Threat Intelligence Center

Endpoints represent one of the most targeted entry points in modern cybersecurity attacks. From unpatched software to weak authentication practices, common vulnerabilities across devices create significant organizational risk.

Attackers are actively exploiting previously unknown zero-day vulnerabilities in Ivanti Enterprise Patch Management Module (EPMM) to gain unauthorized control of MDM servers. These vulnerabilities enable threat actors to bypass authentication mechanisms and establish persistence within enterprise mobile device management infrastructure.

Threat actors are increasingly exploiting complex network routing and domain configuration weaknesses to conduct sophisticated phishing campaigns. By leveraging misconfigurations in DNS, BGP, and email authentication protocols, attackers can spoof legitimate domains and bypass traditional security controls.

Google has confirmed the existence of a zero-day vulnerability in Chrome (CVE-2026-2441) for which an exploit is actively being used in targeted attacks. This critical vulnerability requires immediate attention from security teams and users alike.

Security researchers have identified a coordinated phishing campaign leveraging a legacy Office vulnerability in combination with XWorm, a fileless remote access trojan designed to evade endpoint detection systems. This attack chain demonstrates how threat actors continue to weaponize known vulnerabilities alongside advanced malware techniques to establish persistent access.

Employee monitoring software, commonly known as bossware, has become an unexpected attack surface for threat actors. These tools, designed to track employee activity and productivity, often operate with elevated system privileges and deep network access.