Trust is doing a lot of heavy lifting this week. |
From third-party services and cloud control planes to “harmless” file types and legitimate tools, attackers are finding quiet ways in… and staying there.
Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Flickr Investigates Third-Party Email Data Leak |
Flickr is notifying users after discovering a potential data exposure linked to a vulnerability in a third-party email service provider used by the platform.
Although Flickr reported no compromise of core systems or exposure of passwords or payment data, the incident involved sensitive account metadata and underscores the risks third-party services can pose. |
Flickr said the issue was quickly contained, though exposed data such as names, email addresses, usernames, IP addresses, and account activity could still be used for phishing.
Audit third-party integrations now by enforcing least-privilege access, minimizing shared data, monitoring for anomalous activity, and validating incident response readiness through tabletop exercises. |
TeamPCP Targets Docker and Kubernetes Environments |
Flare researchers identified TeamPCP as the threat actor behind a large-scale campaign exploiting exposed cloud orchestration interfaces. First seen in late 2025, the campaign reflects a shift from endpoint attacks to exploiting cloud control planes such as Docker, Kubernetes, and vulnerable React applications.
Researchers confirmed at least 185 compromised servers in the initial PCPcat campaign, with signs of wider exposure driven by automation and lateral movement.
Lock down cloud control planes now by enforcing least privilege, monitoring for unauthorized orchestration activity, and regularly testing incident response for full cluster compromise. |
Windows Screensavers Used to Deploy RMM Backdoors |
A spearphishing campaign is abusing Windows screensaver files to install legitimate RMM tools and establish persistent access without traditional malware. ReliaQuest researchers say the campaign exploits an overlooked executable format to turn trusted RMM software into persistent, hard-to-detect access. The technique reflects a shift toward abusing legitimate tools, combining business lures, .scr execution, and sanctioned RMM software for scalable intrusions.
Block .scr execution from user-writable locations, tightly govern RMM installations with allowlists and monitoring, and regularly test incident response for unauthorized remote-access scenarios. |
|
|
A user just ran a screensaver that installed an RMM agent — what happens next in your environment? |
|
|
Yesterday's Pulse Check Results |
If your network became part of a botnet today… |
|
|
Security Tools You Can Use |
|
|
Microsoft 365 Exposed via Phishing and OAuth Flaws |
Praetorian researchers identified an attack chain where an abused email API and verbose errors combine to enable full Microsoft 365 compromise. Instead of using malware, attackers abuse business logic to bypass email defenses and steal OAuth tokens for authenticated cloud access. |
Praetorian says this combination enables Microsoft 365 compromise when public email APIs and verbose production errors are present.
Lock down public email APIs, suppress verbose production errors, tightly scope OAuth access, and regularly test incident response for token exposure scenarios. |
New Tool Scans LinkedIn Against Epstein Records |
A new open-source tool called EpsteIn lets users scan LinkedIn connections against more than 3.5 million pages of Epstein-related DOJ court documents. Designed to run entirely on a local machine, the tool flags potential name matches without uploading professional network data to third-party servers. However, testing by 404 Media showed that name-based matches can produce false positives, underscoring the need for careful validation. Treat exported LinkedIn data as sensitive, manually validate name matches with source context, and restrict access to results to prevent misuse or reputational harm. |
|
|
Open-source intelligence (OSINT) tools are helpful for penetration testers and researchers, but misuse or poor validation can create real security, legal, and reputational risks. As public data volumes grow, disciplined OSINT practices are critical to ensure insights are accurate, ethical, and defensible. |
How to apply OSINT responsibly: |
-
Treat OSINT as an investigative starting point by validating context, corroborating findings across multiple sources, and correlating results with trusted threat intelligence feeds before drawing conclusions.
-
Protect OSINT outputs as sensitive data by restricting access, documenting assumptions and confidence levels, and securely storing or deleting collected datasets and enrichment results.
-
Conduct OSINT ethically and responsibly by complying with legal and platform requirements, using threat intelligence tools to support analysis, and clearly separating activity analysis from identity or intent attribution.
|
Disciplined OSINT practices help teams derive meaningful insights from public data while minimizing errors, privacy issues, and misinterpretation. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
