Misconfigured Microsoft Power Pages Likely Exposed 27 Million Records to ExfilSquad
A suspected Microsoft Power Pages configuration failure has been linked to the exposure of roughly 27 million records across 13 organizations, after the data...
Microsoft
20 articles
Microsoft working on Defender patch for ShieldBreak zero-day
Microsoft is working on a security patch for the "ShieldBreak" zero-day vulnerability disclosed last week by security researcher "Nightmare Eclipse" and now ...
HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hide Malware and C2 Connections
HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit th...
McDonald’s Employee Data Appears in Leak, Seller Claims 1.7M Records Stolen
A seller claims 1.7M McDonald’s employee records were stolen from Azure.
Malicious Google Apps Script Profiles Crypto Victims Before Delivering Signed Windows Malware
A targeted cryptocurrency intrusion has exposed how Google-hosted Apps Script pages can be weaponized to profile prospective victims before delivering signed...
Fortune 500 Companies Hit in Azure Data Theft Campaign
A threat actor is claiming the exfiltration of millions of records from McDonald’s, TCS, Vodafone, and other large organizations. The post Fortune 500 Compan...
Weekly Recap! – Top 50 Biggest Cybersecurity Stories of the Week: Apple Spyware, Zoom Zero-Click RCE, VMware vCenter Exploits, Microsoft Patch Day & More
Welcome to this week’s edition of the GBHackers cybersecurity newsletter — your weekly cybersecurity bulletin covering the 50 most important stories from Aug...
12 KB Backdoor Masquerades as Realtek Software and Hides C2 in Windows Whitespace
A compact, custom-built Windows backdoor that impersonates Realtek software, persists through WMI, and conceals its command-and-control address inside what a...
Windows 11’s strongest security defenses can be bypassed without a screwdriver
Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without phy...
McDonald’s, Vodafone Hit in Massive Azure Credential Theft Campaign
A threat actor using the alias “TheHatman” is allegedly selling large corporate employee directories that were allegedly extracted from Microsoft Azure and E...
Mustang Panda Upgrades CoolClient With a Kernel Rootkit
Mustang Panda upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making the backdoor harder to detect. HoneyMy...
Microsoft Entra ID Makes Passkeys Default, Retires SMS and Voice MFA in 2027 for Better Security
Microsoft will make passkeys the default authentication experience in Entra ID beginning September 1, 2026, and will fully retire its native SMS and voice mu...
Download More RAM Attack Bypasses Windows VBS, HVCI and Disables Microsoft Defender
A newly disclosed Windows attack technique, dubbed “Download More RAM,” can undermine Virtualization-Based Security (VBS), bypass Hypervisor-Protected Code I...
Microsoft Copilot App Overhaul Merges Personal Chats and Ends Podcasts, Deep Research
Microsoft is reshaping its consumer and productivity AI strategy with a major update to its Copilot application, merging personal chat histories and generate...
CISA adds Metabase, Windows and Cisco Secure Firewall flaws to exploited vulnerabilities list
The vulnerabilities added to the KEV catalog include a heap inspection flaw in Cisco Secure Firewall (CVE-2026-20349), a use-after-free vulnerability in the ...
Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
The threat actor known as HoneyMyte (aka Mustang Panda) has been observed deploying an updated version of the CoolClient backdoor with a signed Windows kerne...
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol (CDP) inside a running Google Chrome or Micro...
DPRK’s Lazarus Group exploits Windows zero-day in backdoor campaign
Initial access is gained through fake job offers and PDF viewer downloads.
CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps
Cybersecurity researchers have uncovered a large-scale, global recruitment-themed phishing campaign that uses fake interview scheduling pages and Browser-in-...
Akira ransomware reboots into Windows Safe Mode to knock EDR offline
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system ...