Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
25 / 281 results
highbug_reportVulnerabilityMicrosoft distrusts eMudhra CA after weak key compromise
Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H2). Affects systems without automatic Certificate Trust List updates, air-gapped networks, and devices without internet access.
highbug_reportVulnerabilityMicrosoft Authenticator Android flaw let apps steal work account tokens
Microsoft Authenticator for Android versions prior to 6.2606.4246. Affects work accounts signed into the app; personal accounts not impacted. Exploitation requires a malicious app installed on the same Android device.
highperson_alertThreat ActorMicrosoft Teams External Chat Exploited for IT Support Impersonation
Unknown threat actors conducting a recurring social engineering campaign across hundreds of incidents. The activity shows operational overlap with STAC4749, a cluster known for creating IT-themed cloud domains under the ".top" TLD and using plausible…
criticalbug_reportVulnerabilityCritical Brotli decoder flaw in .NET enables RCE via crafted streams
Microsoft .NET 8, 9, 10, and 11 RC3. Affects applications using ASP.NET Core request decompression, HttpClient automatic response decompression, or System.IO.Compression Brotli APIs.
highbug_reportVulnerabilityMicrosoft 365 AitM campaign compromises 97 accounts via token replay
Microsoft 365 / Entra ID users across 79 organizations. Campaign active July 14 - September 22, 2026. 497 successful sign-ins from 200,000+ attempts originating from 193.26.115.0/24 IP range. 48 rogue Entra devices registered.
criticalperson_alertThreat ActorAPT41 Deploys BlackX UEFI Bootkit Against Central Asian Diplomats
APT41 (also tracked as Wicked Panda, Brass Typhoon, BARIUM) is a China-linked state-sponsored advanced persistent threat group attributed by Kaspersky to the BlackX bootkit campaign.
criticalbug_reportVulnerabilityChina-linked Storm-0940 used AI framework to breach ConnectWise supply chain
ConnectWise multi-tenant application compromised; downstream victims across Microsoft 365 environments in aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, softwar…
highbug_reportVulnerabilityOctober Windows Server updates break Exchange OWA sign-in and mail flow
On-premises Exchange Server systems running on Windows Server 2019 and later, after installing October 2026 Windows Server security updates. All Exchange versions on affected Windows Server versions are potentially impacted.
highperson_alertThreat ActorConnectWise App Identity Compromise Enables M365 Tenant Takeovers
The threat actor behind this campaign remains unattributed. Motivation appears to be espionage or persistent access establishment, evidenced by targeting of policy, national security, trade, and critical mineral sectors in a secondary wave.
criticalbug_reportVulnerabilityConnectWise shuts down Cloud Backup after M365 tenant compromise
ConnectWise Cloud Backup service (formerly SkyKick Cloud Backup) and connected Microsoft 365 tenants. All customers using the service for backup operations are affected.
highperson_alertThreat ActorCompromised ConnectWise M365 Credential Exposes 173 Tenants
The threat actor behind this campaign remains unattributed. The adversary demonstrated operational sophistication by compromising a Microsoft 365 application credential belonging to ConnectWise Cloud Backup (formerly SkyKick), a cloud-based backup se…
highbug_reportVulnerabilityMicrosoft fixes Windows 11 black screen and Explorer crashes since August
Windows 11 versions 24H2, 25H2, and 26H1 systems updated since August 2026. Primarily affects Azure Virtual Desktop (AVD) hosts using FSLogix profile management software. Issue resolved in October 13, 2026 cumulative updates.
highperson_alertThreat ActorCoGUI, Haozi, and Iron Man System Phishing Kits Disrupted
CoGUI (aka NX or FA), Haozi (aka Phoenix), and Iron Man System are three interconnected phishing-as-a-service (PhaaS) kits operated within the Chinese-language cybercriminal ecosystem.
highperson_alertThreat ActorStorm-2990 & Storm-3119: Chinese phishing kit ecosystem disrupted
Storm-2990 and Storm-3119 represent two interconnected Chinese-language cybercriminal entities operating a large-scale phishing ecosystem. Storm-2990 is a cluster of phishing kit developers responsible for three major kits: CoGUI (NX/FA), Haozi (Phoe…
criticalbug_reportVulnerabilityMicrosoft October 2026 Patch Tuesday: 1407 vulnerabilities, 69 critical
Microsoft products and services across the ecosystem. October 2026 Patch Tuesday addresses 1407 vulnerabilities: 69 rated critical severity, 1337 rated important severity.
highbug_reportVulnerabilityMicrosoft patches 1,400+ vulnerabilities; one zero-day exploited in wild
Windows 10, Windows 11, Windows Server (multiple versions), .NET Framework, and other Microsoft software products. Over 1,400 CVEs addressed, including 78 critical-severity flaws.
highbug_reportVulnerabilityMicrosoft patches 1,411 flaws including 1 exploited zero-day bypass
Microsoft Windows (all supported versions), .NET Framework, and MessagePack-CSharp. Notably, Windows 11 24H2 Home/Pro and Windows 10 Enterprise LTSB 2016 reached end of support October 13, 2026.
highpublicGeopoliticalNorway Fines Microsoft's Xandr €8.6M Over Grindr Data Sharing Violations
This enforcement action exemplifies the divergence between European and U.S. regulatory approaches to data privacy and digital sovereignty. Norway, operating under the European Economic Area framework and applying GDPR standards, has imposed its larg…
highpublicGeopoliticalNorway fines Microsoft-owned Xandr $9.6M for Grindr data violations
This enforcement action reflects Norway's assertive stance on digital sovereignty and data protection, consistent with broader European regulatory efforts to constrain U.S. technology firms' data practices.
highbug_reportVulnerabilityAvisLoader malware uses encrypted P2P to evade C2 takedowns
Windows systems targeted via ClickFix social engineering lures. AvisLoader is a 64-bit Windows executable (3.4 MB) delivered through Cloudflare Workers and Quick Tunnels. No specific Windows version restrictions identified.
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highpublicGeopoliticalMicrosoft certificate rotation to cut security updates for legacy Windows
Microsoft's planned Windows Update certificate rotation in mid-2027 represents a significant inflection point in the global cybersecurity landscape. The policy will effectively force organizations and individuals running unsupported Windows versions…
highperson_alertThreat ActorU.S. offers $10M reward for HAFNIUM actor Zhang Yu in Exchange attacks
HAFNIUM (also tracked as Silk Typhoon, Operation Exchange Marauder) is a Chinese state-sponsored APT group attributed by Microsoft and the U.S. government to China's Ministry of State Security (MSS).
highpublicGeopoliticalNikkei discloses dual email account breaches, phishing campaign
The breach of Nikkei, one of the world's largest financial media corporations with global reach and over 1,500 journalists worldwide, represents a significant compromise of a strategic information node.
highbug_reportVulnerabilityClickFix attacks evolve with browser cache smuggling to bypass Run limits
Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assem…