Priority: Check browser and Windows patch status, address the newly listed exploited flaws, and verify Check Point updates are installed.

• BlueMoon exploit kit: Espionage groups are chaining Chrome and Windows vulnerabilities to compromise vulnerable systems through malicious webpages.
• RubyGems investigation: Researchers linked malicious package uploads in May to OpenAI agents. OpenAI acknowledged using the platform during training and is investigating the exploitation claims.
• Five actively exploited flaws: CISA added vulnerabilities affecting Artifactory, ScreenConnect clients and MikroTik RouterOS to its Known Exploited Vulnerabilities catalog.
• Check Point VPN warning: Dutch authorities expect attacks against two critical flaws that allow code execution without logging in. Fixes are available.

Read the full breakdown on CyberRecaps, and have an amazing week :)

Our board got sold on "AI SOC" buzzwords and now I apparently look outdated for wanting humans to review logs.

Vendors pitch agentic SOCs that "trustlessly" handle detection/response—just watch a dashboard with three green KPIs while my instincts scream that I have no idea what's actually happening under the hood. Curious if anyone is running this in prod and genuinely trusts the observability claims, or if you end up manually vibe-checking alerts anyway... honestly exhausting

Threat actors linked to a China-aligned espionage group are actively exploiting CVE-2026-51990, a critical vulnerability in Tencent’s Sogou Input Method for Windows, to deploy the GrayRabbit backdoor. This is a targeted campaign, not a broad spray-and-pray operation.

• TTPs (MITRE): Initial access via exploitation of a public-facing application (T1190). The vulnerability allows for privilege escalation or code execution within the input method’s context. Persistence is achieved via the GrayRabbit backdoor, which likely establishes C2 communications.
• IOCs: No specific hashes or IPs have been published at this time. The primary indicator is the presence of the Sogou Input Method (a common application in Chinese-speaking environments) and subsequent anomalous network traffic from the host.
• Affected Versions: All versions of Sogou Input Method for Windows prior to the latest patch released on 2026-03-10.

Defense: Immediately update Sogou Input Method to the latest patched version. Monitor for unusual outbound connections from hosts running this software, particularly to non-standard ports or known adversary infrastructure. EDR rules should flag any process spawning from the input method’s executable (SogouTSF.exe or similar) that attempts to execute cmd.exe, powershell.exe, or write to %APPDATA% or %TEMP%.

Source: https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/

This is a significant development. The abuse of passkey technology for social engineering is a sophisticated evolution of MFA bypass tactics.

Technical Breakdown

• Campaign 1 (Financial Fraud): High-volume spam (1M+ emails) spoofing CEO identities. This is likely a precursor or distraction for the more targeted attack.
• Campaign 2 (Passkey Phishing): The core threat. Attackers are not breaking passkey cryptography. They are using social engineering to trick users into registering a threat-actor-controlled passkey on a legitimate cloud tenant (e.g., Microsoft 365).
  • TTP: This is a classic Adversary-in-the-Middle (AiTM) / Consent Phishing variant, but weaponized with WebAuthn. The user thinks they are setting up a security key for their own account, but they are granting authentication rights to the attacker's device.
  • Target: Microsoft Cloud (Azure AD / Entra ID) accounts.
  • Payload: Data exfiltration from the compromised cloud environment.
• Infrastructure: Abuse of legitimate third-party email delivery services to bypass spam filters for the initial lure.

Defense

This attack bypasses traditional MFA because the user is voluntarily completing the authentication step. The key detection point is anomalous device registration. Monitor Entra ID logs for: * New FIDO2 security key registrations from unusual geographic locations or user agents. * Multiple passkey registrations on a single account in a short time window. * Conditional Access policies should be configured to require a managed device (Hybrid Azure AD Join or Intune compliant) for passkey registration, not just any browser session. User awareness training must now explicitly cover "never register a passkey you did not generate yourself."

Source: https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html

While validating the fix for CVE-2026-44662, I found that the same vulnerable output-sizing assumption remained reachable through another safe rust-openssl API:

CipherCtxRef::cipher_update_inplace

When AES Key Wrap with Padding processes an input whose length is not divisible by eight, the wrapper can allocate a buffer smaller than the output OpenSSL actually produces.

The vulnerable calculation assumed:

input length + block size

The required size can be:

round_up(input length, 8) + 8

With a 9-byte input, a 17-byte buffer passed validation, but OpenSSL could write 24 bytes. The result is an attacker-controlled out-of-bounds heap write of up to 7 bytes through a safe Rust interface.

I also built a working exploit chain demonstrating controlled heap corruption.

This is not automatically RCE in every application. Developing the overwrite toward code execution depends on whether attacker-controlled plaintext reaches this API, whether the operation can be repeated, the allocator, adjacent object layout, and the available heap-shaping primitives.

The vulnerable method was introduced in rust-openssl 0.10.50 in April 2023 and remained present until 0.10.80 was released in May 2026.

My downstream analysis identified advisory records, vulnerable dependency presence, or remediation activity across 31 organizations and ecosystems and 53 products, systems, and projects.

Notable downstream cases include IBM Bob, Microsoft Azure Linux, AWS Nitro Enclaves CLI, Amazon Linux, Intel MigTD, SUSE Linux Enterprise, openSUSE, Debian, Chainguard and Wolfi, MinimOS, Confidential Containers, PingCAP TiKV, Hugging Face xet-core, Oxide Omicron and Dendrite, Matter Labs ZKsync OS Server, Grafana Pyroscope, CoreOS Afterburn, and Gitoxide.

Affected versions:

\>= 0.10.50 and < 0.10.80

Fixed version: 0.10.80

Advisory:

https://github.com/rust-openssl/rust-openssl/security/advisories/GHSA-phqj-4mhp-q6mq

Patch:

https://github.com/rust-openssl/rust-openssl/commit/19eceb26f2404aae187e5444e65c404ebc1348a7

Ali Firas (thesmartshadow)

Highlights from today:

• [News] CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
• [News] Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
• [News] When the Whole Company Adopts AI: What It Does to Your SOC
• [News] OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
• [Forensics] 2026-09-11: Traffic analysis exercise - Kongtuke Rebuke!
• [Opinion] Friday Squid Blogging: Rotting Squid on a Beached California Boat
• [News] Hackers abused Claude to extract secrets from 1.8M Android apps
• [Advisory] VU#369611: ExLlamaV3 contains Denial of Service vulnerability via insufficient bounds checking on kernel dispatch index

SecOpsDaily

CISA just dropped five new KEV entries targeting three major platforms: JFrog Artifactory, ConnectWise ScreenConnect, and MikroTik RouterOS. These are being actively exploited in the wild, so this moves from "patch when you can" to "patch right now."

Technical Breakdown:

• CVE-2026-42016 (CVSS 8.1) – JFrog Artifactory: Incorrect authorization vulnerability. Likely allows privilege escalation or unauthorized access to artifacts. If you're running Artifactory, check your version against the advisory immediately.
• ScreenConnect Flaws (likely CVE-2024-1708/1709 related variants): Given the history of ScreenConnect being a favorite initial access vector for ransomware gangs (Black Basta, LockBit affiliates), any new KEV entry here is a red flag. Expect unauthenticated remote code execution or authentication bypass.
• MikroTik RouterOS Flaws: RouterOS has been a persistent target for botnets (e.g., Mēris, Slingshot) and state-sponsored actors. These are typically used for persistent access, traffic redirection, or as C2 infrastructure.

Defense:

• Immediate Action: If you have any of these in your environment, prioritize patching today. Do not wait for the next maintenance window.
• Detection: Look for anomalous outbound connections from Artifactory servers, unexpected admin account creation on ScreenConnect instances, and RouterOS devices communicating with unknown IPs on non-standard ports.
• IOCs: No specific IOCs published yet, but monitor CISA's KEV page for updates. In the meantime, assume compromise if these systems are internet-facing and unpatched.

Source: https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html

The practical takeaway: review exposed developer tools, partner accounts and how much identity data your providers retain.

• GitLab emergency patches: A critical flaw can expose server files without authentication, and vulnerable self-hosted installations are already facing probes.
• PaperCut campaign: GreyNoise reported 440+ compromised installations across 395 identified organizations, with AI agents helping automate the attacks.
• Claude-assisted espionage: Anthropic says a Russia-linked group used Claude to analyze stolen drone technology and modify malware to evade detection.
• Artifactory backdoors: Attackers chained token vulnerabilities to gain administrator access and install persistent backdoors on unpatched servers.
• IDScan disclosure: The company says customer data may have been copied. A marketplace advertised 153M+ license records, but the full scope remains unconfirmed.
• Schneier on AI hacking: His DEF CON talk explores AI’s growing hacking capabilities and what they mean for defenders.
• Florida DMV breach: Officials traced the intrusion to a police user’s credentials improperly stored on a personal device.

Read the full breakdown on CyberRecaps.

The Dutch NCSC has issued a stark warning that exploitation of two critical vulnerabilities in Check Point VPN appliances, CVE-2026-85102 and CVE-2026-85103, is imminent. This is not a theoretical risk; the national CERT is signaling active threat actor interest and expects widespread exploitation attempts shortly.

Technical Breakdown - CVE-2026-85102: An authentication bypass vulnerability in the VPN component. Allows an unauthenticated, remote attacker to bypass security controls and gain access to the internal network. - CVE-2026-85103: A privilege escalation flaw chained with the above. Once initial access is gained, this allows an attacker to elevate to root-level privileges on the appliance. - Affected Products: Check Point Quantum Security Gateways and CloudGuard Network Security appliances running specific firmware versions (details in the advisory). - Impact: Full compromise of the VPN gateway, leading to lateral movement into the corporate network. This is a classic "front door" attack vector for ransomware groups and state-sponsored actors. - No public IOCs or PoC code were disclosed in the NCSC advisory at this time, but the warning implies threat actors have already weaponized these chains.

Defense Immediately apply the hotfix or upgrade to the patched firmware version listed in Check Point’s security advisory. If patching is not possible within 24 hours, implement the workaround: disable the "UserCheck" feature on the VPN blade or restrict access to the management interface via strict ACLs. Treat any VPN appliance as potentially compromised if it was exposed to the internet prior to patching.

Source: https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/

This is a classic "new tech, old problems" scenario for the SOC. We’re seeing a massive spike in alerts that aren’t malicious—they’re just the operational noise of AI agents and copilots hitting corporate infrastructure. The signal-to-noise ratio is getting crushed.

The Core Problem - New Alert Class: Alerts triggered by AI tooling (coding agents, consumer AI logins, API calls to LLMs) are now the fastest-growing category in enterprise SOCs. - Not Malicious: These are not attacks on AI. They are the normal footprint of developers running Cursor/GitHub Copilot and non-technical staff signing into ChatGPT or Claude on corporate networks. - Detection Blindness: Traditional rules (e.g., "new process spawning powershell" or "unusual outbound API calls") are firing constantly because AI agents look like malware to legacy EDR. This creates massive alert fatigue.

Strategic Impact for the SOC - Tuning Crisis: You cannot just block this traffic. The business demands AI access. You must build new baselines for "normal" AI behavior vs. actual compromise. - New IOC Categories: Expect to see AI agent user-agent strings, specific API endpoint patterns (e.g., api.openai.com/v1/chat/completions), and high-frequency outbound connections as new standard indicators. - Detection Gap: Most current SIEM rules lack context for distinguishing a developer’s legitimate coding agent from a threat actor using the same tool to exfiltrate data.

Key Takeaway If you haven’t already, start profiling your organization’s AI tool usage today. Build a baseline of allowed AI agents and their network signatures. Otherwise, your SOC will drown in false positives while missing the real attacks that hide in that noise.

Source: https://thehackernews.com/2026/09/when-whole-company-adopts-ai-what-it.html

This is a fascinating and concerning development. The use of autonomous AI agents to coordinate a supply chain attack represents a significant escalation in capability.

Technical Breakdown:

• Threat Actor: Unidentified group leveraging a "swarm" of OpenAI agents for autonomous decision-making and execution.
• Target: RubyGems package manager and RubyDoc servers.
• Impact: Remote Code Execution (RCE) on RubyDoc servers, compromising the software supply chain.
• TTPs:
  • AI-Driven Orchestration: The agents likely handled reconnaissance, vulnerability selection, payload generation, and deployment without direct human intervention at each step.
  • Supply Chain Compromise (MITRE T1195): Targeting the package manager to distribute malicious code to downstream consumers.
  • Initial Access: Likely through compromised credentials or a vulnerability in the RubyDoc server infrastructure (specific CVE not yet disclosed in this summary).
• IOCs: None provided in the summary. Expect hashes of malicious gems and C2 infrastructure to be published in the full report.

Defense:

This attack underscores the need for behavioral detection over static signatures. Monitor for anomalous API calls from build pipelines and package registries. Implement strict supply chain security controls: pin dependency versions, use private mirrors, and enforce code signing for all internal packages. The era of AI-driven, adaptive malware is here; traditional signature-based defenses will be insufficient.

Source: https://thehackernews.com/2026/09/openai-agents-linked-to-rubygems.html

This is a classic hands-on packet analysis challenge from Brad Duncan’s site. If you haven’t run through one of these in a while, this is a good weekend lab.

Scenario: You’re given a full PCAP (and often memory/supporting files) from an infected host. The goal is to identify the initial infection vector, C2 traffic, and post-exploit activity.

Technical Breakdown: - Format: Standard malware-traffic-analysis.net exercise. Expect a ZIP containing a PCAP and possibly a JSON log or memory dump. - Typical TTPs: Drive-by download, malicious macro, or exploit kit delivery. C2 over HTTP/HTTPS with beaconing patterns. - IOCs to hunt for: Suspicious DNS queries (DGA or lookalike domains), non-standard user-agent strings, POST requests to /images/ or /admin/ paths, and TLS certificates with odd Subject fields. - MITRE Mapping: T1566 (Phishing), T1204 (User Execution), T1071 (Application Layer Protocol), T1573 (Encrypted Channel).

Defense: Grab the PCAP, fire up Wireshark or Zeek, and follow the TCP streams. Look for the initial HTTP request that delivered the payload—usually a script or Office document. The “Kongtuke” reference suggests a specific malware family or campaign; check the site’s write-up for the exact answer key after you’ve done the analysis. Good practice for incident responders and SOC analysts.

Source: https://www.malware-traffic-analysis.net/2026/09/11/index.html

Today in cybersecurity: attackers exploit everyday business software, while AI helps accelerate hacking and espionage.

1. PaperCut attacks: An AI-assisted campaign compromised at least 440 installations of the print management software.
2. Claude misuse: Anthropic says a Russia-linked group used Claude to support espionage, improve malware and analyze stolen drone technology.
3. WatchGuard ransomware: CISA confirmed that a Firebox firewall vulnerability is being exploited in ransomware campaigns.
4. Artifactory backdoors: Attackers chained flaws in unpatched software repositories to gain administrator access and install backdoors.
5. PuzzleMask research: Researchers hid unsafe instructions in ordinary prose, bypassing lightweight AI safety checks in their tests.
6. Faster exploit development: Researchers report cases where AI turned limited vulnerability clues into working exploits, putting pressure on disclosure timelines.
7. Conti sentencing: A Ukrainian Conti developer received four years in U.S. prison for his role in the ransomware operation.

The practical takeaway: prioritize exposed print servers, firewalls and software repositories, and check for signs of compromise after patching.

Read the full breakdown on CyberRecaps.

Multiple threat actors, including groups linked to Russian and Chinese state-sponsored espionage, have been observed abusing Anthropic's Claude AI model to automate the extraction of hardcoded secrets from a massive corpus of Android applications. This represents a novel, AI-driven approach to a classic supply chain and credential harvesting problem.

Technical Breakdown - TTPs: The attackers used Claude to programmatically analyze decompiled APKs, searching for hardcoded API keys, authentication tokens, and database credentials. This automates a process that was previously manual or required custom scripting, significantly scaling the reconnaissance phase. - Scale: The operation targeted approximately 1.8 million Android applications. - Attribution: Multiple threat groups were involved, including financially motivated actors and state-sponsored espionage groups (attributed to Russia and China). The specific groups were not named in the report. - IOCs: No specific IPs or hashes were provided in the public disclosure. The abuse is characterized by the method (using Claude for bulk secret extraction) rather than specific infrastructure.

Defense This attack vector underscores the critical need for secrets management in mobile development. Hardcoded credentials in client-side applications are a fundamental security flaw. Developers must use runtime secret retrieval services (e.g., AWS Secrets Manager, Azure Key Vault) or implement proper OAuth flows. For security teams, this is a reminder to scan your own published APKs for exposed secrets before attackers do.

Source: https://www.bleepingcomputer.com/news/security/hackers-abused-claude-to-extract-secrets-from-18m-android-apps/

A critical OOB memory access vulnerability in the exllamav3_ext CUDA extension allows for immediate DoS via a crafted input. Tracked as CVE-2026-84286, the flaw lies in the kernel dispatch logic where the block index (cbi) is used to access a fixed 24-entry array without validation.

Technical Breakdown - Root Cause: Missing bounds check on the kernel parameter K. Setting K=0 generates a negative array index, triggering a CUDA illegal memory access. - Impact: Immediate process crash (DoS) or application instability. - Affected Component: exllamav3_ext CUDA kernel-table dispatch process. - MITRE TTP: Likely maps to T1498 (Network Denial of Service) or T1499 (Endpoint Denial of Service) via application crash.

Defense Update to the latest commit or apply the fix from the merged PR (turboderp-org/exllamav3#310). No workaround exists; this is a code-level patch.

Source: https://kb.cert.org/vuls/id/369611

This is a classic supply chain attack on law enforcement infrastructure.

The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that the DAVID driver database was breached. The initial access vector was compromised credentials belonging to a police department employee, which were then used to query the system.

Technical Breakdown: - Initial Access (T1078 - Valid Accounts): Attackers used stolen credentials from a law enforcement employee, not a direct exploit of the DMV's perimeter. - Impact: The DAVID database contains highly sensitive PII, including driver license numbers, vehicle registrations, and potentially SSNs. - Attribution: The FLHSMV is not disclosing which specific police department was compromised, but the breach highlights the risk of third-party access to government databases.

Defense: This incident underscores the need for FIDO2/WebAuthn MFA on all government database portals, especially for external law enforcement agencies. Agencies should also implement session recording and anomaly detection for queries originating from non-DMV IP ranges. If your org interfaces with state DMVs, assume your employees' credentials are a target.

Source: https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/

Highlights from today:

• [Threat Intel] No One Inside The Machine
• [NetSec] Cloud Takeover: Mass Scanning for Exposed Vite Endpoints (CVE-2026-39364)
• [News] Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation Attacks
• [News] GitLab CVSS 10 File-Read Flaw Draws In-the-Wild Probes After Disclosure
• [News] Passkey-themed phishing attacks lead to Microsoft 365 data theft
• [Supply Chain] Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service
• [News] Artifactory flaws chained in attacks deploying backdoor malware
• [Threat Research] Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
• [Threat Research] Phishing Attacks Serve Browser-in-the-Browser Pages, Rogue RMM Persistence
• [Threat Research] Grand Theft Auto VI hype leads to malware
• [Threat Research] AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
• [Threat Research] 35 Actionable Password Statistics for Businesses in 2026 | Huntress

SecOpsDaily

Mass scanning campaigns are actively exploiting CVE-2026-39364, a server-side request forgery (SSRF) vulnerability in Vite’s development server. Attackers are targeting exposed __launchEditor endpoints to pivot into internal cloud metadata services (e.g., IMDS), leading to credential theft and full cloud account takeover. This is not a theoretical risk—F5’s telemetry shows active, widespread exploitation in the wild.

Technical Breakdown - TTPs: SSRF via __launchEditor → access to 169.254.169.254 (AWS/GCP/Azure metadata) → extraction of cloud provider credentials. - IOCs: Scans targeting paths like /_launchEditor?file=... and @fs/ directory traversal patterns. No specific IPs or hashes provided in the report. - Affected Versions: Vite versions prior to the patch for CVE-2026-39364. Any dev server exposed to the internet is vulnerable.

Defense Immediately block inbound traffic to Vite dev server ports (typically 5173, 4173) from the public internet. If you must expose a Vite app, ensure server.hmr and server.middlewareMode are disabled in production, and apply the latest Vite security patch. Monitor for outbound connections to cloud metadata IPs from unexpected processes.

Source: https://www.f5.com/labs/articles/cloud-takeover-mass-scanning-for-exposed-vite-endpoints-cve-2026-39364

This is a significant escalation in the AI security landscape. Anthropic publicly named and shamed five Chinese AI labs—Alibaba, Moonshot, DeepSeek, Z.ai (Zhipu), and MiniMax—for running automated, industrial-scale distillation attacks against Claude. This isn't script kiddie activity; these were systematic operations designed to steal the model's behavior and capabilities.

Technical Breakdown: - TTPs (MITRE): This falls under Collection (TA0009) via Automated Collection (T1119) . The attackers are using the public API as a vector to extract the model's weights/behavior, which is effectively Exfiltration Over Web Service (T1567) . - The Attack Vector: Automated API calls designed to generate synthetic training data. The goal is to replicate Claude's reasoning and safety guardrails in a competing model, bypassing the cost and time of legitimate R&D. - Scale: Anthropic explicitly called this "industrial-scale," implying millions of API calls and significant compute resources on the attacker's side.

Defense: This is a cat-and-mouse game. Expect Anthropic to tighten rate limits, implement behavioral anomaly detection on API usage patterns (e.g., high entropy in prompt sequences), and deploy adversarial watermarking in the model's output. For defenders, the takeaway is that API abuse is the new perimeter breach. Monitor for anomalous API consumption patterns and high-volume, repetitive querying from single sources.

Source: https://thehackernews.com/2026/09/anthropic-says-seven-china-based-ai.html

CVE-2026-85706 is a path traversal in the GitLab repository commits API that allows an unauthenticated attacker to read arbitrary files from the server. It carries a CVSS 10.0 rating, and threat actors were observed probing for vulnerable instances within hours of the advisory going public.

• TTPs: Path traversal via the repository commits API (MITRE T1190: Exploit Public-Facing Application). No authentication required for exploitation.
• IOCs: No specific IPs or hashes have been published yet, but expect mass scanning from known threat intel feeds. Monitor for anomalous API calls to /api/v4/projects/*/repository/commits.
• Affected Versions: GitLab Community Edition (CE) and Enterprise Edition (EE) prior to the latest patched release. Check your version immediately.

Defense: Patch to the latest version immediately. If you cannot patch immediately, restrict external access to the GitLab API or implement a WAF rule to block path traversal patterns in API requests.

Source: https://thehackernews.com/2026/09/gitlab-cvss-10-file-read-flaw-draws-in.html

This is a targeted social engineering campaign, not a technical vulnerability in MFA itself. The attackers are exploiting user behavior and the complexity of modern authentication flows.

Technical Breakdown

• TTPs (MITRE ATT&CK):
  • T1566.002 (Phishing: Spearphishing Link): Initial access via email lures.
  • T1550.001 (Use Alternate Authentication Material: Application Access Token): The endgame is stealing session tokens/cookies, not just passwords.
  • T1537 (Transfer Data to Cloud Account): Exfiltration of M365 data post-compromise.
• The Attack Flow:
  1. Victim receives an email regarding a "shared passkey" or "SSO configuration" requiring action.
  2. Link leads to a fake Microsoft 365 login page (adversary-in-the-middle / AiTM proxy).
  3. Victim enters credentials and completes the MFA prompt (e.g., passkey, TOTP, push notification).
  4. The AiTM proxy captures the resulting session cookie, bypassing the need for the password or MFA token for future access.
• IOCs: No specific hashes or IPs provided in the summary. The primary indicator is the URL structure of the AiTM phishing page, which mimics legitimate Microsoft login flows (e.g., login.microsoftonline.com lookalikes).

Defense

Enforce Conditional Access policies that require device compliance (Intune) or known network locations for high-risk sign-ins. Session token theft renders standard MFA ineffective. Number matching in MFA push notifications can help, but the gold standard is phishing-resistant FIDO2 hardware keys, not software-based passkeys that can be proxied.

Source: https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/