Credential Theft Alert: Microsoft 365 Users Targeted by Multi-Stage Redirect Scams

 

New Phishing Campaign Exploits Link Wrapping to Target Microsoft 365 Users

Cybercriminals are leveraging trusted security tools like Proofpoint and Intermedia’s link wrapping services in a sophisticated phishing campaign aimed at stealing Microsoft 365 credentials.

According to researchers from the Cloudflare Email Security team, attackers are now abusing legitimate email security features to bypass detection and lure users to credential-harvesting pages using a multi-layered redirection technique.

Ingram Micro Faces 3.5TB Data Leak Threat from SafePay Ransomware Group

 

Ingram Micro Faces 3.5TB Data Leak Threat from SafePay Ransomware Group

Some regional websites still recovering as threat actors set August 1 deadline

Cybercriminals behind the recent ransomware attack on Ingram Micro have set a deadline to leak 3.5 terabytes of stolen company data, according to a post published by the SafePay ransomware group on July 29. The attackers say they will release the trove on August 1, escalating the pressure on the global IT distributor in a classic double extortion move.

Golden dMSA Attack Targets Windows Server 2025: Persistent Cross-Domain Threat

 

Golden dMSA: Critical Windows Server 2025 Flaw Enables Cross-Domain Persistence & Enterprise-Wide Exploits

A newly uncovered vulnerability in Windows Server 2025 is raising alarm across the cybersecurity community. Dubbed Golden dMSA, the flaw allows attackers to generate valid passwords for all Delegated Managed Service Accounts (dMSAs) and Group Managed Service Accounts (gMSAs)—opening the door to persistent, cross-domain access across an entire Active Directory (AD) forest.

Critical Bug in ‘mcp-remote’ Allows Remote Code Execution

 

                 

Critical mcp-remote Vulnerability (CVE-2025-6514) Enables Remote Code Execution on Client Systems

Cybersecurity researchers have disclosed a critical remote code execution (RCE) vulnerability in the popular open-source project mcp-remote, tracked as CVE-2025-6514 with a CVSS score of 9.6. This vulnerability allows attackers to execute arbitrary operating system commands when a vulnerable MCP client connects to a malicious or untrusted remote MCP server.

Critical Flaws in Ivanti Endpoint Manager Mobile Let Attackers Decrypt User Credentials

 

Ivanti Patches High-Severity Vulnerabilities in Endpoint Manager Mobile – Password Decryption & SQL Injection Risks Identified

Ivanti has released critical security updates for its Endpoint Manager Mobile (EPMM) software, addressing three high-severity vulnerabilities that could allow attackers to decrypt user passwords or extract sensitive data from backend databases.

Google Play Under Siege: Fake PDF App Infected 90K Users with Anatsa Trojan

 

Anatsa Banking Trojan Hits 90,000 Android Users Through Fake PDF App on Google Play

A recent wave of cyberattacks has exposed tens of thousands of Android users in North America to a powerful banking trojan, Anatsa, delivered through a deceptive app posing as a PDF reader on the official Google Play Store.

Iranian Cyber Threats Intensify Against U.S. Defense and OT Networks, Warn Federal Agencies

U.S. Agencies Warn of Escalating Iranian Cyber Threats to Defense and Critical Infrastructure

Multiple U.S. cybersecurity and intelligence agencies have issued a joint advisory cautioning organizations about an uptick in malicious cyber activity tied to Iranian state-sponsored and affiliated actors.