A phishing operation is going after executives with two attacks at once: steal the Microsoft 365 session, then install remote-control software that no antivirus flags. Four minutes. Let's go.
🚨 THE BIG STORY
CSuite phishing takes the account and the computer
Researchers tracked the CSuite campaign across 351 sandbox analyses, with half originating in the US. One path captures Microsoft 365 logins and active sessions; the other installs legitimate IT tools like ScreenConnect and Atera for persistent remote access. Lures impersonate Microsoft 365, Adobe, DocuSign, Zoom and Dropbox.
🧠 Why It Matters
Stealing a live session beats stealing a password — the attacker is already inside the mailbox, no MFA prompt needed. And because the remote-access tools are real IT software, antivirus won't flag them. Resetting the password fixes neither. If you don't use Atera, an Atera install on your network is an incident.
⚡ CYBER IN 60 SECONDS
An AI agent broke into a security nonprofit and got root in seconds. DIVD says two unknown flaws in the Zammad ticketing system let an autonomous agent hijack sessions, run code and escalate — faster than any human response. Network segmentation is what stopped it. Zammad users should upgrade to version 7 now. [AI Agent Breached Security Nonprofit in Seconds]
Apple patched an iPhone zero-day used in spyware attacks, and CISA added it to its exploited-vulnerabilities list. Used against specific targeted individuals, but update anyway — exploitation widens once a flaw is public. [Apple Patches iPhone Zero-Day Used in Spy Attacks]
543,699 passwords and keys in public GitHub code still work. Median time sitting exposed: 784 days. Over half are types GitHub's automatic protection doesn't block, and 69,041 live Google Cloud credentials were among them. [543,699 Live Passwords Found in Public GitHub Code]
🎭 SCAM TO WATCH
Russian state hackers have found the gap in phishing training. Microsoft says the group Star Blizzard now sends a completely harmless first email — an invitation, no attachment, no link. Only after you reply does the real message arrive: a password-protected archive, with the password supplied as an image so scanners can't read it. The reply is what turns a cold email into a conversation you trust. More than 100 organizations have been hit. The tell: a password-protected attachment you weren't expecting, especially one where the password arrives as a picture. And replying to an unknown sender isn't a neutral act — verify through a channel you already have. [Russian Hackers Wait for Your Reply, Then Attack]
🛡️ TODAY'S SECURE MINDSET
Ask your IT provider one question: which remote-management tools do we actually use? Get the list in writing. Today's lead story works because attackers install real IT software — ScreenConnect, Atera, Syncro — that no antivirus will flag. The only way to spot it is knowing what's supposed to be there. If you don't have IT support, check your installed programs for anything you don't recognize. [CSuite Phishing Hijacks Microsoft 365 Sessions]
See you tomorrow. — SecureMindset