Certighost Lets a Domain User Impersonate a Domain Controller
A crafted AD CS chase sent the CA to rogue directory services. July updates add a real-DC check, but defenders still need issuance and replication evidence.
Read article →identity
Authentication, access, credentials, and identity systems.
Compromised Microsoft 365 Mailboxes Spread QR-Code Phishing
Talos tied QR-code PDFs to credential theft, inbox-rule changes, SharePoint staging and new phishing sent from compromised Microsoft 365 mailboxes.
Read article →
Crafted ChatGPT Link Created a Scheduled Workspace Agent in Tests
Zenity found URL parameters that preselected a template and auto-submitted instructions inside a logged-in user's Workspace Agents builder.
Read article →
Google Sued a Phishing Service Behind 2.5 Million Scam Texts
A civil lawsuit targets a Telegram-based phishing-kit operation that Google links to 2.5 million texts and more than one million fraudulent URLs.
Read article →
Microsoft Entra Actor Token Impersonated a Global Admin in Testing
CVE-2025-55241 allowed an Entra actor token from one tenant to impersonate users in another through the legacy Azure AD Graph API.
Read article →
Klue Breach Exposed Salesforce Data Through Stolen OAuth Tokens
A forgotten Klue credential led to customer OAuth token theft and direct access to Salesforce CRM data across several companies.
Read article →Showing 27–32 of 32