Extortion crew hijacks Microsoft 365 accounts via fake passkey setup
2026-07-09T14:51:48Z•2cbbec21b3eb20241d0413deebfff5689440319145c81bc11c7124b773114ff0
AI-governanceAWS ClaudeCVE-2026-50656Citrix NetScalerEntra passkeyInterpolMicrosoft 365RoguePlanetWindows Defenderaccount-takeoveragent-skillsextortionfraud-bustlocal-privilege-escalationmalicious-ai-agentspatchphishingsocial-engineeringsupply-chainvishing
What happened
Multiple security developments: the Pink extortion crew is using vishing and fake Entra passkey enrollment pages to hijack Microsoft 365 accounts and extort victims. Microsoft released a patch for a local privilege escalation in Microsoft Malware Protection Engine tracked as CVE-2026-50656 (RoguePlanet), which can lead to SYSTEM privileges on Windows 10/11. Several vendors and startups announced AI governance and gateway products (Citrix MCP Gateway, Vectogate platform, AWS Claude apps gateway) and research highlights risks from malicious or jailbroken AI coding agents and agent skills. Law-en
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 2cbbec21b3eb20241d0413deebfff5689440319145c81bc11c7124b773114ff0
- Enrichment time
- 2026-07-09T14:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.