Attackers are finding new ways to blend in. |
From collaboration platforms and AI browser agents to cloud identity tricks and major breaches, today's stories show why visibility matters. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Zoom Fixes Account Takeover Vulnerability |
Zoom has patched a Windows vulnerability that could enable unauthenticated account takeover, along with three high-severity privilege escalation flaws. CVE-2026-53412 could allow unauthorized account access without valid credentials, while the remaining vulnerabilities enable privilege escalation after local access is gained.
|
Zoom did not report any active exploitation of the vulnerabilities at the time of publication.
Apply the latest patch, enforce MFA and least privilege, monitor for unusual Zoom authentication activity, and test incident response plans for account takeover scenarios. |
ClickLock Malware Traps Macs in Password Loop |
A new macOS malware campaign uses fake verification prompts to trick users before locking them out of key applications for days. Researchers found that ClickLock repeatedly shuts down key macOS applications while stealing passwords, session cookies, cryptocurrency wallet data, and other sensitive information.
More than 100 victims across 33 countries have been targeted and the campaign remians active in the wild. Train users to not paste unsolicited Terminal commands or enter passwords into unexpected prompts, and if ClickLock is suspected, immediately isolate the Mac, restart in Safe Mode, revoke active sessions from a trusted device, and reset account credentials. |
Claude for Chrome Flaw Exposes Gmail |
Researchers found flaws in Anthropic's Claude for Chrome that could let malicious extensions trigger Gmail, Google Docs, and Google Calendar actions without user interaction.
The vulnerabilities allow synthetic clicks to trigger trusted tasks, with organizations using the beta extension's "Act without asking" feature facing the greatest risk of unauthorized access. The findings highlight the growing need for stronger security controls as AI browser agents gain more access to enterprise applications and data.
Disable "Act without asking," audit browser extensions with access to Claude, enforce least privilege for AI browsing agents whenever possible, and continuously monitor extension permissions as part of your overall endpoint security program. |
|
|
|
What's your biggest browser security concern today? |
|
|
|
Yesterday's Pulse Check Results |
What's your biggest weakness when spotting scams? |
|
|
|
Security Tools You Can Use |
|
|
|
OAuth Spoofing Evades Entra ID Detection |
Researchers uncovered large-scale campaigns using OAuth client ID spoofing to enumerate Microsoft Entra ID accounts while evading common detection methods. Spoofed OAuth client IDs let attackers validate user accounts while leaving application names blank in sign-in logs, reducing visibility for defenders. |
Two separate campaigns targeting more than 3 million user accounts across thousands of Microsoft Entra tenants were identified, with both still active in the wild.
Monitor Microsoft Entra for blank application names and AADSTS700016 errors, enforce phishing-resistant MFA, and test identity-focused incident response plans. |
The Biggest Breaches of 2026 So Far |
TechRepublic ranked 2026's biggest data breaches so far, revealing attackers still rely heavily on compromised accounts and social engineering.
Breaches affecting organizations such as Instructure Canvas, Carnival, ADT, Panera Bread, and Aura exposed millions of records, disrupted services, and increased long-term phishing and identity theft risks. Despite their differences, the incidents shared a common pattern of attackers exploiting trusted brands and human error to access valuable personal data.
Treat every breach notification as a reminder to update passwords, enable phishing-resistant MFA, and closely monitor exposed and privileged accounts. |
|
|
|
Protect Your Cryptocurrency Accounts |
Cryptocurrency accounts remain a prime target for cybercriminals because transactions are difficult or impossible to reverse once funds are stolen. |
How to secure crypto accounts: |
- Enable phishing-resistant MFA, use a dedicated email address for crypto accounts, and monitor login activity, API keys, and security settings for unauthorized changes.
- Protect your assets and recovery information by storing cryptocurrency in a hardware wallet and keeping your recovery phrase offline in a secure location.
-
Access exchanges and wallets only through trusted bookmarks or verified URLs instead of links from emails, ads, or search results.
|
Combined, these steps can help reduce your risk of account takeover. | |
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
