Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

thehackernews.com Oct 26, 2026

Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware

Curated by Shubham · TechCapsules · Oct 26, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers report a widespread social‑engineering campaign that exploits Microsoft Teams’ external chat feature to impersonate IT support and deliver malware. Attackers create throwaway Microsoft 365 tenants, often using the .onmicrosoft.com domain or paid .top TLDs, and display names that mimic legitimate help desks. Victims receive mass email “newsletter” spam, then a Teams message offering urgent assistance, leading to remote‑access tools such as Quick Assist or TeamViewer. The remote session installs backdoors, harvests Active Directory data, and deploys Chaos ransomware.

💡 Why It Matters

· The attacks reveal how attackers turn a trusted collaboration platform into a low‑effort initial‑access vector, bypassing traditional security controls and forcing organizations to scrutinize external Teams connections.

Read full article on thehackernews.com

Sony reportedly investigating as PS5 users report hackers posing as children being…

Sony is investigating a security flaw affecting PlayStation 5 users, where hackers add unauthorized “child” accounts to PlayStation Network profiles. The exploit bypasses passwords and two‑factor authentication, allowing attackers to view personal data and make purchases with linked payment methods. Affected users report difficulty removing these child accounts, as Sony’s family‑management system only permits removal of adult members. The issue has been reported mainly in Japan but is not limited to that region. Sony urges users to review family settings and enable two‑factor authentication.

💡 The breach exposes a critical gap in Sony’s account protection, enabling unauthorized financial activity and data access. It underscores the need for robust family‑account controls to prevent similar exploits.

thehackernews.com · Oct 26

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

An unknown threat actor has infected 953 online stores, predominantly Magento, with malicious JavaScript loaders that evade security scanners. The campaign, active since July 2025, injects code into CMS blocks, delivering payloads only to real shoppers while filtering out bots. Five domains, including deepveindrilling[.]com, host the loaders, which store code in localStorage for repeated execution. Infections stem from PolyShell (CVE‑2026‑48356) and SessionReaper (CVE‑2025‑54236) exploits, with some sites adding rogue admin accounts. Store owners are urged to audit CMS tables, update patches, and enforce strong passwords.

💡 The attack demonstrates how sophisticated malware can bypass automated defenses, exposing millions of shoppers to hidden threats. It underscores the urgency for e‑commerce platforms to harden CMS integrity and patch critical vulnerabilities.

thehackernews.com · Oct 26

PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity

Palo Alto Networks’ Unit 42 has withdrawn its earlier claim that a recent breach of a European government agency involved direct exploitation of the PHP2Shell flaws (CVE‑2026‑109618 and CVE‑2026‑109619). The firm now says the attackers leveraged a vulnerable PHP application but cannot confirm the initial access stemmed from those specific CVEs. Post‑exploitation activity included AI‑assisted commands that harvested password hashes, MFA tokens, and set up an NTLM‑relay tunnel for attempted Domain Admin escalation. Concurrently, CYFIRMA identified a low‑volume, rotating‑node scanning campaign linked to North Korea’s Lazarus Group, probing 216 unpatched PHP hosts across 12 countries and sectors. The scans, coordinated via a closed I2P channel, use Korean‑specific language and aim to shortlist targets for future exploit deployment.

💡 The blend of AI‑driven post‑exploitation and stealthy, globally dispersed scanning shows threat actors are maturing their toolchains to evade detection while preparing precise, high‑impact attacks.

thehackernews.com · Oct 26

Between alerts: What Attackers Do in the Spaces Ordinary Detection Misses

Security operations centers (SOCs) are inundated with isolated alerts that rarely reveal an attack’s full narrative. Network detection and response (NDR) platforms can stitch these alerts into a continuous timeline, exposing the stealthy steps attackers take between high‑severity events. Modern adversaries use AI to automate reconnaissance, leverage legitimate admin tools, and pace their activity to blend with normal traffic, often remaining undetected for days or weeks. Analysts focusing only on the triggering alert miss the chained behaviors that link initial access to later exfiltration. Correlating protocol‑aware network telemetry across DNS, LDAP, SMB, and other services uncovers these hidden sequences, allowing SOCs to investigate without overwhelming alert volumes. This integrated view also supports faster containment and reduces investigation fatigue for teams.

💡 By revealing the hidden choreography of low‑profile actions, organizations can stop breaches before data leaves the network, turning a reactive alert flood into a proactive defense.

thehackernews.com · Oct 26

Gheist Uses Stolen GitHub Tokens to Steal Private Repository Secrets via Actions…

An automated campaign dubbed “Gheist” has been using stolen GitHub tokens to create malicious workflow files in private repositories and GitHub Enterprise environments. The tool opens a new branch named ci-sync‑, commits a workflow that prints every readable secret to the Actions log, downloads the log via the API, and then deletes the run. Wiz’s investigation, ongoing since September 15, identified over 13,500 such branches across more than 850 compromised accounts, ranging from personal projects to enterprise repos. GitHub’s safeguard that pauses suspicious runs only protects public repositories, leaving private and Enterprise Server instances exposed. The attack also leverages compromised AWS credentials to enumerate Secrets Manager, and a recent variant targets self‑hosted runners. As of October 24 the campaign remains active, with many compromised accounts already removed from GitHub.

💡 By exfiltrating secrets directly through GitHub’s own infrastructure, the attack bypasses traditional network defenses, giving attackers unfettered access to production credentials.

thehackernews.com · Oct 26

Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations

Researchers at Huntress uncovered a Microsoft 365 token‑replay campaign that hijacked sign‑in sessions and replayed stolen access tokens to infiltrate 97 accounts across 79 organizations between July 14 and September 22, 2026. The attackers used an adversary‑in‑the‑middle login page to capture credentials and MFA codes, then harvested the resulting tokens and “sprayed” them at scale, achieving 497 successful sign‑ins from over 200,000 attempts traced to the 193.26.115.0/24 subnet. After gaining access, they added rogue authenticator apps and registered 48 fake Entra devices to maintain persistence, sometimes removing existing MFA within three hours. Hidden email rules were also deployed to delete or forward messages, and compromised mailboxes were used to send spam before Microsoft Entra ID Protection flagged the accounts as high risk. The operation originated from a Romanian IP linked to the AsyncRAT‑infected hosting provider 1337 Services GmbH, which has connections to previously seized RDP rental services.

💡 By bypassing MFA through token replay, the attack demonstrates a scalable method to subvert modern authentication, forcing organizations to rethink token‑validation and device‑registration safeguards.