Microsoft shipped CVE-2026-65660 in August as a moderate spoofing bug at CVSS 6.5. The record now reads remote code execution at 8.8, and CISA added it to KEV on 25 September with forensic triage required. If your farm deferred the August patch because the advisory said spoofing, here is what to hunt.

A reported AI-driven intrusion in Spain raises a harder question than which model was used: what could one successful login reach? Our analysis examines attack hypotheses, evidence gaps, preventive controls, and a practical SMB response plan.

Unit 42 published Spring Ring today, 31 August 2026. The activity in the report is from January through April. This is leftover tradecraft, not a weekend outbreak. If you are hunting it because the write-up is new, you are hunting a gap that has been sitting in Teams since winter. The gap is Chat with anyone plus a voice call that never hits the mail gateway. They are not phish-mailing IT. A throwaway .onmicrosoft.com tenant named like a helpdesk opens a Teams chat. Then a 10

PhishLocker is a fake Windows lock screen. The password plus the tunnel is the prize. On 18 August, Expel caught SynkLoader off a scheduled-task EDR hit that started in Microsoft Teams and ended in a fake lock screen. The EDR alert was the first clean look at a loader nobody had published yet. File times and compile stamps ran back to about 28 July. They named it SynkLoader. No crew name came with it. How SynkLoader arrives in Microsoft Teams The user had already been talked

In the world of cloud security, things move fast. Sometimes, cracks in big systems like Microsoft's Entra ID show up in ways that make you double-check your own setup. Security researcher Dirkjan van der Bijl recently revealed a vulnerability that allows attackers to snag Global Admin rights in nearly any Entra ID tenant. This issue is tied to undocumented "Actor tokens" and a sloppy validation problem in the old Azure AD Graph API. If you're a security pro working with Micro

In the ever-evolving world of cybersecurity, new vulnerabilities can turn a seemingly secure setup into a hacker's playground. Just last month, on August 6, 2025, Microsoft documented CVE-2025-53786, an elevation of privilege (EoP) vulnerability affecting hybrid Microsoft Exchange Server deployments. This flaw allows attackers with administrative access on on-premises Exchange servers to escalate privileges and potentially compromise your entire Microsoft 365 (M365) Exchange

Identity and access management is no longer just an enterprise challenge. With hybrid work, cloud adoption, and the rise of generative AI, small and mid-sized businesses (SMBs) are facing the same risks — often with fewer resources. Microsoft’s Secure Employee Access Report 2025 highlights the problem: “58% of security leaders expect the number of identities in their organization to grow in the next year.” “61% reported an increase in identity- and network-related incidents d

Misconfigurations in Microsoft 365 and Azure remain one of the biggest cybersecurity risks. Inception Security explains how to close seven overlooked security gaps to protect against account compromise and tenant breaches. If you run Microsoft 365 and Azure, your biggest risk isn’t a zero‑day—it’s misconfiguration. Tenant compromises are frequently the result of compromised privileged accounts, which is why Microsoft stresses dedicated admin identities, MFA, and least privile

Learn how hackers use Microsoft 365 MFA bypass to gain access, add persistence, and exfiltrate data. Detect attacks with KQL queries and stop them fast.

Direct Send lets any device relay mail through your tenant's smart host with no credentials. Attackers use it to deliver phishing that looks internal and slips past third-party filters. How the abuse works, and the tenant settings that shut it down.

At Inception Security, our mission is to equip organizations with the knowledge and tools to combat advanced cyber threats. As experts in threat intelligence and incident response, we've conducted extensive research into numerous APT campaigns. This includes uncovering the NightEagle group—also tracked as APT-Q-95—for its precision and sophistication. Through our proprietary analysis and forensic investigations, we've determined that this North American-aligned APT has been l