Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
23 / 268 results
highbug_reportVulnerabilityRussian APT exploits OWA XSS flaw for persistent mailbox access
Microsoft Outlook Web Access (OWA) vulnerable to CVE-2026-42897 (CVSS 8.1), a cross-site scripting flaw. Targets include U.S. and European government entities, telecommunications, financial, hospitality, and aerospace sectors.
criticalperson_alertThreat ActorLaundry Bear exploits Exchange OWA zero-day to deploy OWAReaper backdoor
Laundry Bear (also tracked as Void Blizzard, TA488 by Proofpoint) is a Russian state-sponsored threat actor focused on long-term email intelligence collection.
highbug_reportVulnerabilityCertighost PoC released: AD CS flaw enables domain takeover via rogue CA
Microsoft Active Directory Certificate Services (AD CS) in Windows domains. CVE-2026-54121 patched in July 2026 Patch Tuesday. Affects environments using AD CS for certificate-based authentication where attackers have low-privileged domain user acces…
highperson_alertThreat ActorOperation BlueDash: Phishing Campaign Delivers RMM Tools via Fake Teams
Operation BlueDash is a phishing campaign attributed with moderate-to-high confidence to a threat actor group operating from Nigeria. The attribution is based on analysis of infrastructure, code history, and a GitHub environment used to operate the c…
highbug_reportVulnerabilityDNS hijacking on hotel Wi-Fi redirects users to fake Microsoft 365 logins
Wi-Fi gateways at hotels and conference centers in multiple U.S. cities, India, and Saudi Arabia. Targets traveling employees from financial services, professional services, legal, healthcare, energy, and retail sectors accessing Microsoft 365.
highperson_alertThreat ActorBlueNoroff Phishing Kit Profiles Crypto Wallets Before Malware Delivery
BlueNoroff (also tracked as APT38, NICKEL GLADSTONE, BeagleBoyz, Stardust Chollima) is a North Korean state-sponsored threat actor attributed to financially motivated operations targeting the cryptocurrency and technology sectors.
highbug_reportVulnerabilityCertighost exploit public for AD CS flaw allowing DC impersonation
Microsoft Active Directory Certificate Services (AD CS) on Windows Server 2012 through 2025 (including Server Core) and Windows 10 versions 1607 and 1809. Environments with Enterprise CA and default Machine certificate template are vulnerable.
criticalbug_reportVulnerabilityBing Images SVG flaw allowed unauthenticated RCE as SYSTEM on servers
Microsoft Bing Images service (CVE-2026-32194, CVE-2026-32191). Both Windows Server 2022 and Linux image-processing workers. Vulnerability exploitable via public "Search by Image" upload and URL-based image crawler.
highbug_reportVulnerabilityBing malvertising pushes fake Claude installer delivering SectopRAT
Microsoft Bing search users seeking Claude AI desktop app. Malicious Claude Artifact hosted on legitimate claude.ai domain (removed by Anthropic). At least 29 organizations compromised July 21-22, 2026.
highpublicGeopoliticalMicrosoft 365 outage disrupts cloud services across North America
The incident represents a technical service disruption affecting critical cloud infrastructure rather than a geopolitical cyber event. Microsoft 365's position as backbone infrastructure for government, defense, and commercial operations in North Ame…
highperson_alertThreat ActorChaos Ransomware Group Deploys msaRAT Rust Implant via Headless Browsers
Chaos is a ransomware group that operates through spam floods, vishing campaigns, Quick Assist abuse, and RMM tools for initial access and persistence. The group deploys custom tooling including the msaRAT Rust-based implant as a pre-ransomware stage…
highperson_alertThreat ActorChaos ransomware gang deploys msaRAT backdoor via browser hijacking
Chaos is a ransomware gang that emerged in early 2025, distinct from the earlier same-named ransomware family active since 2021. The group has been linked to Iranian state-backed threat actor MuddyWater, who reportedly leveraged Chaos ransomware to d…
criticalbug_reportVulnerabilityMicrosoft July 2026 Patch Tuesday: 569 vulnerabilities, 56 critical
Microsoft product portfolio (specific products and versions not disclosed in available data). 569 total vulnerabilities patched, including 56 rated critical severity.
criticalbug_reportVulnerabilityMicrosoft SharePoint RCE flaws actively exploited; immediate patching required
Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Five critical vulnerabilities: CVE-2026-50522 (CVSS 9.8, deserialization RCE), CVE-2026-58644 (CVSS 9.8, unauthenticated RCE), CVE-2026-5…
highperson_alertThreat ActorKratos Phishing Kit Dismantled After Stealing Microsoft 365 Sessions
The Kratos operator is an Indonesian individual arrested by local authorities for allegedly developing and operating the Kratos phishing-as-a-service (PhaaS) platform.
highbug_reportVulnerabilityAzure DevOps MCP server flaw lets hidden PR comments hijack AI agents
Microsoft Azure DevOps MCP server versions up to and including v2.8.0 (released June 24, 2026). The flaw affects the repo_get_pull_request_by_id tool, which returns pull request descriptions without prompt-injection guardrails.
criticalbug_reportVulnerabilityMicrosoft SharePoint RCE CVE-2026-50522 actively exploited for persistence
Microsoft SharePoint Server (specific versions not provided). Vulnerability enables remote code execution with machine key theft capability, allowing persistent access beyond patch deployment.
criticalbug_reportVulnerabilityMicrosoft SharePoint RCE (CVE-2026-50522) actively exploited after PoC
Microsoft SharePoint Server (all versions prior to July 2026 patches). Vulnerability involves deserialization of untrusted data leading to unauthenticated remote code execution. CVSS 9.8 (Critical).
highbug_reportVulnerabilityWindows LegacyHive zero-day enables privilege escalation, unofficial patches available
Microsoft Windows systems (all current versions). Specific affected versions not disclosed. Impacts up-to-date Windows installations. No CVE assigned yet.
highbug_reportVulnerabilityHollowGraph malware abuses Microsoft 365 calendar for C2 and exfiltration
Microsoft 365 environments with compromised mailboxes. Threat actors leverage Microsoft Graph API and calendar features to establish covert command-and-control channels.
highbug_reportVulnerabilityAI-assisted phishing toolkit targets Windows users in Mexico via fake gov site
Windows users in Mexico targeted via fake government ID-lookup website. Delivery mechanism uses WebDAV to distribute infostealer malware. Toolkit contains 1,048 files including phishing templates, droppers, and builder documentation.
highperson_alertThreat ActorHollowGraph Malware Uses Microsoft 365 Calendars for Covert C2
HollowGraph is a newly discovered espionage implant that leverages Microsoft 365 calendar infrastructure for command and control operations. The malware was identified and analyzed by Group-IB.
highbug_reportVulnerabilityACR Stealer campaign targets Microsoft enterprise customers
Microsoft enterprise customers; targets browser-stored credentials, authentication tokens, and sensitive documents across enterprise environments