NewsMicrosoft Threat Intelligence
Phishing Abuses RMM Tools for Persistent Access
Teaser from the source
Microsoft observed phishing campaigns that abused MSP360 RMM to deploy ScreenConnect, creating redundant remote-access channels for follow-on activity The post Phishing Abuses RMM Tools for Persistent Access appeared first on Microsoft Security Blog .
This is the RSS-feed teaser. Read the full article at the original source.
Read at Microsoft Threat IntelligenceMore on Persistent
Other advisories
- MediumCVE-2026-111040The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised H…
- Not ratedosv:CVE-2026-120634CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer
- Not ratedosv:CVE-2026-99238tracing: Hold trace_types_lock when updating modules in persistent instances
- Not ratedosv:CLEANSTART-2024-AL26272When processing surfaces, the lifetime may outlive a persistent buffer leading to memory corruption and a potentially exploitable crash
- Not ratedosv:CLEANSTART-2024-RQ90566Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17
- Not ratedosv:CLEANSTART-2026-YF22424Security fix for GHSA-hfvc-g4fc-pqhx applied in: prometheus-alertmanager-fips 0.32.0-r0, traefik 2.11.41-r1, etcd 3.6.9-r0, gatekeeper-fips 3.20.1-r1, grafana 12.3.6-r1, minio 0.20251015.172955-r2, gatekeeper 3.20.1-r1, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0, loki 3.6.10-r1
- Not ratedosv:CLEANSTART-2026-WQ89744Security fix for GHSA-mh2q-q3fh-2475 applied in: consul 1.22.7-r0, consul 1.22.7-r2, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r2, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0
- Not ratedosv:CLEANSTART-2026-OS27290Security fix for GHSA-p77j-4mvh-x3m3 applied in: consul 1.22.5-r1, gatekeeper 3.20.1-r1, gatekeeper-fips 3.20.1-r1, minio 0.20251015.172955-r1, gcp-compute-persistent-disk-csi-driver-fips 1.25.0-r0
Other news entries
- Cursor removes malicious Claude Code extension after SSH backdoor attemptNewsCSO Online
- Inside a malicious Claude Code-branded extension and its persistent SSH backdoorNewsMicrosoft Threat Intelligence
- Malicious Claude Code extension on Cursor planted SSH backdoorsNewsBleepingComputer
- Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH BackdoorNewsThe Hacker News
- As Russia's Cyberwar Evolves, Belarus Steps ForwardNewsDark Reading
- Hackers exploit Cisco SD-WAN flaw to deploy custom KeyDrift malwareNewsBleepingComputer
- Cisco Expressway Series Remote Code Execution VulnerabilityNewsCisco PSIRT
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
ID