Phishing Scheme Bypasses Microsoft 365 MFA to Redirect Vendor Payments
PremiumPhishing allowed attackers to bypass Microsoft 365 MFA, hijack a finance mailbox, and redirect vendor payments.
§Topic · Identity, Access & Credentials
Identity, Access & Credentials
Credential theft, infostealers, session hijacking, MFA bypass, SSO and Active Directory attacks.
All dispatchesWednesday, August 19
Infostealers Drive Surge in Credential Theft with 1.7 Billion Compromised Accounts
Flashpoint reports infostealers exfiltrated 1.7 billion credentials in the first half of 2026, fueling account takeover risk.
TWINLOOT Exploits Microsoft Services for Stealthy Credential Theft and Network Intrusion
TWINLOOT Python implant uses SharePoint and Teams to host C2, steal credentials, and pivot inside Microsoft tenant environments.
Critical Vulnerability in MLflow Exploited for Credential Theft
Active exploitation of MLflow SSRF (CVE-2026-64849) leads to cloud credential and secret theft from ML deployments.
Monday, August 17
AmnesiaStealer Malware Threatens macOS with Enhanced Control
PremiumNew macOS infostealer steals keychain and browser data via ClickFix and supports remote interactive browser control.
Massive Azure Credential Breach Puts Major Corporations at Risk
PremiumCompromised Azure/Entra credentials exfiltrated employee directories from major corporations, data now offered for sale.
Friday, August 14
Credential Theft Threatens Thousands Due to Malicious LiteLLM Releases
PremiumMalicious LiteLLM PyPI releases contained credential-stealing code that may have exposed secrets for 2,100+ organizations.
Adobe Commerce Vulnerability Exploited Shortly After Disclosure
PremiumCritical Adobe Commerce vulnerability was targeted and exploited shortly after disclosure, risking customer account takeover.
Monday, August 10
Windows Hello for Business Vulnerability Enables Stealthy Entra ID Access
PremiumMalware running in a signed Windows session can quietly use Windows Hello for Business keys to authenticate to Entra ID and persist.
Massive Malware Campaign Exploits npm Packages to Spread RAT and Infostealer
PremiumCampaign published nearly 800 malicious npm packages delivering a cross-platform RAT and infostealer for Windows, macOS and Linux.
CSS Bomb Attacks Exploit Email Vulnerabilities to Steal Passwords
PremiumCSS bomb technique manipulates webmail UI to spy on user activity and capture passwords and tokens without JavaScript.
Friday, August 7
Wednesday, August 5
Greatness PhaaS Enhances Attack Arsenal with Device Code Phishing
Greatness PhaaS adds device-code phishing and AiTM capabilities to bypass MFA and capture OAuth tokens for account takeover.
Massive Supply Chain Attack Hits npm Packages, Exposing Billions to Credential Theft
Mini Shai-Hulud/npm campaign compromises popular packages, indicating coordinated supply-chain poisoning activity.
Get these articles delivered to your inbox.
Subscribe free