Huntress

Volume 343, Issue 4 · 9 articles from 3 issues

In This Issue

• M365 Token Spray and Replay Campaign Compromises Business Email Accounts
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware
• Huntress Tragic Quadrant Rates 'Pucker Factor,' Reveals RMM as Biggest Risk
• CMMC Level 2 Non-Negotiable Requirements Explained
• Passkeys Raise the Bar. Here's Where Attackers Can Still Get In.
• Reports of SIEM's Death Have Been Greatly Exaggerated
• Camera Management Software Compromise Leads to Malware Deployment
• AI, Scripts, Operator: Inside the ConnectWise Attack
• Managed for Malice: How Attackers Turn MDM into Remote Access

M365 Token Spray and Replay Campaign Compromises Business Email Accounts (Huntress, Thursday, October 22nd, 2026)

Huntress tracked an M365 token replay campaign that hit 79 organizations with nearly 500 successful sign-ins. Read more

Amazon-Themed ClickFix Campaign Serves Up Finger-Licking Malware (Huntress, Wednesday, October 21st, 2026)

Huntress details an Amazon-themed ClickFix campaign using the finger utility to deliver Lumma Stealer and NetSupport. Read more

Huntress Tragic Quadrant Rates 'Pucker Factor,' Reveals RMM as Biggest Risk (Security Boulevard, Tuesday, October 13th, 2026)

Huntress maps attack tactics by prevalence and business impact, finding RMM tool abuse in 45% of endpoint incidents. Read more

CMMC Level 2 Non-Negotiable Requirements Explained (Huntress, Monday, October 12th, 2026)

Huntress explains which NIST 800-171 controls are non-negotiable under CMMC Level 2 self-assessments for defense contractors. Read more

Passkeys Raise the Bar. Here's Where Attackers Can Still Get In. (Huntress, Wednesday, October 14th, 2026)

Huntress explains how attackers still target enrollment, recovery, endpoints and social engineering despite passkeys. Read more

Reports of SIEM's Death Have Been Greatly Exaggerated (Huntress, Thursday, October 29th, 2026)

Huntress argues SIEM is not dead but the ingest-based pricing model is, and discusses AI and smarter logging strategy. Read more

Camera Management Software Compromise Leads to Malware Deployment (Huntress, Tuesday, October 27th, 2026)

Huntress reports attackers compromising camera management software for initial access, then sideloading malicious DLLs to deploy malware. Read more

AI, Scripts, Operator: Inside the ConnectWise Attack (Huntress, Monday, October 26th, 2026)

Huntress analyzes the ConnectWise Cloud Backup credential abuse, finding signs consistent with an AI agent using scripted tooling. Read more

Managed for Malice: How Attackers Turn MDM into Remote Access (Huntress, Wednesday, October 28th, 2026)

Huntress reports attackers abusing legitimate MDM platforms such as Hexnode and Rippling to deploy rogue RMM tools and keep remote access. Read more

More from Huntress · All section posts · This week