Sophisticated Phishing Campaign Targets US C-Suite with Microsoft 365 and Remote Access Tools
PremiumC-Suite phishing campaign steals Microsoft 365 sessions then deploys RMM tools to establish remote access across US targets.
Friday, October 2
Antino Backdoor Exploits Microsoft 365 for Stealthy Cyber Intrusions
PremiumAntino Windows backdoor uses Outlook and OneDrive for covert C2, enabling stealthy commands and data exfiltration.
Warlock Ransomware Targets Critical Sectors via SharePoint Vulnerabilities
PremiumWarlock (Longlegs/Storm-2603) exploits SharePoint vulnerabilities to deploy ransomware against water and telecom operators.
Zimbra Users Urged to Update Amid Exploitation of Critical Vulnerability
PremiumCritical Zimbra OS command-injection CVE-2026-73570 exploited via crafted emails without user interaction before disclosure.
Wednesday, September 30
NeedyMantis Malware Sustains Long-Term Network Breaches Across Multiple Sectors
Microsoft links NeedyMantis malware to long-term persistence in telcos, universities, medical nonprofits, and government contractor networks.
JADEPUFFER Leverages Compromised Azure Service Principals for Destructive Cloud Operations
JADEPUFFER (Storm-3168) used compromised Azure service principals to delete resources and perform destructive cloud operations.
Monday, September 28
AI Advances Challenge EDR Systems with Modified Credential Dumper
PremiumLocal uncensored AI modified a credential-dumping tool to evade two EDR products, demonstrating AI-assisted offensive tooling risks.
Teen Researcher Unveils Major Security Flaw in Microsoft Authentication System
PremiumResearcher discovered Microsoft Titan auth flaw that could hypothetically allow forged admin access to massive internal datasets.
Novel Windows Process Injection Technique Bypasses Traditional EDR Monitoring
PremiumNew console named-pipe process-injection technique bypasses common EDR hooks by avoiding WriteProcessMemory and VirtualAllocEx APIs.
Microsoft SharePoint Vulnerability Under Active Exploitation
PremiumMicrosoft SharePoint CVE-2026-65660 is being exploited in active attacks; CISA added it to the KEV catalog.
Friday, September 25
Wednesday, September 23
AI-Powered Phishing Campaign Targets Companies with Sophisticated Scams
Microsoft-tracked AI-assisted phishing campaign sent more than one million personalized payment-diversion scam emails.
Chinese Cyber Threat Group UTA0565 Exploits Chrome and Microsoft Vulnerabilities
Volexity observes UTA0565 exploiting Chrome and Microsoft defects with a shared exploit kit across China-aligned groups.
BigDiskBuster Zero-Day Exploit Challenges Microsoft Defender Updates
Researcher Nightmare Eclipse published Defender exploits/PoC (BigDiskBuster) that block Defender updates and affect endpoint protections.
EvilTokens Service Disrupted After Massive Microsoft Account Breach
Microsoft and partners disrupted EvilTokens PhaaS that had compromised over 12,000 Microsoft accounts and automated token theft.
Monday, September 21
Friday, September 18
Wednesday, September 16
Vite Servers Under Siege: Exploit Targets Cloud Credentials
Automated mass-scanner targets exposed Vite dev servers to steal AWS/Azure credentials and infrastructure state files.
Microsoft Issues Emergency Patch to Resolve RDS and Hyper-V Failures
Microsoft issued out-of-band emergency fixes after Patch Tuesday caused RDS issues, addressing service failures and related regressions.
Chinese Hackers Exploit Unpatched Flaws in Chrome and Windows to Deploy GRIMWEDGE Backdoor
China-linked actors chained Chrome and Windows flaws to deploy GRIMWEDGE JavaScript backdoor against NGOs; validate browser and OS patching.
Get these articles delivered to your inbox.
Subscribe free