NRG Networks Inc.

Researchers at Todyl's MXDR Team have reported an ongoing campaign in which threat actors are using stolen Microsoft Entra ID application credentials and Azure DevOps identities to gain unauthorized access to Microsoft 365 and Azure environments. As of November 3-4, 2026, the activity has impacted at least 27 organizations, including MSPs and their downstream customers across government, energy, transportation, education, legal, and nonprofit sectors. Attackers compromised valid application credentials rather than exploiting a Microsoft vulnerability. Approximately 45 application registrations across 18 organizations were targeted, with more than 33 successfully authenticated. The threat actor leveraged application identities, allowing them to bypass user-focused MFA and Conditional Access controls that do not apply to app-only authentication. Investigators observed: Searches across roughly 25 Microsoft tenants. Downloads of at least 81 files. Access to approximately 2,279 mailbo...

Linux security product cPGuard from OPSSHIELD . An attacker reportedly gained access to OPSSHIELD's update distribution infrastructure using compromised credentials and pushed a malicious update through the trusted cPGuard update channel. The malicious script installed a backdoor and collected sensitive server data. Affected Versions The compromised updates were distributed in cPGuard versions 5.88.12 through 5.88.19 . Data Potentially Stolen The malicious script reportedly collected: /etc/shadow password hashes /etc/passwd Root MariaDB/MySQL configuration files Root shell history Root SSH authorized keys and known-hosts files This could expose credentials, SSH keys, and other sensitive administrative information. Recommended Actions Immediately update cPGuard to version 5.88.25 or later. Treat any server that installed versions 5.88.12-5.88.19 as potentially compromised. Rotate: Root passwords Local account passwords SSH keys API keys and secrets stored on the system Review l...