Microsoft SharePoint Vulnerability Fuels New Ransomware Campaigns
CISA confirms active exploitation of a high-severity Microsoft SharePoint RCE now used in ransomware intrusions and lateral movement.
Wednesday, August 12
Research Unveils USB Exploit Leading to SYSTEM Access on Windows 11
Windows Plug and Play abuse can fetch signed vendor software and escalate to SYSTEM on fully updated Windows 11 via USB emulation.
Microsoft's August Security Update Tackles Over 400 Vulnerabilities, Highlights Three Zero-Day Exploits
Microsoft released massive August updates covering hundreds of CVEs, including multiple zero-days — prioritize exploited and high-impact fixes.
Monday, August 10
Windows Hello for Business Vulnerability Enables Stealthy Entra ID Access
PremiumMalware running in a signed Windows session can quietly use Windows Hello for Business keys to authenticate to Entra ID and persist.
Phishing Campaign Exploits Microsoft 365 Accounts in Financially Driven Attacks
PremiumActive AitM phishing campaign hijacks Microsoft 365 accounts to collect payroll and finance emails using residential proxies.
Friday, August 7
ChainDrop Worm Infiltrates Hundreds of npm Packages, Threatens Billions of Installs
PremiumChainDrop npm worm compromised 400+ packages, impacting components with combined monthly installs exceeding two billion.
Critical Vulnerability in Popular Code Editors Puts Millions at Risk
PremiumCritical one-click RCE affecting Cursor, VS Code, and Google Antigravity could compromise developers by executing code via malicious links.
Wednesday, August 5
Greatness PhaaS Enhances Attack Arsenal with Device Code Phishing
Greatness PhaaS adds device-code phishing and AiTM capabilities to bypass MFA and capture OAuth tokens for account takeover.
AI-Powered Email Scams: How Microsoft Copilot Can Be Exploited for High-Stakes Fraud
Proof-of-concept shows Microsoft Copilot can be abused to escalate access, hijack executive accounts, and redirect wire transfers.
PNLD Data Breach Exposes Sensitive UK Law Enforcement Information on Dark Web
PNLD compromise leaked contact data for police and justice professionals, published by ExfilSquad on dark web.
Monday, August 3
Open-Source Phishing Kits Exploit Microsoft 365 Authentication
PremiumOpen-source AiTM phishing kits proxy live Microsoft 365 auth sessions, capturing tokens and bypassing MFA protections.
Russian Cyber Group Targets Travelers Through Hospitality Networks
PremiumWiz documents CaptiveCrunch AiTM campaign by Storm-2945/Midnight Blizzard targeting hospitality captive portals to harvest credentials.
Azure Cosmos DB Vulnerability Puts Data at Risk: What You Need to Know
PremiumCosmosEscape exposed primary keys for Azure Cosmos DB, granting attackers full read/write access to affected databases.
Friday, July 31
Amazon Traces npm Package Hijacking to North Korean Group
PremiumAmazon attributes debug and chalk npm package hijacks to North Korea-linked actors who pushed wallet-draining scripts into popular packages.
Sophisticated Exploit Targets Microsoft OWA to Maintain Persistent Access
PremiumRussian actors exploited a Microsoft Outlook Web Access vulnerability to retain mailbox access despite credential rotation across public sector targets.
Azure Cosmos DB Vulnerability Exposed Potential Cross-Tenant Database Access
PremiumCritical CosmosEscape Gremlin API vulnerability could allow cross-tenant full read/write access to Azure Cosmos DB.
Wednesday, July 29
Monday, July 27
Critical Azure Automation Vulnerability Risks Cross-Tenant Identity Exposure
PremiumDefault Azure Automation public-by-default configuration combined with code flaws could enable cross-tenant identity takeover and data access.
Certighost Flaw Enables AD Users to Masquerade as Domain Controllers
PremiumCertighost exploit lets low-privileged AD users obtain a DC certificate and authenticate as that machine, risking full directory compromise.
Sunday, July 26
Get these articles delivered to your inbox.
Subscribe free