Microsoft — FreeIntelHub

BleepingComputer General Microsoft May 26

Microsoft Defender can now automatically isolate hacked endpoints

Microsoft is testing a new Defender for Endpoint capability that will automatically isolate compromised endpoints to thwart attackers' attempts to move later...

BleepingComputer →

GBHackers TTPs Microsoft Linux May 26

Quasar RAT Hits Developers With Fileless Linux Attacks

Quasar Linux (QLNX) is a new, stealthy Linux Remote Access Trojan that quietly turns developer and DevOps workstations into high‑value beachheads for softwar...

GBHackers →

The Hacker News CVE Microsoft May 26

Microsoft Patches SharePoint RCE Flaw CVE-2026-45659 Across Server Versions

Microsoft has rolled out updates to fix a remote code execution vulnerability impacting SharePoint that could be exploited by bad actors in attacks without r...

T1190 1 IOC

The Hacker News →

SecurityWeek General Microsoft Palo Alto Networks CrowdStrike Fortinet Zscaler Cloudflare Okta May 26

Anthropic Expands Claude’s Enterprise Security Governance With 28 New Integrations

Notable integrations include CrowdStrike, Palo Alto Networks, Microsoft, Okta, Zscaler, Netskope, Cloudflare, Fortinet, and Wiz. The post Anthropic Expands C...

SecurityWeek →

GBHackers Campaigns Microsoft Linux May 26

China-Linked Hackers Hit SEA Edge Routers With Custom Linux Implant

China-linked hackers are conducting a stealthy infrastructure-centric espionage campaign across Southeast Asia by compromising Linux-based edge routers with ...

GBHackers →

Help Net Security CVE Microsoft May 26

High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)

Microsoft has released patches for a high-severity remote code execution vulnerability (CVE-2026-45659) in SharePoint that may be exploited in low-complexity...

T1190 1 IOC

Help Net Security →

BleepingComputer Advisory Microsoft May 26

Microsoft: Domain Controller lookup may fail on Windows Server 2016

Microsoft has confirmed a new known issue affecting Windows Server 2016 systems that causes domain controller lookups to fail after installing the KB5087537 ...

BleepingComputer →

CSO Online Data Breach Microsoft May 26

Vulnerabilities have become cyber attackers’ No. 1 door to the enterprise

Patching practices are coming under intense pressure of late, as time-to-exploit windows accelerate — a new reality likely to worsen as AI assistance in atta...

T1078 T1598

CSO Online →

Help Net Security Ransomware Microsoft Google Apple May 26

Product showcase: F-Secure Internet Security blocks phishing sites, fake stores, and SMS scams

F-Secure Internet Security protects against viruses, ransomware, spyware, infected email attachments, and other cyber threats. It focuses on securing devices...

T1566

Help Net Security →

GBHackers Ransomware Microsoft May 26

Ransomware Uses ChaCha20 and Curve25519 to Encrypt Windows Files

Payload ransomware is a new Windows ransomware family that combines ChaCha20 stream encryption with per-file Curve25519 ECDH key exchange, making victim data...

T1070

GBHackers →

CSO Online Phishing Microsoft May 26

Security experts caution MFA alone can no longer stop threat actors

Cybersecurity experts are warning enterprise admins about an increasing number of phishing campaigns aimed at stealing Microsoft 365 (M365) access tokens to ...

T1566

CSO Online →

SANS ISC General Microsoft May 25

Microsoft Access VBA, (Mon, May 25th)

Microsoft Access files (Microsoft Office&#;x26;#;39;s Database) can contain VBA code.

SANS ISC →

SANS ISC Campaigns Microsoft GitHub May 25

TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)

TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft...

SANS ISC →

SANS ISC Campaigns Microsoft GitHub May 25

TeamPCP Supply Chain Campaign: Activity Through 2026-05-24, (Mon, May 25th)

TeamPCP now operates across three package ecosystems in parallel, it reached GitHub&#;x26;#;39;s own internal codebase, it trojanized an officially Microsoft...

SANS ISC →

BleepingComputer Phishing Microsoft May 25

FBI warns of Kali365 phishing service targeting Microsoft 365 accounts

The FBI is warning about the Kali365 phishing-as-a-service platform (PhaaS) that is used to hijack Microsoft 365 accounts by abusing OAuth device code authen...

T1566

BleepingComputer →

GBHackers Campaigns Microsoft May 25

APT Group Patches termsrv.dll to Enable Multiple RDP Sessions

A sustained cyber espionage campaign attributed to the Cloud Atlas advanced persistent threat (APT) group has introduced a stealthy technique that modifies t...

GBHackers →

Infosecurity Magazine Phishing Microsoft May 25

FBI Warns 'Kali365' Phishing Kit Hijacks Microsoft 365 OAuth Tokens

The Kali365 phishing-as-a-service platform lowers the barrier of entry for cybercriminals, said the FBI

T1566

Infosecurity Magazine →

GBHackers Vulnerability Disclosure Microsoft May 25

Hackers Exploit Azure RBAC to Steal Key Vault Secrets

Hackers are increasingly exploiting cloud identity and access management systems, and a methodical, sophisticated, and multi-layered attack, where a threat a...

T1041

GBHackers →

GBHackers TTPs Microsoft May 25

MiniUpdate RAT Abuses Azure C2 for Targeted Espionage

A sophisticated espionage campaign by the Iran-nexus advanced persistent threat group known as Screening Serpens also tracked as UNC1549 and Smoke Sandstorm ...

GBHackers →

GBHackers Phishing Microsoft Barracuda May 25

Hackers Use CypherLoc Kit to Push Fake Microsoft Support Scams

CypherLoc is a sophisticated browser-lock scareware designed to drive victims to fraudulent tech support calls. It evades scanners and sandboxes by executing...

T1566

GBHackers →