Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data

2026-11-02T13:24:02Z•2b050483323a1b42d1fd93a08cc24b3aa81eb2994da6f463b417d62c82604298
CVE-2026-111357CVE-2026-118539CVE-2026-97229CVE-2026-98432active-directory-certificate-servicesactive-exploitationad-csbackdoorcredential-theftcritical-vulnerabilitiescryptocurrency-theftcybersecuritydata-breachddosgovernment-targetinginfostealerlinuxmalwaremicrosoft-teamsphishingprivilege-escalationremote-access-trojanremote-code-executionsocial-engineeringsoftware-trojanizationstate-sponsored-threatssupply-chain-compromisewindowszero-day

What happened

A cybersecurity news feed covering active exploitation, malware campaigns, supply-chain compromises, social engineering, data breaches, cryptocurrency theft, and critical vulnerabilities affecting enterprise, cloud, Linux, Windows, network appliances, developer tools, and web platforms. Several reports describe actively exploited or highly severe issues, including Ivanti, Drupal Commerce, GitLab, Linux kernel, WordPress, LXD/MicroCloud, and AD CS abuse. The collection also highlights state-sponsored activity, AI-assisted attacks, infostealers, ransomware-like financial theft, malicious updates

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
the_hacker_news
Record identifier
2b050483323a1b42d1fd93a08cc24b3aa81eb2994da6f463b417d62c82604298
Enrichment time
2026-11-02T13:24:02Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.