Intel Exchange

The O-UNC-066 threat actor is targeting Microsoft 365 users through vishing and real-time phishing panels to hijack Entra passkey enrollment for data extortion.

LSHIY LLC linked actors conducted a massive password spray campaign targeting Azure CLI to bypass MFA via ROPC, while new vulnerabilities in AI agents like Amazon Q Developer emerged.

Unauthenticated attackers can bypass authentication on exposed Gitea instances to gain full administrative control by spoofing the X-WEBAUTH-USER HTTP header.

Adversaries target Microsoft Sentinel infrastructure to blind security teams by disabling analytic rules, shortening data retention, or altering diagnostic settings.

An unidentified threat actor launched an 81-million attempt password spray campaign against Microsoft 365 via Azure CLI, leveraging LSHIY LLC infrastructure.

The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.

The ErrTraffic Malware-as-a-Service framework uses the ClickFix social engineering tactic and EtherHiding blockchain dead-drop resolvers to distribute infostealers and loaders through compromised WordPress sites and fake AI platforms.

Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.

The MexicanMafia threat actor, also known as PanchoVilla, is conducting a sophisticated campaign using the Kimera reconnaissance engine and custom exploits against perimeter devices in Latin America.

An invoice fraud campaign uses legitimate Upflow.io tokens and spoofed subdomains to bypass authentication and capture payments via fraudulent IBANs.