint encryption options, arguing BitLocker and FileVault have won the engine war so the real purchase decision is the management layer for compliance proof, key escrow, and cross-platform policy. Microsoft BitLocker with Intune is named the baseline for Windows estates, with Sophos, ESET, Trend Micro, Check Point, Trellix, and others covering mixed or regulated fleets. It also warns that TrueCrypt-lineage freeware is unmaintained and that Kaspersky cannot be sold to US customers.
12
Your Cloud Security Checklist Doesn't Work the Way You Think It Does
Intruder's 2026 Cloud Security Index found misconfiguration risk profiles differ sharply across AWS, Azure, and Google Cloud across 3,000 organizations.
Intruder analyzed misconfiguration data from 3,000 organizations across AWS, Azure, and Google Cloud for its 2026 Cloud Security Index. Weak IAM controls and missing logging affected 80-98% of accounts regardless of provider, while exposed services ranged from 76% on AWS to just 8% on Google Cloud. Top issues included S3 buckets without HTTPS enforcement (87% of AWS accounts), Entra ID users without MFA (55% of Azure accounts), and missing OS Login MFA (77% of Google Cloud accounts). Weak IAM prevalence rose with organization size, from 87% at SMEs to 98% at large enterprises, and midmarket organizations took the longest to remediate at 35 days on average.
28
30
30
Cybersecurity jobs available right now: June 30, 2026
Help Net Security lists cybersecurity job openings across the US, UAE, France, Israel, Japan, Ireland, India, and Canada at major employers.
The roundup includes roles such as AI Offensive Security Engineer at AGAPI, Cloud Security Engineer at Spotify, IAM Engineer at Proton, DFIR in Israel, and a Senior Inspector overseeing NIS2 and AI regulation compliance in Ireland. Most listings were marked as no longer accepting applications, with a few still open including DFIR at Cye, IAM Engineer at Proton, and Detection Engineering at Saronic. The list covers employers across finance, infrastructure, and technology sectors.
12
Microsoft Offers $60,000 Bounty for Critical Cross-Tenant Vulnerabilities
Microsoft expands Dynamics 365 and Power Platform bug bounty, paying up to $60,000 for critical cross-tenant vulnerabilities.
Microsoft expanded its bounty incentives for Dynamics 365 and Power Platform, with qualifying rewards from $1,250 to $60,000. Critical cross-tenant vulnerabilities receive a 100% award multiplier and important ones 50%, while critical AI inference manipulation or inferential disclosure can earn up to $30,000. Scope covers Dynamics 365 apps, Power Apps, Power Automate, Copilot Studio, Power Pages, Dataverse, and selected on-premises products. Reports must be rated Critical or Important and submitted via the MSRC Researcher Portal.
18
30
30