Attackers can force Android devices into a continuous boot loop using a specially crafted app that requires no permissions and only needs to be installed. [...]

SonicWall warned customers of two security flaws affecting end-of-life Global Management System (GMS) systems that will not be patched. [...]

Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. [...]

DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords. [...]

Hackers using stolen Microsoft Entra ID application credentials have accessed 27 organizations, including managed service providers and downstream customers.

The campaign, tracked as Key Eater, began November 1 and targeted approximately 45 application registrations across 18 organizations. More than 33 were authenticated successfully.

Investigators recorded 81 downloaded files and access to approximately 2,279 mailbox items, with visibility limited to organizations supplying Todyl telemetry.

Hackers Use Stolen Microsoft Entra ID Credentials

The attacker authenticated as application service principals using valid secrets rather than exploiting a Microsoft software flaw. Investigators also observed an Azure DevOps federated workload identity and replayed developer sessions.

Application authentication does not trigger user MFA prompts, while user-scoped Conditional Access does not govern app-only access. How the original credentials were stolen remains unknown; current and expired secret pairs suggest a file repository or live backend rather than internet-exposed configurations.

For nearly every credential, the operator requested an Azure Resource Manager token, followed by Azure Key Vault and frequently Graph, Storage, or Cognitive Services tokens.

Previously unused applications then authenticated within minutes. This sequence suggests vault contents supplied additional credentials, although Key Vault audit logs are required for confirmation.

The actor conducted 29 single-wildcard searches through Microsoft Graph across approximately 25 tenants before downloading SharePoint files at roughly one per second.

Collected documents included password lists, private keys, VPN profiles, MFA and remote monitoring API keys, backup-storage credentials, firewall configurations, and service-account maps.

MSP multitenant applications extended exposure into customer environments: one application swept 15 client tenants in approximately 10-second loops.

Partner Center tokens and delegated administration applications were also targeted, although one observed GDAP automation application failed to authenticate against customer tenants. These relationships expanded access beyond the initially targeted organizations.

Scripted clients accounted for 95% of sign-ins, producing bursts of 24 attempts within 10 seconds and retry intervals near 11 seconds. A downloaded connector archive preceded authentication by about 2.5 minutes.

Despite this speed, Todyl found no self-propagating worm. Extended pauses and changes to spoofed browser signatures indicated human direction.

AI-assisted automation remains a low-confidence possibility, and investigators assessed the activity as unrelated to October’s Storm-0940 ConnectWise campaign.

All confirmed malicious sign-ins, downloads, and token replays originated from 199[.]19[.]77[.]84, with distinctive user agents task177-f2267/1.0 and sait-tenant-deep/37346.

After detections, the operator moved to refresh-token replay; Conditional Access blocked every observed replay on November 3.

Defenders should examine failed service-principal authentication alongside successful events, particularly AADSTS7000215 errors preceding success. Separately documented OAuth client-ID spoofing illustrates why authentication failures also warrant investigation.

Containment requires removing compromised application credentials, disabling affected service principals where necessary, and rotating secrets exposed through vaults or downloaded documents.

Investigators recommend correlating Entra, Azure DevOps, Key Vault, Storage, and Microsoft 365 audit records, then reviewing MSP customer relationships.

User sessions, PATs, and SSH keys require separate revocation. No new consents, credentials, roles, or users established persistence in observed environments. Four AI-service tokens were issued, but issuance alone does not demonstrate resource abuse.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Hackers Use Stolen Microsoft Entra ID Credentials to Breach 27 Organizations and Steal Data appeared first on Cyber Security News.

Hackers are using ClickFix attacks to install Phexia, a modular macOS backdoor that steals passwords, collects browser data, and deploys cryptocurrency miners.

According to WithSecure’s investigation, the commercially sold malware has been used by multiple threat actors since at least late 2025, with infections increasing during 2026.

The attacks turn a simple Terminal command into persistent access. Victims are directed to fake verification pages that encourage them to copy and run commands. Public research links this delivery method to typosquatted websites and fake browser verification prompts.

WithSecure tracked changes through October 2026, including obfuscated AppleScript, updated persistence names, and additional command infrastructure. A major development was the adoption of Polygon smart contracts to locate command-and-control servers.

Phexia Malware Steals Passwords

Across infections where WithSecure could observe initial execution, the attack began inside Terminal. A command downloaded a shell script using curl and passed its contents directly to bash.

The script launched an AppleScript dropper through osascript. That dropper created a LaunchAgent under ~/Library/LaunchAgents, allowing the malware to restart after its loader stopped.

The loader remained encoded inside the LaunchAgent configuration rather than being saved as a separate readable script. At execution, bash decoded the embedded content and passed it to osascript.

Next, the loader queried public Polygon services to retrieve the current command server address from a smart contract.

This technique, known as EtherHiding, lets attackers change infrastructure without replacing the installed loader. The blockchain stores the server pointer, not the malware payload itself.

October builds used LaunchAgent labels beginning with com.Apple., followed by random lowercase letters. WithSecure also found that reinfection could leave older agents active, allowing multiple builds to communicate with different servers simultaneously.

Phexia’s backdoor validates account passwords using dscl . authonly and saves valid credentials in ~/.passphrase. Public analysis documented a fake “System Preferences” dialog designed to obtain the user’s Mac password.

WithSecure observed password capture within minutes in some cases, while other attempts began about 22 hours after infection. Because passwords appeared directly in command arguments, security logs could also contain exposed credentials.

The stealer modules collected browser cookies, saved login databases, history, browser encryption secrets, and the login keychain.

They also copied LastPass and NordPass extension stores. Wallet directory checks showed discovery activity, but did not independently prove wallet contents were stolen.

Collected files were compressed into ZIP archives and uploaded to command servers. A second upload sent the same archive to 62.60.226[.]50 over unencrypted HTTP.

Operators also deployed XMRig through ledger and shell task responses. WithSecure observed repeated downloads, miner restarts, and changes to mining pools and wallet addresses.

Indicators of Compromise

Type	Indicator	Context
Polygon smart contract	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0	C2 resolver observed from June through October 2026
Polygon smart contract	0x3445fB8Df432320251f611e691fe6B0C6664C960	Used by a build installed on October 27, 2026; resolved to dhsbdgs[.]icu

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team 

The post Hackers Use ClickFix Attacks to Install Phexia Mac Malware That Steals Passwords and Mines Cryptocurrency appeared first on Cyber Security News.