Microsoft security researchers have documented a targeted phishing campaign that exploits employee trust in internal compliance processes. Attackers craft convincing fake compliance notices impersonating Microsoft's own compliance and legal teams, tricking employees into providing credentials and multi-factor authentication details.

The TeamPCP supply chain campaign has resumed operations following a 26-day hiatus, launching a coordinated attack against multiple critical development tools. Researchers have identified three concurrent compromises affecting Checkmarx KICS, Bitwarden CLI, and xinference packages on PyPI, alongside the emergence of CanisterSprawl, a newly identified npm worm.

Security researchers have identified ConsentFix v3, an evolved attack framework targeting Azure OAuth implementations through automated consent phishing. This threat leverages legitimate OAuth flows to establish persistent access to cloud environments without triggering traditional authentication alerts.

The TeamPCP supply chain campaign has resumed operations following a 26-day hiatus, with attackers now executing three concurrent compromises targeting widely-used development infrastructure. Checkmarx KICS, Bitwarden CLI, and xinference packages have been poisoned with malicious code, while a newly identified npm worm named CanisterSprawl is actively propagating across package repositories.

Security researchers have identified a malware distribution campaign leveraging malicious advertisements for Homebrew, the popular macOS package manager, to deliver MacSync Stealer. This attack exploits user trust in legitimate development tools to compromise macOS systems.

Endpoint Detection and Response (EDR) and Identity Threat Detection and Response (ITDR) platforms often operate independently, leaving a critical gap in attack detection. When adversaries compromise credentials or abuse identity services, EDR systems miss the lateral movement patterns while ITDR lacks visibility into endpoint behavior.