Cybersecurity firm Huntress published its 'Tragic Quadrant,' a ranked list of attack tactics most frequently hitting small and mid-sized businesses. The data shows remote monitoring and management (RMM) tool abuse accounted for 45% of endpoint incidents in Q1 2026, mailbox manipulation made up 24.6% of identity threat signals so far in 2026, and adversary-in-the-middle attacks that bypass multi-factor authentication represented 18.9% of identity-based threats tracked in 2025.
bleepingcomputer.com
· 2026-10-27
Huntress researchers Sarah Reddish and Spike Brandt detailed a ClickFix campaign that begins with a sponsored Google ad for 'amazon business,' redirecting victims through a suspicious domain to a spoofed Amazon login page hosted on Google Sites. A fake CAPTCHA on that page triggers Windows' decades-old finger utility, which launches a multi-stage chain delivering a pirated NetSupport Client RMM tool and Lumma Stealer infostealer malware. Google has pulled the malicious ad, but the attackers' infrastructure, which now uses barbeque-themed domain names, remains active.
darkreading.com
· 2026-10-21
ConnectWise shut down customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities used to connect to Microsoft 365 tenants. Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, while security firm Huntress identified at least 162 compromised tenants in its own environment. ConnectWise says it has found no evidence that customer backup data itself was accessed, and existing backups remain intact.
bleepingcomputer.com
· 2026-10-17
Huntress researchers say attackers are chaining two AhsayCBS vulnerabilities—an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134)—to compromise at least five organizations since October 7. After breaking in, attackers deployed JSP webshells and installed an XMRig cryptocurrency miner disguised as edge.exe, persisting via a fake Windows service.
bleepingcomputer.com
· 2026-10-09
Security firm Huntress found attackers had built a Custom GPT named 'Plus 5.6' hosted on the real ChatGPT.com domain, designed to look like an official OpenAI model. The bot told users ChatGPT was unavailable and pushed them to a fake Cloudflare security check page that instructed them to copy and paste a Windows command, a technique known as ClickFix, which could install malware capable of accessing files, screens, webcams and microphones. Huntress says some victims reached the fake bot via a sponsored Google ad for 'ChatGPT' placed above organic search results.
androidauthority.com
· 2026-10-01
Huntress researchers found a custom ChatGPT variant named 'Plus 5.6', promoted via sponsored Google search results, that redirects users to a fake Google Sites page mimicking a Cloudflare check. That page instructs visitors to run a PowerShell command which installs a signed application alongside a malicious DLL, deploying a remote access trojan. Huntress says it has investigated at least 40 related incidents, and OpenAI plans to retire the custom GPTs feature on December 11.
bleepingcomputer.com
· 2026-09-29
Huntress' Security Operations Center reports that over the past nine months, attackers have been abusing legitimate sharing features on AI platforms—like Claude Artifacts, claude.ai/share links, and indexable ChatGPT and Grok conversations—to distribute malware. These campaigns exploit the trust users place in familiar AI branding, often surviving only hours or days before the platforms take the content down.
bleepingcomputer.com
· 2026-09-11
N-able released N-central 2026.3 Hotfix 4 on Saturday to fix CVE-2026-86218, a maximum-severity remote code execution bug that lets unauthenticated attackers run code on unpatched, internet-exposed servers. Shadowserver counts nearly 1,500 exposed N-central instances, mostly in the US and Europe, while security firm Huntress suspects the flaw, along with two related authentication-bypass bugs, may already have been exploited as a zero-day in at least one customer breach.
bleepingcomputer.com
· 2026-09-07
Huntress researchers found phishing campaigns that trick victims into running a disguised but legitimate Faronics Deploy installer, often labeled as an Adobe file, which secretly enrolls their machine into an attacker-controlled management console. From there, attackers run PowerShell scripts to fetch additional tools and install ConnectWise ScreenConnect, giving them persistent remote access. Over 457 endpoints were targeted between July 21 and August 20 using fake invoice and tax-document lures.
bleepingcomputer.com
· 2026-09-01
Security firm Huntress published findings from investigations conducted throughout 2026 in which it helped organizations confirm they had unknowingly hired North Korean operatives posing as IT staff. Cases included an Australian healthcare firm that flagged three employees suspected of impersonating Chinese nationals, plus two separate incidents in the financial services sector uncovered in August. Huntress noted these DPRK-linked workers have grown more skilled and active, blending into IT teams while funneling wages back to the regime and potentially planting malware or stealing data.
darkreading.com
· 2026-08-26
GoKawiil