Attackers have used the Mirage2FA phishing-as-a-service toolkit against about 4,500 companies in the US and EU from 2024 to 2026, abusing Microsoft 365 login flows and bypassing two-factor authentication, with ANY.RUN saying 48% of targeted email addresses were potentially compromised. This matters because your users can do everything right with 2FA and still lose accounts if you are not watching for suspicious sign-in patterns and training them to treat every 365 prompt with doubt.
Researchers found a weakness in NVIDIA NemoClaw that lets an attacker-controlled webpage take unauthenticated control of a local Ollama instance and plant hidden instructions inside the model. If you are testing local AI agents, you need to treat the host like any other exposed app, lock down browser access paths, and avoid running them on production endpoints.
Meta has added support for multiple passkeys per account in WhatsApp, so users on both iOS and Android can sign in with phishing-resistant passkeys, and says more than 1 billion people use a passkey to log in. This is a good moment to update staff guidance and push passkeys as the default for business WhatsApp use where it is allowed.
Twenty-four npm packages have been used as free phishing infrastructure, hosting single-page HTML that redirects to fake CAPTCHA pages via unpkg mirrors. Dev and security teams should tighten npm allowlists, scan dependencies, and treat odd CAPTCHA prompts on internal tools as a red flag.
Marimo has fixed a high severity flaw where a crafted notebook could execute attacker-supplied Model Context Protocol commands as a local subprocess as soon as it was opened in edit mode. If your data or AI teams use Marimo, you should push the patched version and avoid opening notebooks from untrusted sources.
Need IT support that just works? Email hello@icthero.co.uk or talk to us.