Mirage2FA Surge Hits 4,500 US and EU Companies, Abusing Microsoft 365 Login Flows
2026-08-25T13:24:00Z•a568e822550aeb2e4e2fc5c03a1683cede39ed1dea17c05b23640e9ae54e735d
CVE-2026-18963CVE-2026-19478CVE-2026-21962CVE-2026-61979account-takeoveractive-exploitationauthentication-bypassbackdoorclickfixcredential-theftcritical-vulnerabilitiescyber-espionagefake-captchagitlabkeycloaklinuxmalwaremfa-bypassmicrosoft-365npm-supply-chainoracle-weblogicphishing-as-a-serviceratremote-code-executionrootkitrust-supply-chainwindowswordpresszero-day
What happened
The Hacker News feed reports multiple significant cybersecurity developments, including active exploitation of critical vulnerabilities in Oracle WebLogic, GitLab, and miniOrange SAML; identity and MFA bypass phishing campaigns targeting Microsoft 365; malware and RAT distribution through npm, FTP banners, fake CAPTCHA pages, and SEO-poisoned gaming sites; supply-chain attacks affecting Rust crates; and targeted cyber-espionage campaigns. Several items involve unauthenticated account takeover or remote code execution and require urgent defensive attention.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- a568e822550aeb2e4e2fc5c03a1683cede39ed1dea17c05b23640e9ae54e735d
- Enrichment time
- 2026-08-25T13:24:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.