60
60
Admins, patch your Cisco enterprise security solutions! (CVE-2023-20032)
60
60
60
60
60
60
60
60
60
60
60
ToolShell: Details of CVEs affecting SharePoint servers
60
60
60
60
60
60
Zero-day vulnerabilities in Microsoft Exchange Server
60
Ivanti Releases Urgent Security Updates for Endpoint Manager Vulnerabilities
60
60
60
60
60
Trend Micro addresses actively exploited Apex One zero
60
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
Arctic Wolf documented a threat cluster tracked as PREY-0058 that impersonates internal IT help desk staff by phone, luring Directors, VPs, and executives to authentication-themed URLs formatted as victim-organization lure domains. Adversary-in-the-middle panels intercept credentials and MFA approvals, and stolen sessions are replayed through residential proxies such as NodeMaven from IPs matching the victim's geo-location and ASN, defeating impossible-travel alerts. Attackers perform discovery against SharePoint and Entra ID, then harvest data from OneDrive, Exchange, and Box before issuing extortion demands. Defenders are advised to require managed devices, use phishing-resistant MFA like FIDO2, enable Continuous Access Evaluation, and monitor sign-ins, SharePoint SearchQueryPerformed, and MailItemsAccessed events.
72
60
60
57
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means
GitGuardian found the Shai-Hulud infostealer worm now scans 469 credential locations, including CI/CD and AI tool configs, expanding supply-chain risk.
GitGuardian researchers found that a recent Shai-Hulud worm variant scans for credentials across 469 locations in developer environments, CI/CD tooling, cloud configurations, and AI tool configs, up from 189 paths in earlier variants. The worm reuses stolen credentials to pivot from developer workstations to source code, cloud infrastructure, and package publishing channels, turning credential theft into forward-propagating supply chain attacks. The analysis urges defenders to prioritize removing long-lived package publishing tokens in favor of short-lived OIDC-based trusted publishing, citing recent Docker and GitHub Actions improvements.
55
60
60
60
60
60
60
Ivanti Patches Critical Remote Code Execution Flaws in Endpoint Manager
60
60
60