Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 220 results
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows overlap with STAC4749, a tracked cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible emp…
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs are vulnerable.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
highbug_reportVulnerabilityOctober Windows Server updates break Exchange OWA sign-in and mail flow
On-premises Exchange Server systems running on Windows Server 2019 and later, after installing October 2026 Windows Server security updates. All Exchange versions on affected Windows Server versions are potentially impacted.
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
highbug_reportVulnerabilityMicrosoft fixes Windows 11 black screen and Explorer crashes since August
Windows 11 versions 24H2, 25H2, and 26H1 systems updated since August 2026. Primarily affects Azure Virtual Desktop (AVD) hosts using FSLogix profile management software. Issue resolved in October 13, 2026 cumulative updates.
highperson_alertThreat ActorCoGUI, Haozi, and Iron Man System Phishing Kits Disrupted
CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System are three interconnected phishing-as-a-service (PhaaS) kits operated within the Chinese-language cybercriminal ecosystem.
highperson_alertThreat ActorStorm-2990 & Storm-3119: Chinese phishing kit ecosystem disrupted
Storm-2990 and Storm-3119 represent two interconnected Chinese-language cybercriminal entities operating a large-scale phishing ecosystem. Storm-2990 is a cluster of phishing kit developers responsible for three major kits: CoGUI (NX/FA), Haozi (Phoe…
criticalbug_reportVulnerabilityMicrosoft October 2026 Patch Tuesday: 1407 vulnerabilities, 69 critical
Microsoft products and services across the ecosystem. October 2026 Patch Tuesday addresses 1407 vulnerabilities: 69 rated critical severity, 1337 rated important severity.
highbug_reportVulnerabilityMicrosoft patches 1,400+ vulnerabilities; one zero-day exploited in wild
Windows 10, Windows 11, Windows Server (multiple versions), .NET Framework, and other Microsoft software products. Over 1,400 CVEs addressed, including 78 critical-severity flaws.
highbug_reportVulnerabilityMicrosoft patches 1,411 flaws including 1 exploited zero-day bypass
Microsoft Windows (all supported versions), .NET Framework, and MessagePack-CSharp. Notably, Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 reached end of support October 13, 2026.
highpublicGeopoliticalNorway Fines Microsoft's Xandr €8.6M Over Grindr Data Sharing Violations
This enforcement action exemplifies the divergence between European and U.S. regulatory approaches to data privacy and digital sovereignty. Norway, operating under the European Economic Area framework and applying GDPR standards, has imposed its larg…
highpublicGeopoliticalNorway fines Microsoft-owned Xandr $9.6M for Grindr data violations
This enforcement action reflects Norway's assertive stance on digital sovereignty and data protection, consistent with broader European regulatory efforts to constrain U.S. technology firms' data practices.
highbug_reportVulnerabilityAvisLoader malware uses encrypted P2P to evade C2 takedowns
Windows systems targeted via ClickFix social engineering lures. AvisLoader is a 64-bit Windows executable (3.4 MB) delivered through Cloudflare Workers and Quick Tunnels. No specific Windows version restrictions identified.
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highpublicGeopoliticalMicrosoft certificate rotation to cut security updates for legacy Windows
Microsoft's planned Windows Update certificate rotation in mid-2027 represents a significant inflection point in the global cybersecurity landscape. The policy will effectively force organizations and individuals running unsupported Windows versions…
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highbug_reportVulnerabilityClickFix attacks evolve with browser cache smuggling to bypass Run limits
Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assem…
highbug_reportVulnerabilityMicrosoft Exchange privilege escalation allows mailbox access (CVE-2026-96940)
Microsoft Exchange Server on-premises: Subscription Edition RTM, Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15. Exchange Online already patched server-side; no customer action required.
highperson_alertThreat ActorTA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
TA419 is a China-aligned, espionage-motivated threat actor attributed by Proofpoint. Active since at least April 2025, the group conducts credential phishing campaigns targeting individuals at U.S.
criticalperson_alertThreat ActorWarlock exploits SharePoint flaws to deploy ransomware in Iberia
Warlock (also tracked as Gold Salem, Longlegs, Storm-2603) is a suspected China-linked threat actor that gained prominence in mid-2025 through zero-day exploitation of Microsoft SharePoint vulnerabilities dubbed "ToolShell." The group is attributed b…
highperson_alertThreat ActorWarlock: China-Linked Ransomware Group Targets Critical Infrastructure
Warlock is a China-linked ransomware group that has demonstrated a focus on critical infrastructure and public sector targets. The actor's motivation appears to align with both financial gain through ransomware operations and potential strategic inte…
highperson_alertThreat ActorChina-Nexus Actor UAT-11587 Deploys Antino Backdoor Across Asia
UAT-11587 is a China-nexus threat actor tracked by Cisco Talos, first detected in September 2025 targeting Taiwan's academic, think tank, and civil society policy community.
highperson_alertThreat ActorMicrosoft X Account Hijacked in Cryptocurrency Pump-and-Dump Scheme
The threat actors behind this incident remain unidentified. Their motivation appears to be financial gain through a cryptocurrency pump-and-dump scheme, leveraging the compromise of Microsoft's official X (formerly Twitter) account with over 13 milli…
highpublicGeopoliticalGovernment sector cyber threats surge to 27% in Microsoft 2026 report
Microsoft's 2026 Digital Defense Report reveals a substantial escalation in cyber threat activity targeting government agencies, which now represent 27% of observed incidents—a 59% relative increase from 17% in 2025.