Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
26 / 264 results
criticalbug_reportVulnerabilityCISA: Critical WSO2 auth bypass CVE-2026-5430 under active exploit
WSO2 enterprise products (specific versions not provided in source), Microsoft SharePoint (unspecified versions), and Adobe Commerce (unspecified versions).
highperson_alertThreat ActorStorm-3168 (JADEPUFFER) conducts agentic Azure cloud attacks
Storm-3168 is Microsoft's tracking designation for JADEPUFFER, a threat actor first documented by Sysdig in July 2026 as the first known agentic ransomware operation.
highperson_alertThreat ActorStorm-2570 Ransomware Affiliate Operates Across Multiple RaaS Ecosystems
Storm-2570 is a ransomware affiliate tracked by Microsoft Threat Intelligence since April 2025. Unlike actors that consistently support a single ransomware operation, Storm-2570 operates as a cross-ecosystem threat actor working with multiple ransomw…
highperson_alertThreat ActorUNK_CondorFiltration Targets Chilean Orgs via Default Password Spray
UNK_CondorFiltration is a threat cluster attributed by Proofpoint, conducting password spray campaigns against Microsoft 365 tenants. The actor's motivation appears to be credential harvesting and data exfiltration from cloud environments, with a spe…
highperson_alertThreat ActorMicrosoft Dismantles EvilTokens PhaaS Platform Linked to 12K Compromises
EvilTokens, tracked by Microsoft as Storm-2992, is a cybercrime operation that developed and operated a commercial phishing-as-a-service (PhaaS) platform.
highbug_reportVulnerabilityZero-day PoC blocks Microsoft Defender updates via disk exhaustion
Microsoft Defender on all supported Windows versions. No patch available. Tool published September 19, 2026 by Abdelhamid Naceri. No CVE assigned.
highbug_reportVulnerabilityEvilTokens PhaaS platform disrupted after enabling 12,000+ inbox compromises
Organizations worldwide using Microsoft 365 and OAuth device code authentication. Over 12,000 inboxes compromised across 10,000+ organizations since February 2026.
highperson_alertThreat ActorEvilTokens PhaaS disrupted after 12,000 Microsoft account compromise
EvilTokens (tracked by Microsoft as Storm-2992) is a Phishing-as-a-Service (PhaaS) platform that emerged in February 2026. The operation was administered by two suspects, aged 32 and 38, arrested in the U.K.
criticalbug_reportVulnerabilityFake LastPass installer uses Microsoft-signed driver to kill EDR and steal passwords
Windows systems where users downloaded a fake LastPass Authenticator installer from a malicious GitHub repository (github.com/LastPass-Authenticator). The attack uses a Microsoft-signed kernel driver (Alinubx.sys, renamed CcProtect.sys from CnCrypt d…
highperson_alertThreat ActorClickFix Lures Deploy ChainScript RAT via Polygon Blockchain C2
The Blackpoint Adversary Pursuit Group has identified threat actors leveraging ClickFix-style social engineering lures to distribute ChainScript, a previously undocumented remote access trojan.
highbug_reportVulnerabilityBragJack PoC hijacks AI assistants via malicious browser extensions
AI assistants in Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude (Chrome). Attack vector: malicious browser extensions using Prompt Forcing technique. Specific affected versions not disclosed.
criticalbug_reportVulnerabilityMicrosoft patches CVSS 10.0 Azure AI Foundry authentication bypass
Azure AI Foundry (Microsoft Foundry) platform. All instances automatically patched by Microsoft. CVE-2026-85889 affects critical function lacking authentication, enabling network-based privilege escalation by unauthenticated attackers.
highbug_reportVulnerabilityWindows 11 Sept 2026 updates break domain login via Machine Identity Isolation
Windows 11 versions 24H2, 25H2, and 26H1 after installing September 2026 security updates (KB5124008, KB5124012). Affects enterprise environments with domain-joined devices NOT connected to Windows Server 2025 domain controllers.
highbug_reportVulnerabilityBrowser extensions can hijack AI agents in Chrome, Edge, Comet, Opera, Claude
Chromium-based browsers with embedded AI assistants: Google Chrome (fixed in v143.0.7499.192, Jan 2026), Microsoft Edge (fixed in v150.0.4078.48, July 2026), Perplexity Comet, Opera Neon, and Claude in Chrome extension.
highperson_alertThreat ActorREF9334 Deploys KREMLIN Malware Targeting Brazilian Financial Sector
REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns.
highperson_alertThreat ActorUTA0560 Exploits Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 is a Chinese-linked threat actor tracked by Volexity that conducts cyber espionage operations targeting non-governmental organizations. The actor demonstrates sophisticated capabilities in exploiting zero-day vulnerabilities and conducting sp…
highbug_reportVulnerabilityMicrosoft releases emergency patches for RDS failures after September updates
Windows 10 21H2/22H2, Windows 11 24H2/25H2/26H1, Windows Server 2019/2022/2025. Remote Desktop Services, Hyper-V (HCS-managed VMs with Plan9 shares), and USB Audio Class 1.0 devices with multichannel audio affected by September 2026 security updates.
highbug_reportVulnerabilityMicrosoft September 2026 updates break RDS on Windows Server and clients
Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and Windows 10/11 all versions that applied September 2026 Patch Tuesday updates. Impacts Remote Desktop Services (RDS), RDP connections, MMC, RDS Licensing Diagnoser, and File Explorer.
highbug_reportVulnerabilityMicrosoft warns of passkey phishing and CEO fraud campaigns targeting cloud
Microsoft cloud environments (Azure AD/Entra ID, Microsoft 365, SharePoint, OneDrive). Campaign 1: U.S. enterprise users in IT services, consumer goods, real estate, and manufacturing (August 2026).
highperson_alertThreat ActorShinyHunters and Helix Linked to Passkey-Themed M365 Phishing Campaign
ShinyHunters and Helix are cybercrime actors linked to data extortion operations. Both groups have established reputations in the underground economy for compromising corporate environments and exfiltrating sensitive data for extortion or sale.
highbug_reportVulnerabilityAI-enhanced BEC campaign targets finance teams with CEO impersonation
Over 1 million emails sent August 3-5 targeting enterprise finance/accounts payable departments, primarily in United States (87.7%). Campaign used third-party email delivery infrastructure to impersonate C-level executives (CEO, CFO, President) with…
criticalbug_reportVulnerabilityBlueMoon exploit kit chains Windows and Chrome zero-days in espionage ops
Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape).
highbug_reportVulnerabilityPasskey-themed phishing campaign targets cloud identities via AiTM
Microsoft 365 / Entra ID users across multiple organizations. Campaign active since May 2024 (likely typo in source stating "May 2026"). Targets include SharePoint, OneDrive, Exchange, and Microsoft Graph API access.
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
criticalbug_reportVulnerabilityMicrosoft Defender zero-day "ShieldCrash" bypasses September patch
Microsoft Defender on all supported Windows 10, Windows 11, and Windows Server versions with September 2026 Patch Tuesday updates applied. The vulnerability is an incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read as SYSTEM…