Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
25 / 267 results
highperson_alertThreat ActorAPT31 Deploys BlueMoon Exploit Kit Chaining Chrome and Windows Zero-Days
APT31 (also tracked as Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, Violet Typhoon, and ZIRCONIUM) is a China-aligned state-sponsored threat actor conducting espionage operations.
criticalbug_reportVulnerabilityMicrosoft Sept 2026 Patch Tuesday: 964 CVEs, 2 zero-days under attack
Microsoft products across the ecosystem. 964 vulnerabilities total: 104 critical, 860 important. Two zero-day vulnerabilities are actively exploited in the wild.
criticalbug_reportVulnerabilityMicrosoft Defender zero-day "ShieldCrash" bypasses September patch
Microsoft Defender on all supported Windows 10, Windows 11, and Windows Server versions with September 2026 Patch Tuesday updates applied. The vulnerability is an incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read as SYSTEM…
highbug_reportVulnerabilityMicrosoft patches 974 vulnerabilities, including 2 actively exploited zero-days
Microsoft Windows (all supported versions), Windows Server 2012 and later, and other Microsoft software products. Two actively exploited zero-days: CVE-2026-81963 and CVE-2026-85880 (privilege escalation).
criticalbug_reportVulnerabilityMicrosoft patches 966 flaws including 2 actively exploited zero-days
Microsoft products (specific products and versions not disclosed in provided data). Two zero-day vulnerabilities are actively exploited; 964 additional flaws patched in September 2026 Patch Tuesday.
highbug_reportVulnerabilityPEEP toolkit turns Chrome/Edge into backdoors via malicious extension
Chrome and Edge browsers on Windows and Linux. PEEP is a post-exploitation toolkit requiring prior administrative or code execution access. It masquerades as "Smart Bookmarks" extension (ID: ejkndncpkdcjcikfhiamcdehdoegilbj) and uses native messaging…
highbug_reportVulnerabilityVishing campaign steals M365 tokens via AitM phishing, targets executives
Microsoft 365, SharePoint, OneDrive, Exchange, and Box SaaS platforms. Primarily targets executive-level staff (directors, VPs) in U.S. organizations across construction, engineering, healthcare, pharmaceuticals, real estate, finance, and professiona…
highbug_reportVulnerabilityBigBear 2.0 PhaaS bypasses MFA, steals 5,000+ Microsoft 365 credentials
Microsoft 365 users across 258 organizations in 40+ countries. All authentication methods except FIDO2/WebAuthn hardware tokens are vulnerable. Campaign leverages Evilginx2-based adversary-in-the-middle (AiTM) framework with geo-matched residential p…
highbug_reportVulnerabilityREVSTEALER Deploys Four Persistent Modules Including Crypto Miner
Windows systems infected with REVSTEALER infostealer (active since February 2026). Four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) remain after core stealer self-deletes.
highbug_reportVulnerabilityPhishing campaign uses invisible Unicode to bypass email filters
Organizations using email security systems that rely on keyword matching and literal string detection. Campaign targets Small Business Administration (SBA) loan applicants and businesses seeking financing.
highbug_reportVulnerabilityBraZetsu malware framework enables Initial Access Broker marketplace
Windows systems in Iberian Peninsula and Latin America, particularly Brazil. Targeted sectors include e-commerce, corporate, financial, industrial, and law enforcement. Browsers affected: Google Chrome, Microsoft Edge, Brave, Vivaldi, Opera.
highbug_reportVulnerabilityAttackers abuse Microsoft Teams external chat to impersonate IT support
Microsoft Teams users in enterprise environments with external collaboration enabled. All organizations using Teams for business communication are at risk if users accept external contact requests and grant remote access via RMM tools or Quick Assist…
highbug_reportVulnerabilitySilver Fox campaign uses fake installers to disable Windows Update
Windows systems globally, primarily China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
highbug_reportVulnerabilityActive malware campaign uses fake vendor sites to deliver Silver Fox malware
Organizations with China-based operations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors.
highbug_reportVulnerability22K Exchange servers unpatched for CVE-2026-62911 auth bypass flaw
Microsoft Exchange Server 2016, 2019, and Subscription Edition (SE). Approximately 21,899 internet-exposed servers remain unpatched globally, with highest concentrations in the United States (6,200) and Germany (5,100).
highperson_alertThreat ActorClickFix Operators Dominate Initial Access via Social Engineering
ClickFix operators are threat actors leveraging a social engineering technique that manipulates users into executing malicious commands through clipboard manipulation.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse tunnels
Windows systems with PowerShell and Windows Terminal enabled. Targets organizations with Active Directory environments. Attack vector: compromised websites displaying fake Cloudflare CAPTCHA prompts.
highperson_alertThreat ActorSpring Ring Campaign Weaponizes Microsoft Teams for Vishing Attacks
Spring Ring is a coordinated social engineering campaign identified between January and April 2026 that leverages external Microsoft Teams accounts to impersonate IT help desk personnel.
highbug_reportVulnerability19 malicious Chrome/Edge extensions steal crypto and credentials
Google Chrome and Microsoft Edge users who installed any of 19 malicious extensions, including "Enable Right Click & Copy" (70,000+ Chrome users, 10,000+ Edge users). Campaign active since early 2024.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse-tunnel backdoor
Organizations across multiple sectors using Windows environments with PowerShell and Windows Terminal. Attack leverages compromised websites serving fake Cloudflare CAPTCHA pages to social engineer users into executing malicious PowerShell commands.
highperson_alertThreat ActorTerminalFix Campaign Deploys Multi-Stage Attacks via Fake CAPTCHAs
TerminalFix is a coordinated campaign activity (variant of ClickFix social engineering technique) disclosed by Microsoft Threat Intelligence. The campaign targets organizations across multiple industries using compromised websites to deliver sophisti…
highbug_reportVulnerability19 malicious Chrome/Edge extensions drain crypto wallets via auto-updates
19 browser extensions (18 Chrome, 1 Edge) published since February 2024, with "Enable Right Click & Copy — Smart Unlock + OCR" having 80,000 installs. Extensions either created by threat actor or purchased from legitimate owners.
highbug_reportVulnerabilityCoordinated attacks target AI infrastructure for credential theft and cryptomining
AI infrastructure platforms: LiteLLM gateways (CVE-2026-42271, CVE-2026-48710), RAGFlow deployments, and Kestra workflow environments. All exposed instances with administrative surfaces reachable from the internet are at risk.
highbug_reportVulnerabilityMicrosoft SharePoint RCE chain (CVE-2026-55040 + CVE-2026-63520) exploited
Microsoft SharePoint Server (on-premises). CVE-2026-55040: JWT authentication bypass. CVE-2026-63520: Business Connectivity Services RCE. Over 8,700 SharePoint servers exposed online. Specific vulnerable versions not disclosed in article.
highperson_alertThreat ActorNovaCookies PhaaS Toolkit Hijacks Microsoft 365 Sessions via DocuSign
NovaCookies is a subscription-based adversary-in-the-middle (AitM) phishing-as-a-service (PhaaS) platform priced at $320/month, advertised via Telegram.