Category
Microsoft
- 14
- stories
- OCT 18
- latest
Ongoing Microsoft 365 Campaign Abuses ConnectWise App
Threat actors have compromised a credential within the vendor’s infrastructure, allowing them to abuse a client assertion that bypasses traditional user authentication.
DENNIS FISHER · OCT 18 · 3 min
All Microsoft
Unauthenticated RCE Chain Found For Microsoft SharePoint CVE-2026-55040 and CVE-2026-63520
The chain leverages two distinct vulnerabilities—an authentication bypass and an unsafe .NET type instantiation flaw—to provide full server control without valid credentials.
Dennis Fisher · 2 min
Critical SharePoint Bug Under Attack
The flaw (CVE-2026-50522) affects SharePoint Enterprise Server 2016 and 2019 as well as SharePoint Subscription service. Microsoft released the fix for this vulnerability on July 14.
Dennis Fisher · 1 minNew Forg365 PhaaS Kit Emerges
Like EvilTokens and Kali365, Forg365 is distributed through Telegram and offered as a commoditized service for attackers who want to target Microsoft 365 environments.
Lindsey O'Donnell-Welch · 2 min
Evil Is as Evil Does: New EvilTokens Affiliate Panel Uncovered
This new ARToken operator panel has a clear lineage going back to the EvilTokens framework, which emerged in early 2026.
Dennis Fisher · 2 min
The Past is Always Present in Vulnerability Disclosure
Microsoft’s reaction to the Nightmare-Eclipse saga is raising memories of the worst days of the disclosure debate.
Dennis Fisher · 4 minGitHub Confirms Internal Breach
The company said it is still working through the intrusion but does not believe any customer repositories or data was affected at this point.
Dennis Fisher · 3 min
Windows CVE-2026-32202 Exploited in the Wild
The current exploits are targeting CVE-2026-32202, a bug in the Windows Shell that allows an attacker to gain access to some sensitive data on the target network.
Dennis Fisher · 2 minStealthy Deep#Door Stealer Targets Windows Machines, Credentials
Deep#Door stealer is being used in intrusions targeting Windows machines, using an obfuscated deployment chain.
Dennis Fisher · 3 min
New Campaign Targets Mac Users With Novel Malware
The campaign targets high-value individuals and organizations in the cryptocurrency, digital assets, and finance sectors.
Dennis Fisher · 2 min
Myths and Mythos: An AI Vulnerability Research FAQ
It’s still very early days for all of this, and relatively little is known about Claude Mythos’s real capabilities, so we wanted to dig into what actually is known and what it all means.
Dennis Fisher · 6 min
Microsoft, Europol Disrupt Tycoon 2FA Phishing Service
The comprehensive effort, which involved seizing 330 active domains, cuts off a critical pipeline for account takeovers that targeted over 500,000 organizations and sent tens of millions of fraudulent emails monthly.
Dennis Fisher · 3 min
