company
Security vendor that published the analysis of CVE-2026-43760 and CVE-2026-65400 and reviewed the public proof of concept.
No evidence-backed relationships are recorded.
Huntress says a researcher targeted after Black Hat and Def Con was sent a Google Doc that rendered an Apps Script sidebar with ClickFix instructions. The lure arrived by DM, not email.
Reality
A spraying campaign against Entra ID used OAuth's password grant for Azure CLI to get tokens with no MFA prompt. The lesson is about policy coverage, not about second factors.
Reality
Wiz says rogue device registrations are drifting toward benign names, while nearly one in seven Entra tenants saw such an attack in 90 days. Naming strings were never the signal.
Reality
New York's regulator confirmed impact to licensed firms from the exploited N-central flaw. The product belongs to banks' IT providers, which answer to no financial supervisor.
Reality
Huntress says a public proof of concept needs only an IP address to pull any file off unpatched Macs, driving a helper process that carries Full Disk Access.
Reality