Threat Intelligence Center

A security researcher has disclosed two additional zero-day vulnerabilities affecting Microsoft Defender, with all three flaws now confirmed exploited in active attacks. The CVE-2026-33825 vulnerability and related bypass techniques are being weaponized by BlueHammer and RedSun malware campaigns.

Security researchers have identified an active campaign leveraging obfuscated JavaScript to deliver Formbook, a credential-stealing infostealer, through MSBuild and PowerShell execution chains. This multi-stage attack exploits legitimate Windows build tools to bypass traditional endpoint detection.

Security researchers have identified ATHR, a vishing platform that automates voice phishing attacks through AI-powered voice agents targeting Asterisk VoIP systems. The platform leverages WebRTC technology to conduct large-scale voice-based social engineering campaigns, significantly lowering the operational burden for attackers.

The UK's critical infrastructure sectors—defense, energy, government, healthcare, and telecommunications—are facing a sustained wave of coordinated cyber threats. These attacks exploit gaps in network segmentation, outdated authentication systems, and supply chain vulnerabilities to penetrate sensitive environments.

Security researchers have identified critical flaws in NGINX's Model Context Protocol (MCP) integration that allow attackers to discover and compromise web servers at scale. CVE-2026-27944 and CVE-2026-33032 enable adversaries to use Shodan and similar reconnaissance tools to identify vulnerable NGINX instances running nginx-ui, then exploit the integration flaw to gain unauthorized access.

Security researchers have identified PowMix, a botnet actively targeting the Czech workforce through credential harvesting campaigns. This threat exploits common attack vectors to compromise user credentials and establish persistent access to organizational networks.