CySecurity News - Latest Information Security and Hacking Incidents: Microsoft

Microsoft Microsoft Teams Phishing Attacks Technology User Security

Microsoft Teams to Get AI-Powered Context-Aware Phishing Detection

Microsoft has announced plans to deploy AI-powered phishing detection within Microsoft Teams, extending its security model beyond conventional link- and attachment-based filtering. The forthcoming capability is designed to identify phishing and social-engineering activity by analyzing the conversational context of messages, rather than relying solely on known indicators of compromise such as malicious URLs, payloads, or domains. Microsoft expects the feature to begin rolling out in early November 2026, with general availability anticipated between early and mid-December 2026.

The protection is expected to focus on external first-contact chats, which represent a frequent initial access vector for threat actors. Attackers commonly impersonate IT support personnel, suppliers, recruiters, or internal employees to establish trust before requesting credentials, multi-factor authentication codes, payment authorization, or other sensitive data. Because such campaigns may not include links or attachments, they can evade traditional email-style security controls that depend on observable technical artifacts.

Microsoft states that the new Teams detection system will evaluate contextual signals within conversations to detect deceptive intent, impersonation attempts, and social-engineering patterns. This approach is intended to address increasingly sophisticated phishing techniques in which attackers use legitimate-looking language and normal chat behavior to manipulate recipients. For instance, a message requesting a verification code while posing as an IT administrator may be flagged even if it contains no suspicious URL or file.

From an administrative perspective, Microsoft says the feature will not require manual enablement or a dedicated policy configuration. The protection is expected to activate automatically for most Teams users, reducing deployment overhead for enterprise security teams. When a potentially malicious interaction is detected, Teams will present an in-chat warning, enabling users to verify the sender’s identity, disengage from the conversation, and report or block the suspicious contact.

The tech giant has also emphasized privacy safeguards around the AI-based system. According to the company, customer message content will not be retained for AI model training or used for secondary purposes such as productivity insights, advertising, or employee monitoring. The capability is intended exclusively for security protection. As adversaries increasingly shift phishing operations from email to collaboration platforms, Microsoft’s context-aware detection could provide an additional defensive layer for organizations using Teams for external communication.

Microsoft and Japanese Police Dismantle Network Behind Over 1 Billion Phishing Messages



 

YAM store

cvv Cyber Fraud Fake Captcha Japanese police Malicious Emails Microsoft Phishing Technology YAM store

Microsoft and Japanese Police Dismantle Network Behind Over 1 Billion Phishing Messages

Microsoft and Japan's National Police Agency have jointly dismantled a phishing operation that sent more than 1 billion fraudulent emails and text messages to organizations across 150 countries since January 2026, with over 750 million of those messages directed specifically at Microsoft customers. The action was announced on Tuesday under an order from the U.S. District Court for the Southern District of Florida.

The operation brought together Microsoft's Digital Crimes Unit, the Japan Cybercrime Control Center, Health-ISAC, and private cybersecurity firms including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs. The U.S. Secret Service also participated in the investigation.

The Marketplace

At the center of the operation sits YAM Store, which Microsoft internally tracks as Storm-3119. Investigators describe it as a Chinese-language underground marketplace that sold access to compromised Microsoft 365 and Google cloud environments, software licenses, storage space, and stolen credentials. Chinese-speaking actors are believed to have built the phishing kits it supported, according to Microsoft.

To stock the marketplace, operators bought up expired domains from defunct companies, rebuilt their websites to look active, and used those fake identities to register new cloud accounts. Some went further and built fake companies from scratch, using AI-generated documents, images, and business content to pass verification checks. Once inside Microsoft environments, attackers used stolen application credentials to manage accounts and abused SharePoint and OneDrive to store and deliver phishing content.

Three Phishing Kits

YAM Store operated alongside three phishing kits that Microsoft collectively tracks as Storm-2990: CoGUI, Haozi, and Iron Man. Each kit was rented out on a subscription model, letting operators with little technical background run large, automated fraud campaigns against targets worldwide.

Iron Man was the most developed of the three. Security firm Resecurity, which assisted in the investigation, found that the kit's infrastructure held 911 published build versions and roughly 2,360 phishing packages covering 130 countries and geographic areas, with the catalog receiving updates as recently as October 1, 2026. Its template library contained over 2,300 lure designs impersonating banks, retailers, delivery services, streaming platforms, and government agencies, including traffic and parking authorities. The kit also included a payment-card capture module that collected card numbers, expiry dates, and CVV codes from victims.

To block security researchers and automated scanners, the kits used geofencing, IP filtering lists, and fake CAPTCHA gates that stopped bots while letting real victims through. Operators also received real-time Telegram alerts whenever a victim entered credentials, and some ran live sessions to interact with victims as they responded to lures.

"Over 1 billion malicious email and SMS messages were sent since the start of 2026. More than 750 million of those were aimed directly at Microsoft customers." [Microsoft Digital Crimes Unit, October 2026]

Some campaigns also used device-code phishing, a technique that misuses Microsoft 365's standard device sign-in flow. Rather than stealing passwords directly, attackers tricked victims into entering a short device code, which gave them a valid login token and full access to the account. Microsoft has since recommended that organizations review whether device-code sign-in is necessary and consider restricting it through access policies.

The Takedown

The Florida court order gave Microsoft and Health-ISAC authority to seize and redirect the core domains behind YAM Store, CoGUI, and Iron Man. Microsoft deactivated more than 20,000 accounts linked to YAM Store and blocked over 100,000 domains used for impersonation and fraud. TRM Labs worked to trace and freeze cryptocurrency assets connected to the operation. Infrastructure removal was still continuing as of Tuesday.

Japan's National Police Agency had alerted Microsoft to the operation in late 2025, after a surge of fraud hit Japanese individuals and businesses. Japan ranked as the single most targeted country in the campaign, followed by the United States, Australia, and India. The healthcare sector, financial services companies, wholesale distributors, and IT firms absorbed the largest share of attacks.

No arrests have been announced.

What the wider pattern tells us

The YAM Store action follows a March 2026 takedown of Tycoon 2FA, a separate phishing platform that Europol and Microsoft dismantled together with law enforcement from Latvia, Lithuania, Portugal, Poland, Spain, and the United Kingdom. Tycoon 2FA used adversary-in-the-middle techniques to intercept login credentials and session cookies in real time, bypassing multi-factor authentication and reaching nearly 100,000 organizations since it first appeared in 2023. At its peak in November 2025, the platform was generating over 30 million phishing messages a month. That case resulted in a civil complaint naming Saad Fridi as the alleged creator.

Both operations ran on the same basic model: platforms that sold ready-made attack tools to buyers with little technical skill, letting them run large fraud campaigns cheaply. Microsoft advised organizations to treat email from education and nonprofit domains with extra care, since YAM Store sold cloud accounts tied to real .edu and .org tenants obtained through the domain-buying scheme, making fraudulent emails look like they came from real institutions.

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers



 

Xandr

Advertising Data Regulation European Union GDPR Grindr Microsoft Norway Privacy sensitive data Xandr

Microsoft's Xandr Handed Norway's Largest Privacy Fine for Funneling Grindr User Data to Thousands of Advertisers

Norway's data protection authority has issued its largest fine to date, hitting Microsoft-owned advertising company Xandr with a NOK 92 million ($9.6 million) penalty for passing sensitive personal data belonging to Norwegian Grindr users through automated advertising auctions without a legal basis. The decision, signed October 2 by Datatilsynet Director General Line Coll and Head of International Tobias Judin, targets one of the most contested privacy questions in digital advertising: whether ad intermediaries can claim ignorance of how consent was collected by the apps they serve.

Grindr is a location-based dating app primarily used by gay, bisexual, trans, and queer people. For nearly two years, from July 2018 to April 2020, Xandr sat at the center of the app's advertising infrastructure, operating on both the buying and selling sides of real-time bidding. The process works fast and invisibly. The moment a user opened Grindr, the app passed their data through Xandr to a pool of companies competing in a split-second auction for the right to show that person an ad. Datatilsynet found that this relay included at minimum each user's advertising ID, IP address, and the fact of their Grindr use. Under GDPR, that last detail matters enormously. The authority concluded that being identifiable as a Grindr user is itself information that indicates sexual orientation, a category that European data law places under strict protection and requires explicit consent to process.

Xandr's defense rested on the argument that it believed Grindr had already collected consent from its users. Datatilsynet rejected that reasoning on a straightforward legal basis: Xandr was not a passive conduit but a joint controller alongside Grindr. Under GDPR's joint controller framework, both parties carry independent obligations to confirm a lawful basis exists before processing sensitive data. Xandr never verified that any such basis was in place, and the authority ruled that the company had no right to treat consent as someone else's responsibility. "Xandr omitted to verify that the consents from Grindr were valid, and did not do anything to ensure they had a legal basis for their own processing," Coll stated in the decision.

The investigation turned up a complicating detail. Xandr had been notified of the probe by Datatilsynet in February 2020. Despite that, the company deleted documentation about its processing of Grindr users' data between July 2020 and February 2023, when the authority sent a second information order. Xandr told investigators the deletion had occurred as part of its routine data retention policies. Datatilsynet refused to let that explanation close the gap, noting that the company knew an active investigation was underway when the records were removed.

In setting the penalty at NOK 92 million, Datatilsynet cited the duration of the violations, the direct financial benefit Xandr drew from the unlawful sharing, and the fact that thousands of Norwegian users had their sensitive data exposed to potentially thousands of companies without their knowledge. Crucially, the fine was calculated against Xandr's own annual turnover and not Microsoft's. The authority noted that the violations took place before Microsoft completed its acquisition of Xandr in June 2022, after AT&T sold the unit it had rebranded from AppNexus in 2019.

A Microsoft spokesperson mentioned that the investigation "focused on conduct that predates Microsoft's acquisition of Xandr," adding that interpretations and applications of legal standards have continued to evolve since then. The company said it is reviewing the decision and assessing its options. Xandr, which now operates as Microsoft Advertising, has three weeks to appeal to Norway's Privacy Appeals Board.

The case has roots in January 2020, when the Norwegian Consumer Council filed complaints against Grindr and five ad tech companies: AppNexus, MoPub, OpenX, AdColony, and Smaato. Austrian privacy rights organization noyb joined the action and celebrated the outcome, calling the decision "a major blow to the online adtech industry." This week's fine against Xandr is the downstream enforcement of a broader probe that, on the Grindr side, produced a NOK 65 million penalty against the app itself in 2021. Norway's Borgarting Court of Appeal upheld that fine against Grindr in October 2025 after the company challenged it through two rounds of litigation.

Grindr's data-sharing history has had consequences beyond Norwegian borders as well. In September 2026, the dating app agreed to pay £26 million to settle a UK class action brought by roughly 12,000 users who alleged the platform had shared information including HIV status, sexual orientation, ethnicity, and location with third-party advertising firms before 2020. The London lawsuit, filed in April 2024 by law firm Austen Hays, alleged violations of UK data protection law during roughly the same period covered by the Norwegian proceedings.

The Datatilsynet decision marks one of the more pointed statements yet from a European privacy regulator on how far down an ad supply chain accountability can reach. By treating Xandr as a joint controller rather than an infrastructure provider, the authority made clear that operating the pipes through which sensitive data flows carries its own legal obligations, regardless of which company collected the data in the first place.

Microsoft Exchange Vulnerability Could Leak Confidential Organizational Info



 

Severe Flaw

Cyber Security Microsoft Microsoft Exchange Organization Security Severe Flaw

Microsoft Exchange Vulnerability Could Leak Confidential Organizational Info

Microsoft has issued an emergency security update to fix a vulnerability in Exchange Server that could expose confidential organizational communications. The flaw, tracked as CVE-2026-96940, has received a CVSS severity score of 8.8 out of 10.

Reported by TechRadar, the vulnerability could allow attackers who already have valid login credentials to increase their privileges within Exchange and access mailboxes belonging to other users. Microsoft released the fix on October 2, ahead of its originally intended schedule.

About the flaw

The security issue stems from a weakness in authorization controls, which determine what information a user can access. By exploiting the flaw over a network, an authenticated attacker could gain permissions beyond those assigned to their account.

Threat actors could first obtain credentials through phishing attacks or by purchasing stolen login details from underground online markets. Once inside an organization’s Exchange environment, they could exploit the vulnerability to read emails and attachments belonging to other employees.

However, the flaw does not provide unrestricted access across different customer environments, known as tenants. It also does not directly grant administrator-level or SYSTEM-level privileges on the underlying Windows server.

What happens in case of successful exploitation?

Successful exploitation could expose sensitive business information, including financial records, invoices, contracts, customer correspondence, internal discussions, and confidential documents.

Attackers could use the stolen information to support further cyberattacks. For example, they might impersonate company employees, send convincing fraudulent emails, or conduct business email compromise (BEC) scams to trick organizations into transferring money or disclosing additional information.

The vulnerability is particularly problematic because an ordinary employee’s compromised account could potentially provide an entry point for accessing information held in other employees’ mailboxes.

Affected products

The vulnerability affects the following on-premises products:

Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Updates 14 and 15

Microsoft has confirmed that Exchange Online customers are protected by a server-side fix. Organizations running affected on-premises installations should install the appropriate security updates promptly.

Exchange Server 2016 and 2019 have reached the end of their standard support lifecycle. Eligible organizations must be enrolled in Microsoft’s Extended Security Update programme to receive the relevant updates for these versions. Microsoft recommends that organizations without the required coverage migrate to Exchange Server Subscription Edition.

Microsoft’s response

Microsoft reported no evidence that the vulnerability was being actively exploited at the time of the report. However, the company assessed that exploitation was more likely, making timely patching important.

Administrators should run Microsoft’s Exchange Server Health Checker after installing the update to verify successful deployment and identify any additional actions required.

Japanase Media Company Nikkei Reveals Intrusions Attacking Users and Employees



 

User Data

Cyber Attacks Data Leak Data Privacy Google Microsoft Nikkei User Data

Japanase Media Company Nikkei Reveals Intrusions Attacking Users and Employees

Japanese media company Nikkei has disclosed two separate cyber incidents involving employee accounts on Microsoft 365 and Google Workspace. One of the incidents allowed attackers to use an employee's account to send about 9,000 phishing emails, while the other may have exposed the personal information of 1,646 employees and business partners.

The incidents were disclosed on October 4 and reveal the risks organizations face when attackers gain access to legitimate employee accounts. Nikkei has not attributed either incident to a specific hacking group or confirmed whether the two attacks were connected.

Microsoft 365 account used to send phishing mails

The more recent incident involved an employee's Microsoft 365 account. According to Nikkei, attackers gained unauthorized access to the account and used it on September 30 to send approximately 9,000 emails.

The messages were sent to people both inside and outside the company. Some recipients were journalistic sources and other individuals who had previously communicated with Nikkei employees.

The emails contained links leading to malicious websites. Because the messages were sent from a legitimate Nikkei employee account, recipients could have been more likely to trust them. This type of account compromise can allow attackers to use an organization's existing relationships to distribute phishing messages.

Nikkei said the incident may have exposed recipients' names and email addresses, along with the contents of some emails. The company is still investigating the number of people whose personal information may have been affected. According to Nikkei, “There may be an increase in emails impersonating Nikkei employees or our group companies,”

Google workspace breach

Nikkei also disclosed a separate incident involving an employee's Google Workspace account. The account was accessed without authorization beginning in late July.

The company discovered the intrusion in early August after receiving an alert from Google. Nikkei then changed the account's password and said it has not detected any further unauthorized access.

The incident may have exposed information belonging to 1,646 employees and business partners. The potentially affected information included names and email addresses.

Nikkei said the exposed information did not include data related to its readers or journalistic sources. The company also said it has found no evidence that the information was misused.

Nikkei’s response

After the Microsoft 365 incident, Nikkei changed the affected password and contacted recipients of the phishing emails, asking them to delete the messages. The company warned that additional emails impersonating Nikkei employees or its group companies could appear.

Nikkei has also reported the incidents to Japan's data protection authority. Investigations into the scope of the Microsoft 365 compromise and the information potentially exposed are continuing.

Nikkei has experienced other cybersecurity incidents in recent years. In November 2025, the company disclosed a malware-related credential theft incident that potentially exposed information connected to more than 17,000 employees and business partners.

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Campaigns



 

Phishing Email

Cyber Attacks Microsoft MSP360 RMM Phishing Email

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Campaigns

Microsoft has warned of a new wave of phishing campaigns that abuse the legitimate MSP360 Remote Monitoring and Management (RMM) software to establish persistent remote access on victim devices. Once this foothold is secured, attackers deploy a second RMM tool, ConnectWise ScreenConnect, creating a redundant channel for control and further malicious activity. This dual-RMM technique enables threat actors to blend into normal IT operations while carrying out credential theft and data exfiltration with reduced risk of detection.

The attack chain, observed by Microsoft in July 2026, begins with phishing emails disguised as meeting invites, PDF-related lures, or fake software update prompts. These messages distribute a digitally signed MSP360 RMM v2.5.0.67 installer under deceptive filenames such as “ZoomSetup_Installation_v2.5.0.67_ oid[redacted].exe” or “PDF Reader & Editor the Adobe Acrobatte_rmm_v2.5.0.67_ oid[redacted].exe.” When executed, the installer drops multiple DLLs, triggers a User Account Control (UAC) elevation to gain privileged context, and establishes persistence by registering Windows services and autorun Registry entries. It also modifies Windows Firewall rules to allow inbound UDP traffic to MSP360 on port 48678, ensuring uninterrupted remote access.

With MSP360 in place, attackers leverage its PowerShell execution capabilities to stealthily install ScreenConnect on the compromised endpoint. This second RMM client provides a backup remote-access path and is used to transfer additional payloads, run post-compromise tools, and perform information collection and credential-access operations. Microsoft notes that ScreenConnect’s native RunFile functionality is abused to execute these payloads, further camouflaging malicious activity within legitimate administrative workflows. The combination of two trusted RMM platforms gives attackers flexibility and resilience, allowing them to maintain control even if one channel is disrupted.

In a parallel set of incidents during the same period, Microsoft observed attackers substituting MSP360 with Faronics Deploy Agent before installing ScreenConnect, indicating a broader pattern of RMM abuse. While no specific threat group has been attributed to these campaigns, the consistent use of multiple RMM tools suggests a coordinated effort to maximize persistence and minimize detection. By relying on signed, legitimate software, attackers reduce the likelihood of triggering endpoint security alerts, making these intrusions particularly challenging to identify without behavioral monitoring.

Organizations are advised to enforce strict application allowlisting, monitor for unusual RMM installations, and scrutinize processes that invoke UAC elevation or modify firewall rules. Security teams should also track anomalous PowerShell activity and unexpected service registrations linked to RMM agents. As remote administration tools become increasingly weaponized, a defense-in-depth strategy combining endpoint detection, network segmentation, and user awareness training is critical to mitigating dual-RMM phishing threats.

New TerminalFix Campaign Attacks via Fake CAPTCHAs and Installs Backdoors



 

TerminalFix

Backdoors ClickFix Cyber Attacks Microsoft TerminalFix

New TerminalFix Campaign Attacks via Fake CAPTCHAs and Installs Backdoors

Microsoft has revealed information of a new ClickFix version, called TerminalFix, that intends to lure users into launching a malicious command in PowerShell or Windows Terminal.

TerminalFix is attacking organizations across various industries.

About the ClickFix campaign

The campaign deploys hacked websites to show a fake Cloudflare CAPTCHA authentication overlay that lures users into copying and running a malicious PowerShell command.

Although traditional ClickFix campaigns send victims to the Windows Run dialog, TerminalFix campaigns use the same tactic but send users to PowerShell or TerminalFix instead. This increases the execution of complex, multi-line scripts successfully.

Attack tactic

Contrary to earlier ClickFix versions that usually deploy a single infostealer, this TerminalFix campaigns uses an advanced multi-stage attack chain that integrates “DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a custom reverse-tunnel implant – giving the attacker persistent, network-level proxy access through the compromised host,” said Microsoft.

After execution, the Powershell commands mimics as a Cloudflare authentication process while downloading a ZIP archive which contains an authentic binary and a compromised DLL used for sideloading.

DLL sideloading

The sideloaded DLL initiates a detailed second stage, downloading payloads hidden inside PNG images via steganography, creating dual persistence via scheduled tasks and Registry Run key, doing robust domain reconnaissance. Lastly, it deploys a Python-based reverse-tunnel C2 implant that channels arbitrary TCP traffic back via an encoded WebSocket channel to threat actor infrastructure.

This type of invasion can be dangerous as it offers threat actors with direct access to a firm’s internal network via the reverse tunnel.

The reverse-tunnel capability and discovered reconnaissance could allow a threat actor to locate and reach additional systems from an infected host. According to Microsoft, firms should treat impacted devices as possible network pivot points and look out for credential exposure and lateral movement.

Implications

Threat actors can use this access to disable security controls, deploy ransomware across the organization, escalate privileges, and exfiltrate sensitive data.

The mix of stealth tactics such as hidden folders, DLL sideloading, steganography and persistent network access result in this TerminalFix campaign a real danger to enterprise environments.

According to Microsoft, “Customers can use Microsoft Defender XDR Threat analytics and related Microsoft threat intelligence reporting to stay current on the malicious activity, indicators, detection coverage, and recommended response actions associated with this compromise.”

Hackers Linked to China Install StormEncryptor Ransomware



 

StormEncryptor

China malware Microsoft Ransomware StormEncryptor

Hackers Linked to China Install StormEncryptor Ransomware

Threat actor links to China

Microsoft has revealed that a financially motivated hacker linked to China, called Storm-1175 has installed an earlier undocumented ransomware strain known as StormEncryptor. Storm-1175 is believed to exploit a critical flaw in a cybersecurity supply-chain campaign where threat actors can install custom ransomware throughout large list of target networks.

Storm-1175 began installing a new ransomware strain, Microsoft Threat Intelligence warned this week. Threat actors earlier deployed Medusa ransomware to take money from finance organizations, healthcare providers, and professional services in the US, Australia, and Britain.

About the attack

In April 2026, the threat actors operated “high-velocity ransomware campaigns,” abusing both recently revealed zero-day exploits and flaws, “in some cases a full week before public vulnerability disclosure.” Microsoft warned it had observed the gang transition from initial access to full encryption in less than 24 hours.

In the recent campaign, according to Microsoft, the group may be exploiting CVE-2026-18577- a flaw in the N-central, a remote monitoring and management (RMM) console used by various service providers to supervise client endpoints.

Attack tactic

Microsoft has not officially verified the access vector, but found that StormEncryptor installations started the same day the bug was revealed. The flaw allows threat actors “unauthenticated, ‘god-mode’ access,” warned cybersecurity firm Huntress.

The flaw permits threat actors with no credentials to get full administrative command over the N-central server to handle clients’ machines remotely’. The single hacked server becomes an entry point to every endpoint it commands. A single provider can offer dozens of ransomware incidents throughout its entire client base.

A similar supply-chain attack on an RMM tool in 2021 from software provider Kaseya permitted Revil ransomware group to hack 60 of Kaseya’s direct consumers before attacking 1,500 downstream organizations.

In 2024, another supply chain attack on an RMM, affected ConnectWise’s ScreenConnect product. It resulted in various downstream ransomware campaigns. According to Microsoft, Storm-1175 was amid the various gangs attacking ScreenConnect during that phase.

Estimates of impacted firms have not been confirmed. Parent company N-central’s N-able software company said it reached out to a limited number of impacted customers. Huntress has acknowledged few of its own consumers were affected and posted a timeline demonstrating how the threat actors travelled across downstream hosts in two cases, but Huntress did not verify the number of downstream organizations impacted from the ransomware attacks.

HollowGraph Malware Abuses Microsoft 365 Calendars for Covert Command-and-Control



 

Microsoft data breach

Cyber Attacks data security Data Theft Malware attacks Microsoft Microsoft 365 Security Microsoft data breach

HollowGraph Malware Abuses Microsoft 365 Calendars for Covert Command-and-Control

The malware component HollowGraph is using Microsoft 365 mailbox calendars to hide its C2 channels and traffic, enabling the bad actors to communicate with the malware and exfiltrate the data. Group-IB researchers note that HollowGraph is a part of the Cavern command-and-control framework used by the Iranian nation-state actor previously observed targeting Israeli organizations. Researchers note that at least 12 Microsoft 365 mailboxes were compromised using HollowGraph, and three of them established communication with the attackers’ C2 servers between June 3 and July 9.

Additionally, based on the infrastructure and victims’ location, Group-IB experts suggest that Israel is the likely target of this malware. The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox. It stores the configuration data in the logAzure.txt file, which contains the Microsoft Entra ID information, client credentials, mailbox addresses of the victims, domains controlled by the attackers, and keys required to communicate with the C2 infrastructure.

The attackers have taken measures to ensure that this file is not suspicious; specifically, it is placed in the known location used by Microsoft Entra ID and has the standard log file name. The malware communicates with its C2 server using the Microsoft 365 calendars. Specifically, HollowGraph creates events scheduled on May 13, 2050, and uses their titles and attachments to exchange data with the attackers. There are two types of such events: GET and SEND. The first one is used to retrieve the encrypted commands by extracting the contents of the event’s title.

In turn, the SEND type of events is used to exfiltrate the stolen data by adding it as an attachment. Researchers note that the mailbox calendars are used as a “dead drop” to store the data; hence, HollowGraph does not use traditional C2 servers to avoid detection. It implements a strong encryption scheme to protect the command and data exfiltration channels and uses a combination of RSA and AES_256_GCM encryption algorithms. The RSA public key is embedded into the calendar event, whereas the HollowGraph malware uses the AES key to encrypt the data.

Besides the Microsoft Graph API, HollowGraph also uses the Domain Name System (DNS) to communicate with its C2 servers. Specifically, the malware resolves the domains controlled by the attackers to extract the IPv6 AAAA records, which contains the updated Microsoft Entra ID credentials required to maintain persistence on the compromised mailboxes. Similar to the information stored in the logAzure.txt file, these credentials include the Microsoft Entra ID tenant, client ID and secret, and the mailbox information.

All of these credentials are extracted from the DNS responses and stored in the malware configuration. Group-IB researchers conclude that HollowGraph is a sophisticated backdoor that utilizes various cybersecurity technologies to compromise targeted Microsoft 365 mailboxes and remain undetected for as long as possible. While the technical capabilities of this malware component overlaps with the ones attributed to the Lyceum Iranian nation-state actor, the researchers are not certain about its origin.

Nevertheless, Group-IB experts note that there is a high likelihood that HollowGraph belongs to the Cavern framework used by Lyceum. To detect and prevent similar attacks, the cybersecurity experts recommend that organizations monitor the Microsoft Graph API activity and Microsoft 365 audit logs for any suspicious activities related to the creation of the calendar events. Specifically, defenders should pay attention to the events created by applications using the Microsoft Graph API scheduled far in the future, with the suspicious subjects and attachments.

The researchers also recommend that organizations add the cloudlanecdn[.]com domain to their threat intelligence platforms and continuously monitor their Microsoft 365 environments for any unauthorized OAuth client credential applications. In addition, Group-IB experts note that Microsoft Entra ID Conditional Access policies and outbound DNS traffic should be reviewed to detect and block similar恶意 activities, such as DNS tunneling. This report highlights the importance of the growing threat landscape in cloud environments caused by the increasing reliance on the collaborative software in enterprise networks.

Malware components like HollowGraph demonstrate that the attackers do not limit themselves to traditional network security tools and can use the trusted infrastructure to launch attacks against various organizations. In particular, the attackers utilize the cloud infrastructure as a part of their mitigation strategy. In turn, the defenders should shift their focus from traditional network perimeter security to inspecting individual hosts and applications for detecting malicious activities.

Microsoft Warns of Rising ACR Stealer Campaigns Targeting Enterprise Credentials



 

Microsoft

ClickFix Cyber Attacks data security Data Stealer Enterprise security Infostealer Malware Malware attacks Microsoft

Microsoft Warns of Rising ACR Stealer Campaigns Targeting Enterprise Credentials

Microsoft has observed an uptick in attacks using the ACR Stealer information-stealing malware family. Attackers distributed the malicious payload targeting enterprise users and compromising browser data, authentication tokens, and sensitive business files between late April and mid-June 2026.

The malware operators used ClickFix social engineering, WebDAV servers, and Microsoft HTML Application Host utilities to deliver the payload to the target systems. Microsoft notes that ACR Stealer is a malware-as-a-service (MaaS) that likely represents repackaged Amatera Stealer. It is a remote-access tool that steals credentials and sensitive data from the target systems and uses various methods to avoid detection. Microsoft reported that there are two main attack chains that the attackers used to distribute ACR Stealer.

The first one began with a ClickFix lure诱导 users to run a command that triggered a remote WebDAV server. Specifically, the malicious command used rundll32.exe, a legitimate Windows process, to execute a DLL file located on the remote server. The attackers used WebDAV to host the payload because the file system structure of the server was similar to the standard Windows file system, which helped the malicious traffic to blend in with network traffic.

After establishing a connection to the command-and-control (C2) server, the attackers delivered an obfuscated PowerShell script that initiated the malware installation process. It downloaded the malware payload as a Python loader, installed scheduled tasks to maintain persistence, and attempted to clear the event logs, PowerShell history, and other tracking mechanisms. The malware also used process injection to execute itself in memory, evading detection by security software. Some ACR Stealer variants used blockchain-based dead-drop resolvers to receive updates or C2 addresses.

In this technique, the attackers used publicly accessible blockchain addresses to store encryption keys and other data needed to retrieve the payload, also known as EtherHiding. The second attack chain also began with a ClickFix lure but used MSHTA to execute the payload. In this method, the attackers tricked the users into launching a Microsoft HTML Application that delivered an obfuscated PowerShell downloader to the target system. The downloader then retrieved an encrypted payload from a public steganographic JPEG image and executed it in memory.

In both attack chains, the malware maintained persistence by installing scheduled tasks, encrypting and decrypting browser credentials using Windows Data Protection API (DPAPI), and injecting itself into processes. It also stole browser data, including cookies, tokens, and passwords, by targeting the Chromium database used by Google Chrome and Microsoft Edge browsers.

Additionally, the malware scanned the target system for PDF files, Microsoft 365 documents, and files stored in the Desktop, Downloads, and other folders and enterprise file-sharing platforms such as OneDrive and SharePoint. Microsoft notes that the observed attacks only represent a subset of the initial ACR Stealer delivery methods. The tech giant added that the malware operators could use various other attack chains to compromise enterprise systems.

Microsoft advises users never to copy commands from websites that claim to repair errors or confirm their human identity, as attackers often use such websites to deliver malware. It also recommends that organizations limit user access to unnecessary online resources and deny access to domains associated with new and suspicious websites.

The company also advises organizations to use application control policies to block PowerShell, Python, MSHTA, rundll32.exe, and other utilities from running obfuscated scripts or downloading content from remote or user-controlled sites. Microsoft also published a list of mitigation measures and indicators of compromise (IOCs) that can help organizations detect ACR Stealer attacks.

Microsoft-Signed Driver Used to Disable Security Software in GodDamn Ransomware Attacks



 

software

Cybersecurity Hyadina Microsoft PoisonX RaaS ransomware software

Microsoft-Signed Driver Used to Disable Security Software in GodDamn Ransomware Attacks

A ransomware group known as Hyadina has been observed using a Microsoft-signed Windows kernel driver to disable endpoint security software before deploying its latest ransomware variant, GodDamn, according to researchers at Symantec. The campaign combines trusted administrative software, publicly available offensive security tools and a signed kernel driver to establish control over victim environments before encrypting systems.

Hyadina has operated as a ransomware-as-a-service (RaaS) group for approximately four years, evolving its malware from earlier variants known as Beast and Monster to its current GodDamn locker. The group primarily targets organizations in the United States while reportedly avoiding victims in former Soviet countries. Previous attacks have affected organizations across healthcare, manufacturing, education and several other industries.

Symantec was unable to determine how the attackers initially gained access to the compromised environment. The first confirmed activity appeared on May 29, when an unauthorized copy of AnyDesk was discovered inside the Music folder of an infected system. Although AnyDesk is legitimate remote access software widely used for IT support, threat actors frequently abuse remote monitoring and management applications because they provide persistent access while blending into normal administrative activity.

The following day, the attackers deployed an executable named symantec.exe, which installed a kernel-mode driver called PoisonX. Running in the Windows kernel gives a driver the highest level of system privileges, allowing it to interact directly with core operating system functions. According to Symantec, PoisonX carried a valid Microsoft Hardware Compatibility signature, enabling Windows to load the driver as trusted.

Once active, PoisonX terminated security-related processes and removed user-mode API hooks commonly used by endpoint detection and response (EDR) solutions to monitor application behavior. By disabling those monitoring mechanisms, the attackers reduced the visibility of security software before carrying out the remaining stages of the intrusion.

With endpoint protections weakened, Hyadina expanded its operation using a collection of credential theft and reconnaissance utilities. Investigators observed fourteen open-source tools designed to recover credentials from web browsers, email clients and instant messaging applications, as well as utilities capable of extracting Wi-Fi credentials and capturing live network traffic. All but one of those tools originated from NirSoft, which publishes legitimate Windows administration utilities. The remaining tool, Mimikatz, is widely known for extracting credentials and authentication material from Windows systems and is frequently abused during post-compromise activity.

The attackers also relied on PsExec, Microsoft's remote administration utility, to move laterally across the victim's network. Combined with legitimate remote management software, credential theft utilities and the signed kernel driver, the attackers were able to strengthen their foothold across multiple systems before deploying the GodDamn ransomware payload.

Symantec also examined the origins of PoisonX. The driver was uploaded to GitHub on April 7 by a developer using the name oxfemale, who described it as a research tool. The developer regularly publishes offensive security projects, including exploit proof-of-concepts, credential stealers and software designed to disable antivirus products, while identifying themselves on LinkedIn as a Russian security researcher specializing in reverse engineering and penetration testing. Symantec, however, considers PoisonX to be malware because its primary function is to disable security protections rather than support legitimate defensive research. Researchers said it remains unclear how the driver obtained Microsoft's Hardware Compatibility signature or whether the signing process was manipulated.

Microsoft maintains a Vulnerable Driver Blocklist to prevent known malicious or exploitable drivers from loading, even when they possess valid signatures. However, Symantec noted that newly identified drivers are not added to the blocklist immediately. Updates can take days or, in some cases, weeks to reach enterprise systems, leaving a window during which attackers can continue using newly signed or newly discovered drivers before defensive protections are updated.

Commenting on the broader use of legitimate software during ransomware intrusions, Symantec's Brigid O Gorman noted that nearly any administrative or security tool can become malicious when misused. She said this makes behavioral and adaptive security controls particularly important because they focus on suspicious activity rather than relying solely on known malicious files or applications. In the case of Hyadina, that combination of trusted software, publicly available offensive tools and a signed kernel driver enabled the attackers to disable security protections, steal credentials, move laterally through the environment and ultimately deploy ransomware.

Microsoft and Google Remove ModHeader After Finding Dormant Collector



 

Technology

Browser Google Microsoft ModHeader Technology

Microsoft and Google Remove ModHeader After Finding Dormant Collector

ModHeader is a famous header-editing extension with over 1.6 million installs across Microsoft’s Edge and Google’ Chrome browser.

Google and Microsoft remove the collector

Experts discovered a secret browsing-history collector built into its official store variant, and have withdrawn the ModHeader from Google and Microsoft.

An empty allow-list kept the collector switched off and it was dormant, and no proof has surfaced that it retrieved or sent even one browsing domain.

About the discovery

Stripe OLT, a UK cybersecurity organization analyzed the code against Google’s Web Store signature and verified the collector shipped within the authentic extension, not a fake one.

Stripe OLT’s study covers the Chrome build and its 900,000 users (an estimate); and Edge and its 700,000 users. Microsoft removed the listing on July 3rd whereas Google pulled the Chrome listing a week after, on July 10th.

Attack tactic

Variant 7.0.18 still edits HTTP headers as shown. The same minimized background also consists of another system. On the first attempt, it makes a device fingerprint and deploys a hardcoded encryption key. As the user browses, it takes the domain from each page that user opens, encodes it, and gathers it locally, up to 1000 different domains.

Scheduler and other things

A scheduler combines your fingerprint with the encrypted list, uploads it to api.stanfordstudies[.]com, and deletes the local copy once a day. If the collector were turned on, browsers using it wouldn't all beacon at once because the upload time is offset per install. The same pipeline is described in separate teardowns by researcher Yunus Aydin on version 7.0.17 and HackIndex on version 7.0.18.

How does collector function

The collector functions only if your browser matches an entry on an internal allow-list, but the list ships empty. Every time, the check fails, and the pipeline stops before it gathers even a single domain.

The small change is populating the list, without any click and no new permissions from the users, sent as a routine update. The endpoint URL, the scheduler, the storage logic, and the hardcoded key are all on the same device.

But not everything was silent. The extension pinged extensions-hub[.]com with the product, version, and browser when it was installed, updated, and uninstalled.

Additionally, it was evident that the piece had been running because a script that runs on every page had already recorded actual request metadata in plain text to local storage.

Operation Endgame Disrupts Global Cyber Crime Assembly Line



 

Scams

CyberCrime Malware Attack Microsoft Operation Endgame Ransomware Scams

Operation Endgame Disrupts Global Cyber Crime Assembly Line

Private companies and international authorities have disrupted a malicious “assembly line” that let hackers steal millions of login details and theft of $47 million in ransom payments via extortion. The operation aimed at catching two tools that are used in online scams.

The first tool is called Amadey, a malware-as-a-service platform for disrupting devices and deploying infected payloads for ransomware and related attacks. Amadey was first discovered in 2018 and in 2025, it exploited GitHub as it stored system info from malicious devices and deployed custom payloads.

The second tool is called StealC, it is an infostealer-as-a-service tool that steals cryptocurrency wallets, browser extensions, authentication cookies, and login credentials.

Disrupting a crucial link in the cyberattacks chain

Amadey and StealC are distinct tools that function autonomously. They are widely used, but many people use them in their personal cybercrime operations.

The tools depend on the same infrastructure to function. Microsoft made this link after analyzing the tools using AI. The discovery allowed Microsoft to stop both tools simultaneously.

“This action goes after the cybercrime ‘assembly line,’ where coordinated tools drive ransomware, financial fraud, and disruptions to public services. Amadey and StealC are often used alongside each other: Amadey helps attackers gain access to devices, while StealC steals passwords and sensitive information. Together, they form a critical link in the chain,” Microsoft said.

About the investigation

Companies gathered proof that the tools shared the same infrastructure and invoked RICO statutes against organized crime. This resulted in treating the two tools as part of a single scam.

Microsoft has disrupted over 200 C2 servers and shut down criminal control of over 18,000 compromised computers. Europol also assisted in the operation to track down the culprits and recovered around 27 million stolen login details and found $47 million worth of crypto assets tied to cybercriminals.

“During this action, 326 servers and 142 domains were actioned by law enforcement and the private sector partners, severely crippling the malware’s distribution network. By taking down these tools simultaneously, the collaboration between law enforcement and private parties has increased friction for cybercriminals, making it harder for attacks to succeed, spread, or recover,” Europol said.

Operation Endgame

Other firms that helped in “Operation Endgame” are ESET, IBM X-Force, ESET, Mitsui Bussan Secure Directions, and Bitsight.

According to Europol, another tool that disrupted Operation Endgame was SocGholish. It is a malware installer tied to the Russian cybercrime group Evil Corp. that distributes via hacked websites. If you visit such sites, you will be tricked into installing malware apps mimicking as browser extensions or genuine software.

GhostApproval Symlink Codes Could Run Malicious Codes in AI Coding Agents



 

Technology

AI ai agents ChatGPT Claude Google Microsoft Technology

GhostApproval Symlink Codes Could Run Malicious Codes in AI Coding Agents

Cyber security experts at Wiz discovered that a bug in six famous AI coding assistants allows a booby-trapped code project to silently take over a developer’s system. The assistant can ask access to edit one innocent-looking file, but the write takes over a sensitive file.

The impacted tools are Windsurf, Google Antigravity, Cursor, Amazon Q Developer, Claude Code by Anthropic, and Augment. Wiz has termed the technique GhostApproval and posted it recently.

Three of the six AI assistants have addressed, two did not, while Anthropic argues if it is a bug. The most vulnerable are the tools that modify file before you can notice.

Attack tactic

The threat actors exploit an old Unix feature called symlink (or symbolic link), that AI assistants cannot check.

A symlink silently directs to other files somewhere else on disk, hence writing to it particularly writes to the victim.

“Symbolic links have been a security headache since the early days of Unix. From /tmp race conditions to privilege escalation exploits, symlinks have a long history of bypassing security boundaries by making one path silently resolve to another. It's a well-documented attack primitive - CWE-61 dates back decades,” Wiz said.

Research model

Wiz made a malicious repository with a symbolic link called project_settings.json that really directs to target’s SSH login file, ~/.ssh/authorized_keys. The repo’s README commands the assistant to put “a line” to project_settings.json, and this line is the hacker’s SSH key mimicking an innocent setting. “

If you ask the agent to “set up the workspace” or “follow the README,” it writes the key directly via the symlink into the login file. Following this, if the machine plays an SSH service the threat actor can access, they can sign in without password.

The second variant

Another variant of the attack writes to your shell startup file, ~/.zshrc, which the shell runs the next moment you open a terminal without needing an SSH. There are no indications that any of this has been abused in real-time operations, Wiz has only demonstrated it as their research.

“Symlinks have been exploited for decades – in race conditions (CVE-2018-15664), in package managers (CVE-2021-32803), in container escapes (CVE-2024-21626). Any time a tool writes to a user-controlled path without resolving it first, symlinks become a weapon,” Wiz wrote in its blog.

BlueHammer Microsoft Defender Vulnerability Linked to Ransomware Attacks After CISA Confirms Active Exploitation



 

Microsoft Defender vulnerability

BlueHammer Vulnerability CISA Cyber Attacks Cyber Campaigns Cyber Security Ransomware Attacks Malware attacks Microsoft Microsoft Defender vulnerability

BlueHammer Microsoft Defender Vulnerability Linked to Ransomware Attacks After CISA Confirms Active Exploitation

Microsoft Defender users are advised to update their software after discovering a security flaw known as BlueHammer was used in ransomware attacks. The weakness with identifier CVE-2026-33825 has been added to the list of flaws actively used by malicious actors. It is part of the growing trend of ransomware attackers using zero-day issues.

The issue was uncovered after the cybersecurity researcher, otherwise known as Chaotic Eclipse or Nightmare Eclipse, shared the information regarding another vulnerability before the update was released. The same individual has criticized Microsoft several times over their approach to disclosure of security weaknesses. The researcher has published multiple posts about actively used problems prior to the official date of their resolution.

Microsoft published the details regarding BlueHammer on April 2nd, whereas the security update was released on April 14th. The flaw was categorized as a privilege escalation vulnerability with the ability to escalate the privileges of an authenticated attacker. However, Microsoft updated the description, specifying the risk as more likely than not, while refraining from officially acknowledging active exploitation.

According to the independent security researchers, the vulnerability was actively used by ransomware operators before the release of the mentioned security update. The evidence came from the report by the Huntress team, which discovered multiple attacks that incorporated CVE-2026-33825 as a zero-day exploit. This information has prompted the addition of the weakness to the CISA’s Known Exploited Vulnerabilities (KEV) list on April 22nd, with the updated listing providing the additional context of ransomware attacks.

Despite the confirmation of ransomware attacks, the one issued by CISA does not indicate what group may be responsible for them. There is no public evidence linking BlueHammer to any known ransomware group or family. In spite of that, the weakness has been actively used in ransomware operations. At the same time, it is unclear whether other ransomware groups have used it or may be using it currently. The issue has also prompted the debate over the response to such incidents, with the critics suggesting that the defenders and security researchers are not notified when the weaknesses are added to the ransomware operations.

In practice, the CISA only updates the KEV list periodically. It does not provide threat intelligence and response support for individual organizations every time when the weakness is added to the list. Some security experts have stated that the better alternative would be to notify the defenders directly. In the meantime, a threat intelligence company GreyNoise has announced the availability of a free service that monitors the KEV list for changes, indicating when the weakness is updated to include the details of a ransomware attack.

The discovery of BlueHammer presents an illustrative example of how fast the ransomware attackers can adopt and incorporate the newly discovered vulnerabilities into their operations. Experts advise the defenders to always remain alert, apply the Microsoft security updates in a timely manner and monitor the threats intelligence channels for the relevant weaknesses. The ransomware operators continue to pursue the opportunities, which render the prompt response to the updates crucial.

Microsoft, Europol and Industry Partners Disrupt Amadey and StealC Cybercrime Infrastructure



 

Microsoft security

Cyber Security Cyber Threats CyberCrime Cybercrime Ecosystem Microsoft Microsoft security

Microsoft, Europol and Industry Partners Disrupt Amadey and StealC Cybercrime Infrastructure

Surprisingly, global police forces took down two key cybercrime systems at once - unusual given past efforts typically focused on one threat. Backing came from Microsoft, adding weight to actions targeting Amadey, a program that loads malicious software.

Meanwhile, StealC was also hit; it specializes in stealing user data. Though often seen working hand-in-hand during digital break-ins, both were struck together this time. Shifting tactics like this disrupted not just the tools but their entire support network. Recovery now becomes harder simply because so much of their foundation is gone.

With infrastructure damaged across multiple points, launching new attacks will take far longer than before. Microsoft’s Digital Crimes Unit joined forces with law enforcement, cyber defense companies, and intelligence teams to tackle organized digital threats. From the start, findings on Amadey emerged through collaboration between ESET, BitSight, Lumen, and Mitsui Bussan Secure Directions.

Meanwhile, tracking StealC unfolded thanks to insights from Europol, Germany’s Federal Criminal Police Office, authorities in the Netherlands and Denmark, alongside IBM X-Force and Proofpoint. One thread led to another until distinct probes merged into a clearer picture of an extensive crime network.

From the start, law enforcement leveraged the RICO Act - typically tied to mob-related prosecutions - to dismantle over 200 command hubs controlling malicious software networks. While not obvious at first glance, patterns uncovered by Microsoft’s Copilot system, driven by artificial intelligence, revealed connections across distinct malware groups. Because of these findings, officials began viewing the threats as branches of one coordinated operation rather than separate incidents.

Microsoft reported that just in the first week of May, systems tied to Amadey and StealC reached over 140,000 machines globally. Though it appeared only in 2023, StealC functions like a rental-based attack tool - focused on grabbing login details from browsers, crypto wallets, messages, email accounts, even game profiles.

Those using it adjust their attacks individually, while handling what they collect via online control panels built for ease. First seen in 2018, Amadey operates by delivering malicious software to compromised devices. Because of its design, cybercriminals often leverage it to introduce programs like StealC. One breach may lead - through this tool - to several layers of intrusion.

Though initially subtle, the consequences multiply quickly once active. Modern cybercrime often works like a factory, experts note, where the link between these tools shows how tasks get split up. One crew might build something, another circulate it, while someone else runs it - yet everything fits. Because pieces snap together smoothly, attackers can stack actions into longer sequences even if they never talk.

The setup thrives on separation, not teamwork. Targeting entire networks of malicious software could work better than going after single components, Microsoft suggests. Instead of isolated attacks on specific tools, focusing on how these systems connect might weaken criminal infrastructure more deeply.

When security teams hit several points in an attacker's process simultaneously, it becomes harder, slower, and costlier to bounce back. Disrupting coordination between different parts slows down rebuilding attempts significantly. Each broken link adds friction, making revival less likely or much delayed.

CryptoBandits Malware Combines Crypto Theft and Backdoor Access



 

Microsoft

Credential Theft CryptoBandits cryptocurrency malware Microsoft

CryptoBandits Malware Combines Crypto Theft and Backdoor Access

Microsoft has disclosed details of a newly identified Windows malware campaign that combines cryptocurrency theft, covert command-and-control communications, and remote access capabilities, creating a threat that extends well beyond traditional crypto-stealing malware.

Tracked as CryptoBandits, the malware has been active since at least February 2026 and is designed to compromise Windows systems through malicious shortcut (LNK) files. While its primary objective is to steal cryptocurrency-related information, Microsoft researchers found that the malware also functions as a lightweight backdoor, allowing attackers to maintain ongoing access to infected devices and issue remote commands.

According to Microsoft's analysis, the threat relies heavily on built-in Windows scripting technologies, including Windows Script Host and ActiveX components, to execute malicious actions while avoiding more obvious indicators typically associated with conventional malware families. Once executed, CryptoBandits deploys a portable version of the Tor anonymity network and establishes communications with attacker-controlled hidden services through a local SOCKS5 proxy, concealing the infrastructure used to manage infected systems.

Researchers observed the malware being distributed through malicious shortcut files that masquerade as legitimate content. After compromising a system, CryptoBandits deploys two distinct modules: a worm component responsible for spreading the infection and a cryptocurrency clipper designed to monitor and manipulate wallet-related data.

The propagation mechanism enables the malware to scan connected USB storage devices and generate additional malicious shortcut files that imitate legitimate documents. By replacing or disguising genuine files with weaponized shortcuts, attackers increase the likelihood that the malware will spread when removable media is shared between systems. Microsoft also noted that the malware can deploy additional payloads while excluding them from Microsoft Defender scanning, helping attackers reduce the likelihood of detection.

One of the most dangerous aspects of CryptoBandits is its clipboard-monitoring functionality. Cryptocurrency clippers are designed to watch for wallet addresses copied by victims during transactions. When a targeted wallet address is detected, the malware silently replaces it with an attacker-controlled address before the victim pastes the information into a cryptocurrency application or exchange platform. Because cryptocurrency addresses are often long and difficult to verify manually, victims may unknowingly transfer digital assets directly to criminal-controlled wallets.

Beyond address substitution, Microsoft found that the malware can harvest cryptocurrency seed phrases and private keys, information that can provide direct access to digital wallets. The malware also captures screenshots and transmits collected information to attacker-controlled infrastructure through Tor-based communications channels.

The malware establishes persistence through scheduled tasks and incorporates anti-analysis checks intended to identify whether system monitoring tools are active. Researchers observed the clipper verifying whether Windows Task Manager was running before continuing execution, a technique commonly used by malware operators attempting to evade investigation and detection.

After installation, CryptoBandits launches a renamed Tor executable and registers the infected device with its command-and-control infrastructure. The malware then continuously polls its operators for instructions at intervals of roughly 500 milliseconds, enabling rapid execution of attacker-issued commands. This capability transforms the malware from a simple financial stealer into a remotely managed backdoor capable of supporting additional malicious activity.

Microsoft's investigation also revealed extensive use of runtime obfuscation. Core malware components remain encrypted until execution, while both the Python-based installation routines and JavaScript payloads are intentionally obscured to complicate reverse engineering efforts. Such techniques make static analysis significantly more difficult and can delay detection by traditional signature-based security tools.

At the center of the operation is the malware's bundled Tor client. Rather than relying on exposed internet-facing servers, CryptoBandits routes traffic through localhost: 9050 using a SOCKS5 proxy and communicates with hidden-service infrastructure hosted within the Tor network. By concealing command-and-control traffic behind anonymized routing, attackers reduce network visibility and make infrastructure disruption efforts considerably more challenging.

The campaign gives us a foray into the new trend of financially motivated cybercrimes, where lightweight malware increasingly combines credential theft, cryptocurrency targeting, covert communications, and remote-access functionality within a single package. Security researchers have repeatedly observed threat actors moving away from easily identifiable command-and-control servers in favor of anonymized infrastructure that blends malicious traffic with legitimate network activity.

To mitigate the threat, Microsoft recommends restricting unnecessary use of scripting engines such as Windows Script Host, monitoring systems for unauthorized local SOCKS proxy activity, reviewing unusual clipboard access patterns, and implementing behavioral detection mechanisms capable of correlating script execution, network communications, process activity, and data exfiltration attempts. Additional safeguards include disabling autorun functionality for removable media, restricting execution of shortcut files from USB devices, and closely monitoring Tor-related network traffic originating from enterprise endpoints.

Researcher Reveals VS Code Flaw That Could Expose GitHub Access Tokens Through a Single Click



 

Zero day

Authentication Tokens CVE Data Breach GitHub Access Token malicious VS Code extensions Microsoft vulnerability Zero day

Researcher Reveals VS Code Flaw That Could Expose GitHub Access Tokens Through a Single Click

A publicly disclosed security flaw affecting the browser-based version of Visual Studio Code has drawn attention from developers after a researcher demonstrated how attackers could potentially obtain GitHub authentication tokens through a single user interaction.

The issue was disclosed by security researcher Ammar Askar, who published technical details alongside proof-of-concept code showing how the vulnerability could be abused. At the time of disclosure, no CVE identifier had been assigned and Microsoft had not released an official software patch.

According to Askar's analysis, the weakness exists within github.dev, GitHub's web-based development environment that allows users to work with repositories directly from a browser using technology derived from Visual Studio Code. The attack takes advantage of the way VS Code's webview components communicate with the main editor environment.

Webviews are embedded browser windows used by extensions and web applications to display interactive content. While these components are designed to operate within restricted environments, the researcher found a method to abuse the message-passing mechanism that connects a webview to the editor interface.

The published demonstration shows how malicious JavaScript running inside a webview can trigger actions within the main editor window. By simulating keyboard input and user activity, the code can install a malicious extension without requiring the victim to manually perform the installation process.

Once deployed, the extension is capable of extracting a GitHub OAuth token that is transmitted when users access github.dev. OAuth tokens act as authorization credentials that allow applications to interact with GitHub services on behalf of authenticated users.

According to the researcher, the security concern extends beyond access to a single repository. The token passed to github.dev can inherit the permissions associated with the user's GitHub account, potentially granting access to every repository available to that account, including private projects.

Using the proof-of-concept attack, a malicious extension can retrieve the token and communicate with GitHub's API. This allows an attacker to identify repositories accessible to the compromised account and gather information about private development resources.

Askar argued that the broad permissions associated with the token significantly increase the potential impact of exploitation because access is not limited to the repository that initially triggered the github.dev session.

To reduce exposure while no official fix was available, the researcher advised users to clear cookies and locally stored site data associated with github.dev. Removing this stored data forces additional authentication checks that can help expose suspicious sign-in attempts.

After clearing the stored information, users attempting to access github.dev through a malicious link would be more likely to encounter a warning indicating that the GitHub Repositories extension is requesting authorization through GitHub. Such prompts can serve as an indication that unexpected account access is being requested.

The disclosure also highlighted ongoing tensions surrounding vulnerability reporting processes. Askar stated that GitHub was notified approximately one hour before publication of the research. He described the disclosure as a deliberate decision to release the information publicly rather than pursue a lengthy coordinated disclosure process.

The researcher cited previous interactions involving another VS Code vulnerability that he reported through Microsoft's security channels. According to his account, the issue was later addressed without attribution and was classified as having no security impact despite his concerns regarding its implications.

Askar said that experience influenced his decision to publicly disclose future VS Code security findings rather than continue working through Microsoft's reporting process.

The incident follows several other public disclosures involving Microsoft products by an independent researcher operating under the online alias "Nightmare Eclipse." Over recent months, that researcher has released details regarding multiple unpatched vulnerabilities affecting Windows and related Microsoft technologies, including flaws known as BlueHammer, RedSun, GreenPlasma, MiniPlasma, YellowKey, and UnDefend.

Some of those vulnerabilities were later reported as being actively exploited, further intensifying discussions within the security community about vulnerability handling, disclosure timelines, and communication between vendors and independent researchers.

Microsoft previously responded to some of those disclosures by warning that legal action could be considered when individuals engage in activities that cause harm to customers. The company also stated that it may cooperate with law enforcement agencies when necessary.

In comments provided following the publication of the VS Code findings, Microsoft emphasized the role independent researchers play in improving product security. The company stated that it remains committed to evaluating reported issues, coordinating engineering responses, and delivering mitigations intended to protect customers.

A subsequent statement from Microsoft indicated that the issue had been mitigated within its services and that users were not required to take additional action.

The developer-focused platforms remain attractive targets because authentication tokens can provide access to source code repositories, development environments, and organizational assets. Security teams generally recommend reviewing unexpected links carefully, limiting unnecessary permissions, monitoring account activity, and using strong authentication controls to reduce the likelihood of unauthorized access.

Microsoft Unveils Project Solara, AI Agents to Replace Computing



 

Technology

AI ai agents Computing Microsoft Technology

Microsoft Unveils Project Solara, AI Agents to Replace Computing

Satya Nadella, Microsoft CEO, said computing has entered a new era where AI agents will take over to become the main interface, not applications or operating systems.

Microsoft launches project Solara

Microsoft also released Project Solara, a Qualcomm powered platform built to support Agentic-AI devices that can work across apps, screens, and workflows. According to Microsoft, the next era of computing will not be characterized by such things.

At the Microsoft Build 2026 developer conference, Nadella said that Microsoft is shifting from a world based on apps and devices to one where AI agents will dominate the main interface between computers and users.

Nadella said this while Microsoft showcased Project Solara, a new chip-to-cloud platform built in partnership with Qualcomm which is currently called “agent-first computing”. Microsoft said that agentic AI is developing beyond assistants integrated inside applications and will streamline operations across workflows. This may impact the future of computer usage.

Project Solara is based on the company’s belief that agentic AI will become the key technology for people to interact. Instead of running apps individually and tasks manually, users will use AI agents.

About Project Solara

It is a chip-to-cloud platform that integrates Azure cloud services, hardware, and software to enable agent-first usage. It will also allow people to interact dynamically with AI via specific form factors. Solara is built around the goal that AI agents are the latest unit of programming and a novel way for people to interact with computers.

In a research paper published around the same time, Microsoft said that computing has shifted from mainframes to PCs, smartphones, and IoTs.

Each generation inches closer to users. AI agents will become the next interaction layer, letting people interact with computers via natural language instead of interfaces, menus, and navigating apps.

How will the AI agents replace apps?

Microsoft laid three levels of integrating AI.

In the first stage, AI is put beside an app as a helper, like the LLM chatbots of today.

In the second level, AI is directly integrated inside apps, which makes it central to user experience.

In the third level, AI operates outside the individual apps, streamlining workflows while maintaining context. Solara is particularly built for the third stage.

Microsoft Warns Passwords and SMS-Based 2FA Are No Longer Enough Against Modern Cyberattacks



 

Phishing

2FA Cyber Attacks MFA Microsoft password Phishing

Microsoft Warns Passwords and SMS-Based 2FA Are No Longer Enough Against Modern Cyberattacks

Microsoft is intensifying its push toward passwordless security, warning that traditional passwords and older forms of two-factor authentication are becoming increasingly ineffective against modern phishing attacks powered by artificial intelligence.

In a statement released during World Passkey Day, Microsoft said the cybersecurity industry must reduce dependence on passwords and other “phishable” login methods by accelerating the adoption of passkeys.

For years, technology companies encouraged users to strengthen account security by enabling two-factor authentication (2FA) or multi-factor authentication (MFA). Microsoft itself previously stated that MFA could block more than 99% of password-based attacks. However, cybercriminals have steadily adapted their tactics, particularly targeting SMS-based authentication systems through phishing pages, SIM-swapping schemes, session hijacking, and social engineering attacks.

The company now argues that passwords, even when paired with weak MFA methods like text-message verification codes, continue to leave accounts vulnerable. Microsoft described these older protections as “legacy” authentication methods that can still become entry points for attackers.

Instead, Microsoft is promoting passkeys, which rely on cryptographic authentication rather than memorized passwords. A passkey stores a private digital key directly on a user’s device and only works on the legitimate website or application where it was created. Access is then confirmed through biometric verification, such as fingerprints or facial recognition, or through a device PIN.

Security experts say this approach makes phishing significantly harder because passkeys cannot be reused on fake websites designed to imitate legitimate login pages. Unlike passwords or SMS codes, the authentication process is tied directly to the original domain.

Microsoft also stressed that enabling passkeys alone is not enough if passwords and fallback authentication methods remain active on accounts. According to the company, weak backup options can still be exploited even after stronger protections are introduced. Microsoft has therefore continued removing older authentication systems across its ecosystem, including plans to eliminate security questions from password reset flows beginning in 2027.

The urgency surrounding this transition has increased alongside the rapid growth of AI-generated phishing campaigns. Microsoft cited internal findings showing that AI-assisted phishing operations can achieve click-through rates as high as 54%, meaning more than half of targeted users may interact with malicious messages.

Industry-wide adoption of passkeys is also accelerating. The FIDO Alliance estimates that more than five billion passkeys are already in use globally. Microsoft said hundreds of millions of users now sign into services such as OneDrive, Xbox, and Copilot using passkeys every day.

Internally, Microsoft claims that over 99% of users within its environment now have access to phishing-resistant authentication methods. The company added that account recovery systems remain a critical security challenge because attackers increasingly target recovery processes instead of direct logins.

Researchers and government agencies are broadly supporting the move toward passwordless security. The United Kingdom’s National Cyber Security Centre recently encouraged organizations and consumers to adopt passkeys, citing growing risks from AI-driven phishing and phishing-as-a-service platforms.

Still, cybersecurity researchers caution that passkeys are not completely immune to attack. Recent academic research examining FIDO2 authentication methods found that while passkeys substantially raise the difficulty for attackers, sophisticated compromise techniques involving infected devices, session theft, or manipulated browser environments may still pose risks under certain conditions.

Microsoft maintains that removing passwords and other phishable credentials remains essential as AI systems increasingly act on behalf of users across enterprise environments. If a single digital identity is compromised, attackers could potentially exploit connected AI agents to access systems, trigger workflows, and operate with existing permissions at machine speed.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

About Me

Footer About

Labels

Showing result(s) for

Popular Posts

Pages

Menu Item

About the flaw

What happens in case of successful exploitation?

Affected products

Microsoft’s response

Microsoft 365 account used to send phishing mails

Google workspace breach

Nikkei’s response

About the ClickFix campaign

Attack tactic

DLL sideloading

Implications

Threat actor links to China

About the attack

Attack tactic

Google and Microsoft remove the collector

About the discovery

Attack tactic

Scheduler and other things

How does collector function

Disrupting a crucial link in the cyberattacks chain

About the investigation

Operation Endgame

Attack tactic

Research model

The second variant

Microsoft launches project Solara

About Project Solara

How will the AI agents replace apps?