Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
Passkeys are a major step forward in authentication, but protecting a credential is only part of protecting an account. Attackers can still target enrollment, recovery,…
Category: ThreatIntelligence-IncidentResponse
ClickFix to BEC in 24 Hours: Tragic Quadrant
Most cyber threats start out small and unassuming before they turn into the OH $#!T moments that put your whole business at risk. They can…
Fake WatchGuard VPN Site Steals Credentials
Acknowledgments: Thanks to Stephanie Fairless and Andrew Brandt for their help in analysing this attack. Background A simple search on Google or Bing for a…
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Acknowledgements: Special thanks to Dipo Rodipe, John Hammond, Susannah Matt, Ben Nahorney, and Lindsey Welch for their contributions to this investigation and writeup. Update 10/8/26…
AI SOC automation: Inbox zero for your alert queue
For the last several months, we’ve been busy talking to security teams and building answers to the AI-accelerated challenges that you’ve told us you’re facing.…
Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack
Acknowledgments: Special thanks to Dray Agha for his extensive contributions to this investigation. Background In September, the Huntress agent was deployed on an organization that…
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
Background Threat actors frequently abuse legitimate platforms in their phishing attacks in order to bypass email security measures and increase the believability of the attack.…
SMB1001: How Huntress Maps to Each Tier
The cybersecurity industry failed SMBs. SMB1001 is the apology. Let’s be uncomfortable for a minute. For two decades, cybersecurity failed small- and medium-sized businesses (SMBs).…
How to mitigate shadow AI risks from employee citizen coders
AI tools let non-technical employees build workplace apps in minutes with natural language prompts. While these AI-generated apps boost productivity, they can create severe security…
Behind the tags: How Elastic SIEM grades 1,781 detection rules on noise, speed, and threat coverage
Of Elastic’s 2100+ prebuilt detection rules, 385 are tagged Profile: Recommended and 296 are tagged Aggressive. The rest (62% of the list) are deliberately left…
Qualys TotalAppSec Is Now FedRAMP High Authorized
Key Takeaways Qualys TotalAppSec is now FedRAMP High Authorized on the Qualys Government Platform (FedRAMP Certified Class D, package FR2231052341). Federal AI use cases more…
Companies Push AI Use But Skip Training and Official Policy
Many employees are using AI at work without formal training. 43% of knowledge workers—office employees whose jobs center on information rather than manual work—say their…