Security news from around the web with our take: what happened, what it means for you, and what defenders should do. We link every original story.
3 stories match your filters.
Huntress says attackers trick staff into enrolling PCs in attacker-run Hexnode and Rippling device-management tenants, then use them to install ScreenConnect as SYSTEM, and reinstall it when removed.
Huntress tracked a campaign that replayed stolen Microsoft 365 sign-in tokens to take over 97 accounts at 79 organizations, then planted rogue Entra devices, swapped MFA methods and hid payroll mail.
Huntress says a sponsored Google result led to a fake Amazon login and a ClickFix CAPTCHA that used finger.exe to install the Lumma infostealer and NetSupport remote access.