Varonis Threat Labs detailed a post-compromise technique it calls TrustSink, in which an attacker holding a highly privileged Microsoft Entra account registers a rogue External Authentication Method as an external MFA provider. During normal sign-ins, Entra redirects users to the rogue provider to complete the second factor, and the attacker inserts a convincing Microsoft password prompt that captures the password in plaintext before returning a valid signed token, so the login completes with no error. In testing, every sign-in succeeded while the attacker server logged passwords with source IPs. Resetting a captured password does not remove the rogue provider, which persists in the configuration and works against any external provider model.
Researchers at Zimperium documented RatHat, an Android banking trojan that gains deep control of a phone by abusing its own debugging tools. After tricking the user into granting accessibility permissions, it uses automated taps to enable wireless debugging, reads the on-screen pairing code, and connects to the phone's local debugging service to get shell-level access with no computer attached. It then drops components that disable security apps, open a hidden tunnel to the attacker, and restore the malware even after uninstall, intercepting the removal screen with a fake error. RatHat also uses a generative-AI engine to read the screen and navigate on its own, making it more adaptable than scripted malware.
Researchers at Sophos and ESET found attackers breaching F5 BIG-IP APM access gateways and installing a stealthy Linux rootkit that ESET calls PoisonedRefresh. Rather than dropping a file on disk, it hides a web shell in memory, hooks into the Apache and PHP components, tampers with SELinux settings, and uses disguised requests to run commands while blending into normal traffic. Crucially, it persists across device upgrades, so patching the appliance alone does not remove it. The intrusions likely began by exploiting a critical remote code execution flaw that F5 had earlier downgraded to a mere denial-of-service issue, which may have led some organizations to deprioritize patching it.
Researchers at ANY.RUN documented a phishing campaign spanning 46 countries, with about 45 percent of activity aimed at the United States, that tricks victims into installing legitimate remote monitoring and management software to give attackers persistent access. The lures pose as tax documents, invoices, shipping notices, and government messages, and the operation leans on disposable infrastructure hosted on trusted platforms like Vercel, GitHub Pages, and Netlify, with most hosts appearing for only a single day. Because the specific domains and remote-access tools are interchangeable while the delivery chain stays stable, defenders cannot rely on individual indicators or malware verdicts alone. Remote-management governance is the more durable control.
Proofpoint reported a Russia-aligned group, tracked as Laundry Bear or TA488, exploiting a cross-site scripting flaw in on-premises Outlook Web Access to plant a stealthy backdoor. Tracked as CVE-2026-42897 and rated 8.1, it is a half-click exploit: opening a crafted email in OWA runs attacker JavaScript in the session. The implant, OWAReaper, steals OAuth tokens from mailbox add-ins and grants the low-privilege Default user Owner rights on every mail folder, so any account in the organization can read the mailbox. Because that grant lives on the Exchange server, rotating credentials and re-imaging the device do not remove the access. Microsoft flagged exploitation since May.
Attackers began exploiting a critical Microsoft SharePoint flaw within days of a working proof-of-concept appearing publicly. CVE-2026-50522 is a deserialization of untrusted data issue rated 9.8 that lets a remote attacker run code on on-premises SharePoint without authentication, and Microsoft patched it in the July updates while marking exploitation as more likely rather than confirmed. Offensive security firm watchTowr reports active attacks against on-premises deployments, with attackers pulling SharePoint machine keys in a single request. Those keys let an attacker forge authentication tokens and impersonate users, so access survives patching. It is the third SharePoint flaw to see exploitation this month.
Researchers at StepSecurity documented SleeperGem, a supply chain attack in which malicious versions of three RubyGems packages were published over two days, including one impersonating Microsoft's Git Credential Manager. Each release is a loader that fetches a second stage from an attacker controlled server, then checks around thirty environment variables that continuous integration platforms set. If it finds any, it exits and does nothing; on a developer machine it drops a native daemon and installs persistence. The accounts behind the packages were ordinary ones that had gone dormant for years, which is what made them attractive to hijack, and the releases had no matching source repository tags.
Researchers demonstrated MemGhost, an attack that uses one email to plant a false, persistent memory in an AI personal assistant with inbox access. Because these assistants keep notes about the user and reload them every session, a crafted message can trick the agent into saving a fabricated fact while keeping its reply innocuous, so the tampering goes unnoticed and steers later answers. The team trained an attacker model to write such emails automatically, reporting high success against open-source and commercial agents and showing it transfers across memory backends and survives several defenses. Unlike earlier one-shot injection that leaked data only in the moment, MemGhost's memory persists long after the email is gone.
Volexity has detailed Chinese espionage group UNC5221 (also VerdantBamboo) maintaining access to a victim's Microsoft 365 environment using the Brickstorm backdoor plus previously undocumented malware named Plenet and AgentPSD. The actor sat on the network at least 18 months before detection and had also compromised the victim's MSP. UNC5221 has exploited edge-device zero-days since at least 2023; Brickstorm began as Golang, later Rust. In this case the group pivoted from a compromised Egnyte Storage Sync system through the victim's SSL VPN, then used Brickstorm proxying and stolen credentials to reach Microsoft 365 - deliberately blending with legitimate traffic to evade Conditional Access. It re-breached the org after remediation.
CISA and the UK's National Cyber Security Centre jointly published a malware analysis report for FIRESTARTER, a persistent backdoor that China-linked group UAT-4356 (the same crew behind 2024's ArcaneDoor campaign) planted on Cisco ASA and Firepower firewall devices by chaining CVE-2025-20333 (VPN web server RCE) and CVE-2025-20362 (unauthorized access). The implant hooks into Cisco's Service Platform mount list, a boot-time configuration that controls which programs run when the device starts, so it survives reboots, firmware upgrades, and the September 2025 patches for those two CVEs. CISA found FIRESTARTER on an already-patched US federal civilian agency's Cisco Firepower device through continuous network monitoring - attackers silently returned in March 2026 to deploy a second-stage implant called Line Viper without needing to re-exploit the original vulnerabilities. Updated Emergency Directive ED 25-03 now orders federal agencies to audit every Cisco ASA and Firepower device they run and submit device memory snapshots for CISA analysis. The stark guidance for everyone else: if you confirm a compromise, replace the hardware. Reimaging is not enough because the bootloader itself may be implanted.
TrustStrike Labs