Morning Brief

Attackers are turning Microsoft Teams help desk calls into an entry point for malware and network compromise. A campaign tracked as Spring Ring used external accounts that resembled internal IT support to chat with employees, then call them and press for remote access or software execution. The activity ran from January through April 2026 and approached more than 150 employees at at least 10 organizations. Its danger lies in the human element: a familiar sounding technician and a live conversation can make an unexpected request feel urgent and legitimate. Analysts at Unit 42 identified the…

Cybercriminals are increasingly weaponizing trusted cloud platforms such as Microsoft Azure, Google Firebase, Google Cloud Storage, Amazon Web Services, and Cloudflare to host phishing infrastructure aimed squarely at the financial sector, making malicious traffic nearly indistinguishable from legitimate business activity. Security researchers describe this as a structural shift toward what some call Trusted Infrastructure Phishing , where every stage of an attack, from delivery to credential theft, runs through legitimate, enterprise-approved services rather than attacker-owned domains…

Windows users are being targeted through a malicious campaign that turns a ChatGPT shared link into the step of a malware infection. Rather than breaking into the AI platform, the operators place a deceptive message inside a shared conversation and rely on victims to follow its instructions. The page claims that traffic is too high and directs visitors to a supposed backup site. That destination uses a fake human-verification screen and tells people to open the Windows Run dialog, paste a command, and press Enter. The action quietly starts a PowerShell-based download chain outside the…

METR (short for Model Evaluation and Threat Research and pronounced "Meter"), a research non-profit that evaluates frontier artificial intelligence (AI) models for their ability to carry out long-horizon, agentic tasks, disclosed that it suffered "two notable security incidents" where external actors attempted to gain unauthorized access to its systems. No sensitive information is believed to

Five Venezuelan nationals have pleaded guilty in a U.S. federal case involving attempted ATM jackpotting attacks . This criminal technique uses malware to force cash machines to dispense money without legitimate customer transactions. The case follows an FBI investigation into attempts to compromise ATMs in Wamego and Manhattan, Kansas, during December 2025. U.S. Attorney Ryan A. Kriegshauser said banks and financial institutions should take preventative steps as jackpotting incidents continue to increase across the United States. According to court documents , Luis Alberto Velasquez-Artigas…

A critical authentication bypass vulnerability in JFrog Artifactory , tracked as CVE-2026-82329, is being actively exploited, allowing unauthenticated attackers with network access to gain administrator-level privileges. WatchTowr said its intelligence team has observed attackers exploiting the issue and “minting themselves admin tokens.” An attacker with a valid administrator token could control the affected Artifactory environment, including repositories, user accounts, access permissions, build artifacts, and software packages stored in the platform. JFrog disclosed the vulnerability on…

Nearly 22,000 Microsoft Exchange servers worldwide are still running unpatched for CVE-2026-62911 , a critical authentication-bypass vulnerability that attackers can exploit to seize control of enterprise email infrastructure. According to daily internet-wide scans published by the Shadowserver Foundation, exactly 21,899 unique IP addresses were flagged as vulnerable as of August 31, 2026, underscoring how slowly organizations are responding to one of this year’s most consequential Patch Tuesday disclosures. CVE-2026-62911 Microsoft Exchange CVE-2026-62911 is classified as an authentication…