Recap of a Huntress Tradecraft Tuesday session (October 2026) on phishing kits that target Microsoft 365 tokens, including EvilTokens (a device-code phishing campaign abusing Railway) and the Kali365 control panel. It explains device-code phishing, adversary-in-the-middle and token replay. It lists detections (unfamiliar cloud sign-ins, device-code auth, new devices) and response steps (revoke refresh tokens, remove rogue devices, block device-code flow).
Microsoft 365Microsoft Entra IDHuntress+1
EvilTokensKali365device-code phishing+4
Threat Intel, Blue Team & Detection, Identity & Access· Published and added 22 Oct 2026
CVE-2026-110936 is a DLL search-path flaw in Siemens Software Center (CVSS v4 8.4), fixed in version 4.0.9.8. Attackers paired a validly signed copy of the program (3.5.8.7) with their own DLLs for side-loading, delivered through the Romulus ClickFix platform. Siemens says its channels were not breached and advises behavior-based detection over file hashes. Huntress reported the flaw.
Siemens Software CenterHuntressWindows
CVE-2026-110936RomulusClickFix+6
Threat Intel, Blue Team & Detection· Published and added 19 Oct 2026
ConnectWise suspended its Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management services in October 2026 after a compromised application credential was used to access customers' Microsoft 365 tenants. Huntress saw the Cloud Backup identity sign in to 162 tenants on 15 to 16 October and attacker IP 144.172.64[.]128 try nearly 1,000 Entra tenants, with over 300 successful sign-ins. In one tenant, the Cloud Management Teams app added itself to Global Administrator and added client secrets to other apps. No restoration timeline has been given.
Huntress post on where accounts remain exposed after a passkey rollout. It covers passkey-themed social engineering, the EvilTokens device-code phishing campaign (344 organizations in about 16 days), weak enrollment and recovery, SpecterOps research on Windows WebAuthn hooking on compromised endpoints, and the trade-offs between synced and device-bound passkeys. It closes with ITDR-style post-login monitoring, containment steps (revoke sessions, remove rogue authenticators, hunt inbox rules, OAuth grants, forwarding), and a five-question deployment checklist.
Explains the "non-negotiable" requirements for a Conditional CMMC Level 2 (Self) status under 32 CFR 170.21. The minimum score is 88 of 110, every 3- and 5-point NIST SP 800-171 requirement must be implemented, plus a short list of 1-point ones. Those mandatory items add up to 64 points, which leaves 24 of the remaining 46 one-point requirements to choose. It also covers how this differs from legacy DFARS 252.204-7019/7020 self-assessments scored with the DoDAM (-203 to 110), and how the 180-day POA&M closeout window can silently expire a status in SPRS. The post ends with a Huntress product mapping.
Huntress reports in-the-wild exploitation of two unpatched AhsayCBS vulnerabilities (CVE-2026-105133 and CVE-2026-105134) affecting all versions up to and including the latest 10.3.4. Attackers chain an authentication bypass with OS command injection via the Replication Receiver API to gain unauthenticated RCE with System privileges, drop JSP webshells, deploy XMRig cryptominers disguised as Microsoft Edge, achieve persistence using a modified NSSM binary as a fake Microsoft Edge Update service, and load the vulnerable WinRing0x64.sys driver for kernel-level miner access (BYOVD). At least five organizations were targeted as of October 8; Huntress recommends restricting management-interface access until a patch is released.
HuntressWindowsPowerShell+2
CVE-2026-105133CVE-2026-105134BYOVD
Threat Intel, Offensive Security· Published and added 9 Oct 2026
Huntress commissioned a survey of 501 US knowledge workers (excluding security professionals) on AI usage, training, and policy at work. Key findings: 43% received no formal AI security training, only 26% have a written AI policy, and when asked if a company chatbot could plausibly be exploited via prompt injection, only 26% of workers recognized the risk (31% even among those with a written policy). It also surfaces behavioral risk data, like 25% of workers saying they'd copy a client contract into a personal AI account rather than check with IT first.
LLMChatGPTOpenAI+1
AI Security, GRC· Added 3 Oct 2026, published 2 Oct 2026
Huntress's "Tragic Quadrant" ranks the cyber threats its SOC sees most often against small/mid-sized businesses by prevalence and blast-radius risk, drawing on 2026 telemetry from 5M+ endpoints and 15M identities. It highlights RMM abuse (45% of endpoint incidents in Q1 2026), mailbox-rule manipulation feeding BEC (24.6% of ITDR signals), AiTM session-token theft bypassing MFA (18.9% of identity threats), plus device code phishing (the EvilTokens PhaaS kit hit 344 orgs in 16 days using Railway-hosted infrastructure and spoofed Cisco/Trend Micro/Mimecast redirect links), ClickFix clipboard-paste infections leading to LummaC2 infostealer compromise, and emerging AI-platform abuse (the FakeAgent campaign hosted a malicious Claude Artifact on claude.ai to drop SectopRAT, hitting 29 organizations in two days).
Microsoft 365ClaudeChatGPT+2
EvilTokensRailwayClickFix+3
Threat Intel, Blue Team & Detection· Published and added 1 Oct 2026
A Huntress blog post breaking down how attackers abuse Windows Volume Shadow Copy Service (VSS) beyond the well-known "delete shadow copies before ransomware detonation" pattern — including creating shadow copies to quietly extract NTDS.dit for credential access, and manipulating shadow copy size/configuration. It details why single VSS events (creation/deletion) are noisy, useless alerts on their own, and describes how Huntress correlates VSSAdmin activity with lateral movement, credential-harvesting commands, and process lineage over a time window, illustrated with a real incident involving PsExec, vssadmin create shadow against a domain controller, a blocked cleanup attempt, and follow-on DNS enumeration.
WindowsActive DirectoryMITRE ATT&CK+2
NTDS.ditVSSAdminInhibit System Recovery
Blue Team & Detection· Added 22 Sep 2026, published 15 Sep 2026
A Huntress SOC-informed guide to endpoint hardening, explaining why checklist-only compliance approaches fail and detailing real intrusion paths observed in incidents: internet-exposed RDP brute-forced by scanners, RMM tool abuse delivered via phishing (277% spike in 2025), and ClickFix attacks that trick users into pasting malicious commands into the Windows Run prompt. It closes with a practical weekly checklist covering external exposure scanning, local admin rights reduction, Windows Defender tamper protection, and disabling SMBv1/legacy protocols.
RDPWindows DefenderSMBv1
ClickFix
Blue Team & Detection· Added 11 Sep 2026, published 10 Sep 2026
Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.
Active DirectoryWindows.NET+1
DisARMSMSRC Case 33210Sean Metcalf+1
Offensive Security, Identity & Access· Published and added 8 Sep 2026
Huntress blog post clarifying that DoD's July 13 "strategic pause" only suspended CMMC Phase 2 third-party certification requirements (for solicitations after Nov 2026), while Phase 1 self-assessments, SPRS scoring, and DFARS 252.204-7012's 72-hour CUI incident reporting remain fully in force and now face closer DIBCAC/DOJ False Claims Act scrutiny. It also flags the FAR Council's June 23 proposed CUI rule (part of the Revolutionary FAR Overhaul), which would extend 72-hour breach reporting and a NIST 800-171 Rev 3 baseline to all FAR-based federal contractors, not just the defense industrial base, creating a temporary split between CMMC's Rev 2 and the FAR's Rev 3. It closes with a breakdown of 32 CFR 170.21's strict POA&M limits (no POA&M at Level 1, minimum 88/110 score and only 1-point requirements eligible at Level 2) and practical questions MSPs should ask clients about federal contract exposure.
A Huntress blog post walks Australian boards through ASD's 2025-26 cyber security guidance and its companion frontier-AI cyber threat paper, citing the $12.5B FY23-24 espionage cost figure and the July 2026 Hugging Face autonomous-agent security incident (later linked by OpenAI to an internal cyber-capability evaluation) as evidence that AI is compressing attack timelines from days to hours. It illustrates ASD's "assume compromise" stance with real Huntress SOC cases — catching a VPN intrusion via correlated failed-login logs, and using ransom-note/file-extension artefacts plus sub-60-second mass host/account isolation to contain active ransomware — arguing AI should accelerate detection but remain human-supervised rather than replace analyst judgment.
HuntressHugging FaceOpenAI+2
Australian Signals Directorate (ASD)Australian Institute of Company DirectorsAthena
GRC, Blue Team & Detection, AI Security· Added 3 Sep 2026, published 30 Aug 2026
Huntress details five modern phishing techniques that bypass traditional "check the URL" training and MFA: ClickFix (fake CAPTCHA tricking users into running Win+R/paste commands to execute malware), Browser-in-the-Browser (fake HTML popup windows mimicking OAuth login prompts with forged address bars/padlocks), ConsentFix (dragging an identity icon to leak an OAuth authorization code that attackers trade for Microsoft Entra ID access/refresh tokens), device code phishing (abusing the legitimate microsoft.com/devicelogin flow to authorize an attacker's device via a code, seen weaponized in PhaaS kits like EvilTokens), and fake video-conference (Teams/Zoom/Google Meet) waiting-room overlays that push a malicious "driver update" install. Each section explains why the technique defeats standard security-awareness training and how Huntress's simulated phishing scenarios replicate it.
OAuthMicrosoft Entra IDMicrosoft 365
ClickFixEvilTokensBrowser-in-the-Browser+2
Offensive Security, Identity & Access· Added 3 Sep 2026, published 28 Aug 2026
Huntress blog post arguing that MFA is only a starting point for identity security, walking through how credential/session theft (e.g. via ClickFix fake-CAPTCHA lures that trick users into pasting commands into the Windows Run dialog) bypasses single-sign-on defenses. It includes a real-world case study of a small real estate firm where a CEO's MFA exception led to a business email compromise and fraudulent wire transfers, followed by a practical identity-hardening checklist covering conditional access by geography/device, closing MFA exceptions, monitoring for configuration drift, and reducing stale privileged accounts.
Microsoft Entra IDMicrosoft DefenderMicrosoft 365+1
ClickFixbusiness email compromise
Identity & Access· Added 3 Sep 2026, published 25 Aug 2026
Huntress researchers describe how attackers increasingly abuse legitimate RMM tools like ScreenConnect and AnyDesk instead of custom malware, citing a 277% year-over-year rise in RMM abuse and its presence in nearly 40% of investigated incidents. The piece walks through a real case where a ScreenConnect lure sat dormant for five months before the attacker logged in to hijack a browser session and send spam, and describes how Huntress/AnyDesk staff used RMM access defensively to disrupt an India-based scam call center and a pig-butchering compound. It closes by pitching Huntress's RMM Guard, an app-control feature that inventories and blocks unauthorized RMM installs.
ScreenConnectAnyDeskHuntress+1
Netcraft
Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 21 Aug 2026
A Huntress detection engineer describes using an LLM to analyze a Microsoft 365 account-takeover case: the model flagged an app identifier as malicious, but it turned out to be the legitimate Outlook desktop client (present in 17%+ of customer orgs) — a scoping error caused by comparing against the wrong denominator. Rescoping the same query correctly surfaced the actual malicious tooling (an identifier seen in only three orgs, rewriting inbox rules), which shipped as a live detection rule with true positives and no false positives so far. The piece generalizes this into a framework for delegating detection-engineering work to AI: only hand over tasks you can cheaply and reliably verify, and invest in building fast, repeatable checks (coverage checks, alert-volume checks, known-good/known-bad tests) rather than trusting raw LLM output.
Microsoft 365
HuntressAndrej KarpathyKieran Klaassen+2
Blue Team & Detection, AI Security· Added 3 Sep 2026, published 19 Aug 2026
Huntress breaks down a recurring pattern across 2026 university breaches: Newcastle University's admissions-system misconfiguration exposed ~440,000 contacts, University of Western Australia left Callista student-system credentials exposed online, Avans University had a Power BI misconfiguration leak data for nearly a year, and ShinyHunters breached Instructure's Canvas (defacing login portals during finals week) before exploiting an unpatched RCE flaw in Oracle PeopleSoft across 300+ instances at 100+ organizations. The piece argues higher ed's decentralized IT ownership across departments produces recurring hygiene gaps (misconfigurations, exposed credentials) rather than sophisticated attacks, and that identity/access visibility across distributed environments is the real fix.
Oracle PeopleSoftPower BI
ShinyHuntersNewcastle UniversityUniversity of Western Australia+4
Threat Intel, Identity & Access· Added 3 Sep 2026, published 13 Aug 2026
Huntress interview/recap covering the 2021 HAFNIUM (Silk Typhoon) mass exploitation of on-prem Microsoft Exchange servers that led to 88,000+ web shell backdoors, how Huntress and CrowdStrike tracked victims via cloned adversary infrastructure, and the FBI's unprecedented Rule 41 warrant used to remotely remove web shells at scale. It also details the July 2025 arrest of Xu Zewei, and 2026 FBI Operation Riptide takedowns of the Outsider phishing-as-a-service platform, NetNut residential proxy network, and MediaLand bulletproof hosting provider.
Microsoft Exchange
HAFNIUMSilk TyphoonXu Zewei+10
Threat Intel, Offensive Security, Blue Team & Detection· Added 3 Sep 2026, published 10 Aug 2026
Huntress blog recap of a Tradecraft Tuesday broadcast breaking down the LSHIY password-spraying campaign, which hit Microsoft Azure CLI tenants via IPv6 ranges from BYOIP provider LSHIY LLC, generating over 81 million login attempts and 78 account compromises in a two-week window. The campaign abuses OAuth's deprecated Resource Owner Password Credentials (ROPC) grant at the tenant token endpoint to mint delegated tokens that bypass MFA and Conditional Access Policies when valid credentials are entered. After LSHIY's takedown the actor pivoted to FranTech IPv6 ranges and Tor exit nodes; mitigations include disabling ROPC, restricting Azure CLI for non-admins, and enforcing unscoped Conditional Access covering all users, apps, and client types.
Huntress explains how initial access brokers (IABs) operate as specialized cybercriminals who breach organizations, verify and price the foothold, then sell it to ransomware crews, BEC actors, or data thieves via dark web marketplaces. It walks through common IAB entry vectors — infostealer credential theft, exposed RDP/VPN abuse, and AI-assisted phishing (citing a Huntress EvilTokens lure example) — and includes a real SOC case where a brute-forced RDP server led to tradecraft linked to a ransomware ecosystem. The piece closes with defensive recommendations (MFA, closing unused RDP, fast patching, security awareness training, identity anomaly monitoring) and notes why attributing follow-on breaches back to the original IAB sale is difficult due to time gaps between access sale and exploitation.
Huntress walks through the ransomware attack chain as a repeatable assembly line: initial access brokers selling footholds (often via infostealers, phishing, or unpatched internet-facing systems), Living-off-the-Land abuse of PowerShell and RMM tools to blend in, and ransomware as the final, visible stage. It cites a real cluster of six ransomware intrusions traced back to the same exposed Citrix NetScaler gateway and session-theft trick culminating in DragonForce ransomware, plus 2026 Cyber Threat Report stats: 37.2% of identity attacks involved suspicious logins, a 277% YoY spike in RMM abuse, ~20 hours average attacker dwell time before detonation, and Akira/Medusa/Qilin/RansomHub driving 51.3% of 2025 ransomware incidents.
Citrix NetScalerPowerShellRDP+1
DragonForceAkiraMedusa+3
Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 15 Jul 2026
Huntress details five recurring identity-centered attack patterns seen in its telemetry: credential-based ransomware intrusions that use built-in admin tools for ~20 hours before detonating encryption; Business Email Compromise via inbox rules hiding replies in Conversation History folders; a Qilin ransomware case where attackers impersonated legitimate RMM software, stole browser credentials, and disabled AV; a ClickFix-style social-engineering campaign ("BackgroundFix") that tricks users into pasting a clipboard-hijacked command via a fake "verify you're human" checkbox on a background-remover site; and a shift toward correlation-based SIEM detection that ties together weak brute-force/login signals across VPN, AD, and RDP logs to surface likely intrusions. Each section includes concrete IOC/behavior watchlists for defenders, framing identity (accounts, mailbox rules, device trust, RMM tooling) as the common attack surface.
Microsoft 365SIEMEDR+2
QilinClickFixBackgroundFix
Threat Intel, Blue Team & Detection, Identity & Access· Added 3 Sep 2026, published 14 Jul 2026
Huntress details two 2026 campaigns that bypassed Microsoft 365 MFA despite Conditional Access policies being in place: device code phishing abusing Railway.com's clean IP infrastructure, attributed to the EvilTokens phishing-as-a-service platform, hitting 344 orgs, and a ROPC-based credential replay attack from LSHIY LLC infrastructure with 81 million login attempts and 78 compromised accounts, 55 of which had active MFA policies that didn't actually cover Azure CLI or legacy auth. It breaks down how narrow Conditional Access policy scoping, missing All Cloud Apps coverage, excluded user groups, report-only mode, mislabeled trusted locations, let attackers through, and recommends blocking device code flow and legacy auth via Conditional Access as the fix.
Huntress SOC breaks down how to differentiate legitimate admin use of native tools (PowerShell, WMI, RMM software) from living-off-the-land (LoTL) abuse by attackers, offering a four-point pressure test: who used the tool, where it ran, how it launched, and what followed. It includes real detection examples such as attackers using the legitimate RMM tool Action1 to deploy ScreenConnect for persistent access, a malicious process chain spawning from bomgar-scc.exe, and an LLM-generated script with code comments revealing Telegram-based exfiltration.
PowerShellWMIScreenConnect+2
bomgar-scc.exe
Blue Team & Detection, Threat Intel· Added 3 Sep 2026, published 8 Jul 2026
A Huntress blog post explaining how the Ransomware-as-a-Service (RaaS) model splits ransomware operations into specialized roles - operators who build and maintain malware/leak sites, affiliates who conduct intrusions, and initial access brokers who sell footholds - citing Huntress 2026 Cyber Threat Report data showing Akira, Medusa, Qilin, and Ransomhub accounted for over half of observed ransomware incidents. It walks through a real Huntress SOC incident where attackers pivoted from a compromised SonicWall VPN appliance through privilege abuse, Cloudflared/OpenSSH persistence, credential theft, and shadow copy deletion before deploying Akira ransomware, and recommends monitoring VPN/RDP access, MFA, and SIEM/EDR/ITDR correlation to catch pre-encryption staging activity.
SonicWallRDPVPN+3
AkiraQilinMedusa+2
Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 1 Jul 2026
Huntress details ConsentFix, an evolution of ClickFix that abuses Microsoft 365 OAuth sign-in flows: victims are phished via password-protected Dropbox or DocSend lures, shown a fake Microsoft sign-in page, and tricked into dragging a localhost callback link into their browser, which exfiltrates OAuth tokens and hijacks the session without needing a password or triggering MFA. A cybercrime forum post published the full technique with working code and infrastructure such as Cloudflare Pages, workers.dev, and Pipedream webhooks, and showed attackers using LinkedIn, ZoomInfo, and Hunter.io to profile victims before sending lures.
Microsoft 365OAuthLinkedIn+2
ClickFixConsentFix
Threat Intel, Identity & Access, OSINT· Added 3 Sep 2026, published 29 Jun 2026
A Huntress blog post (authored by DEFCERT's Ryan Bonner) gives MSPs and MSSPs a concrete methodology for spotting clients that are secretly part of the DoD Industrial Base and subject to DFARS 252.204-7012/-7021, CMMC, and NIST 800-171 obligations. It covers public research signals (USASpending.gov contract lookups, ITAR/DDTC registration, AS9100 certification, Nadcap accreditation, contract vehicles like IDIQ/GWAC/BPA/OTA) and direct screening questions (FAR/DFARS flow-down clauses, DoD distribution-statement-marked technical data, PIEE/SPRS/WAWF account access) to determine whether a company handles Controlled Unclassified Information. It closes with a pitch for Huntress's CMMC Level 2 control coverage.
Snyk discloses and analyzes a supply-chain breach at Klue, a market-intelligence SaaS platform, in which attackers used a long-forgotten integration-prototype credential to gain a foothold, then harvested OAuth tokens used for Klue's Salesforce integrations to directly query and exfiltrate customer CRM data across multiple downstream organizations (also affecting Recorded Future, Tanium, Huntress, and Jamf). Extortion attempts followed the exfiltration, and Snyk confirms it was among the affected customers, with impact limited to business contact fields and support-case titles/descriptions in its Salesforce environment. The piece illustrates how a single stale non-human credential and standing OAuth tokens can turn one vendor compromise into a multi-tenant cascade.
SalesforceOAuthSnyk
Recorded FutureTaniumJamf
Threat Intel, Identity & Access, Supply Chain· Added 3 Sep 2026, published 23 Jun 2026
Huntress recaps a Tradecraft Tuesday episode explaining device code phishing, where attackers generate legitimate Microsoft OAuth device authorization codes and phish victims into entering them, instantly receiving valid session tokens that bypass MFA. It covers the technique's origin (Dr. Nestori Syynimaa/AADInternals, 2020), Storm-2372's February 2025 Teams-lure campaign, and a March 2026 EvilTokens PhaaS campaign that abused Railway.com as a clean-IP token-harvesting relay against 344 organizations, plus mitigations like Microsoft's Conditional Access block, device registration monitoring, and disabling device code flow.
OAuthMicrosoft Entra IDMicrosoft 365+1
Storm-2372EvilTokensKali365+4
Identity & Access, Threat Intel, Blue Team & Detection· Added 3 Sep 2026, published 22 Jun 2026
huntress.comarticle🛡️ Security
