IAM / Zero Trust
IAM / ZERO TRUST
New Helix vishing group emerges in SharePoint data theft attacks
A new data-extortion group called Helix is using identity-focused tactics such as voice phishing (vishing), device code phishing, and multi-factor...
IAM / ZERO TRUST
npm 12 Disables Install Scripts by Default to Reduce Supply Chain Risk
GitHub has officially announced the release of npm version 12 with install scripts disabled by default, along with deprecating granular...
IAM / ZERO TRUST
The Verification Step Is the New ATO Battleground in 2026
For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools,...
IAM / ZERO TRUST
New Ghost Phishing Wave Is Breaking Traditional Email Security
A recent EvilTokens campaign targeting businesses across the US and Europe is exposing a new email security blind spot. This...
IAM / ZERO TRUST
Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data
A public issue can trick GitHub Agentic Workflows into leaking the contents of an organization's private repositories, researchers at Noma...
IAM / ZERO TRUST
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between...
IAM / ZERO TRUST
Identity Lifecycle Management Wasn’t Built for AI Agents
Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents...
IAM / ZERO TRUST
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver...
IAM / ZERO TRUST
ARToken PhaaS exposes EvilTokens‘ Microsoft 365 phishing toolkit
A new phishing-as-a-service (PhaaS) platform dubbed "ARToken" appears to operate as an affiliate of the EvilTokens phishing platform, giving researchers a glimpse...
IAM / ZERO TRUST
Identity Lifecycle Management Wasn’t Built for AI Agents
Identity lifecycle management was architected around a person with an employment record, a manager, and a departure date. AI agents...