Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

thehackernews.com Sep 7, 2026

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Curated by Shubham · TechCapsules · Sep 7, 2026

AI-summarised brief · reviewed before publication

Threat hunters have detailed a widespread data‑theft and extortion campaign targeting Microsoft 365 and other SaaS platforms through fake IT help‑desk phone calls, adversary‑in‑the‑middle (AitM) token theft, and residential‑proxy sign‑ins. The operation, tracked by Arctic Wolf as PREY‑0058, mirrors tactics used by the UNC6671 group identified by Mandiant and may be linked to the Cinder/Pink threat actors. Attackers impersonate internal IT staff, lure executives to authentication‑styled URLs, and harvest credentials and MFA approvals to capture session tokens. Those tokens are replayed from proxy infrastructure to access SharePoint, OneDrive, Exchange and Box, where bulk data is exfiltrated before extortion demands are issued. No endpoint malware or lateral network movement is observed; victims span U.S. sectors such as construction, healthcare, finance and professional services. Researchers recommend Conditional Access, phishing‑resistant MFA, tighter SharePoint permissions and staff training to mitigate the threat.

💡 Why It Matters

· By hijacking legitimate MFA flows, the attackers bypass traditional credential‑based defenses, turning trusted executive accounts into direct conduits for large‑scale data theft and ransom.

Read full article on thehackernews.com

Mail service used by 30,000 businesses including NHS trusts suffers major outage

Docmail, a cloud‑based mailing platform used by around 30,000 organisations including NHS trusts and over three‑quarters of UK medical practices, has been offline for five days following an incident that began on 2 September 2026. The service, which digitises client communications and handles printing and postage, was first slowed then taken down for “essential maintenance” after an isolated server problem was identified. CFH, Docmail’s parent, shut the entire platform to investigate, citing advice from external consultants, but has released few technical details. The outage delays appointment letters, council notices and other critical correspondence, and the company’s status page still lists the incident as unresolved. Healthcare providers warn patients to confirm appointments by phone, while local authorities advise checking communication channels for updates.

💡 Missed appointment notices risk patient safety and strain already‑stretched NHS resources.

thehackernews.com · Sep 7

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Researchers at SOCRadar have uncovered PEEP, a sophisticated post‑exploitation toolkit that disguises itself as a “Smart Bookmarks” extension for Chromium‑based browsers such as Chrome and Edge. After an attacker gains administrative or code‑execution access, the installer injects the extension directly into browser profiles, forging Secure Preferences values to bypass Web Store checks and user prompts. A native‑messaging host (nm_host.exe) extends the payload beyond the browser sandbox, allowing host‑level command execution, file management, credential theft, session hijacking and page manipulation. The extension polls a plaintext HTTP C2 server every 30 seconds, exfiltrating browsing history, tab metadata and cookies. Built on the open‑source RedExt framework, PEEP adds dedicated installation routines, update channels and a broader command set, and can be sideloaded on Windows and Linux via PowerShell and Python scripts. The campaign shows Chinese‑language code artifacts but remains unattributed, with about 34 agents observed in the C2 health endpoint.

💡 By turning a trusted browser into a stealthy OS‑level backdoor, PEEP lets attackers pivot from a compromised user account to full system control without triggering typical binary‑based detections.

analyticsinsight.net · Sep 7

Cloud Cyber Security Risks: Threats, Challenges, & Solutions

Modern cloud breaches are primarily driven by credential abuse and configuration errors rather than infrastructure failures, according to recent industry reports. Verizon’s 2025 Data Breach Investigations Report analyzed over 22,000 incidents, identifying stolen credentials as the leading entry method, followed by exploited vulnerabilities at 20%. IBM’s 2025 Cost of a Data Breach Report reveals that multi-environment breaches average USD 5.05 million, significantly higher than on-premises incidents at USD 4.01 million. While global average costs dropped to USD 4.44 million due to AI-driven detection, US costs rose to USD 10.22 million amid regulatory fines. The 2019 Capital One breach exemplifies this risk, where a firewall flaw combined with excessive permissions exposed 106 million records. Experts emphasize that identity-first controls and continuous monitoring are essential, as perimeter defenses are insufficient against attackers leveraging over-privileged accounts and inconsistent security policies across complex, multi-cloud environments.

💡 Organizations must pivot from perimeter defense to strict identity governance, as technical flaws only become catastrophic when paired with excessive standing privileges. This shift is critical for mitigating the disproportionate financial impact of multi-cloud breaches, particularly in high-regulation markets like the United States.

thehackernews.com · Sep 7

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

TantoSec released a proof‑of‑concept exploit that chains a padding‑oracle weakness in Telerik UI for ASP.NET AJAX’s RadAsyncUpload control into unauthenticated remote code execution. The attack requires a non‑default configuration: the page must host the upload control, its handler must read the result, and an explicit encryption key must be set—settings Telerik itself recommends for hardening. Using the AES‑CBC padding oracle (CVE‑2026‑13182) the researcher decrypts and forges the control’s encrypted state, then abuses an unguarded type‑resolution flaw (CVE‑2026‑13181) to load a malicious mixed‑mode DLL, achieving code execution with IIS application‑pool privileges. Progress patched the vulnerabilities in version 2026.2.708 on July 8 and published CVEs on July 22; no wild‑exploitation has been confirmed. The tool, telerik-rau-exploit, includes payloads—one writes a shell, runs in memory.

💡 By publishing a ready‑to‑run exploit, TantoSec turns a previously patched, configuration‑specific flaw into a publicly accessible attack kit, forcing organizations to verify hardening settings that many consider optional.

thehackernews.com · Sep 7

Your Cloud Security Checklist Doesn’t Work the Way You Think It Does

Intruder’s 2026 Cloud Security Index examined misconfiguration data from 3,000 organizations on AWS, Azure and Google Cloud, revealing that risk profiles differ sharply across providers. Six misconfiguration categories were tracked: weak IAM, missing logging, misconfigured services, permissive firewalls, exposed services and weak encryption. Weak IAM and missing logging were nearly universal, affecting 80‑98% of accounts on every platform. In the remaining categories, AWS showed the highest exposure—76% of accounts had exposed services versus just 8% on Google Cloud—while Azure led in misconfigured services at 80%. The study attributes AWS’s higher rates to its broader service portfolio and Google Cloud’s lower rates to its “Shared Fate” model that ships more secure defaults. Larger enterprises generally fared better on most issues, except IAM, which worsened with organization size; mid‑market firms also took the longest to remediate, averaging 35 days.

💡 The divergent misconfiguration patterns force multi‑cloud teams to tailor defenses per provider rather than rely on a single checklist, exposing a hidden efficiency gap in current security workflows.

foreignpolicy.com · Sep 7

25 Years After 9/11, What Are We Failing to Imagine Now?

Twenty-five years after the September 11 attacks, the counterterrorism community faces a renewed “failure of imagination” regarding emerging technological threats. While the 2001 attacks utilized boxcutters and hijacked passenger jets, experts warn that current security frameworks struggle to anticipate how novel technologies might be weaponized. Historical precedents, including over 130 attempted hijackings in the U.S. between 1968 and 1972, demonstrate that aviation threats were long conceivable. Terrorism scholar Brian Michael Jenkins predicted suicidal hijackings in 1989, yet the intelligence community failed to prevent the actual event. Today, researchers Colin P. Clarke and Clara Broekaert argue that the sector remains ill-equipped to visualize how modern tools could facilitate new forms of terrorism. The 9/11 Commission Report previously criticized this lack of foresight, a critique that remains relevant as adversaries adapt to digital advancements. The article emphasizes that relying on past threat models is insufficient. Security professionals must now confront the challenge of predicting unconventional applications of technology. Without proactive imagination, the U.S. government and intelligence agencies risk repeating historical errors. The gap between known threats and potential future scenarios continues to widen, demanding a fundamental shift in how counterterrorism strategies are developed and implemented globally.

💡 Security agencies risk repeating historical blind spots by relying on outdated threat models rather than anticipating how adversaries will weaponize emerging technologies. This cognitive gap leaves critical infrastructure vulnerable to attacks that current frameworks cannot visualize or prevent.