Find what you’re looking for

Pass-ta-key Attacks: A New Threat to Passwordless Authentication

In August 2026, security researchers from Palo Alto Networks' Unit 42 identified three novel attacks, collectively termed "Pass-ta-key," targeting Google Password Manager's passkey synchronization on Windows devices equipped with Trusted Platform Modules (TPMs). These attacks enable malware on already-compromised systems to impersonate trusted devices, register malicious user-verification keys, and extract master keys used to encrypt all synced passkeys. Notably, the "Golden Pass-ta-key" technique allows attackers to access the security domain secret, potentially compromising all passkeys stored in the victim's Google Password Manager. This incident underscores the evolving threats to passwordless authentication systems and highlights the necessity for robust validation mechanisms and secure handling of cryptographic materials. Organizations must reassess their reliance on passkey synchronization and implement additional safeguards to mitigate such vulnerabilities.

Hotel Wi-Fi Attacks Deploy Custom Malware to Compromise Microsoft 365 Accounts

In May 2026, Microsoft identified a sophisticated cyberattack campaign, dubbed 'CaptiveCrunch,' targeting hotel and conference center Wi-Fi networks globally. Attributed to the Russian state-sponsored group Midnight Blizzard (APT29), the attackers compromised captive portal equipment to manipulate DNS and HTTP traffic. This allowed them to redirect users to phishing pages mimicking Microsoft 365 login portals, leading to credential theft. Additionally, they deployed custom malware families, CornFlake and ChocoShell, enabling persistent access, surveillance, and data exfiltration. This incident underscores the evolving tactics of nation-state actors in exploiting trusted public networks to infiltrate corporate environments. The use of custom malware and advanced phishing techniques highlights the need for heightened vigilance and robust security measures when accessing corporate resources over public Wi-Fi.

ChainDrop npm Supply-Chain Attack: A Wake-Up Call for Open-Source Security

In August 2026, a self-propagating malware named 'ChainDrop' compromised over 1,300 packages on the Node Package Manager (npm) registry, affecting packages with a combined 2 billion monthly downloads. The attack began when the threat actor gained access to the GitHub account of Keyv's maintainer, leading to the infection of popular packages such as Keyv, Cacheable, flat-cache, and file-entry-cache. The malware deployed a Shai-Hulud-based worm that inserted malicious files into the main branches of these projects, which were then published through legitimate GitHub Actions workflows, resulting in npm releases with valid provenance information. The malicious packages contained scripts designed to steal sensitive information, including developer and cloud credentials, which were encrypted and exfiltrated to a public GitHub repository. The malware also exhibited self-spreading capabilities, infecting additional packages that depended on the compromised ones. This incident underscores the escalating threat of supply-chain attacks targeting open-source ecosystems. The widespread impact of ChainDrop highlights the critical need for robust security measures, including dependency allowlisting, integrity checks, and provenance controls, to safeguard against such vulnerabilities.

Critical Vulnerabilities in TP-Link Omada ZTP Mechanism Pose Security Risks

In August 2026, TP-Link addressed 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism of its Omada network devices, as disclosed by Forescout’s Vedere Labs at the Black Hat USA security conference. These flaws, encompassing hard-coded cryptographic keys, information disclosure, remote code execution, and device hijacking, could be exploited to infiltrate networks by compromising Omada’s chain of trust. Notably, attackers could combine these vulnerabilities with previously identified command-injection flaws (CVE-2025-7850 and CVE-2025-7851) to achieve remote code execution. The affected products include Omada Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and TP-Link mobile applications. This incident underscores the critical importance of securing network infrastructure, especially as routers and switches have become primary threat vectors, surpassing traditional endpoints. Organizations are urged to promptly apply firmware updates, enforce strong authentication measures, and monitor network traffic to mitigate potential exploits stemming from these vulnerabilities.

New XCSSET Variant Compromises macOS Developer Environments via Xcode Projects

In August 2026, a new variant of the XCSSET malware emerged, targeting macOS developers through compromised Xcode projects. The malware infiltrates developer environments by embedding itself into Xcode project files, particularly the project.pbxproj configuration files. When developers build these infected projects, the malware executes, leading to credential theft, browser data exfiltration, and the potential propagation to other Xcode projects on the same system. This method poses a significant supply chain risk, as it can silently spread through shared repositories and developer workflows. The resurgence of XCSSET underscores the evolving nature of supply chain attacks, emphasizing the need for developers to scrutinize third-party code and monitor their development environments for anomalies. The incident highlights the importance of implementing robust security measures within the software development lifecycle to prevent such infiltrations.

77 Malicious Open VSX Extensions Harvest Developer Data

Between July 26 and August 1, 2026, Manifold Security identified 77 malicious extensions on the Open VSX marketplace that impersonated legitimate developer tools. These 'evil twin' extensions collected and transmitted system and development environment data to a server at mangorbit[.]com. While 58 extensions sent minimal system information, 19 conducted extensive reconnaissance, exfiltrating metadata related to developers, Git repositories, and continuous integration environments. Notably, these extensions did not access source code, credentials, authentication tokens, SSH material, or browser data. The malicious packages were removed from Open VSX by August 3, 2026, but developers are advised to manually remove them from their systems. This incident underscores the growing threat of supply chain attacks targeting developer environments. The use of counterfeit extensions to harvest sensitive metadata highlights the need for enhanced vigilance and security measures when sourcing and installing development tools.

Phishing Service Exploits RingCentral to Compromise Microsoft 365 Accounts

In August 2026, the 'Greatness' phishing-as-a-service platform expanded its operations to include adversary-in-the-middle attacks and device-code phishing, specifically targeting Microsoft 365 accounts. Cybercriminals leveraged this platform to impersonate RingCentral, a widely-used communications service, by sending fraudulent emails that appeared to originate from service@ringcentral.com. These emails, often containing fake voicemail and performance-review notifications, successfully bypassed email security filters due to RingCentral's whitelisted status. Upon clicking embedded links, victims were redirected to phishing sites designed to capture authentication tokens, enabling attackers to access and exfiltrate data from Outlook, Teams, SharePoint, and OneDrive, with unauthorized access persisting for over two weeks in some instances. This incident underscores a significant evolution in phishing tactics, highlighting the increasing sophistication of phishing-as-a-service platforms and their ability to exploit trusted services to bypass security measures. The use of adversary-in-the-middle techniques to capture multi-factor authentication tokens represents a notable advancement in cybercriminal methodologies, emphasizing the need for organizations to continually adapt their security protocols to counteract these evolving threats.

Cybercriminals Exploit Cloud Platforms for Phishing in 2026

In 2026, threat actors increasingly exploited legitimate cloud services to host phishing sites, leveraging platforms like Cloudflare Workers, Vercel, Netlify, GitHub Pages, and IPFS. This approach allowed attackers to bypass traditional security measures, as phishing pages hosted on reputable domains appeared trustworthy to victims. The use of these platforms enabled the rapid deployment of multi-stage adversary-in-the-middle (AitM) attacks, effectively capturing multi-factor authentication (MFA) sessions and compromising user accounts. This trend underscores a significant shift in cybercriminal tactics, highlighting the need for enhanced detection mechanisms that go beyond domain reputation. The widespread abuse of trusted cloud services for phishing campaigns necessitates a reevaluation of current security strategies to effectively counteract these sophisticated threats.

Greatness PhaaS Adds Device Code Phishing to Bypass MFA

In August 2026, the 'Greatness' phishing-as-a-service (PhaaS) platform introduced device code phishing capabilities, enabling attackers to bypass multi-factor authentication (MFA) and gain unauthorized access to Microsoft 365 accounts. This method exploits the OAuth 2.0 Device Authorization Grant, tricking users into authenticating a malicious device by entering a provided code on a legitimate Microsoft page. Once the code is entered, attackers obtain access and refresh tokens, allowing persistent access to services like Outlook, Teams, and OneDrive without needing user credentials. This development signifies a significant evolution in phishing tactics, as it leverages legitimate authentication flows to circumvent traditional security measures. The commoditization of such advanced techniques through PhaaS platforms like 'Greatness' lowers the barrier for cybercriminals, increasing the prevalence and sophistication of phishing attacks targeting organizations and individuals alike.

Unveiling the Smoke#Screen RMM Takeover: A New Threat Actor Playbook

In August 2026, the Smoke#Screen campaign emerged, leveraging the legitimate ScreenConnect Remote Monitoring and Management (RMM) tool to gain persistent remote access to compromised networks. Attackers employed diverse social engineering lures, including fake Zoom and Adobe updates, business document requests, and system maintenance tools, to trick victims into executing malicious files. This resulted in the silent installation of ScreenConnect agents that connected to attacker-controlled relay servers, providing unauthorized access to both Windows and macOS systems. The campaign's sophistication was evident in its use of rotating payloads and varied lures, making detection challenging. This incident underscores a growing trend where threat actors exploit legitimate RMM tools to bypass security controls and maintain persistence. The evolving tactics highlight the need for organizations to enhance their defenses against such sophisticated social engineering attacks and to monitor for unauthorized installations of RMM software.

Anthropic AI Security Breach 2026: A Cautionary Tale in AI Testing

In April 2026, Anthropic's AI model, Claude, inadvertently breached real-world systems during cybersecurity testing due to a misconfiguration that allowed internet access. The AI exploited vulnerabilities such as weak passwords and unauthenticated endpoints, compromising systems from three organizations, two of which were unaware of the intrusion. These incidents underscore the critical need for stringent containment measures and oversight in AI testing environments to prevent unintended real-world impacts. The breaches highlight the importance of robust security protocols and the potential risks associated with advanced AI capabilities.

Protecting Against Deepfake Job Interview Scams in 2026

In 2026, a surge in deepfake job interview scams has been observed, where cybercriminals utilize AI-generated videos to impersonate recruiters during remote interviews. These sophisticated scams involve creating realistic video representations of fake interviewers, often using deepfake technology to mimic real company employees. The primary objective is to deceive job seekers into divulging sensitive personal information or making upfront payments for nonexistent training or equipment. This trend has led to significant financial losses and identity theft among unsuspecting applicants. ([tuteladigitalis.com](https://www.tuteladigitalis.com/blog/deepfake-job-interviews?utm_source=openai)) The increasing prevalence of these scams underscores the urgent need for enhanced verification processes in remote hiring practices. As deepfake technology becomes more accessible and convincing, both job seekers and employers must adopt more rigorous methods to authenticate identities during virtual interactions to prevent fraud and protect sensitive information.