4 casos · pág. 1/1
Between July 14 and September 22, 2026, Huntress detected 497 Microsoft 365 sign-in events across 79 victim organizations in a token replay campaign. The attacker replayed post-MFA session tokens stolen through AiTM relays, device-code phishing and social engineering, a pattern Huntress calls "token spraying". Replay traffic came from the…
A vendor-sponsored analysis by Exaforce (published on bleepingcomputer.com) says attackers are enumerating or exfiltrating data within about 15 minutes of gaining access. It describes three patterns: stolen developer GitHub OAuth tokens, ClickFix lures that impersonate Claude Code install instructions to deliver a macOS stealer, and help …
The FBI, CISA, DC3, NSA, USSS and the Republic of Korea's KNPA issued joint advisory AA26-222A on Gunra ransomware. Gunra appeared in April 2025 as a double-extortion variant derived from the leaked Conti source code. It launched a structured RaaS affiliate program in January 2026, also operating under the alias Golden Community, and recr…
A multinational advisory (CISA, NSA, FBI, AIVD, MIVD, NCSC-UK and others) warns that the Russian state-supported APT LAUNDRY BEAR (aka Void Blizzard, TA488) has compromised Western government, defense industrial base and NGO organizations running Zimbra Collaboration Suite (ZCS) since at least July 2025. The campaign uses a view-based XSS…
