The threats are getting harder to spot. |
Today’s stories feature trusted logins that aren’t so trustworthy, security tools with flaws, AI moving faster than governance, and new blind spots emerging on employee devices. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Microsoft 365 Flaw Leaks Android Tokens |
A vulnerability in Microsoft 365 Android apps allowed other apps installed on the same device to request Microsoft account tokens without user interaction.
A debug setting left active in a shared Microsoft SDK exposed a critical trust boundary that could have enabled unauthorized access to business data across six Microsoft 365 Android apps. |
Microsoft has already patched the issue and did not report any exploitation. Verify that affected Android apps are updated to patched versions, enforce Play Store updates through MDM where possible, and review policies governing third-party app installations on corporate and BYOD devices. |
Comodo Zero-Day Crashes Windows Systems |
A zero-day in Comodo Internet Security allows attackers to remotely crash Windows systems with a single malformed IPv6 packet. Security researcher Marcus Hutchins uncovered the flaw that can remotely trigger Windows system crashes and kernel memory errors, even on systems with inbound ports blocked. Marcus said the vendor has not released a patch and has not responded to his notifications at the time publication. Audit systems running Comodo Internet Security, filter suspicious IPv6 extension headers at the network edge, and test incident response plans. |
Microsoft 365 Attacks Blend Into Normal Logins |
Threat actors are using valid Microsoft 365 credentials and trusted infrastructure to blend into normal business activity.
Barracuda researchers observed a 25% increase in malicious Microsoft 365 logins from low-risk countries, as attackers use trusted infrastructure and compromised credentials to evade detection. The findings highlight a growing risk for organizations because successful logins often attract less attention than failed authentication attempts.
Review Microsoft 365 logs for unusual sign-ins, impossible travel events, and unexpected account changes, then correlate findings with endpoint and network telemetry to identify compromised accounts. |
|
|
|
Vendor hasn't responded after multiple disclosure attempts. Your call? |
|
|
|
Yesterday's Pulse Check Results |
The biggest challenge for AI security is... |
|
|
|
Security Tools You Can Use |
|
|
|
AI Adoption Outruns Governance |
AI adoption is widespread, but recent Veeam research suggests many organizations still lack the governance, compliance, and operational maturity needed to scale it effectively.
The findings showed that while 95% of organizations have adopted AI, many continue to face setbacks from talent, integration, regulatory, and data quality challenges. |
Even as executive confidence remains high, only 31% have completed an AI-related audit or regulatory review, underscoring ongoing governance gaps. Before launching new AI initiatives, conduct an internal audit of governance controls, data management practices, and regulatory readiness to identify gaps that could delay projects or increase compliance risk as adoption scales. |
Local AI Agents Create Security Blind Spots |
Security teams may be overlooking a growing blind spot as AI agents move from the cloud environments to employee endpoints.
Locally hosted AI models and agents can run entirely on endpoints without generating the network traffic, API calls, or login events that many traditional monitoring tools rely on. As these agents gain access to files, sensitive data, and autonomous actions, organizations face growing visibility, compliance, privacy, and auditability risks.
Conduct an inventory of AI runtimes and model-hosting tools such as Ollama and LM Studio on corporate endpoints, then establish monitoring policies that track which AI processes are running and what sensitive data they can access. |
|
|
|
Are You Ready for AI Threats? |
AI is enabling threat actors to scale phishing, malware development, and other cyberattacks faster than ever, making threat intelligence essential for identifying emerging risks before they become active threats. |
How to be proactive with threat intelligence: |
-
Subscribe to trusted and industry-specific threat intelligence feeds to identify emerging AI-driven threats and relevant risks targeting your organizations.
- Monitor adversary TTPs and AI-driven attack trends, including phishing and social engineering campaigns.
- Integrate threat intelligence into security tools and threat-sharing communities to improve detection and risk prioritization.
|
Threat intelligence can provide the strategic visibility security teams need to shift from reactive defense to proactive risk management. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
