[huntress]

October 31, 2026

• Camera management software is being used for initial access and C2 persistence, with DLL sideloading to execute payloads and registry-based login persistence — an inventory gap in most environments (Huntress). · Intrusion Tradecraft & Detection

in Open-Weight Model Turns Firefox's Patch Gap Into Working Exploits

October 30, 2026

• Axis Camera Station gets a full chain write-up: unauthenticated RCE (CVE-2025-30026/CVE-2025-30023) through to decrypting every stored camera credential (CVE-2026-63286) (Ricardo Rodríguez). Huntress separately reports a campaign using camera management software as the initial-access route into victim environments (Huntress). · Vulnerabilities & Disclosures

in Attackers Go for the Management Plane

October 25, 2026

• Huntress detailed a ten-week Microsoft 365 token spray-and-replay campaign (earlier coverage) with full numbers: 497 successful sign-ins against more than 200,000 failed attempts across 79 victim organisations between July 14 and September 22, 2026, all replayed from 193.26.115.0/24 at German host 1337 Services GmbH (AS210558). The attacker registered at least 48 rogue Entra devices, wiped and replaced victims' MFA methods, and created inbox rules to hide traffic. One IP, 193.26.115.72, had all 1,052 of its blocked sign-ins come from four organisations while its 232 successes landed in 28 entirely different ones — the spray and the replay are separate target sets. Containment requires revoking sessions and removing attacker-registered devices and MFA methods; a password reset leaves both in place. (Huntress) · Cloud & Identity
• An Amazon-themed ClickFix campaign abuses the Windows finger utility as a LOLBIN. A sponsored Google result for "amazon business" leads to a spoofed login page with an embedded fake CAPTCHA; the pasted command uses finger to kick off a multi-stage obfuscated chain ending in a pirated NetSupport RMM client and Lumma Stealer. Google pulled the ad but the infrastructure remains live, running on a growing list of barbecue-themed domains (grillmasterspro, EmbersAndBites). Three Huntress customers were hit. (Huntress) · Threat Activity

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

October 24, 2026

• Huntress documented a ten-week Microsoft 365 token "spray-and-replay" campaign that led to BEC at dozens of organisations. Between July 14 and September 22, 2026 it counted 497 successful sign-ins across 79 victim organisations against more than 200,000 failed attempts, all from 193.26.115.0/24 (AS210558, 1337 Services GmbH). Sessions were harvested via AiTM relays and replayed — no password needed. The attacker registered at least 48 rogue Entra devices, wiped and re-enrolled victims' MFA methods, and added inbox-hiding rules. Key containment note: a password reset and session revoke leaves the attacker's devices and MFA methods in place, so they must be removed explicitly (Huntress). · Cloud & Identity

in PHP2Shell's Reliability Problem — and a Third, Unpatched PHP Bug

October 18, 2026

• ConnectWise Cloud Backup (formerly SkyKick) is the pivot in an active Microsoft 365 supply-chain compromise. Microsoft Threat Intelligence says the actor abused the multitenant app's existing consent — including Directory.ReadWrite.All — to obtain access tokens, observing broad successful service-principal authentication from 144.172.64[.]128 on October 15, followed by Microsoft Graph reconnaissance and attempts to add new credentials to the service principal as a backdoor, which survives revocation of the original compromised credential (Microsoft Threat Intelligence). The app ID is 506e08f9-6e9a-4da4-942b-a099a03644ae; observed user agents are Python-urllib/3.12 and python-requests/2.31/2.34.2. Huntress, which raised the alarm on October 16, says the actor signed into 173 tenants, up from its initial 162 (Huntress, BleepingComputer, The Hacker News). · Cloud & Identity

in One Backup App's OAuth Grant Opened Hundreds of Microsoft 365 Tenants

October 15, 2026

• Malicious ChatGPT Custom GPTs remain an active ClickFix lure. Huntress says attackers are rotating Google Sites and standalone domains that direct users from legitimate ChatGPT-hosted pages into PowerShell-based malware installation. Its SOC handled at least 40 incidents tied to one campaign domain, with two confirmed as originating through a Custom GPT. Huntress · AI & Model Security
• A fake WatchGuard VPN site steals credentials before serving the legitimate signed installer. The handoff leaves victims with the expected software after the phishing step, reducing suspicion and complicating user reports. Huntress · Threat Activity

in A Crafted Attachment Can Root Cisco’s Secure Email Gateway

October 11, 2026

• The AhsayCBS exploitation is now a confirmed zero-day with miner payloads. Huntress saw exploitation of CVE-2026-105133 (auth bypass, CVSS v4 5.5) chained with CVE-2026-105134 (OS command injection, CVSS v4 9.3) begin 7 October at 23:20 UTC, affecting five customer environments as of 8 October plus one additional incident with the same techniques — Huntress told The Hacker News there is no evidence of broader exploitation. Post-exploitation includes web shells and an XMRig miner named edge.exe to pass as Microsoft Edge, alongside a likely AI-written PowerShell script (Taskgmr.ps1) that kills Task Manager if it stays open too long overnight. Version 10.3.4, listed in NVD as the fix, is also affected. Huntress advises restricting access to the management interface. The Hacker News, @HuntressLabs · Vulnerabilities & Exploits

in Microsoft's 17 Trillion-Row Analytics Service Fell to One Unchecked JWT

October 10, 2026

• AhsayCBS: the "fixed" version isn't. Huntress now says Ahsay 10.3.4, the current latest build, is still vulnerable to CVE-2026-105133 (auth bypass, public exploit) and CVE-2026-105134 (command injection), so the chain remains unpatched (earlier coverage). Attacks from 7 October across at least five customer environments dropped JSP webshells and XMRig disguised as edge.exe, persisted via a MicrosoftEdgeUpdateSvc service running a renamed NSSM, and used what Huntress believes is an AI-assisted PowerShell script that halts mining when Task Manager opens and kills it at 18:00 or after an hour overnight; one host also got the vulnerable WinRing0x64.sys driver. IoCs and four Sigma rules are published (BleepingComputer, Huntress). · Exploitation in the Wild
• A legitimate Microsoft Power BI page is the first hop in a ScreenConnect delivery chain — clicking "Download Reference" opens a new tab that ends in multiple ScreenConnect instances, with the trusted domain carrying the click (Huntress). · Threat Activity

in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

October 9, 2026

• Huntress reports active exploitation of CVE-2026-105133 and CVE-2026-105134, the AhsayCBS backup-server RCE pair, across five customer environments — webshells, an XMRig miner masquerading as Microsoft Edge, and what it describes as an AI-assisted PowerShell script that watches for Task Manager and kills it if left open overnight (Huntress). It later found that 10.3.4 is also affected — the version customers had been told to upgrade to — and now advises restricting the management interface and hunting for compromise (update) (earlier coverage). · Vulnerabilities & Exploitation

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

September 29, 2026

• Attacker-built ChatGPT Custom GPTs are being used as the lure surface for ClickFix. Victims interact with a Custom GPT hosted on chatgpt.com, get handed a Google Sites link, run PowerShell, and pull a malicious MSI that sideloads a DLL via a Canon-signed binary (a later wave used a Stardock-signed one) to drop a RAT with dual persistence. Huntress responded to at least 40 incidents from the Google Sites domain, two confirmed as Custom GPT-driven (Huntress). · Threat Activity

in PitScaler Goes Global: Citrix NetScaler Chain Exploited for Weeks Before Anyone Had a Patch

September 25, 2026

• DarkMe RAT has dropped the exploits — Huntress finds the RAT previously used in a zero-day APT campaign now arriving in ordinary phishing mail as a fake image file. Huntress Separately, Ontinue documents Lunex, a new infostealer deployed through BYOVD. Ontinue · Threat Activity

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls

September 18, 2026

• Settra ransomware appeared at the start of the summer and Huntress has now seen it in two investigations; the operator dropped a MeshAgent RMM in both, and the later intrusion added BYOVD and a domain admin compromise (Huntress). · Threat Activity

in Plugin4Shell Turns Pinned Agent Plugins Into Zero-Click RCE

September 8, 2026

• N-able N-central shipped Hotfix 4 (build 2026.3.1.14) in the early hours of 6 September UTC for CVE-2026-86218, a static code injection flaw (CWE-96) rated CVSS 4.0 10.0 by N-able as CNA, allowing unauthenticated RCE on the N-central server. Every on-prem build below 2026.3.1.14 is affected, including servers patched to Hotfix 3 roughly eight hours earlier; hosted NCOD instances are already patched. The release notes say a third party disclosed it and that N-able has "no confirmations" of production exploitation, while the incident notice on the status page says the flaw "has been observed being exploited in the wild" (The Hacker News, BleepingComputer). No IoCs, no interim mitigation, no detection guidance beyond auditing N-central user accounts. Huntress, tracking N-central attacks since August, says it reproduced a PoC exploit chain against build 2026.3.1.10 but the appliance logs had rotated, leaving it unable to say which CVE was used; it advises IP allowlisting or VPN-only access to the console (earlier coverage). · Vulnerabilities & Exploits
• ConnectWise ScreenConnect has an unpatched flaw in file-transfer behaviour affecting both cloud and on-prem, with no CVE assigned and a fix promised later this week. The interim mitigation is to deselect the TransferFiles (or legacy TransferFilesInSession) scoped permission on every role and session group. Shadowserver tracks nearly 6,000 internet-exposed instances (BleepingComputer). Separately, Huntress detailed the worm-like rogue-client activity from three unrelated August incidents: a four-stage VBScript chain (1.vbs–4.vbs) where stage one profiles RAM, checks for existing ScreenConnect installs and enumerates Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos and Symantec into a three-bit state variable in %TEMP%\value.txt (The Hacker News, earlier coverage). · Vulnerabilities & Exploits

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

September 6, 2026

• A new N-able N-central chain can create unauthorized administrator accounts. Huntress built a PoC combining CVE-2026-86206 and CVE-2026-86207, which it says is distinct from the August flaws. Huntress says a hotfix is available; its follow-up recommends hunting for anomalous accounts using .invalid email addresses. · Vulnerabilities & Exploits
• Huntress reached the Knight Office login console by pivoting from an IP seen in an adversary-in-the-middle incident. Its phishing-kit investigation offers identity defenders a concrete view of the infrastructure behind session and credential theft. Huntress · Threat Activity

in One Loophole, 100 Agents, 27 Minutes

September 5, 2026

• Rogue ScreenConnect clients across multiple environments are spawning Windows Script Host to run a chain of four VBS files — a clean detection opportunity on RMM parent-child process trees (Huntress). · Threat Activity & Malware

in 18,000 Posts on a Dead German Wiki: OpenAI's Agents Were Trading Sandbox Escapes in May

August 29, 2026

• North Korean remote workers are moving beyond IT into sales, marketing and medical roles. Huntress identified five suspected cases in 2026 by pivoting on shared VPN, proxy and hosting infrastructure; operatives used stolen or altered IDs to get hired and remotely controlled company-issued laptops (Huntress, Dark Reading). · Threat Activity

in PaperCut Ships a Second Emergency Patch After Researchers Bypass the First

August 14, 2026

• Akira affiliates now reboot victims into Safe Mode with Networking to strip EDR — Huntress published full analysis of the technique, and in the observed cases the crew exfiltrated data but failed to encrypt (earlier coverage). (BleepingComputer) · Threat Activity

in vCenter Under Active Exploitation: Critical RCE Weaponized for Reverse-SSH Persistence Across 47 Countries

August 10, 2026

• A pre-auth RCE PoC is circulating for macOS Screen Sharing (CVE-2026-65400). Apple's fix addresses an authentication state-management bug that lets an unauthenticated network attacker reach the service without valid credentials; patched in Sequoia 15.7.9, Sonoma 14.8.9, and Tahoe 26.6.1 (NCSC-NL advisory). Huntress urges immediate patching and has shared detection guidance (Huntress). · Offensive & Exploitation

in ResetNightmare PoC Drops at Black Hat: One Kerberos Flaw, Any Account's Password Reset

August 4, 2026

• N-able N-central auth bypass (CVE-2026-18577) is under active exploitation, and the first fix didn't hold. Over the weekend N-able discovered a second authentication-bypass vector that grants attackers administrator access to both hosted and on-prem N-central servers, letting them reach the customer systems those servers manage; build 2026.3.1.7 (shipped Aug 2) is the first unaffected version (The Hacker News, BleepingComputer). Huntress has published exploitation details and detection guidance (Huntress). Continues our earlier coverage. · Vulnerabilities & Exploits
• Unpatched NTLM leak via the Windows search: URI handler — no CVE, no fix. Huntress details a coercion primitive functionally identical to CVE-2026-33829 but closed without a CVE, with arguably higher real-world risk; mitigations include blocking outbound SMB, enforcing SMB signing, disabling NTLM, and monitoring URI-handler activity (Huntress). · Vulnerabilities & Exploits

in Attackers Seize N-central RMM Servers After N-able's Second Fix Falls Short

August 3, 2026

• N-able N-central has a critical vulnerability that grants attackers "god-mode" access to the RMM console, according to Huntress, which is actively tracking it. An attacker who exploits it could run scripts, push tooling, and open remote sessions on any managed endpoint — the classic RMM-to-fleet blast radius that makes these platforms prime initial-access targets. · Vulnerabilities & Exploits

in God-Mode Access in N-able N-central Tops a Day of Fresh Exploits

July 29, 2026

• Huntress declassified its role in an FBI manhunt tied to the 2021 Silk Typhoon Exchange campaign — which it puts at 88,000 compromised servers, far beyond the "limited and targeted" framing at the time — ending in the arrest of a state-backed operator (Huntress). · Threat Activity
• Huntress is also tracking an active SonicWall credential-stuffing campaign that has produced successful unauthorized logins to VPN and firewall accounts across dozens of organizations; the blog carries IOCs (Huntress). · Threat Activity

in Artifactory Zero-Days Confirmed as the Hugging Face AI Agent's Escape Route

July 26, 2026

• Infostealer operators are hosting phishing pages as Claude Artifacts, Huntress reports — the malicious link genuinely resolves to claude.ai, defeating URL-reputation checks and hitting 29 organizations. · AI & Model Security
• North Korea's Contagious Interview campaign is hiding OTTERCOOKIE malware inside SVG images, per Huntress via gbhackers. · Threat Activity

in Hotel Wi-Fi Becomes an MFA-Bypass Machine for M365 Accounts

July 4, 2026

• LDAP Ping (cLDAP) is a blind spot for AD detection. Huntress researchers (@HuntressLabs, @4ndr3w6S) showed that using LDAP Ping to enumerate AD usernames leaves no trace in Windows audit logs — requests are handled by netlogon.dll rather than ntdsa.dll, so the usual Event 1644 never fires. The pre-auth, no-credentials technique yields confirmed account names for follow-on password spraying and BloodHound/PowerView recon; traffic is still visible at the network level (UDP/389, WFP traces). Huntress · Offensive & Red Team

in Silent Active Directory Recon and a Near-Perfect Linux Root Exploit Lead the Offensive Beat

July 2, 2026

• Huntress is tracking an ongoing, automated password-spray campaign against Azure CLI, abusing the OAuth ROPC flow (which bypasses MFA) from an IPv6 range (2a0a:d683::/32) attributed to LSHIY LLC / AS32167 and linked to China. Over 81 million login attempts between June 12–26 compromised at least 78 Microsoft accounts across ~64–78 orgs. Recommended mitigations: enforce comprehensive MFA and block ROPC. Huntress, BleepingComputer. · Cloud & Identity

in Scattered Spider Suspect Grabbed at Helsinki Airport, Extradited to the US

July 1, 2026

• Huntress revisited device-code phishing, dissecting the variations attackers favor and the "buy-the-tool-skip-the-setup" gaps that keep making it work. Huntress (X) · Cloud & Identity

in CitrixBleed Returns: watchTowr Discloses a New NetScaler Pre-Auth Memory Overread

June 23, 2026

• Klue breach fallout widens to a who's-who of security vendors — after Icarus posted stolen data on June 22, affected Klue customers now include HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium. Huntress says no product data, telemetry, passwords, or card data were touched — exposure is limited to business metadata (names, products trialed, subscription/pricing, sales notes) — and warns the data is ripe for Klue/Huntress impersonation. SecurityWeek · Huntress · Threat Intelligence

in Five Eyes Warns Frontier AI Will Reshape Offensive Cyber Ops as a New Entra ID Conditional Access Bypass Surfaces

June 21, 2026

• Klue, a competitive-intelligence platform, confirmed attackers stole OAuth tokens used to connect to customers' Salesforce environments, and the new Icarus extortion group has claimed it (BleepingComputer). Salesforce disabled the Klue Battlecards integration on June 11; this is the third Salesforce-connected app abused for CRM data theft, and confirmed victims include security vendors Huntress and Recorded Future (SecurityWeek, The Hacker News). · Cloud & Identity
• ClickFix campaigns expanded with three new loaders — BabaDeda, Lorem Ipsum, and Potemkin — per Morphisec, BlueVoyant, and Huntress, with the Lorem Ipsum activity possibly tied to Vice Society (The Hacker News). Microsoft also detailed CryptoBandits, a USB-LNK worm spreading a Windows clipper that uses Windows Script Host, ActiveX, and a bundled Tor proxy for C2 (BleepingComputer). · Threat Intelligence
• Huntress walked through containing a real intrusion at a nursing-facility network: initial access via an exposed RDWeb portal and a compromised test account, followed by RDP lateral movement, enumeration, and persistence attempts — caught and shut down by Managed EDR, Defender telemetry, and SOC response that disabled accounts and blocked the attacker IP before full compromise (Huntress). A useful reminder that internet-exposed RDWeb plus weak test accounts remains a top initial-access path. · Detection & Purple Team

in FortiBleed Exposes 86,000 FortiGate Devices as North Korea's Sapphire Sleet Poisons the Mastra npm Catalog

June 20, 2026

FortiBleed Burns 86,000 FortiGate Devices as Novo Nordisk Loses 1.3TB — Including AI Models — to a Leaked GitHub Token

FortiBleed has compromised ~86,644 internet-facing FortiGate devices in a credential-harvesting campaign, while a leaked GitHub token gave FulcrumSec access to Novo Nordisk, exfiltrating 1.3TB including unreleased drug formulas and internal AI models. Mastra npm packages were trojanized by Sapphire Sleet (North Korea–nexus), and multiple AI infrastructure flaws emerged: SearchLeak (CVE-2026-42824) in Microsoft 365 Copilot, Pickle in the Middle in Google Vertex AI, and vulnerabilities in LiteLLM. Ransomware gangs including Qilin, Gentlemen, and DragonForce continue dominating the threat landscape with EDR-killing tradecraft and cloud-based C2 abuse.