The playbook is evolving… and fast. |
From MFA bypasses to hijacked social accounts and data-for-profit marketplaces, attackers are getting more creative. Meanwhile, AI is reshaping both risk and defense. Read past newsletters here. |
|
|
Here’s what you need to know: |
|
|
Microsoft 365 Phishing Bypasses MFA Protections |
A large-scale phishing campaign is exploiting Microsoft’s device code flow to hijack Microsoft 365 accounts while bypassing traditional login protections.
More than 340 organizations across multiple countries have been impacted, with attackers gaining long-lived tokens lasting up to 90 days, while using trusted infrastructure to blend into normal cloud activity and evade detection. |
The campaign remains active in the wild.
Disable device code authentication where not required and immediately audit sign-in logs for activity tied to Railway IP ranges to identify and contain compromised accounts. |
TikTok Business Accounts Hit by Session Hijacks |
Attackers are using adversary-in-the-middle phishing kits to hijack TikTok for Business accounts, expanding beyond traditional enterprise targets. These accounts control ad spend and often connect to corporate SSO, making them a gateway to broader access.
Push Security reports they have blocked the phishing pages from the campaigns. Enforce phishing-resistant MFA, restrict access to managed devices, and immediately revoke sessions and tokens after any suspected compromise. |
Leak Bazaar Turns Stolen Data into Profit Engine |
A new cybercriminal platform is turning stolen corporate data into structured, resale-ready products instead of raw leaks. The model extends the lifespan and value of stolen data, allowing attackers to repeatedly monetize sensitive information like financial records and personal data. This signals a maturation of the cybercrime economy, where breaches evolve into ongoing revenue streams rather than one-time events. Limit data exposure by enforcing least privilege, using DLP tools to detect and block bulk exfiltration, and reducing unnecessary data retention. |
|
|
Data Exposure Reality Check: How secure is your corporate data? |
|
|
Yesterday's Pulse Check Results |
If a platform fails to protect minors, where should accountability land? |
|
|
Security Tools You Can Use |
|
|
Enterprises Rethink Security for AI Agents |
Enterprise security models are being upended as autonomous AI agents rapidly outnumber human users across corporate environments. This shift matters because AI agents operate at machine speed without human judgment, making them vulnerable to prompt injection and other hard-to-detect attacks. |
As adoption grows, a widening trust gap is pushing security teams to move beyond identity-based controls toward monitoring intent within browser sessions. Separate agent and human identities, and enforce browser-level controls that inspect and sanitize content before agents can act on it. |
RSAC 2026: Zscaler Pushes New Approach to AI Security |
At RSAC 2026, Zscaler’s Adam Geller shared how the company is approaching enterprise AI security as adoption outpaces traditional defenses.
The challenge is limited visibility — many organizations lack a clear view of their AI tools, models, and data flows, increasing exposure to risks like data leakage and prompt injection. For security teams, this reflects a familiar pattern seen in early cloud adoption, where speed outpaced governance.
Build a baseline inventory of AI usage and data flows, then apply zero trust principles to control and monitor access before adding new security tools. |
|
|
Learn How to Automate Compliance for SOC 2, ISO 27001, and More with Vanta
Keeping up with evolving compliance is challenging, but Vanta helps teams get audit-ready faster and stay continuously compliant. Join to learn how Vanta can help you: • Automate evidence, policies, and remediation across SOC 2, ISO 27001, HIPAA, HITRUST, ISO 42001, and more • Build real security foundations, not check-the-box fixes • Show credibility faster with a public Trust Center and AI-powered questionnaires • Keep engineers focused with guided workflows and developer-native automation |
|
|
How Secure Is Your AI Ecosystem? |
As enterprises rapidly deploy AI agents and generative tools, threats like prompt injection and data manipulation are rising. These attacks exploit how AI processes inputs to trigger data leaks, unauthorized actions, and compromised workflows. |
How to protect your AI ecosystem: |
-
Sanitize prompts and separate trusted instructions from external data to prevent prompt injection and unauthorized actions.
- Apply least privilege, use AI-aware DLP, and isolate browser sessions to reduce exposure and prevent data leakage.
-
Continuously log AI activity and follow an AI agent safety checklist to detect anomalies and strengthen protections.
|
Securing AI ecosystems means building early guardrails to protect data, decisions, and workflows as adoption scales. |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
