Proofpoint reported a Russia-aligned group, tracked as Laundry Bear or TA488, exploiting a cross-site scripting flaw in on-premises Outlook Web Access to plant a stealthy backdoor. Tracked as CVE-2026-42897 and rated 8.1, it is a half-click exploit: opening a crafted email in OWA runs attacker JavaScript in the session. The implant, OWAReaper, steals OAuth tokens from mailbox add-ins and grants the low-privilege Default user Owner rights on every mail folder, so any account in the organization can read the mailbox. Because that grant lives on the Exchange server, rotating credentials and re-imaging the device do not remove the access. Microsoft flagged exploitation since May.
Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.
Volexity has detailed Chinese espionage group UNC5221 (also VerdantBamboo) maintaining access to a victim's Microsoft 365 environment using the Brickstorm backdoor plus previously undocumented malware named Plenet and AgentPSD. The actor sat on the network at least 18 months before detection and had also compromised the victim's MSP. UNC5221 has exploited edge-device zero-days since at least 2023; Brickstorm began as Golang, later Rust. In this case the group pivoted from a compromised Egnyte Storage Sync system through the victim's SSL VPN, then used Brickstorm proxying and stolen credentials to reach Microsoft 365 - deliberately blending with legitimate traffic to evade Conditional Access. It re-breached the org after remediation.
CISA and the UK's National Cyber Security Centre jointly published a malware analysis report for FIRESTARTER, a persistent backdoor that China-linked group UAT-4356 (the same crew behind 2024's ArcaneDoor campaign) planted on Cisco ASA and Firepower firewall devices by chaining CVE-2025-20333 (VPN web server RCE) and CVE-2025-20362 (unauthorized access). The implant hooks into Cisco's Service Platform mount list, a boot-time configuration that controls which programs run when the device starts, so it survives reboots, firmware upgrades, and the September 2025 patches for those two CVEs. CISA found FIRESTARTER on an already-patched US federal civilian agency's Cisco Firepower device through continuous network monitoring - attackers silently returned in March 2026 to deploy a second-stage implant called Line Viper without needing to re-exploit the original vulnerabilities. Updated Emergency Directive ED 25-03 now orders federal agencies to audit every Cisco ASA and Firepower device they run and submit device memory snapshots for CISA analysis. The stark guidance for everyone else: if you confirm a compromise, replace the hardware. Reimaging is not enough because the bootloader itself may be implanted.
TrustStrike Labs