ExfilSquad's alleged Microsoft D365 data breach highlights risks from misconfigured Power Pages. Learn attack methods, exposed data types, and mitigation steps.

August 2026 Patch Tuesday Analysis covers Microsoft’s August 2026 Security Updates and notes that the FIRE team is actively developing vulnerability coverage.

In July 2026, FIRE observed a 12% decrease in BEC attack volume, with gift cards remaining the most common cash-out method and Apple Store gift cards representing the largest share of gift card requests. The month also saw lower wire transfer request amounts, 31 cryptocurrency-related scams across 15 unique wallets, and continued reliance on free webmail providers for most BEC attacks.

Today’s Patch Tuesday Alert addresses Microsoft’s July 2026 Security Updates. The FIRE team is actively working on coverage for these vulnerabilities and expect to ship that coverage as soon as it is completed. In-the-Wild & Disclosed CVEsCVE-2026-58644A vulnerability in SharePoint could allow for an unauthenticated user to execute code due to deserialization of untrusted data. Microsoft has...

Fortra Intelligence and Research Experts (FIRE) has identified an active phishing campaign delivering fileless malware that uses five distinct layers of obfuscation.

Microsoft’s June 2026 Patch Tuesday was its largest ever. This Patch Priority Index ranks customer-actionable vulnerabilities by operational risk, highlighting internet-facing threats, active exploitation, public PoCs, and enterprise exposure while excluding low-priority and non-actionable cloud-service CVEs.

Discover key June 2026 BEC threat insights from Fortra Intelligence & Research Experts (FIRE), including a 22% increase in overall attack volume from the prior month.

Legacy email security systems are excellent at stopping known threats. If a malicious link has been flagged before, or if a sending domain is on a global blacklist, the email gets blocked. But what happens when an attacker uses generative AI to instantly script dozens of highly convincing lookalike domains, pairs them with short-lived disposable domain infrastructure, crafts a hyper realistic fake...

A sophisticated phishing kit named Mirage2FA uses obfuscated HTML and JavaScript to target Microsoft 365 users with multi-factor authentication (MFA) evasion techniques. This attack leverages short-lived domains and local browser execution to steal credentials and potentially intercept MFA codes.

Fortra’s May 2026 Patch Priority Index ranks the month’s most important vulnerabilities by real-world enterprise risk rather than severity score alone. It emphasizes prioritizing internet-facing and network-accessible systems first — especially Palo Alto GlobalProtect, Windows DNS, and Microsoft Exchange — while tracking cloud-side remediated issues separately when no customer patching is required.