ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link
Cybersecurity researchers at Zenity Labs have disclosed a critical vulnerability in OpenAI's ChatGPT Workspace Agents, codenamed AgentForger, that could allow a single…
Tag: Microsoft
Police Dismantle Kratos Phishing Kit Targeting Microsoft 365 Sessions and Bypassing MFA
German and US law enforcement, in coordination with Indonesian authorities, have dismantled the infrastructure behind Kratos, a sophisticated phishing kit designed to…
Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents
A critical vulnerability in Microsoft's official Azure DevOps MCP server allows attackers to inject hidden HTML comments into pull request descriptions, which…
CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security…
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC
A critical remote code execution vulnerability in Microsoft SharePoint Server, CVE-2026-50522 (CVSS 9.8), is being actively exploited in the wild following the…
Bit2Watt Attack: Cloud Tenants Could Destabilize Power Grids Using Legitimate GPU Workloads
A new attack technique called Bit2Watt, detailed by researchers from Zhejiang University in a paper accepted to CHES 2026, demonstrates how a…
Open-Source Android AI Agents Vulnerable to Invisible Screen Text Attacks Leading to Host Code Execution
Researchers have demonstrated that open-source Android AI agent frameworks are vulnerable to a novel attack chain where invisible screen text can lead…
Semantic Kernel: Microsoft’s AI Orchestration SDK
Semantic Kernel is Microsoft's open-source SDK for integrating AI into applications. It was found on Kimsuky's infrastructure, likely for developing AI-powered tools.
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server exposed, allowing Rapid7 to recover a full toolkit of 1,048 files including lure templates, filename-spoofing…
HollowGraph Malware Uses Microsoft 365 Calendar Events Dated 2050 for C2 and Data Exfiltration
Group-IB has discovered a new espionage implant named HollowGraph that hijacks Microsoft 365 calendars for command-and-control (C2) and data exfiltration. The malware,…