11 min read
Black October: What Credit Unions Should Do Now
In This Article What "Black October" means for credit unions The PHP flaws CISA says to patch now Attacks that run at machine speed Move staff...
multi-factor authentication
13 min read
Microsoft Authenticator Android Vulnerability (CVE-2026-80097): What Banks, Credit Unions, and Lenders Should Do
In This Article What CVE-2026-80097 is Why one app holds the keys to the work account How the Microsoft Authenticator Android vulnerability worked...
14 min read
Microsoft 365 Token Replay Campaign: What Banks, Credit Unions, and Lenders Should Do Now
In This Article What Huntress found How token spraying works Why the block list kept falling behind What the attacker left behind Read a Conditional...
12 min read
Flax Typhoon and Microsoft 365: What Banks, Credit Unions, and Lenders Should Check
In This Article What the October 8 Flax Typhoon advisory says Three tools aimed at Microsoft 365 mail Block the sign-ins a password spray depends on...
14 min read
Service Account Security: The Forgotten Accounts a Password Spray Found
In This Article The service account security gap a password spray found Why forgotten accounts fall first Four kinds of forgotten account, and the...
12 min read
Conditional Access Exclusions: The List Nobody Reviews
Every institution grants Conditional Access exceptions. Microsoft documents how those lists grow, names access reviews as the compensating control,...
15 min read
Windows Hello for Business Key Abuse: What Financial Institutions Need to Verify
Malware already running in a signed-in Windows session can use that user's Windows Hello for Business key to authenticate to Microsoft Entra ID, with...
14 min read
Hotel Wi-Fi Is Stealing Microsoft 365 Sessions
In This Article What Microsoft Found on Hotel and Conference Wi-Fi Two Attack Paths, and Why the Difference Decides Your Controls The Part That...
14 min read
Microsoft Entra SSPR Registered-Methods Deadline: What Banks, Credit Unions, and Mortgage Companies Must Do
In This Article What Changes on November 9, 2026 Which Institutions Are Most Exposed The Rollout Timeline You Need on the Calendar What to Do Before...
11 min read
CVE-2026-41615: Microsoft Authenticator Information Disclosure: What Financial Institutions Should Do Now
In This Article What the patch actually fixes Why financial institutions should treat this as a tier-1 patch event The three-control playbook for...
