Tag: identity
All entries tagged identity.
- An independent researcher's lab test finds SAP's Security Audit Log carries no event for OS command execution via SM49/SM69 or RFC, only OS-level auditd sees the command on every path
- REF9334/KREMLIN forges Chromium's own Secure Preferences integrity hashes to silently install a banking-fraud browser extension outside the Web Store, resolving C2 through an Ethereum smart contract
- A conference-targeted phishing chain installs a self-regenerating rogue root CA plus a hosts-file/firewall local proxy that fabricates clean HTTPS results for any domain, surviving reboot
- Huntress: distinguishing malicious Volume Shadow Copy abuse (NTDS.dit theft via shadow copy, anti-recovery deletion) from routine RMM/backup housekeeping requires event correlation, not single-event alerting
- NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and DCSyncs domain credentials after exploiting BlueKeep
- The Gentlemen's open-directory attack toolchain: mounting a victim's own VHDX backup files to pull ntds.dit and SAM offline, then chunked-rclone exfil to Wasabi
- Oracle's September 2026 Critical Security Patch Update carries six unauthenticated CVSS 10.0 flaws across WebLogic Server, Access Manager, Forms, Internet Directory, Platform Security for Java and Hyperion Financial Management
- ANNUAL REPORT; Mandiant AI Risk and Resilience Report 2026: eight frontline case studies of AI agents weaponized inside real intrusions and red-team engagements
- Spain's AEPD discloses the first GDPR breach notification attributed to an autonomous AI agent, and tells data controllers to name AI-agent attacks explicitly in risk analyses
- CVE-2026-76460 (+ CVE-2026-76423), Cisco Identity Services Engine: unauthenticated API authentication bypass to root, found while resolving a customer support case, no workaround beyond ACLs (CVSS 10.0)
- Salt confirms misuse of an existing access credential to an unnamed 'peripheral system', up to 1.09 million Swiss mobile customers' records reportedly at risk
- Revolut discloses a customer KYC data breach after fulfilling a fraudulent request sent from inside a genuine government agency's own email domain
- Japan's Digital Agency: a VPN vulnerability exploited since May went undetected for a month, surfaced only by an anomalous mass file-access alert on a maintenance account, exposing ~246,000 government-personnel records
- BigBear 2.0, an Evilginx2-based Microsoft 365 phishing-as-a-service panel that JavaScript-disables FIDO2/WebAuthn to force victims onto phishable MFA, leased to at least five affiliates
- ChimeraZ claims France's Département de l'Aveyron employment platform, exposing 20,000+ people's data including 1,499 CVs, a customer account without MFA, an IDOR flaw and a misconfigured Odoo database, per one of two trackers who reviewed the leak
- "ted backdoor" and curlRAT, a DPRK-nexus actor recompiles a victim's own HAProxy source tree to hide C2 inside the load balancer's self-reported connection statistics
- CVE-2026-86206 / CVE-2026-86207 / CVE-2026-86218, N-able N-central: a third, unrelated auth-bypass/RCE chain in five weeks, the third CVE a pre-auth CVSS 10.0 zero-day N-able says is already exploited
- A dark-web identity-theft storefront sells 153 million+ driver's-license scans traced to identity-verification vendor IDScan.net; FBI opens a formal investigation
- Association des maires de France confirms a UNION-based SQL-injection breach exposing 114,000 records on mayors, municipal councillors and territorial agents, plaintext passwords included
- Coder's Cloudflare-fronted Terraform module registry was compromised for 14 hours, serving trojanized modules that harvested cloud, CI/CD and AI-tooling credentials
- CNIL fines Hôpital privé de la Loire EUR 500,000 over a 727,000-record breach traced to a single unprotected external physician account
- A Teams helpdesk-impersonation campaign installs a Node.js implant (Microsoft detection name: EtherRatz) via a silent MSI, then pivots over WinRM straight to domain controllers and certificate authorities
- Dropbox account takeover via a federated Lenovo-ID trust gap: roughly 5,000 accounts accessed with no password and no 2FA bypass needed
- Swiss federal offices planned to outsource part of the E-ID trust infrastructure to Amazon Web Services; a ministerial veto stopped it in February 2026 on CLOUD Act and digital-sovereignty grounds
- Infostealers now specifically monetize hijacked Claude sessions: Anthropic revokes sessions compromised via Vidar, LummaC2, StealC, RedLine, Acreed and AMOS
- Norway's shared national identity gateway ID-porten knocked out for 64 hours by the third escalating DDoS against Digdir since June
- German mobile carriers leaked callees' IMEI, device model and OS version to callers during call setup, GSMA confirmed the flaw and warned its 1,000+ member operators worldwide
- A near-autonomous, multi-agent AI framework compromised Taiwanese government infrastructure over four days, cracking 85 accounts, exfiltrating 2,564+ personnel records, and bypassing its own safety guardrails by reframing itself as 'authorized penetration testing'
- miniOrange's SAML2Core library ships the same openssl_verify() tri-state authentication bypass across both its WordPress and Joomla SAML SSO products, one vendor code defect, two ecosystems, exploitation already attempted against the WordPress line
- Splunk Enterprise August 2026 hardening release (SVD-2026-0801): three unauthenticated CVSS 9.4 flaws let anyone holding an embedded-report token hijack the report owner's session, admins included
- An MDR vendor denies a circulating compromise claim and publishes what actually happened: a phone-call phishing attempt that got one MFA push approved, and a device-trust policy that made the resulting session useless
- Truffle Security re-tested 10,616 leaked AWS key pairs and 88% still authenticate; 768 of them give full control of a company account, and none of the measured leak surfaces is the current working tree
- SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
- A Valais commune's secretariat mailbox was compromised on 10 August and sat quiet until the attacker used it on 18 August to mail roughly 450 of the commune's own contacts; the send is what triggered detection
- Three Russia-nexus espionage clusters compromise European diplomats and academics without malware, by talking targets through app passwords, device-code approvals and WhatsApp device-linking, all of which are legitimate features working as designed
- Dead-drop command-and-control went commodity: three of four new entrants on Red Canary's monthly list resolve their C2 from a dead drop, two of them from a public blockchain, and the fourth is a GUI for Entra ID device-code phishing
- CVE-2026-69836, Microsoft corrected its own Entra ID CVSS 10.0 record from exploited to not-exploited within a day, and ENISA's exploited feed still says otherwise two days later
- DOJ's superseding indictment against Iran's Mabna Institute names Switzerland twice; among the countries whose universities were compromised, and among those whose companies had employee mailboxes taken
- Oracle's August 2026 Critical Security Patch Update carries three unauthenticated CVSS 10.0 flaws, one of them in the LDAP server of Oracle Internet Directory
- PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint, a second remote-management tool on the company laptop, and a device whose location never matches the login
- CVE-2026-15826, User Profile Builder: a 61-to-70-character username makes WordPress return an error object, absint() turns it into the integer 1, and the plugin logs the caller in as user ID 1 (CVSS 9.8)
- CVE-2026-18963; Keycloak's password-reset flow can be driven to completion without the verification email being clicked, handing an unauthenticated attacker any account including administrators (CVSS 9.1)
- Akira blinds EDR by rebooting a victim host into Safe Mode with Networking, the operator's first observed use of the technique, and the stripped-down boot starved its own encryptor
- Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge
- JWR: a phishing kit that puts a live operator on an encrypted WebSocket into the victim's session, reading card and code digits as they are typed and choosing which one-time-code channel to demand
- France's tax authority cut the intruders' accounts in June and July and found no data theft, it took the criminal's sale listing two months later to establish that 678,000 records had already gone
- WindRelay, a purpose-built Android NFC-relay malware installed silently by a companion remote-access trojan during the fraud call itself, with per-victim app names carrying the victim's own name
- ShieldBreak, a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025
- Belgium's eID signing extension handed any web page the card, the PIN and a drive-by RCE, an eIDAS Qualified Trust Service Provider's browser bridge that never checked the caller's origin
- Gunra ransomware-as-a-service: a joint six-agency advisory documents FortiOS edge exploitation, a persistent MFA backdoor built from one fixed OTP value, and a Linux encryptor whose keys can be reconstructed
- Coding-agent CI harnesses broke on the same trust boundary three different ways, and the two findings that matter most carry no CVE at all
- Connor Moucka pleads guilty over the 2024 SaaS-tenant mass-extortion campaign, 165+ victim organisations reached with stolen credentials and no vulnerability in the platform
- Żabka confirms an external service-provider account reached its ticketing system; the claimed pivot from Jira into source control and production is the seller's assertion, not the company's
- CERT Intrinsec maps where autonomous coding agents leave evidence on disk; the same session databases and token files an investigator needs are a credential-collection target
- Interlock ran Volatility3 and WinPmem against a live endpoint to harvest credentials, the responder's own memory-forensics toolkit used in place of a commodity dumper
- CVE-2026-64638 (XSS2Shell), WordPress Core: a sanitiser disagreement on the login screen chains through DOM clobbering and a JSONP callback into administrator-minted Application Passwords and plugin upload
- WALLIX Bastion's REST API hands full appliance administration to an unauthenticated caller (CVSS 4.0 10.0), the credential vault and session recordings included, with public technical details due in September
- 22 CVEs in Tobit TeamDavid, a DACH-region self-hosted Microsoft 365 alternative: an unauthenticated heap leak hands over stored mailbox passwords, and the vendor stopped responding
- Wiz Cloud Threat Highlights H1 2026: LiteLLM had four separate security events in six months, unauthenticated MCP endpoints turned up across hundreds of environments, and a new extortion actor goes after service accounts rather than people
- Elastic catches Claude Code standing up a reverse tunnel and installing LaunchAgent persistence on a real macOS developer endpoint
- UNC6671 kept operating after BlackFile's announced retirement, across four further extortion brands, and its vishing pretext is now an urgent order to enroll a FIDO2 passkey
- CVE-2026-16443, Keycloak: importing SAML metadata without key-usage attributes silently disables response signature validation, so an unauthenticated attacker forges a login as any known user
- Stolen AI API tokens reach a reselling proxy within minutes, Unit 42 documents the 'transfer station' market and the account-takeover variant that mints its own keys
- LiteLLM callback hooks let an attacker who already holds gateway admin forge tool calls after inference, downstream of every prompt-level defence
- Phishing kits are registering browser service workers to build in-page transparent proxies, relaying credentials and live MFA codes from a fake browser window on trusted cloud hosting
- Switzerland's federal IT provider BIT confirms a SharePoint Server intrusion: ~200 federal user and technical accounts compromised while the July patches were already being installed
- CrowdStrike 2026 Threat Hunting Report: 88% of public-PoC exploitation landed inside 48 hours, and npm accounted for 87% of software-registry threats
- Pass-ta-key: unprivileged malware forges Chrome synced-passkey assertions, registers its own user-verification key, and can steal the master secret that decrypts every passkey
- CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
- CCI Nice Côte d'Azur: a compromised administrator account on the chamber's jobseeker platform was used to run the platform's own export function
- CVE-2026-28323, SolarWinds Web Help Desk: unauthenticated SAML 2.0 authentication bypass on a helpdesk portal (CVSS 9.8)
- French Éducation nationale: a hijacked staff account reached the agent-training system, exposing identity and NIR data for everyone who has worked in an académie since 2001
- CaptiveCrunch: an SVR-linked sub-cluster hijacks hotel and conference captive portals to serve fake update lures, a Go RAT and a token-stealing PowerShell module to travelling staff
- Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual Citrix NetScaler exploitation (CVE-2026-3055), not the agent
- UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad, a five-day-old extortion brand whose other 14 claims look fabricated
- HCSEC-2026-23, HashiCorp Terraform MCP Server leaks its own bearer token to an attacker-supplied address, and its credential cache crosses sessions and tenants (CVE-2026-14869, CVE-2026-16496, CVE-2026-16498)
- Huntress: a three-day credential-stuffing run logged into 92 SonicWall VPN and firewall accounts across 30 organisations, with no follow-on activity observed
- Talos IR Trends Q2 2026: ransomware operators ran their command-and-control through legitimate RMM agents, authentication abuse hit two-thirds of engagements, and missing logs stopped root-cause determination outright
- LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems
- STAC4749 runs Teams helpdesk vishing from attacker-owned .top domains into certificate-pinned Golang implants and Chaos ransomware in under 17 hours
- CVE-2026-59243, Apache Airflow FAB provider: the Azure AD OAuth login decoded ID tokens with signature verification off by default, letting anyone log in as Admin
- MedusaHVNC: a malware-as-a-service RAT that drives the victim's own logged-in browser on an invisible second Windows desktop
- TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)
- Microsoft Email Threat Landscape Q2 2026: phishing moves off email into Teams vishing, and attachment lures drift PDF → DOCX
- CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)
- Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory
- German BKA dismantles Kratos, the Sneaky2FA-derived AiTM phishing-as-a-service platform behind ~15,000 monthly Microsoft 365 credential-theft campaigns
- SANDWORM_MODE, an npm supply-chain worm that 'lives off the AI toolchain', poisoning MCP servers in AI coding assistants to steal developer credentials
- CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)
- Hugging Face: a fully autonomous AI agent breached production, ran 17,000+ actions before detection
- HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2
- Ernst & Young discloses a breach of a third-party IT support-ticket platform used by its tax practice, exposing client tax and financial documents
- Moodle local_o365 plugin: unverified JWT signature on the Teams SSO endpoint lets anyone authenticate as any user (CVE-2026-54733)
- Abbott confirms a Cancer Diagnostics cyber incident; ShinyHunters claims a vished Entra SSO account and 30M+ records
- Microsoft: two parallel ACR Stealer intrusion chains (WebDAV/rundll32/Python with blockchain dead-drop C2, and a fileless MSHTA/steganography chain) both rooted in ClickFix
- Garante fines Wind Tre EUR 1.7M over a vishing-enabled API-enumeration breach that exposed 365,048 telco customers
- Proofpoint: OAuth client ID spoofing validates stolen Entra ID credentials at scale without writing a successful sign-in log
- Microsoft maps three ShinyHunters-tradecraft OAuth-abuse paths against Salesforce customers, none exploiting a Salesforce vulnerability
- Microsoft July 2026 Patch Tuesday ships two actively-exploited zero-days, AD FS local EoP (CVE-2026-56155) and unauthenticated SharePoint EoP (CVE-2026-56164)
- AsyncAPI npm packages backdoored via a GitHub Actions pull_request_target token theft, delivering a multi-stage IPFS implant (M-RED-TEAM)
- CrashStealer, a native-C++ macOS infostealer using a notarized dropper and local dscl password validation to raid keychain, browsers and wallets
- NHS England issues insider-access controls after staff 'snooping' on high-profile patients' records
- GodDamn ransomware (Beast/Monster rebrand) blinds EDR with 'PoisonX', a malicious kernel driver Microsoft signed
- Forg365: a commercial Microsoft 365 phishing-as-a-service kit bundling device-code + AiTM phishing, in-panel AI lure drafting, and a browser extension for SSO-cookie persistence
- 'Helix' data-extortion cluster pairs manager-impersonation vishing with device-code phishing and automated SharePoint exfiltration
- ShinyHunters' Odido (NL telecom) breach: Dutch police voice analysis points to Dutch-national involvement; same vishing-into-spoofed-portal playbook, now against an EU telco
- Two 2026 M365 account-takeover campaigns (Railway device-code phishing, LSHIY ROPC spray) beat Conditional Access without breaking MFA
- CitrixBleed 2 (CVE-2025-5777) weaponised into a repeatable IAB kill chain ending in DragonForce ransomware (STAC3725)
- RedHook Android RAT abuses ADB Wireless Debugging to self-grant shell (uid 2000) privileges without an exploit
- Psychiatrische Dienste Aargau (PDAG) email accounts compromised via phishing and abused to relay spam
- CERT Polska: UNC1151/Ghostwriter shifts to Gmail with real-time 2FA-relay phishing against officials and public administration
- Mandiant "Ghost in the Database": recovering an active ADFS token-signing key from Machine DPAPI when the WID/DKM Golden SAML path fails
- CVE-2026-40138/-40139/-40140/-40141, BeyondTrust Remote Support / Privileged Remote Access: critical pre-auth bypass, flagged by NCSC-CH
- Jamf Threat Labs documents "PamStealer": a macOS infostealer that validates the victim's password via the PAM API before exfiltrating it
- AdaptHealth breached via a social-engineered hijack of a third-party contractor's session
- Kaspersky: community AI-agent "skills" are an emerging supply-chain surface, OpenClaw marketplace still distributing malicious skills
- Cisco Talos: "ARToken" exposes a full BEC-as-a-service toolkit on top of Microsoft 365 device-code phishing
- Kaspersky GReAT: ToddyCat's "Umbrij" automates Gmail/Workspace OAuth-token theft via Chromium remote-debugging abuse
- CVE-2026-8451, Citrix NetScaler ADC/Gateway: pre-auth SAML memory overread (CitrixBleed lineage), public PoC
- A malicious "Perplexity AI" Chrome extension intercepted every address-bar keystroke via a search-suggest override
- Hijacked npm and Go packages weaponise VS Code's folderOpen task autorun to drop a credential-stealing Python implant
- Keycloak JWT algorithm confusion (CVE-2026-11800): forging federated identity in the EU public sector's dominant IdP
- Island: "BadBlocker"; an 11M-user Chrome ad-blocker is one server config change away from arbitrary JavaScript on any site
- Netcraft: Bluekit PhaaS uses Browser-in-the-Middle to defeat FIDO2 and Device Bound Session Credentials
- FBI/CISA: Russian intelligence now phishing Signal Backup Recovery Keys for persistent account takeover
- macOS.Gaslight, a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst
- ShinyHunters used a single vishing call into the company's identity platform to breach Madison Square Garden
- Edgecution: abusing the Chrome/Edge Native Messaging API as a browser-sandbox-to-host bridge
- CVE-2026-56447, CVE-2026-56446, CVE-2026-56425, CVE-2026-56424, CVE-2026-56423, CVE-2026-56422, MISP 2.5.42: two site-admin RCE paths plus Azure-AD auth and broken-access-control hardening
- NCSC-CH: active Microsoft 365 "voicemail" phishing wave in Switzerland delivers infostealers and harvests M365 credentials
- Swiss Post Cybersecurity publishes its inaugural Swiss Threat Landscape Report
- WhatsApp-borne VBScript silently installs a ManageEngine RMM agent for living-off-the-land remote control
- PostCSS npm typosquats deliver a Nuitka-compiled Python RAT with Chrome DPAPI credential theft
- SonicWall CVE-2024-40766: why patched firewalls keep falling to Akira and Fog
- Elastic shows how the newly-GA Azure AD Graph Activity Logs close a long-standing Entra enumeration blind spot
- Two Scattered Spider members plead guilty over the 2024 Transport for London intrusion
- Klue OAuth-token breach, victim list grows, CRM-API abuse chain detailed
- Cisco ISE CVE-2026-20181 + CVE-2026-20190: an unauthenticated credential-harvest primitive feeding authenticated root code execution on the identity plane
- Mastra npm supply-chain compromise (easy-day-js)
- 15 malicious JetBrains Marketplace plugins exfiltrate AI provider API keys on "Apply"
- FortiBleed, 73,932 internet-facing FortiGate devices exposed, Russian-speaking group cracking credentials into Active Directory
- DragonForce abuses Microsoft Teams TURN relays for C2 and chains four vulnerable drivers (BYOVD)
- Huntress: Potemkin loader delivers RMMProject RAT and bypasses Chromium App-Bound Encryption
- Munich: ~120,000 student records suspected on the darknet, terminated employee under investigation
- Varonis "SearchLeak" (CVE-2026-42824): one-click M365 Copilot data exfiltration, now patched
- WordPress supply-chain compromise via Awesome Motive's CDN backdoors ~1.2M sites
- PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule
- Sekoia: APT28 (GRU Unit 26165) tradecraft shifts to LLM-generated payloads and cloud-native C2
- Velvet Ant "Operation Highland": subverting the Linux authentication stack for a decade
- South Korea fines Coupang a record ₩624.7 bn over an unrevoked signing key held by a former employee
- Novo Nordisk discloses theft of clinical-trial and healthcare-professional data
- ShinyHunters Oracle PeopleSoft campaign: gadget-chain access, SSH default-credential lateral movement, mass exfiltration
- Windows Netlogon RCE CVE-2026-41089 now confirmed exploited in the wild in the EU; CERT-EU issues advisory 2026-007
- ServiceNow unauthenticated REST endpoint queried customer instance tables before a silent 5 June patch
- Red Canary: Microsoft Entra Agent ID abuse, OBO OAuth flow turns a compromised AI agent into a delegated phishing sender
- Unit 42 catalogues cloud-logging defense-evasion across AWS CloudTrail and Google Cloud Logging, with concrete detection mappings
- CVE-2026-44748, SAP June Patch Day: SAML XML Signature Wrapping in NetWeaver AS ABAP (CVSS 9.9) plus an unauth RFC kernel memory-corruption (CVSS 9.8)
- Meta discloses 20,225 Instagram account takeovers via an AI support-tool logic flaw; Maine AG notification filed 8 June
- NCSC-CH Week 23: coordinated surge in job-seeker targeting, fake interviews, reshipping identity theft, and LinkedIn-to-GitHub infostealer delivery
- "Ghost-Sender": Exchange Online accepts spoofed inbound mail bypassing SPF/DKIM/DMARC when a third-party MX fronts the tenant, no vendor patch
- France's Tchap government messenger breached via account takeover, 73,467 civil servants' metadata scraped, CNIL notified
- Unit 42: Microsoft Teams external-chat now a primary phishing surface for APT29 and UNC6692
- Keycloak 26.6.3: privilege escalation via OAuth token-exchange and SSRF in the EU public sector's reference identity platform
- CVE-2026-10868, MISP: critical mass-assignment account-takeover in the EU threat-sharing platform
- Symantec: five-month, low-and-slow mailbox-espionage campaign against a global stock exchange
- One-click GitHub OAuth-token theft via github.dev, full-disclosed with PoC; Microsoft patched 3 June
- Enclave: a single debug flag left on in six Microsoft 365 Android apps allowed silent OAuth-token theft
- Huntress: Windows search: URI handler leaks NTLMv2 hashes, Microsoft declines to patch
- CVE-2026-10611, MISP: OTP bypass when LDAP mixed-auth and OTP enforcement are both enabled
- NCSC Switzerland: Booking.com breach feeds two-pronged WhatsApp hotel-booking phishing against Swiss travellers
- Sophos 2026 Active Adversary Report: identity is the dominant intrusion root cause
- Dashlane discloses TOTP brute-force that downloaded encrypted vaults of fewer than 20 users
- CVE-2026-8931, Disig Web Signer: critical RCE in a Slovak electronic-signature client
- Attackers social-engineer Meta's AI support chatbot into resetting Instagram passwords
- "Miasma" worm backdoors 32 Red Hat Cloud Services npm packages via OIDC trusted-publishing abuse
- California AG sues former 23andMe (Chrome Holding Co.) over the 2023 genetic-data breach, bulk-enumeration coding error plus absent credential-stuffing defences
- "Signal Support" impersonation phishing harvests cloud-backup recovery keys from high-value users
- Red Canary: detecting Entra Agent ID privilege escalation, credential injection into agent blueprints enables lateral movement across the entire tenant
- The Gentlemen ransomware, Microsoft publishes full technical dissection of the Storm-2697 Go-encryptor
- Wiz CIRT names JINX-0164, LinkedIn-recruiter lures, AUDIOFIX macOS infostealer, MINIRAT npm pivot into CI/CD
- CVE-2026-4868 (+ five further CVEs), GitLab 19.0.1 / 18.11.4 / 18.10.7 patch release: Duo AI identity impersonation, unauthenticated project enumeration
- TechCrunch finds 100 K passport scans and selfies on a public-read S3 bucket behind a UK Visa Portal lookalike
- Carnival Corporation confirms 5.99 M-record ShinyHunters breach, passport + driver's-licence numbers exposed across four cruise brands
- Apereo CAS version 7.3.7.1 patches an OIDC-provider flaw reported by Coop Switzerland; CERT-FR issues advisory CERTFR-2026-AVI-0654
- Nx Console / TanStack / DAEMON Tools supply-chain cascade lands three CISA KEV entries
- SANS ISC, Akira ransomware kill chain reconstructed entirely from SSLVPN syslog and Windows EVTX, no EDR
- Dutch National Police arrest 35-year-old over AFC Ajax fan-data breach, misconfigured API access-control and shared keys exposed 300,000+ accounts and 42,000 season-ticket records
- Tycoon 2FA after the March 2026 takedown: two-tier AiTM operator architecture and the OAuth device-code variant
- ShinyHunters Salesforce campaign; Charter and 7-Eleven both confirm; 7-Eleven count put at ~185,000 affected
- Lithuania's Centre of Registers loses ~600,000 state-register records to abused institutional credentials; foreign-state actor suspected
- Google's threat-intel group maps a Chinese-language PhaaS ecosystem doing real-time OTP relay over RCS/iMessage
- CVE-2026-9058, Szafir SDK (KIR): signature-verification routine reports success on an untrusted certificate chain, enabling auth bypass in Polish e-government
- npm ships 2FA-gated "staged publishing" GA in response to the 2026 supply-chain worm waves
- Deleted Google Cloud API keys keep authenticating for up to 23 minutes
- Unit 42, ROADtools operationalised by Midnight Blizzard, Curious Serpens and UTA0355 for Entra ID device registration, token theft and tenant enumeration
- FBI PSA260521, Kali365 OAuth device-code PhaaS bypasses M365 MFA without credential capture
- Megalodon mass-poisons 5,561 GitHub repos in a 6-hour window; SysDiag + Optimize-Build workflows exfiltrate cloud credentials and OIDC tokens
- Verizon 2026 DBIR: vulnerability exploitation overtakes credentials as primary breach vector for the first time in 19 years
- Keycloak 26.6.2, 16 CVEs including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and cross-realm IDOR in Authorization Services (CVE-2026-4630)
- SonicWall Gen6 SSL-VPN incomplete-patching (CVE-2024-12802), Akira-linked actors brute-force MFA via UPN/SAM account-name split, February–March 2026 intrusions
- Webworm (China-aligned) shifts to EU government targets, EchoCreep (Discord C2) and GraphWorm (Microsoft Graph / OneDrive C2) backdoors documented by ESET, with Belgian, Italian, Serbian, Polish and Spanish governmental victims
- Storm-2949 SSPR-to-Key-Vault Azure kill chain
- Nx Console VS Code extension (2.2 M installs) compromised via stolen publisher credentials, 11-minute window 2026-05-18 12:36–12:47 UTC
- Microsoft DCU disrupts Fox Tempest malware-signing-as-a-service feeding Rhysida, INC, Qilin and Akira ransomware operations
- 7-Eleven confirms ShinyHunters breach of 600,000+ Salesforce franchise-application records, same campaign as Instructure, Vimeo, Wynn Resorts, Vercel, Medtronic
- CISA contractor (Nightwing) exposed AWS GovCloud admin keys and internal credentials in public GitHub repo for ~6 months
- Tycoon2FA after the March 2026 takedown, OAuth Device Authorization Grant abuse on Microsoft 365
- CVE-2026-42897 Exchange OWA, EM Service auto-mitigation depends on outbound connectivity to officemitigations.microsoft.com
- Kaspersky GReAT documents Kimsuky's Rust-based HelloDoor and TryCloudflare-tunnel C2 added to the PebbleDash toolkit
- CERT-PL CVE-2026-44088, SzafirHost JAR zip-polyglot bypass in Poland's qualified e-signature browser helper
- SentinelOne: "Living Off the Pipeline", CI/CD subversion taxonomy with three real intrusion cases (TeamCity, GitLab service-account pivot, Contagious Interview)
- Unit 42: Gremlin Stealer evolved with .NET-resource XOR obfuscation, real-time crypto-clipper, and WebSocket browser-process session-hijack module
- node-ipc npm package backdoored via expired-domain account takeover, 90+ credential categories exfiltrated, three malicious versions, ~3-minute window to detection
- GTIG: UNC6671 "BlackFile" vishing → AiTM → rogue-MFA → programmatic SharePoint exfiltration of 1M+ files per victim; DLS shutdown signals probable rebrand
- Sophos 2026 State of Identity Security: Switzerland records highest identity-breach incidence globally; energy and federal government hardest-hit sectors
- CVE-2026-45691, Nextcloud Server / Enterprise Server: 2FA bypass on WebDAV via pre-authenticated session token reuse
- The Gentlemen RaaS, backend "Rocket" database leaked (16.22 GB), Check Point analysis exposes operator handles, ZeroPulse C2 internals, 1,570+ victims, decryptor published on GitHub
- CVE-2026-41089 / CVE-2026-41096 / CVE-2026-41103 / CVE-2026-42898; Microsoft May 2026 Patch Tuesday (120+ CVEs, no zero-days)
- CVE-2026-44277 / CVE-2026-26083, Fortinet FortiAuthenticator and FortiSandbox unauthenticated RCE
- BWH Hotels (Best Western, WorldHotels, Sure Hotels), 181-day unauthorised access to a guest-reservation web application, six EU brands in scope
- German court finds bank liable for sophisticated phishing loss, PSD2/IP-analytics obligations clarified
- Instructure/Canvas extortion: 330 institutions across six countries; May 12 extortion deadline; 44 Dutch institutions confirmed
- MuddyWater (Iran/MOIS) deploys Chaos ransomware as false flag; harvests credentials via Teams