Full Daily Digest

The attack path involved compromised ConnectWise application identities, which allowed threat actors to gain unauthorized access to Microsoft 365 tenants. Nearly 1,000 Entra tenants were targeted, with 300 successful sign-ins. The absence of service principals in some tenants limited the attackers' access. ConnectWise responded by disabling seven application identities and revoking certificates, though previously issued access tokens remain valid until expiration. This incident underscores the importance of robust application credential management and monitoring. Mitigation steps include reviewing tenant sign-ins, disabling compromised applications, and investigating suspicious activities. Implementing Entra controls, such as restricting client secrets and limiting administrative roles, can further reduce the risk of credential misuse.

The Hacker News · 2026-10-18 · Incidents: ConnectWise suspends Cloud Backup service after attackers compromise Microsoft 365 tenants via unauthorized application identities.

The Ledger wallet implant highlights the growing sophistication of hardware-based attacks, targeting cryptocurrency users directly. The npm Trusted Publishing flaw underscores the risks of dependency chain vulnerabilities, where attackers can exploit abandoned repositories to inject malicious code. AWS's Strands Box offers a controlled environment for AI agent testing, mitigating risks associated with AI-driven automation. The surge in DDoS attacks reflects the increasing availability of attack tools, while the misuse of stolen AI API keys demonstrates the monetization of AI resources by cybercriminals. Android's scam alerts represent a proactive approach to combating social engineering attacks, leveraging AI to enhance user protection.

Help Net Security · 2026-10-18 · Incidents: Ledger wallet implant leads to $93M theft, npm flaw exposes 1,500+ packages, and DDoS attacks rise by 25% in 2026.