All news in category “Threat and Trends Reports”

🔍 This podcast episode examines the 2025 Talos Year in Review, highlighting a sharp increase in internal phishing that evades traditional perimeter defenses. Hosts Amy Ciminnisi and Martin Lee explain how Microsoft 365's Direct Send feature has been broadly weaponized to deliver trusted-looking internal mail. They also unpack blended state-sponsored campaigns from China and North Korea that pair zero-day exploitation with advanced social engineering.

🔐 In 2025 attackers increased focus on weaknesses in multi-factor authentication (MFA) and the trust inherent in everyday workflows, with phishing used for initial access in 40% of incidents. Cascaded phishing leveraged compromised, legitimate accounts to craft highly convincing lures, while abuse of Microsoft 365 Direct Send enabled internal-looking spoofed messages. MFA spray attacks and device compromise—driven by voice phishing against administrators—targeted IAM tools and high-turnover device ecosystems, with higher education notably impacted. Defenders should harden device management, enforce strong lockout and conditional access policies, and adopt email protections such as Reject Direct Send and tightened SPF/DMARC.

🔐 Attackers increasingly rely on stolen credentials—via credential stuffing, password spraying and phishing—to gain immediate, low-noise access. Legitimate logins often evade detection, allowing adversaries to dump additional passwords, move laterally, and persist. The author warns that AI is accelerating these techniques and advocates a DAIR (Dynamic Approach to Incident Response) loop, plus clear communication and hands-on training to contain and remediate identity-based intrusions.

🔐 Talos demonstrates how adversaries can repurpose legitimate macOS features to achieve remote execution and lateral movement across enterprise fleets. By weaponizing Remote Application Scripting (RAE) and abusing Spotlight Finder comments as a staging area, attackers can bypass static file analysis and traditional SSH-focused telemetry. The research validates multiple native transfer channels—including SMB, netcat, Git, TFTP, and SNMP—and urges defenders to emphasize process lineage, IPC anomalies, and strict MDM controls.

🔐 Identity-centric systems have evolved from simple login mechanisms into the operational backbone of digital enterprises. By replacing the old network perimeter with a person- and device-centric model, modern identity frameworks enable fine-grained access control, real-time authorization and auditable accountability across cloud, mobile and distributed workforces. They also power customer personalization and fraud detection, helping teams move faster while reducing operational and security risk.

🔒 Much reporting on cyber risk focuses on AI, but frontline incidents remain grounded in social engineering and identity exploitation. Experts say attackers increasingly abuse legitimate tools — including trojanized RMM clients — and target network security appliances, OAuth flows, and machine identities to bypass defenses. Techniques like ClickFix, phishing, token theft and supply‑chain worms enable lateral movement and ransomware. Defenders should combine user training, RMM allowlists and layered, phishing‑resistant authentication.

🔒 Microsoft warns that threat actors are increasingly abusing external Microsoft Teams collaboration to impersonate IT or helpdesk staff and gain remote access. Attackers initiate cross-tenant chats to request remote assistance—commonly via Quick Assist—then perform reconnaissance and deploy small payloads into user-writable locations. They abuse trusted, signed applications for execution and use HTTPS-based C2 and tools like Rclone to exfiltrate filtered, high-value data, often blending into normal traffic. Administrators are urged to treat external Teams contacts as untrusted, restrict remote-assistance tools, and limit WinRM usage.

🔒 Microsoft warns that attackers are exploiting Microsoft Teams cross-tenant features to impersonate IT helpdesk staff and trick employees into granting remote control. The cross-tenant helpdesk impersonation playbook leverages real-time chats, social engineering, and legitimate remote-support tools so access appears user-approved and avoids typical malware detections. Organizations are urged to tighten external access, restrict support workflows, enforce Zero Trust controls, and improve behavioral monitoring.

🔒 Nitin Raina’s move from IT operations to Thoughtworks’ global CISO and global head of enterprise risk illustrates a fast-growing trend: CISOs increasingly lead enterprise risk programs. Since 2020 Raina has built an ERM function that links strategic, operational, and cybersecurity risks through assessments, gap analyses, and controls. Industry reports show most CISOs now share accountability for operational business risk and are responsible for AI governance, making GRC and risk quantification central to executive and board trust.

🔐 The article argues that modern ransomware operates like an industry, with affiliates, suppliers, marketplaces and subscription services coordinating long before a ransom note appears. It cites the March 2024 Change Healthcare incident and disputes between affiliates and operators to illustrate franchise dynamics. It details technical enablers such as BYOVD EDR killers and emerging AI-assisted tooling, and urges defenders to map actors, tools and supply‑chain exposure rather than treat incidents as isolated break‑ins.

📧 Threat actors are exploiting Apple account-change notifications to deliver callback phishing within legitimate emails sent from Apple's infrastructure. They place scam text into the account's first and last name fields, then trigger a shipping-info update so Apple sends the altered notification. Because messages are sent from appleid@id.apple.com and pass SPF, DKIM, and DMARC, they appear authentic and can bypass filters, increasing the risk of successful callback scams.

🔐 Microsoft Defender Security Research outlines a human-operated intrusion playbook where attackers abuse cross-tenant Microsoft Teams collaboration to impersonate IT/helpdesk staff and socially engineer users into granting remote assistance. With user consent, adversaries gain interactive access via Quick Assist or similar tools, then execute attacker modules by side-loading them into trusted vendor-signed applications. The chain leverages native administrative protocols such as WinRM and commercial RMM tooling to move laterally and stage sensitive business data for exfiltration. Microsoft Defender provides correlated identity, endpoint, and collaboration telemetry to surface and disrupt this pathway.

🔒 Microsoft describes how Microsoft Defender’s predictive shielding — part of automatic attack disruption — proactively contains exposed high-privilege identities to stop credential abuse and lateral movement. In a June 2025 public sector incident, automated containment prevented attackers from leveraging exposed domain credentials to escalate and pivot across identity and Exchange infrastructure. The feature evaluates exposure signals and applies just-in-time restrictions to block sign-ins, sessions, and interactive pivots while investigators remediate. It’s available out‑of‑the‑box for Defender for Endpoint P2 customers who meet prerequisites.

🔍 Flare analysts recovered a forum document, The Underground Guide to Legit CC Shops, that explains how fraud actors vet stolen credit card marketplaces. The guide shifts emphasis from opportunistic card use to disciplined supplier evaluation, offering a technical checklist (domain age, WHOIS, SSL), social‑intel techniques, and strict OPSEC recommendations. It also highlights how shops emulate legitimate e‑commerce (pricing, ticketing, escrow) and warns of commercial bias in endorsed services.

🔔 As data breach notices become common, fraudsters increasingly send fake alerts or piggyback on real incidents to trick recipients into clicking malicious links or divulging credentials. These scams often demand immediate action, use spoofed sender addresses, and lack personal account details. Verify any notice by logging into the real account or contacting the organization through trusted channels, and reduce exposure with a password manager and MFA.

🔍 Cisco Talos’ Q1 2026 vulnerability pulse shows steady Known Exploited Vulnerabilities (KEVs) overall, while networking equipment comprised roughly 20% of KEV-related flaws and may rise further. Overall CVE disclosures climbed in Q1, with March being the steepest month, and Talos flagged 121 CVEs with AI relevance. The report stresses persistent patch-management gaps, growing software supply chain compromises, and a surge in abuse of the n8n automation platform where exposed webhooks are weaponized to deliver malware and fingerprint devices.

⚠️ Cleafy researchers report that attackers are deliberately creating malformed Android packages to evade static analysis, with over 3,000 affected samples across families such as Teabot, TrickMo, Godfather and SpyNote. The technique exploits inconsistencies between ZIP Local File Headers and the Central Directory so that tools like JADX crash while the Android installer still accepts and runs the app. Observed tactics include directory-file name collisions, unsupported compression methods, corrupted AndroidManifest.xml entries and non-ASCII filenames in assets that confound decompilers. To counter this, Cleafy published Malfixer, an open-source Python utility that detects and repairs malformed APKs for conventional reverse engineering workflows.

📧 In Q1 2026, Check Point Research found Microsoft was the most impersonated brand in phishing campaigns, accounting for 22% of brand impersonation attempts. Apple (11%), Google (9%), Amazon (7%) and LinkedIn (6%) followed, reflecting attackers’ focus on both enterprise and consumer ecosystems tied to identity, devices and payments. The report underscores a persistent trend: threat actors exploit trusted brands to harvest credentials and gain initial access to personal and corporate environments.

🔎 Supply chain dependencies create hidden cyber blind spots that can cascade into large-scale operational, financial, and reputational damage. Many SMBs underestimate the threat — ESET’s 2026 SMB Cyber Readiness Index shows supply chain attacks rank well below concerns about AI-powered malware. High-profile incidents (3CX, CDK, Change Healthcare, Jaguar Land Rover) and erroneous updates (CrowdStrike) show risk from both malice and error. The author advises mapping third-party dependencies, enforcing vendor cybersecurity standards, and adopting zero trust and continuous monitoring.

🔒 The article argues that the ongoing debate over the CISO reporting line persists because many organizations still view cybersecurity as a technical issue rather than a strategic leadership concern. It emphasizes that reporting relationships matter for access, authority and influence, but they are not a panacea. Effective security depends on governance, trust between the CISO and their boss, and the ability to operate across IT, legal, HR, procurement and business units. The piece rejects a universal model and urges focus on cross‑functional authority and leadership.