Password spraying across more than 5,700 Chilean M365 accounts broke into only seven unused service accounts
Proofpoint says an unknown actor sprayed over 5,700 M365 accounts in Chile and breached only seven, all dormant service accounts at one retailer. Employee logins held, and those seven unused accounts still gave the attacker mail, Teams chats, OneDrive files and, in one case, the Azure portal.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+20
- Incentives55
- Confidence50
A compromised public torrent archive has been serving malware to government and enterprise PCs since mid-August
Kaspersky says a previously unknown multi-stage loader has spread since mid-August through a compromised public torrent archive. It reaches its command server through the Solana blockchain. Victims include government and transport organisations.
Reality
- Evidence32
- Adoption30
- Hype gap+35
- Incentives85
- Confidence50
buildOne report1 publisher VectraRAT reaches high integrity by reparenting itself under auto-elevating computerdefaults.exe
SOCRadar's teardown of the $250-a-month service puts the elevation step behind an administrator account and permissive UAC settings, so on a fleet of standard users the rental buys remote access and credential theft and stops there.
Reality
- Evidence58
- Adoption28
- Hype gap+30
- Incentives52
- Confidence55
buildOne report1 publisher Gigabud clones a banking app into an Android work profile to register a new device
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
- Evidence42
- Adoption38
- Hype gap+12
- Incentives34
- Confidence48
buildOne report1 publisher A passkey 'upgrade' call ends with the attacker's phone number registered as an MFA method
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence55
buildConfirmed2 publishers VulnCheck found a root command channel in ZBT-derived OEM firmware that the default WAN firewall leaves open. Only the board ID and the firmware hash tell you whether your branch office is running it.
Reality
- Evidence72
- Adoption66
- Hype gap+16
- Incentives55
- Confidence68
buildOne report1 publisher Invisible email spans reach the summarizer because text extraction never checks visibility
The hidden-keyword trick that once fooled Bayesian spam scoring now lands inside an LLM's context window. The one component that could strip it is deliberately built to leave styling alone.
Reality
- Evidence34
- Adoption
- Not scored
- Hype gap+22
- Incentives86
- Confidence52
buildOne report1 publisher NovaCookies turns an MFA approval into a live Microsoft 365 session for $320
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality
- Evidence48
- Adoption40
- Hype gap+18
- Incentives66
- Confidence47
Rogue 'Delta WiFi Fast' access point shows evil twins now land where nobody owns the network
A passenger reportedly replaced a Delta flight's in-flight Wi-Fi with their own network and a phishing page. It surfaced the same week the administration floated paying private firms to hack back.
Reality
- Evidence28
- Adoption16
- Hype gap+34
- Incentives42
- Confidence35
Same Backdoors, Two Outcomes: APT36 Lands in Kabul, Stalls in Delhi
Acronis says Pakistan's Transparent Tribe is running new Patchcord and Sheetcord implants against Afghan government and telecom targets, with no confirmed compromises in India.
Reality
- Evidence58
- Adoption44
- Hype gap+8
- Incentives62
- Confidence55