ConnectWise Cloud Backup Credential Misuse Exposes Microsoft 365 Customers
Security researchers reveal a campaign abusing a compromised ConnectWise Cloud Backup credential to access 173 Microsoft 365 tenants and customer data.
Critical AhsayCBS Vulnerabilities Enable Remote Code Execution And Cryptomining Attacks
Threat actors are exploiting two AhsayCBS vulnerabilities to deploy web shells and XMRig cryptocurrency miners, prompting security experts to recommend restricting management interface access.
Critical PaperCut Vulnerabilities Enable Remote Code Execution On Unpatched Systems
Security researchers have observed attackers chaining two PaperCut vulnerabilities to bypass authentication and execute remote code, prompting urgent patching and access restriction recommendations.
Password Spraying Attacks Rise As Attackers Target Microsoft Azure MFA Gaps
Huntress has reported a 155x increase in password spraying attacks during 2026, with attackers exploiting Azure CLI access and gaps in MFA protection.
Researchers Spot Suspected AI Generated PowerShell Script Used For Active Directory Reconnaissance
Huntress researchers have uncovered an intrusion involving a suspected AI generated PowerShell script used to map Active Directory environments, highlighting the growing role of artificial intelligence in cyberattacks.
Azure CLI Password Spray Campaign Compromises Microsoft Accounts Through Legacy OAuth Flow
Huntress has identified a large scale password spray campaign targeting Azure CLI, with more than 81 million login attempts compromising at least 78 Microsoft accounts across 64 organizations.
Unpatched Windows Search URI Vulnerability Exposes NTLMv2 Hashes To Potential Attacks
Cybersecurity researchers have disclosed an unpatched Windows Search URI vulnerability that could expose NTLMv2 hashes, allowing attackers to conduct relay attacks and gain deeper network access.
Chinese-Speaking Threat Actors Exploit SonicWall VPN and VMware ESXi Zero-Days
Huntress identifies a sophisticated attack chain leveraging SonicWall VPN and VMware ESXi zero-day vulnerabilities, enabling VM escape and persistent hypervisor access through VSOCK communication.
