Mandiant detailed an August 4, 2026 Akira ransomware intrusion in which an affiliate brute-forced a SonicWall SSL VPN account that had no multi-factor authentication, gaining access within minutes. The attacker then used RDP to reach the domain controller, enumerate Active Directory, and steal credentials and file-share data, though the ransomware payload itself failed to deploy. Mandiant's 2025 data shows compromised credentials caused 21% of ransomware incidents with a known entry point, and RDP was used for lateral movement in about 85% of cases.
bleepingcomputer.com
· 2026-10-13
Security firm Island discovered a phishing campaign using fake ChatGPT, Gemini, Claude and Perplexity sites that target advertising agency staff and media buyers. The sites exploit the recent launch of Meta's Muse AI agent and use browser-in-browser techniques to fake Google login windows, capturing credentials and MFA codes to hijack high-value ad accounts.
bleepingcomputer.com
· 2026-10-06
A vulnerability has been identified in middleware used by SWIFT banking systems and government networks that could allow attackers to achieve remote code execution. The flaw reportedly affects environments relying on hardware-based multi-factor authentication, and administrators are being urged to apply patches immediately.
darkreading.com
· 2026-10-02
Varonis Threat Labs disclosed a technique called TrustSink in which an attacker with a highly privileged Entra account registers a rogue external MFA provider that inserts a fake password prompt into legitimate login flows, capturing users' plaintext passwords. The rogue provider still returns a valid signed token to Entra, so the sign-in completes normally with no visible error, and resetting a stolen password does not remove the malicious provider from the authentication flow. Varonis says the method could work with any authentication system using this external MFA model but demonstrated it specifically against Microsoft Entra.
bleepingcomputer.com
· 2026-09-22
Security researchers warn that attackers can gain lasting access to SaaS and cloud accounts simply by tricking a logged-in user into approving a malicious OAuth application, sidestepping passwords, malware, and multifactor authentication entirely. Once granted, these app permissions can let attackers read email, browse files, pull source code, or touch CI/CD systems through legitimate API access until the tokens or grants are revoked.
darkreading.com
· 2026-09-18
Security researchers note that as MFA, conditional access and device trust make direct credential theft harder, attackers are shifting focus to account recovery workflows. Instead of stealing a user's second authentication factor, criminals are tricking service desk staff into resetting or reassigning it on their behalf.
bleepingcomputer.com
· 2026-09-09
GoKawiil