Monthly Threat Report October 2026

Introduction

The Monthly Threat Report from Hornetsecurity by Proofpoint brings you monthly insights into M365 security trends, email-based threats, and commentary on current events in the cybersecurity space. This edition covers industry events from September 2026, carried through October 10. As a news and commentary edition, it includes no statistical sections this month and gives the space to research and incidents instead.

Executive Summary

• Microsoft published the SharePoint flaw CVE-2026-65660 as medium-severity spoofing at CVSS 6.5, then on August 27 rewrote its own CVE record to describe remote code execution and raised its score to 8.8. Attacks began on September 24, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on September 25 with federal remediation due in three days.
• Microsoft’s Digital Crimes Unit and a partner coalition announced on September 22 that they had disrupted the EvilTokens phishing service, taking 50 websites and more than 150 supporting domains under a court order from the Eastern District of Virginia. The subscription service, which paired device code phishing with an artificial intelligence (AI) assistant for triaging stolen mailboxes, had reached more than 12,000 inboxes at over 10,000 organizations since February.
• Previdian reported attempts against the Atlassian file read flaw CVE-2026-21589 (CVSS v4.0 9.3) within two hours of a public proof of concept. Reading files requires no authentication, and where Jira defers to Crowd, the files potentially can include plaintext Crowd credentials.
• Proofpoint tracked a spraying campaign across 5,714 Microsoft 365 accounts in 28 tenants that compromised seven, every one a functional account with no prior sign-in by a person. Proofpoint believes each still used its original or an easily guessed password, and none had multi-factor authentication (MFA) enforced.

Threat Overview

Seven Accounts, and Not a Person Among Them

On September 22, Proofpoint published an analysis of a password spraying campaign it tracks as UNK_CondorFiltration, which worked through Microsoft 365 tenants in Latin America, almost all of them Chilean, from July 21 to August 16. The totals: 32,825 authentication events, 5,714 unique accounts, 28 tenants, 1,487 source addresses on AWS EC2, and seven accounts compromised.

Again, seven accounts compromised and none showed a prior legitimate user session anywhere in Proofpoint’s telemetry. These were functional accounts, standing behind a ticket queue, a till, or a supplier payment run, and by Proofpoint’s reading each still held the password set at creation, or one just as easy to guess. None had MFA enforced. Six fell within seven minutes of each other. Against staff accounts, whose owners must change their passwords, the same spraying produced nothing Proofpoint could confirm.

Automation made the attempt nearly free. Melvin Langvik wrote TeamFiltration as a Microsoft 365 penetration testing tool. It checks whether an address is real by querying the Teams API, roughly 300 times a second, and never trips lockout. Spray traffic hops between AWS regions through FireProx, which is how the campaign used 1,487 addresses and kept IP blocklists a step behind. After a password lands, the tool can pull mail and files on its own, although Proofpoint cautions that sign-in records by themselves do not prove any data left.

All seven compromises came on August 14 and 15, in the campaign’s last burst, against a large Chilean retailer that absorbed 78.3% of the observed events. On the account Proofpoint walks through in detail, the operator moved to German VPN infrastructure and tried the victim’s corporate VPN within a minute, where MFA or Conditional Access turned it away. Azure Portal and SharePoint Online sessions followed, and about 25 minutes after the first sign-in a request went out for a Microsoft Graph token. Opening the Azure Portal prompted the attacker to enroll in MFA, the clearest sign that none was configured.

Why It Matters

Seven from 5,714 is a poor hit rate, and every success landed on an exception. All seven sat in one organization, so this is one tenant’s provisioning habit and not a pattern measured across all 28. The habit is ordinary, though, which is why it generalizes. Controls that protect a person tend to break a scheduled job, the fix is an exemption that outlives whoever asked for it, and the account keeps every permission its work ever needed.

So “no interactive sign-ins in 90 days” does not mean an account is dormant. It equally describes an account doing exactly its job, on a credential untouched since provisioning, outside every policy you enforce on staff.

The Sign-In Page Is Real, the Session Is Not

On October 1 we published a breakdown of EvilTokens and device code phishing, the technique behind the platform whose disruption Microsoft announced nine days earlier. Our August edition covered the same flow in the hands of a single phishing kit. By September it had a price list.

The OAuth protocol includes a device authorization flow for equipment with no practical way to type a password, such as meeting room hardware. The screen displays a code, someone types it into a browser on a phone or laptop, and the token goes to the screen. Device code phishing changes only who holds that token. The attacker starts the flow, a business-themed lure sends the victim to a page that generates a live code, and the victim enters it at Microsoft’s real sign-in page, hxxps://microsoft[.]com/devicelogin, clearing MFA if asked. The token lands in the attacker’s session, which then reads mail, plants inbox rules, and maps the organization through Microsoft Graph.

Why It Matters

Nothing here is spoofed. The domain is Microsoft’s, the certificate is valid, and the rightful owner satisfies the second factor in person, for a session they never started. A decade of training about inspecting the address bar has nothing left to act on.

In August this was one kit running 34 lure templates. September added a subscription tier and a support channel, handing the attack to buyers who could never have built it.

The control is the same either way. Entra ID Conditional Access can restrict the device code flow, and the honest version of that policy is an allowlist: name the devices that need it, scope a policy to them, and deny the flow everywhere else. For most organizations that list is short, and for some it is empty.

Major Incidents and Industry Events

Microsoft and Partners Take EvilTokens Off the Air

Microsoft’s Digital Crimes Unit (DCU) announced on September 22 that it had disrupted the EvilTokens service under authority from the US District Court for the Eastern District of Virginia, with Health-ISAC as co-plaintiff, seizing 50 websites and disabling more than 150 domains behind them. Microsoft’s threat intelligence write-up covers the technical side, and both Bleeping Computer and The Hacker News reported the action. Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs contributed.

The service went on sale over Telegram in February 2026. Microsoft gives the price as $1,500 up front plus $500 a month, with separately priced add-ons such as an antibot redirector and bulk mail senders. The base kit offered 44 lure themes, spanning e-signature requests, Microsoft and third-party cloud services, invoices, voicemail alerts, and eFax notices. Links hopped across compromised but otherwise legitimate websites and ended on serverless hosting that reputation filters tend to trust, mostly Vercel (hxxps://*[.]vercel[.]app), Cloudflare Workers (hxxps://*[.]workers[.]dev), and AWS Lambda.

Buyers were paying for the AI tooling. Before a campaign, an assistant tailored mail to a named target. After a compromise, a chatbot summarized and translated the victim’s mail then answered the questions a fraudster asks first: which threads involve money, who can release it, which supplier bills are outstanding, and whose name to borrow.

Microsoft counts more than 12,000 inboxes at more than 10,000 organizations, and SpyCloud separately recaptured phished data covering 8,708 accounts across 6,585 corporate domains in 79 countries. Coinbase traced about $1.1 million in payments through four Tron addresses, a measure of operator revenue and not of victim losses. Officers from the Metropolitan Police Service detained two suspected operators, aged 32 and 38, in London on September 11, and both are out on police bail while inquiries continue.

Why It Matters

Microsoft calls this a disruption of infrastructure and concedes that the business model will survive it. For $1,500 and a monthly fee, a customer with no particular skill bought a technique that defeats URL inspection and survives MFA, with the mailbox reconnaissance already automated on top. Our August analysis of AI-accelerated cyber threats argued that AI’s near-term effect on attacks is economic, and for the second consecutive edition that argument has turned up inside a live operation. Working out who approves invoices used to be the slow, expensive, human part of business email compromise. Here it was handled automatically.

A SharePoint Flaw Filed as Spoofing, Reclassified as Code Execution

CVE-2026-65660 shipped in Microsoft’s August 11 updates as a spoofing bug at CVSS 6.5, reported by Dinh Ho Anh Khoa of Viettel Cyber Security. On August 27 Microsoft edited its own CVE record to describe remote code execution and raised the score to 8.8. The code injection classification (CWE-94) had been on the record from the start, attached to a description that said spoofing. The affected products are SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition.

The weakness lies in SafeControls, the list SharePoint consults to decide which server-side controls may load. When ToolPane regenerates a Register directive, a quote character inside an attribute value passes through unescaped, so a crafted value can terminate early and smuggle in directives of its own. SharePoint has already validated types by the time those extras appear, but has not yet instantiated the control, so they can register any .NET class, and XamlServices.Parse() turns that into deserialization and code execution. Viettel’s payload is a webshell held entirely in memory; by the researcher’s account, other deserialization techniques tend to fail on registry permissions, and this one does not.

The attacker needs to be signed in, though any low-privileged account suffices. Khoa also showed a pre-authentication route that pairs the flaw with an authentication bypass Microsoft fixed earlier, and it works only against sites that permit anonymous page access.

Exploitation followed publication. SecurityWeek reported that Previdian logged the first attempts on September 24 and webshell attempts a day later, timing that matches Viettel’s technical write-up, which The Hacker News covered before the attacks began. Microsoft amended its advisory on September 25 to confirm exploitation, and CISA added the flaw to the KEV catalog the same day alongside a MikroTik RouterOS bug, CVE-2026-67279, with federal remediation due on September 28 under Binding Operational Directive 26-04. That directive also tells agencies to establish whether they were compromised before they patched.

Why It Matters 

This is the second consecutive edition in which an on-premises SharePoint flaw has drawn active exploitation, after CVE-2026-55040 last month, when attackers also probed its pairing with CVE-2026-63520.

The reclassification carries further than the bug does. An organization that prioritized by severity in August put a 6.5 spoofing issue near the bottom of its queue, a defensible call that August 27 overturned four weeks before the first attacks. The change arrived as an edit to a record Microsoft had already published, and a scanner or ticket that captured the 6.5 at first ingestion had no reason to look again. Severity can be revised after you have acted on it, so a patch process needs a way to notice when the record behind an item moves.

Because exploitation began before the KEV listing, the August update closes the hole without telling you whether anything came through first. CISA tells federal agencies to go and look, and the rest of us should hold to the same standard.

Two Hours From Proof of Concept to Honeypot Traffic

Atlassian disclosed CVE-2026-21589 on October 5, an unauthenticated file read rated 9.3 under CVSS v4.0 across eight self-hosted products: the Data Center editions of Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, and Crowd, plus Crucible and Fisheye. A library common to all eight treats a pair of colons in a request path as a slash, enough to climb out of the plugin resource endpoints to any file in the web root. Directory listings stay shut, so an attacker needs the filename and its location in advance, a weaker protection than it sounds.

On October 6, watchTowr released a technical write-up with working exploit code. Previdian told Bleeping Computer that its honeypots started logging attempts within two hours, from 38.60.157[.]86, 146.70.187[.]234, and 159.26.119[.]225, and that a Nuclei template had since appeared. By October 8, SecurityWeek reported, Previdian had counted 190 attempts from 32 addresses in 10 countries. Both timings come from Previdian alone. CISA added the flaw to the KEV catalog on October 15.

Why It Matters

Our September edition predicted that the interval between public exploit code and real exploitation would keep compressing. In August, honeypot operators saw Rapid7’s SharePoint proof of concept in traffic the next day; here, Previdian reported attempts within two hours. Different observers watched different products, so treat the two figures as a direction of travel.

Two hours does not accommodate a change advisory board, a maintenance notification, or a staging soak. For internet-facing software, the first response to a critical unauthenticated flaw has to be an edge mitigation you can push in minutes, with the patch following on its own schedule. Atlassian shipped WAF and proxy guidance alongside the updates, which gives defenders that first move.

Predictions for the Coming Months

• Unowned service and functional accounts will be the initial access path in a growing share of M365 incidents. The exemptions that keep automation running are written into policy, and the accounts answer to nobody. We expect more post-incident reports where the compromised identity had no human owner on record.
• Device code and consent phishing will outlive the EvilTokens disruption. The technique depends on no single platform, and Microsoft itself expects the model to outlast the infrastructure it seized. We expect successor services within two quarters, with mailbox triage as a standard feature.
• The interval between public exploit code and opportunistic scanning will keep contracting toward whatever automation allows. Two hours was this month’s figure for a flaw needing no authentication and no complex payload, and the practical floor is how quickly scanning infrastructure can be retargeted.
• Shipping and retail impersonation will climb through November and December, as it does every fourth quarter, with lures generated per recipient from kits instead of reused templates. That removes the repetition that made seasonal campaigns easy to filter and easy to teach users to spot.

Monthly Recommendations

• Inventory every non-human identity in your tenant and give each one a named owner. Rotate credentials on functional and service accounts, enforce MFA or move them to workload identities with certificate-based authentication, and treat an empty sign-in history as a reason to look closer. 365 Permission Manager shows what those accounts can reach across Teams, SharePoint, and OneDrive.
• Restrict the OAuth device code flow in Entra ID Conditional Access to the devices that need it, and deny it everywhere else. Build the allowlist from your hardware inventory. Then alert when a successful sign-in is followed by a new authentication method, a new inbox rule, or an unfamiliar device registration, and correlate the three into one signal, since each alone reads as noise.
• Patch on-premises SharePoint to the August level, verify it host by host, and then go looking for what preceded the patch. Check internet-facing sites for anonymous page access, unexpected registered assemblies, and webshell artifacts, and re-triage anything in your backlog whose vendor severity has changed since you scored it.
• Train users on device code lures, where the address bar is correct. The lesson has to be procedural: approve a device sign-in prompt only if you triggered it yourself, seconds earlier, on a device in front of you. Security Awareness Training is where that habit gets built.

---

About Hornetsecurity

Hornetsecurity is a leading global provider of next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world. Its flagship product, 365 Total Protection, is the most comprehensive cloud security solution for Microsoft 365 on the market. Driven by innovation and cybersecurity excellence, Hornetsecurity is building a safer digital future and sustainable security cultures with its award-winning portfolio. Hornetsecurity operates in more than 120 countries through its international distribution network of 12,000+ channel partners and MSPs. Its premium services are used by more than 125,000 customers.