SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Spring Ring Vishing Campaign Exploits Microsoft Teams to Target Corporate Networks

0
·1 views

A threat campaign dubbed Spring Ring uses fraudulent Microsoft 365 external tenants to impersonate corporate IT staff via Microsoft Teams chat and voice calls, according to a Unit 42 report published August 31, 2026. Attackers trick employees into granting remote access through RMM tools like Quick Assist or running malicious executables delivered via customized S3 URLs. In more advanced intrusions, the campaign deploys an obfuscated PowerShell RAT and attempts NTLM Relay attacks against domain controllers using the PetitPotam technique to escalate privileges. The attack chain can result in persistent access, hidden browser instances with sideloaded extensions, and lateral movement across internal networks, though NTLM Relay was blocked in observed cases. Security teams are advised to restrict external Teams communication, enforce RMM tool approvals, enable PowerShell and AMSI controls, and harden NTLM relay defenses including SMB signing.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Tutorial Shows How Federated Learning Can Train Fitness AI Without Sharing Raw Data

A developer tutorial published on DEV Community demonstrates how to build a privacy-preserving fitness AI model using Federated Learning and Edge AI techniques. The approach keeps sensitive health data — such as heart rate, GPS, and sleep metrics — on users' devices rather than uploading it to a central cloud server. Only encrypted mathematical model updates, not raw data, are shared with an aggregation server using the FedAvg algorithm. The tutorial uses open-source tools Flower (flwr) and PySyft to build a collaborative calorie-prediction model across multiple simulated users. The method is presented as a practical path toward HIPAA-compliant, trust-building health applications in community fitness ecosystems.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developers Cancel AI Coding Subscriptions Over Unpredictable Usage Limits

Developers on Hacker News have been publicly abandoning paid AI coding tools like Claude Pro and Codex, citing usage limits that run out faster than expected and without clear explanation. Multiple users reported exhausting their monthly allowances within minutes or hours of starting complex tasks, prompting mid-project switches to competing services. The core frustration is not the tightness of the limits but their illegibility — subscribers cannot predict how limits are measured or when they will run out, making planning impossible. Some users concluded that paying directly through usage-based APIs is more reliable than flat subscriptions, since per-token billing at least makes costs transparent and predictable. The pattern documented across the week's discussions points to a recurring cycle: a heavy user hits an invisible wall mid-task, and that friction — rather than model quality — is what drives the cancellation.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

ServiceNow Patches Four Critical Flaws Including Three CVSS 10.0 Vulnerabilities

ServiceNow has released patches for four severe security vulnerabilities affecting its AI Platform and Now Platform, three of which carry the maximum CVSS score of 10.0. The flaws include unauthenticated code injection via the GraphQL Composite Data API (CVE-2026-18885), a privilege escalation bug in configuration image upload processing (CVE-2026-18886), SQL injection in dynamic ORDER BY clauses (CVE-2026-74820), and a sandbox escape vulnerability (CVE-2026-6876). All four can be exploited remotely without authentication or user interaction, potentially allowing attackers to execute arbitrary code, manipulate databases, escalate privileges, and compromise integration credentials. No active exploitation has been confirmed in the wild as of the disclosure date. Organizations are advised to apply the available hotfixes immediately and restrict external access to ServiceNow administration, API, and upload endpoints.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

TerminalFix Malware Uses Fake CAPTCHA to Tunnel Into Corporate Networks via WebSocket

Microsoft has warned of a high-severity attack campaign called TerminalFix, disclosed on August 31, 2026, in which threat actors compromise websites to display convincing fake Cloudflare CAPTCHA pages that trick users into pasting malicious PowerShell commands into their terminals. Once executed, the malware extracts a ZIP archive, performs DLL side-loading through the legitimate LockScreenContentServer.exe, and reconstructs payloads hidden inside PNG image files using steganography. The infection establishes dual persistence via a Windows Run registry key and a 60-minute scheduled task, while also enumerating Active Directory and internal servers for reconnaissance. A Python-based reverse tunnel client then relays arbitrary TCP traffic over an encrypted WebSocket connection to an external command-and-control server, effectively turning the victim's endpoint into a pivot point into the internal network. Defenders are advised to enforce PowerShell Constrained Language Mode, block execution of known binaries from non-standard paths, and monitor for suspicious WebSocket connections to domains such as gitnow.dev.

0 comments Read more at DEV Community