Tag
Microsoft
26 stories since Jul 2025.
- 26
- stories
- OCT 18
- latest
Ongoing Microsoft 365 Campaign Abuses ConnectWise App
Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication.
DENNIS FISHER · OCT 18 · 3 min
All Microsoft
New Campaign Weaponizes Microsoft Teams for Remote Access
Unlike standard commodity malware that aims for quick credential theft, this campaign features a manual, hands-on-keyboard scheme designed to escalate rapidly from a single compromised workstation to broad, network-wide access.
Dennis Fisher · 2 min
Unauthenticated RCE Chain Found For Microsoft SharePoint CVE-2026-55040 and CVE-2026-63520
The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.
Dennis Fisher · 2 min
Critical SharePoint Bug Under Attack
The flaw (CVE-2026-50522) affects SharePoint Enterprise Server 2016 and 2019 as well as SharePoint Subscription service. Microsoft released the fix for this vulnerability on July 14.
Dennis Fisher · 1 minEvil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
Dennis Fisher · 2 min
The Past is Always Present in Vulnerability Disclosure
Microsoft’s reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.
Dennis Fisher · 4 minWindows CVE-2026-32202 Exploited in the Wild
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
Dennis Fisher · 2 minStealthy Deep#Door Stealer Targets Windows Machines, Credentials
Deep#Door stealer is being used in intrusions targeting Windows machines, using an obfuscated deployment chain.
Dennis Fisher · 3 minNew Campaign Targets Mac Users With Novel Malware
The campaign targets high-value individuals and organizations in the cryptocurrency, digital assets, and finance sectors.
Dennis Fisher · 2 min
Myths and Mythos: An AI Vulnerability Research FAQ
It’s still very early days for all of this, and relatively little is known about Claude Mythos’s real capabilities, so we wanted to dig into what actually is known and what it all means.
Dennis Fisher · 6 min
Microsoft, Europol Disrupt Tycoon 2FA Phishing Service
The comprehensive effort, which involved seizing 330 active domains, cuts off a critical pipeline for account takeovers that targeted over 500,000 organizations and sent tens of millions of fraudulent emails monthly.
Dennis Fisher · 3 min
Microsoft Uncovers New Malicious Campaign Targeting Developers
This campaign is an offshoot of the more familiar and pervasive fake job interview and phony tech worker scams that have been coming from North Korea for several years.
Dennis Fisher · 3 min
Microsoft Fixes Six Exploited Bugs in February Patch Tuesday Updates
The exploited vulnerabilities in question exist across various products, from Microsoft Word to Windows Shell.
Decipher · 3 minCybercrime and APT Groups Exploiting WinRAR Bug
Exploitation of CVE-2025-8088 in the wild began before disclosure, with attacks confirmed as early as July 18, 2025.
Dennis Fisher · 4 min
Microsoft Releases Emergency Patch for CVE-2026-21509
The vulnerability (CVE-2026-21509) requires user interaction for an attack to succeed, with the most likely vector being an attacker sending a malicious Office file to a victim, who then opens it.
Dennis Fisher · 1 minMicrosoft Disrupts RedVDS Cybercrime Platform
The takedown marks a significant blow to the cybercrime-as-a-service ecosystem, which fuels large-scale, automated fraud.
Dennis Fisher · 3 minMicrosoft Warns of Exploited Windows Kernel Zero-Day
The important-severity flaw (CVE-2025-62215) has been exploited, said Microsoft.
Lindsey O'Donnell-Welch · 2 minMicrosoft Fixes Actively Exploited Flaws in Patch Tuesday Release
Microsoft issued fixes for several actively exploited vulnerabilities in its latest patch Tuesday release.
Lindsey O'Donnell-Welch · 2 min