Skip to content
September 2026 Page 59

September 2026

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks

Ravie LakshmananSep 07, 2026Phishing / Identity Security Threat hunters have disclosed details of a widespread data theft and extortion threat cluster that’s targeting Microsoft 365 and other software-as-a-service (SaaS) offerings through information technology (IT) help… 

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts

Ravie LakshmananSep 07, 2026Malware / Vulnerability Cybersecurity researchers have disclosed details of worm-like activity that abuses ConnectWise ScreenConnect to distribute a malicious Visual Basic Script (VBScript) payload to newly connected systems. According to Huntress, three… 

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released

A TantoSec proof-of-concept turns an AES-CBC “padding oracle” in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution — but only against applications in a specific non-default configuration, and Progress patched the chain in…