Stolen AI API Key Leaves One Company With Nearly $1 Million Bill
Unit 42 says stolen AI API keys can reach gray-market proxy services within minutes, turning one exposed credential into catastrophic usage charges.
Read article →identity
Authentication, access, credentials, and identity systems.
NetScaler SAML Flaw Lets Remote Attackers Run Code as Root
Public research turns a patched NetScaler memory overflow into a root-code-execution risk for SAML deployments, making build verification urgent.
Read article →
RingCentral Breach Exposes 1.6 Million Account Records
Customer contact data is public after a social-engineering breach; defenders should harden support and identity checks against targeted impersonation.
Read article →
Two SharePoint Flaws Chain Into Unauthenticated Server Code Execution
Rapid7 joined a SharePoint identity bypass to unsafe .NET type creation. August's cumulative updates complete Microsoft's two-cycle fix.
Read article →
Gunra Steals Cloud Data and Deletes Backups Before Encryption
Government agencies traced Gunra from exploited edge devices through credential theft, cloud exfiltration, backup deletion, and cross-platform ransomware.
Read article →
Remus Malware Stores Command Server Addresses in Ethereum Contracts
Remus uses an Ethereum smart contract to resolve changing command infrastructure before stealing browser sessions, credentials, and wallet data.
Read article →
Windows Hello Keys Let Signed-In Code Create Persistent Entra Access
Code in a signed-in Windows session can invoke a TPM-backed Windows Hello for Business key, authenticate without a device identity claim, and create a path to durable Entra access.
Read article →
Researchers Forge WSUS Updates Through Standalone Microsoft SQL Server
SpecterOps shows how relayed WSUS machine-account access can forge targeted updates and bypass payload signature checks when SUSDB runs on a separate SQL Server.
Read article →
Unit 42 Extracted the Master Key Protecting Google's Synced Passkeys
Unit 42 showed three post-compromise paths from Chrome's local passkey state to silent assertions, substituted verification keys, or the master secret protecting synced credentials.
Read article →
N-central Attacks Reached Customer PCs After the First Fix Fell Short
N-central operators need Hotfix 2 build 2026.3.1.10 and a downstream endpoint hunt because the new release supersedes the first hotfix.
Read article →
Certighost Lets a Domain User Impersonate a Domain Controller
A crafted AD CS chase sent the CA to rogue directory services. July updates add a real-DC check, but defenders still need issuance and replication evidence.
Read article →
Compromised Microsoft 365 Mailboxes Spread QR-Code Phishing
Talos tied QR-code PDFs to credential theft, inbox-rule changes, SharePoint staging and new phishing sent from compromised Microsoft 365 mailboxes.
Read article →
Crafted ChatGPT Link Created a Scheduled Workspace Agent in Tests
Zenity found URL parameters that preselected a template and auto-submitted instructions inside a logged-in user's Workspace Agents builder.
Read article →Showing 14–26 of 29