NEW#0001
Huntress3 days ago7 min▣LLM reportcritical A critical pre-auth RCE vulnerability (CVE-2026-86218, CVSS 10.0) in N-able N-central is being actively exploited, granting attackers full administrative control over MSP environments.
N-able N-central is under active exploitation via multiple CVEs, including a CVSS 10.0 pre-auth RCE (CVE-2026-86218). Attackers gain administrative access, abuse the Take Control feature to pivot to managed endpoints including domain controllers, and deploy Cloudflare tunnels for persistence. On-premises deployments must patch to 2026.3 HF4 immediately.
NEW#0002Huntress3 days ago7 min▣LLM reporthigh AD RMS relies on a non-rotatable 255-year SLC private key accessible to the local AD RMS Service Group, enabling offline decryption of all protected documents without Domain Admin privileges.
AD RMS protects documents using AES content keys sealed to a Server Licensor Certificate (SLC) private key. The SLC key is valid for 255 years and cannot be rotated without orphaning existing protected documents. Any domain user can discover the cluster and enumerate templates; AD RMS Service Group members can extract the SLC private key to decrypt all protected content offline.
NEW#0003Huntress6 days ago6 min▣LLM reportcritical Pre-auth RCE chain in PaperCut NG and MF (CVE-2026-81578, CVE-2026-82078) is actively exploited in the wild, dropping Java payloads that execute discovery commands and delete logs.
Two CVEs chain improper access control and unsafe class-loading to enable unauthenticated remote code execution in PaperCut Application Server. Huntress confirmed exploitation in two customer environments where attackers dropped Java .class files executing whoami, ver, and tasklist as SYSTEM. Payloads delete server.log and themselves. Patches exist for v25 and v26; v24 fixes in progress; v23 and older have no patch.
#0004Huntress10 days ago18 min▣LLM reporthigh A tampered Exodus Wallet 24.33.4 installer delivers a modular RAT while installing a functional but UI-suppressed wallet. The RAT uses memory-resident reflective PE loading via JavaScript FFI using the koffi library, with an AES-256-CBC encrypted 10 MB payload. C2 runs over Azure Table Storage as a dead drop mechanism. Six plugin DLLs provide remote command execution, file management, browser credential and cookie theft, SOCKS proxy, hidden VNC, and LuaJIT script execution. Persistence is maintained via Task Scheduler COM API with an INetHealth task clearing proxy settings to ensure direct C2 egress.
#0005Huntress14 days ago6 min▣LLM reporthigh Adversaries have evolved phishing tradecraft to bypass MFA and traditional security awareness training by abusing legitimate system tools and cloud authentication flows. Techniques include ClickFix (terminal execution via fake CAPTCHA), Browser-in-the-Browser (HTML-rendered fake windows), OAuth consent phishing, device code flow abuse, and fake video conference overlays. These methods exploit user trust in legitimate infrastructure and routine troubleshooting habits to deploy malware or hijack authentication tokens.
#0006Huntress16 days ago6 min▣LLM reportmedium Attackers are shifting from network perimeter breaches to identity compromise, leveraging stolen credentials and session tokens to access consolidated SSO environments. MFA alone is insufficient; gaps like overprivileged accounts, unmonitored session tokens, and MFA exceptions create exploitable paths. The article describes ClickFix social engineering and a real-world BEC case to illustrate the impact of identity security gaps.
#0007Huntress24 days ago5 min▣LLM reporthigh A pattern of university breaches in 2026 stems from systemic misconfigurations and exposed credentials rather than sophisticated exploits. Decentralized IT governance in higher education creates blind spots where configuration gaps remain unnoticed until opportunistic attackers discover and exploit them. The breaches emphasize that identity and access management, rather than endpoint malware, are the primary damage vectors.
#0008Huntress24 days ago7 min▣LLM reporthigh Researchers at DEF CON 2026 released CloudBasher, a toolkit that abuses CloudShell IAM design weaknesses across AWS, Azure, and GCP to automate environment discovery and deploy persistent workloads. Separately, indirect prompt injection via MCP was demonstrated as a method to turn blocked WAF requests into malicious instructions for AI agents. Threat actor trial abuse and education sector breaches were also discussed.
#0009Huntress24 days ago8 min▣LLM reporthigh A malvertising campaign targeting macOS users uses Google sponsored search results to direct victims to a fake Claude installation guide on claude.ai. The guide uses the ClickFix technique, instructing users to paste a curl command into Terminal that downloads the MacSync stealer and RAT. MacSync features a six-stage kill chain that exfiltrates browser data, keychain secrets, and cryptocurrency wallets, and establishes persistence via a Mach-O RAT connecting to a hardcoded IP over WebSocket.
#0010Huntressabout 1 month ago10 min▣LLM reporthigh Device code phishing abuses the legitimate OAuth 2.0 Device Authorization Grant flow to trick users into entering attacker-generated device codes on Microsoft's legitimate login page, granting attackers valid OAuth session tokens that bypass MFA. Multiple threat actors and PhaaS platforms including Storm-2372, EvilTokens, and Kali365 have adopted this technique at scale. Mitigations center on Microsoft Entra ID Conditional Access policies to block device code flow, monitoring new device registrations, and detecting suspicious token exchange patterns in Entra ID logs.
#0011Huntressabout 1 month ago16 min▣LLM reporthigh A threat actor compromised an IIS web server via Adobe ColdFusion vulnerabilities and deployed steganographic ASPX webshells concealed within image files. The attacker then executed a comprehensive defense impairment script that disabled IIS logging, tampered with Microsoft Defender through multiple vectors, killed and deleted security tool services, used IFEO debugger injection to neutralize monitoring binaries, and extracted credentials using a Mimikatz kernel driver after enabling WDigest plaintext caching. The attacker further uninstalled the ModSecurity WAF, deleted critical COM/CLSID registry keys to cripple OS functionality, and cleared all Windows event logs to destroy forensic evidence.
#0012Huntressabout 1 month ago11 min▣LLM reportmedium LDAP Ping is a pre-credential Active Directory reconnaissance technique that abuses the anonymous DC Locator protocol to enumerate valid usernames without generating authentication failures. The tool ldapnomnom claims to produce no Windows audit logs, but source code analysis confirms it uses TCP exclusively, making connections visible to Event 5156 (Windows Filtering Platform). Event 1644 is structurally blind to LDAP Ping because the query is dispatched to netlogon.dll, bypassing the LDAP search engine. netlogon.log captures every query and response including disabled-account state invisible to the attacker. True UDP cLDAP remains a blind spot for Windows event logging, requiring network-layer visibility or MDI for attribution.
#0013Huntressabout 2 months ago8 min▣LLM reportinfo This article is a comprehensive system hardening guide covering user access controls, network configuration, firewall setup, patch management, OS-specific hardening for Windows and Linux, service/application configuration, logging, and physical security. It emphasizes that hardening is an ongoing process rather than a one-time task and recommends aligning to established frameworks like CIS Benchmarks, NIST guidelines, and DISA STIGs. The guide also covers common pitfalls such as undocumented exceptions, skipping asset inventories, and disabling logging for performance.
#0014Huntressabout 2 months ago12 min▣LLM reporthigh A threat actor exploited an SQL injection vulnerability in an IIS web application to gain initial access to a Windows endpoint running MSSQL. After access, the attacker performed extensive environment modifications including reconnaissance via tasklist, exfiltration to an OAST domain, creation of a new local administrator account, enabling Terminal Services, disabling Windows Defender, installing BadIIS modules, deploying an XMRig cryptocurrency miner with persistence, and adding CnCrypt Protect for defense evasion. The breadth of modifications on a single endpoint was notable compared to similar incidents.
#0015Huntress2 months ago15 min▣LLM reportcritical An Initial Access Broker is exploiting CVE-2025-5777 (CitrixBleed 2), a pre-authentication memory overread in Citrix NetScaler ADC/Gateway, to steal session tokens and bypass MFA. The stolen sessions are used to access Citrix published desktops, followed by a consistent privilege escalation via a registry symbolic-link LPE tool that abuses the Windows AppMgmt service and Group Policy refresh to gain SYSTEM. The operator then creates backdoor admin accounts, installs rogue ScreenConnect/Zoho Assist RMM clients, moves laterally with PsExec and Impacket, and ultimately deploys DragonForce ransomware. The full kill chain from initial access to encryption was observed completing in under one hour in at least one case.
#0016Huntress2 months ago11 min▣LLM reporthigh Two distinct campaigns exploited Microsoft 365 authentication flow misconfigurations to bypass MFA at scale. The Railway campaign leveraged device code phishing via Railway.com PaaS infrastructure (attributed to the EvilTokens PhaaS platform), compromising 344 organizations by harvesting OAuth tokens valid up to 90 days. The LSHIY campaign used the deprecated ROPC OAuth flow to replay credentials against Azure CLI, attempting 81 million logins and compromising 78 accounts—55 of which had MFA policies that failed to cover the attack path due to scoping gaps, report-only enforcement, or mislabeled trusted locations.
#0017Huntress2 months ago9 min▣LLM reporthigh The article details two evolving social engineering techniques: ClickFix, which tricks users into pasting and executing attacker-supplied PowerShell commands via fake prompts, and ConsentFix, which abuses Microsoft 365 OAuth consent flows by manipulating users into dragging a localhost callback link into the browser to capture session tokens. A complete ConsentFix playbook with working code was publicly shared on a Russian cybercrime forum, enabling widespread adoption. Both techniques bypass traditional security controls by exploiting user muscle memory and legitimate platform infrastructure.
#0018Huntress2 months ago10 min▣LLM reporthigh Huntress demonstrated that a standard Microsoft 365 user with no admin privileges can be escalated to Global Administrator in under six minutes by exploiting common identity misconfigurations — specifically, an over-privileged service account owning an enterprise application, lack of MFA enforcement, and standard users being permitted to access the Azure portal. Analysis of 12,000+ M365 tenants revealed that over 60% were missing at least half of recommended security controls, with MFA gaps, over-privileged accounts, and admin restriction failures being the most prevalent issues. The article argues that continuous, automated identity posture management is essential because configuration drift creates exploitable windows far shorter than the 24-hour scan cycles of traditional tools.
#0019Huntress3 months ago5 min▣LLM reporthigh Threat actors are increasingly targeting macOS environments with infostealers delivered via deceptive .dmg disk images. These attacks rely on social engineering tactics, such as custom background images and misleading filenames, to trick users into bypassing Apple's Gatekeeper protections. This enables rapid 'smash-and-grab' data theft without the need for the malware to establish persistence on the host.
#0020Huntress3 months ago5 min▣LLM reportmedium Researchers disclosed an unpatched NTLM coercion vulnerability in the Windows search: URI handler that allows attackers to steal Net-NTLMv2 hashes via a malicious link or command execution. Despite sharing the same severity and underlying mechanism as a recently patched Snipping Tool vulnerability (CVE-2026-33829), Microsoft declined to service this flaw. Defenders must rely on environmental mitigations like blocking outbound SMB and restricting NTLM traffic to prevent exploitation.
