Weekly Threat Awareness ReportEntra ID RCE · SharePoint Bypass Exploited · Mirage2FA Session Theft

Microsoft SharePoint - Security Feature Bypass

Weak Authentication  ·  No credentials required · Network  ·  Actively exploited

A high-risk vulnerability rooted in weak authentication mechanisms within Microsoft SharePoint lets an unauthorized attacker bypass the security features protecting the system, gaining access over a network without valid credentials. Any organization using SharePoint for data management is at risk, and a successful breach could lead to significant data theft, operational disruption, and severe reputational damage. Sophisticated groups including TA505, Bookworm, Mustang Panda, and COBALT DICKENS have been linked to this activity. With public exploit code available on GitHub and significant discussion on social media, the risk of widespread attack is extremely high.

WordPress Login Screen - Cross-Site Scripting

Cross-site Scripting (CWE-79)  ·  Remote  ·  Fixed in 7.0.3, backported to 4.7

A high-severity cross-site scripting flaw in the WordPress login screen lets an attacker inject malicious code into the login page to trick an administrator or user into running unintended commands - and from there, escalate a simple web-based attack into full control of the site. It is being actively exploited in the wild, with numerous proof-of-concept exploits circulating online. Advanced persistent threat groups including Kimsuky, APT37, and UNC6671 have been linked to the threat environment, marking it as a high-priority target for sophisticated attackers. WordPress has released version 7.0.3 and has also shipped security patches for all older versions dating back to 4.7.

Mirage2FA - Telegram-Sold PhaaS Kit Bypassing Microsoft 365 MFA

Mirage2FA is a Phishing-as-a-Service kit sold on Telegram that hijacks Microsoft 365 sessions through an Adversary-in-the-Middle (AiTM) proxy, stealing credentials, MFA responses, and session tokens. Delivery relies on HTML smuggling, fake CAPTCHAs, and cloned Microsoft login pages. The kit does not defeat MFA directly - it captures the authenticated session cookie created after a successful MFA challenge, inheriting the session MFA was meant to protect. ANY.RUN logged 9,426 targeted mailboxes and 4,532 likely compromised across 94 countries, mostly in the US. Session theft dominates the outcome mix: of 9,332 potential compromise events, 4,561 were cookie theft, 3,044 password/2FA captures, and 1,339 SSO logins - a kit optimized for durable account takeover rather than one-shot credential resale. Attribution is commercial-criminal, not nation-state: the platform runs as a multi-tenant, Telegram-managed service (tracked in underground telemetry as LinXcoded), so many downstream actors run campaigns off the same core kit. OSINT artifacts - Telegram bot references in the JavaScript, a .my.id domain, and ASN registration records - point to the aliases LinXcoded and zxcoder; these are operator-linked indicators, not confirmed identity attribution.

Evooo1Bot - Mirai-Based Modular Botnet Targeting Internet-Facing Devices

Evooo1Bot is a previously undocumented Linux botnet family that reuses the DDoS engine from the publicly leaked Mirai source code and wraps it in a far more modular framework. Its name comes from the hardcoded string "evooo1" found in every binary, and FortiGuard Labs documented the family in August 2026. Observed distribution is concentrated in North America, Europe, and Asia, with a smaller share in South America, and targeting patterns are consistent with automated vulnerability scanning and per-CVE payload selection. Pairing SSH brute-forcing with CVE exploitation gives the operator two growth paths: opportunistic spread through weak credentials, and targeted compromise of unpatched systems.