Threat Intelligence Center

Security researchers have disclosed CVE-2026-42897, a zero-day vulnerability affecting Microsoft Exchange Server that requires no user interaction beyond opening a malicious email to trigger exploitation. This vulnerability poses significant risk to organizations in regulated industries—medical practices, law firms, and accounting firms—that rely on Exchange for business-critical communications.

Security researchers have identified EvilTokens, a threat actor group leveraging artificial intelligence to automate and personalize phishing campaigns at scale. The group deploys BlueKit, Kali365, and Tycoon2FA tools to target construction firms and financial services organizations.

OpenAI has confirmed a security breach stemming from a supply chain attack on TanStack, a widely-used development library. The attack involved Mini Shai-Hulud malware and has been tracked by Microsoft Threat Intelligence and TeamPCP researchers.

Living off the land binaries and administrative tools are the preferred weapons of attackers targeting professional service firms. By establishing a 45-day baseline of Certutil, MSBuild, PowerShell, WMIC, and netsh activity, you can distinguish legitimate administrative behavior from malicious execution patterns.

Security researchers have identified a straightforward bypass technique targeting Outlook's link preview functionality in the junk folder. This vulnerability allows attackers to conceal malicious URLs from user inspection and security scanning, increasing the likelihood of successful phishing and malware delivery.

Security researchers have identified a phishing campaign by the FlowerStorm threat actor group that employs KrakVM virtual machine obfuscation to circumvent email security controls. This technique allows malicious payloads to evade detection by running code in isolated virtual environments that traditional email gateways struggle to analyze.