"153 million" — a single figure that drew the FBI's attention after a dark‑web service called Nexus claimed it had digital scans of more than 153 million U.S. and Canadian driver's licenses, along with millions of other identity documents, according to independent journalist Brian Krebs. The claim, and the provenance alleged by Nexus, make the point this week: attackers prefer doors that already open.
Microsoft: Teams-based intrusions that become full network access
Microsoft warned of a human‑operated intrusion campaign that leverages Microsoft Teams external collaboration to impersonate IT or help‑desk personnel and socially engineer targets into granting interactive remote sessions. Microsoft said attackers establish remote control via legitimate remote‑management (RMM) tools, then run PowerShell to download a malicious MSI that stages a portable Node.js runtime and "an obfuscated JavaScript implant" providing persistent command execution and command‑and‑control.
After implant deployment, Microsoft described extensive host and Active Directory reconnaissance, periodic screenshot capture, execution of follow‑on payloads through trusted Windows binaries, and lateral movement over Windows Remote Management (WinRM) toward high‑value assets such as domain controllers. Microsoft called the pattern "high‑impact" because it grants an external operator interactive access to internal infrastructure.
Spring Ring: Teams vishing at scale, and NTLM relay escalation
Palo Alto Networks Unit 42 reported a coordinated operation called Spring Ring that used external Teams accounts to pose as help desk staff. Between January and April 2026 the campaign targeted more than 150 employees across at least 10 companies, Unit 42 said. What began as benign chats often became voice‑phishing calls coercing victims to run RMM tools or custom malware; in an advanced variant attackers moved from vishing into a Microsoft NT LAN Manager (NTLM) relay attack aimed at an organization's domain controller. Unit 42 identified as many as 26 distinct attacker identities behind the attempts.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramblePhishing-as-a-Service resilience and CEO‑targeted turnkey kits
Phishing infrastructure continues to operate like a commercial market. Group‑IB found the Outsider phishing‑as‑a‑service kit (operated by an actor known as "ChenLun") remained resilient after law‑enforcement seizures, with more than 700 new pages created within a month of Google filing suit against the operators. Group‑IB said affiliates deliver campaigns by SMS and that the kit uses WebSocket connections for live keylogging and to manipulate multi‑factor authentication challenges.
Separately, ZeroBEC disclosed BlueKit, a turnkey executive phishing service targeting financial‑industry CEOs. BlueKit uses document‑sharing lures, a browser‑in‑the‑middle (BitM) flow and ZeroBot to screen bots; selected victims were moved into a fake document viewer that delivered a legitimate ScreenConnect client pointing to attacker infrastructure. BlueKit is sold at prices ranging from $250 for seven days to $940 for 30 days, placing it near the high end of current PhaaS offerings, ZeroBEC said.
llms.txt: AI instruction files turned supply‑chain tripwire
A scan of 6,214 live domains belonging to defense contractors, Fortune 500 and Big Tech firms found 8,265 llms.txt and llms‑full.txt files placed at site roots as curated instruction sets for AI agents. An Israeli stealth startup reported 120 files that referenced PyPI or npm package names and unregistered domains. Researcher Alon Hertz said his team registered several of those package names and embedded a tiny beacon; the first callback arrived in under four minutes.
The scan also documented an active exploitation: authentication vendor Clerk's llms.txt mistakenly referenced an unscoped npm package name, which an unknown actor registered and used to transmit the installer's username, machine name, working directory and timestamp. Clerk has since addressed the issue. At the same time, a coalition of more than 100 companies — including OpenAI, Anthropic, Google and Microsoft — published a public letter warning that AI compresses attack timelines and can accelerate exploitation of misconfigurations and legacy weaknesses.
Signed binaries, sideloading, and trusted tools abused
Attackers keep weaponizing legitimate trust. iZOOlogic described a tax‑lure campaign that delivered a signed commercial executable inside a malicious disk image paired with a hidden unsigned DLL used for DLL sideloading; the loader includes three encrypted payloads, two of which decrypt to legitimately signed kernel drivers, and a Registry‑resident second stage that connects to an external server over UDP.
Intezer documented a "remote‑controlled Rubber Ducky" delivered via a counterfeit privacy‑browser site surfaced by a mistyped domain and a sponsored search result; the campaign used an MSIX installer signed through Microsoft's infrastructure and showed near‑zero detections on VirusTotal. Huntress reported threat actors weaponizing the legitimate Faronics Deploy endpoint management platform to run attacker‑controlled PowerShell, observing more than 457 endpoints encountering Faronics‑related lures and cases where Faronics was chained to ScreenConnect. Morphisec detailed trojanized Electron apps distributing a Windows stealer called RevStealer that can fall back to a smart contract on Polygon for alternate command servers.
What this means for security teams, regulators, and end users
- Security teams: review external collaboration and RMM approval workflows, monitor Teams and messaging channels for help‑desk impersonation, and audit llms.txt/third‑party package references before installing tools that AI agents or build systems might pull.
- Regulators and procurement leaders: note the Nexus claim and the Dropbox‑Lenovo disclosure — legacy integrations and identity‑verification suppliers are attack surfaces that drew FBI and media scrutiny and may warrant closer oversight.
- End users and executives: treat click‑to‑allow prompts, unexpected remote‑access requests, and document‑sharing links with heightened suspicion; attackers are increasingly buying turnkey tools that turn a single mistaken click or mistyped domain into full access.
These reports arrive with a straightforward, recurring lesson from the week: attackers prefer to walk through open doors. Changing a password will not close every door — bad app approvals, legacy integrations and active remote sessions will. As the bulletin puts it: check what already has access before adding anything new.
