Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants
2026-10-17T07:24:00Z•471aefea32fb208c431abffe4a2f068b746be271312783b20f84b0202e3f222e
CVE-2025-61624CVE-2026-0322CVE-2026-102764CVE-2026-105133CVE-2026-105134CVE-2026-105740CVE-2026-99999AI securityAitM phishingBeyondTrustChina-linked threat actorConnectWiseFortinetGitHub account compromiseLinux kernelMFA theftMicrosoft 365PAN-OSactive exploitationbackdoorcredential compromisecritical vulnerabilitiescryptominingcyber espionagemalwareransomwareremote code executionsupply-chain attackvirtualization escapeweb shellzero-click spywarezero-day
What happened
The feed reports multiple active and high-impact cybersecurity threats, including exploitation of zero-day and critical vulnerabilities in enterprise products, cloud and virtualization escape issues, supply-chain compromise, credential theft, phishing, malware deployment, and targeted cyber-espionage. Notable incidents include China-linked exploitation of BeyondTrust Remote Support (CVE-2026-102764), active PAN-OS exploitation (CVE-2026-0322), FortiOS exploitation to deploy PEERSTITCH (CVE-2025-61624), critical Linux VM-to-host memory exposure (CVE-2026-99999), critical RCE flaws in Next.js, a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 471aefea32fb208c431abffe4a2f068b746be271312783b20f84b0202e3f222e
- Enrichment time
- 2026-10-17T07:24:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.