Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
More on Exfiltrate
Other advisories
- Not ratedosv:CVE-2026-105941Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
- Highghsa:GHSA-vx52-2968-3vc6pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
- HighCVE-2026-101043pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
- Not ratedosv:CVE-2026-47231Admidio has IDOR in `documents-files.php` `mode=move_save` that lets any folder-uploader exfiltrate files from private folders
- LowCVE-2026-48978Oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens in oras.land/oras-go
- HighCVE-2026-72763n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
- Not ratedosv:CVE-2026-48978oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
- Not ratedosv:CVE-2026-59853SiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)
Other news entries
- Chrome Store Hosts 'Poper Blocker' Spyware Downloaded by MillionsNewsDark Reading
- Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate CredentialsNewsThe Hacker News
- Recent ZyXEL Switch Vulnerability Exploited by Chinese HackersNewsSecurityWeek
- TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard DataNewsThe Hacker News
- BragJack Attack Can Turn a Browser's Agentic AI Against ItNewsDark Reading
- Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML ExportsNewsThe Hacker News
- Amazon Kiro Prompt Injection Can Exfiltrate Sensitive Data Through Kiro PowersNewsThe Hacker News
- Hospital operator Nutex Health says data stolen in cyberattackNewsBleepingComputer
Source: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html
ID