Cybercrime

New phishing campaign tricks employees into bypassing Microsoft 365 MFA

Unwitting employees register a hacker’s device to their account; the crook then uses the resulting OAuth tokens to maintain persistent access.

Hackers turn bossware against the bosses

A threat actor is using Net Monitor for Employees and SimpleHelp to launch ransomware and cryptocurrency attacks.

‘Dead’ Outlook add-in hijacked to phish 4,000 Microsoft Office Store users

The first ever known malicious add-in bypassed a weak vetting process with a simple URL hack.

Windows shortcut files targeted by ransomware gang Global Group

A new wave of attacks is exploiting a weakness in the way Windows handles .lnk files.

Huawei’s industry-leading ransomware protection solution first to be Tolly Group-certified

Pretend Disk Format: PDFs harbor new dangers

Virtual Hard Disks masquerading as PDF files are allowing hackers to sneak remote-access software through enterprise defenses.

One click is all it takes: How ‘Reprompt’ turned Microsoft Copilot into a data exfiltration tool

A new Copilot exploit reveals how LLMs can be quietly turned into always-on data exfiltration tools.