Cloud & Identity
Passkeys aren't the panacea. Unit 42 details three attack paths — Pass-ta-key, Silver, and Golden — against Chrome's Google Password Manager cloud authenticator that let ordinary Windows malware sign into passkey-protected accounts with no fingerprint, PIN, or on-screen prompt.
Phishing
Kali365, the phishing-as-a-service kit the FBI flagged in May for stealing Microsoft 365 tokens past MFA, has broadened its targets to AWS, Okta, Xerox DocuShare and Russian services, Arctic Wolf reports — extending its core OAuth device-code phishing to far more of the stack.
Education Security
Matthew Lane, the hacker behind a massive intrusion into student information systems, admits to federal crimes, highlighting the fragile state of K-12 and collegiate data security. CHICAGO, IL — Matthew Lane, a 20-year-old former college student, has admitted to orchestrating one of the most expansive cyberattacks on the
Trending
EvilTokens abuses the Microsoft 365 device code flow: the victim enters a legitimate code on Microsoft's own genuine sign-in page, which is why URL-checking advice fails. Huntress has documented more than 340 organizations affected across five countries since mid-February 2026.