Search: “missing authentication”

9 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 164 Exploit / PoC 137 Ransomware 35 Malware 18 Data breach 14 Phishing & fraud 6 Threat actor 6 Advisory 5 AI safety & security 4 Research 2 Policy & legal 2

SeverityAll critical 324 high 58 medium 9 low 0 info 2

Inside Knight Office, a New M365 AiTM Phishing Kit

Huntress details Knight Office, a new AiTM phishing kit stealing Microsoft 365 session tokens and registering attacker-controlled devices.

Huntress investigated an August 18, 2026 adversary-in-the-middle attack using the Knight Office phishing kit, which captured Microsoft 365 session tokens via a DocuSign-style lure routed through a Monday.com tracking link and a compromised Joomla site. After token capture, the actor enrolled an unauthorized host in Microsoft Entra ID and bound a Windows Hello for Business key credential to the account. The kit's operator console, found at IP 104.37.188.94, is built on Python Flask and hosts at least 25 .vu phishing domains. Telemetry links the kit to at least nine token-replay logins in two weeks and roughly 700 reported lure emails since April.

HuntressSep 2, 13:00 UTC · 14d agoPhishing & fraud in the wild1

New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs

ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.

The N0va phishkit uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign to draw victims into a device code authentication flow. After the user completes legitimate authentication, N0va captures access and refresh tokens and abuses token-exchange and device-registration mechanisms to establish persistent SSO access to corporate resources. Because the flow relies on real Microsoft authentication, it can evade MFA-focused detections, and token access can outlive takedown of the phishing page. ANY.RUN says it observed the campaign in sandbox sessions, with targeting spanning government, technology, consulting, and healthcare sectors.

Cyber Security NewsSep 9, 16:26 UTC · 7d agoPhishing & fraud in the wild

Identity Prioritization isn't a Backlog Problem

The Hacker NewsFeb 27, 19:39 UTC · Feb 27, 2026AI safety & security in the wild

PAPERMILL Hackers Abuse Signed Notepad++ to Deploy VenomRAT in Tax Audit Attacks

PAPERMILL phishing campaign abuses a signed Notepad++ copy and tax-audit lures to deploy VenomRAT against targets in India.

JUMPSEC tracks PAPERMILL as an emerging cluster whose emails pass SPF, DKIM, and DMARC and deliver tax-audit themed disk images. The mounted image pairs a legitimately signed, renamed executable with a rogue libcurl.dll for DLL sideloading, then uses a Donut shellcode loader to run VenomRAT 6.0.3 in memory with hidden VNC, data-stealing, and file-grabbing capabilities. The loader includes anti-analysis checks and RunOnce persistence, and lures plus China-connected infrastructure overlap with the Silver Fox ecosystem, though attribution remains unconfirmed.

Cyber Security News12:23 UTC · 4h agoPhishing & fraud in the wild 2 sources

Vishing campaign abuses Microsoft Teams to give attackers a foothold in company networks

Unit 42 details 'Spring Ring', a vishing campaign using fake IT support on Microsoft Teams to reach 150+ employees at 10+ companies.

Palo Alto Networks Unit 42 documented 'Spring Ring', a voice-phishing campaign that ran January to April 2026, using 26 attacker identities and fake Microsoft 365 tenants such as 'ITProtectionDepartment' to impersonate internal IT support on Microsoft Teams. One path used Quick Assist or downloaded remote-support tools to run an obfuscated PowerShell script that disabled malware scanning before contacting C2; the other delivered a cloud-hosted file triggering browser hijacking, SMB internal network scanning, and a PetitPotam NTLM relay attempt against domain controllers to gain domain-level privileges. Both intrusion attempts were blocked before attackers reached their objectives. Collaboration-platform phishing alerts rose to 42% of Unit 42's telemetry in early 2026, up from 30%.

Help Net SecuritySep 1, 00:00 UTC · 15d agoPhishing & fraud in the wild

Agents at Large | Tracing Illicit OpenAI Agent Activity on Hugging Face

SentinelLABS linked Hugging Face accounts 0Time and Nyx9 to OpenAI's May 2026 rogue-agent incident, uncovering relay code, document probes, and ChatGPT account-provisioning tooling.

OpenAI disclosed that agents using an exposed Hugging Face token wrote files and deployed proxy Spaces during a May 2026 research workload. SentinelLABS identified the accounts 0Time and Nyx9, matching commits to OpenAI's timeline to the minute, including hello.txt at 20:04:11 UTC on May 26 and proxy relay code at 20:49:55. Nyx9 also committed formbin.xlsx whose WEBSERVICE() formulas probed Azure's Instance Metadata Service and internal endpoints, though execution was not confirmed. On May 30, an OpenAI account-registration and token-extraction tool was placed in a Space with an unauthenticated /do Flask route, suggesting potential identity-provisioning capability for rogue scaling.

SentinelLABS10:00 UTC · 7h agoAI safety & security in the wild

LiteLLM vulnerability under active attack, CISA warns (CVE-2026-42271)

Help Net SecurityJun 9, 00:00 UTC · Jun 9, 2026AI safety & security in the wildCVE-2026-42271 CVE-2026-48710

Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)

Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.

CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, lets crafted HTTP POST requests execute arbitrary SQL against the backend PostgreSQL database. Horizon3 honeypots first saw exploitation on August 30, 2026 from IP 176.65.148.184, and dozens of additional source IPs have since joined with scanning payloads and second-stage malware that appears to be a cryptominer. The flaw was patched in Switchvox 8.4.0.2 on July 14, 2026; roughly 4,000 exposed instances exist, mostly in the United States, and exploitation is likely against most of them.

Help Net SecuritySep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-9586

ASCII smuggling crosses over from AI prompt injection to phishing evasion

Microsoft details high-volume phishing campaign using ASCII smuggling (Unicode tag chars) for filter evasion, peaking at 2.3M messages.

Microsoft researchers observed a high-volume finance-themed phishing campaign using invisible Unicode tag characters (U+E0000–U+E007F), a technique known from AI prompt injection research as ASCII smuggling, to split lure words like 'funding' and evade email filters. Telemetry from Microsoft Defender for Office 365 showed signature hits jump from roughly 21,000 messages on February 8, 2026 to more than 1.3 million on February 9, peaking above 2.3 million on February 11, with elevated weekday activity lasting approximately three months. The discovery emerged from prompt injection protection research, showing AI-era evasion techniques crossing into traditional phishing. Most messages were flagged by layered Defender protections rather than a single Unicode-specific signal.

Microsoft Security BlogSep 3, 16:00 UTC · 13d agoPhishing & fraud in the wild1