Bank of America Phishing Email Delivers ScreenConnect Malware
Acknowledgments: Huntress wishes to acknowledge the contributions of Andrew Schwartz of the DE&TH team for his efforts in tracking remote monitoring and management (RMM) tool…
Category: ThreatIntelligence-IncidentResponse
Inside an Oracle Database SQL Injection Attack
Acknowledgments: Special thanks to Lindsey O’Donnell-Welch for contributions to this investigation and write-up. Background On July 27, 2026 Huntress was alerted to credential theft activity…
Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam
Acknowledgments: Special thanks to Anna Pham, Bryan Masters, and Jai Minton for their contributions to this investigation, improvements to detection signals, and write-up. TL;DR: Huntress…
Meet the Huntress MCP Server
Security data is only useful if you can get to it when you need it. For most partners and customers, that means logging into the…
CVE-2026-69414 ShieldBreak Zero-Day: No Patch, and CISA BOD 26-04 Gives You 14 Days
Executive Summary ShieldBreak (CVE-2026-69414) is a zero-day elevation-of-privilege vulnerability in the Microsoft Malware Protection Engine used by Microsoft Defender, allowing a low-privilege local attacker to…
Intelligence Insights: August 2026 | Red Canary
= trending up from previous month= trending down from previous month = no change in rank from previous month *Denotes a tie Four fresh faces:…
From Screen Share to Root Access: Breaking Down CVE-2026-43760 and CVE-2026-65400 on macOS
Acknowledgments: Special thanks to Bryan Masters and Stuart Ashenbrenner for their contributions to this investigation and write–up. TL;DR: If you’re running Screen Sharing on macOS…
Five Years, 88,000 Backdoors, and a Pair of Handcuffs: Inside the Global Manhunt That Ended in an Arrest
That’s the story we dug into on Episode 3 of _declassified, where John Hammond, Principal Security Researcher, sat down with Huntress CEO Kyle Hanslovan and…
Akira Hits Safe Mode: Ransomware Rebooting Around EDR
Acknowledgments: Special thanks to Dray Agha for his help in analysing this attack. Akira has become one of the most prolific ransomware operations and was…
CVE-2026-68820 Is in KEV. What BOD 26-04 Requires Now
Executive Summary CVE-2026-68820 is an actively exploited Windows vulnerability listed in CISA’s Known Exploited Vulnerabilities (KEV) Catalog, with a remediation deadline as suggested by CISA…
Oracle Critical Security Patch Update August 2026
Oracle addresses 925 CVEs in its August 2026 Critical Security Patch Update with 943 patches, including 154 critical updates. Key Takeaways The August 2026 Critical…
Fake Refund Scam Hits Shopify Shop App Users
Special thanks to Justin Cook and Matt Poto for their contributions to this investigation and writeup. Scammers are reimagining the classic fake refund scam with…