Microsoft warns of global campaign stealing auth tokens from 35K users
2026-05-05T14:51:51Z•3e7e51c239408acf12053ff40bcd85ab19d3eb20d2318793fb240da56fed99aa
BluekitCISA KEVInstructureLinux KernelMOVEit AutomationNCSCSalt Typhoonactive-exploitationauth-token-theftauthentication-bypasscPaneldata-breachphishingphishing-kitprivilege-escalationvulnerability-disclosure
What happened
Multiple high-impact incidents and active-exploitation advisories: Microsoft disclosed a global phishing campaign that stole authentication tokens from ~35,000 users using fake “code of conduct” lures and legitimate services; a new Bluekit phishing kit with AI/automation and 40+ templates was documented; Instructure (Canvas) is investigating a data exposure that may affect thousands of schools; and the Salt Typhoon incident impacted an IBM Italy subsidiary. Progress fixed critical MOVEit Automation flaws (authentication bypass CVE-2026-4670 and privilege escalation CVE-2026-5174) that could be
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 3e7e51c239408acf12053ff40bcd85ab19d3eb20d2318793fb240da56fed99aa
- Enrichment time
- 2026-05-05T14:51:51Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.