Bryant Smith

Adversaries are exploiting CVE-2026-84869 and hijacked ScreenConnect sessions to deploy a multi-stage VBScript chain that enables worm-like propagation, credential theft, and cryptomining.

Researchers disclosed multiple zero-day vulnerabilities in N-able N-central Appliance (v2026.4.0.31) enabling unauthenticated RCE through XXE chains and session confusion.

Microsoft Defender for Endpoint has introduced new token context fields in Advanced Hunting to surface privileged group SIDs and logon attributes at the time of token creation.

The Storm-2372 threat actor and security researchers bypass Microsoft Entra ID Conditional Access by registering phantom devices and spoofing Intune compliance claims.

Threat actor EvilTokens uses device code flow phishing to bypass MFA and obtain Primary Refresh Tokens for persistent Microsoft 365 access.