ESKA Security

ESKA Security Cybersecurity Services for SMB to Enterprise Level Companies

MFA Passed. The Attacker Logged In Anyway — Across 79 Organizations.Multi-factor authentication is essential. But what h...
10/29/2026

MFA Passed. The Attacker Logged In Anyway — Across 79 Organizations.

Multi-factor authentication is essential. But what happens when attackers steal the session token after MFA has already been completed?

On October 26, Huntress published research into a Microsoft 365 campaign that compromised accounts across 79 organizations between July 14 and September 22, 2026.

The researchers documented 497 successful sign-ins involving stolen authentication tokens.

The technique combined adversary-in-the-middle (AiTM) phishing with token replay. Instead of simply stealing passwords, attackers captured authenticated sessions and reused them to access Microsoft 365 accounts.

Investigators also observed unauthorized Entra ID device registrations, changes to MFA methods, and malicious inbox rules designed to conceal email activity.

For businesses, the consequences go beyond account compromise. A hijacked Microsoft 365 session can expose sensitive communications, enable business email compromise, and allow attackers to maintain access even after a password reset.

What should security teams prioritize?

• Apply phishing-resistant MFA where possible.
• Monitor suspicious token reuse and unfamiliar device registrations.
• Investigate unexpected changes to authentication methods.
• Revoke compromised sessions and review mailbox rules during incident response.

The lesson isn't that MFA doesn't work. It's that identity security must protect the entire authenticated session, not just the login.

Adobe patched this e-commerce flaw in July. CISA now confirms attackers are exploiting it.On October 27, CISA added CVE-...
10/28/2026

Adobe patched this e-commerce flaw in July. CISA now confirms attackers are exploiting it.

On October 27, CISA added CVE-2026-48356 in Adobe Commerce and Magento Open Source to its Known Exploited Vulnerabilities catalog.

The vulnerability isn't new. Adobe released fixes on July 14. What's new is confirmation that exploitation is happening in the wild.

Rated critical (9.6 by Adobe), the flaw involves insufficient restrictions on uploading dangerous file types. Under the documented conditions, it could enable code ex*****on in the current user's context and potentially elevated access.

An attacker doesn't need an account, but exploitation does involve user interaction. This is not evidence of an automatic, unauthenticated takeover of every Magento store.

For retailers, the stakes extend beyond downtime: a compromised storefront can put customer information, checkout integrity and brand trust at risk.

Security teams should:

• Inventory production, staging and legacy Commerce/Magento installations.
• Verify that the July 2026 security updates are installed.
• Review suspicious uploads, logs and unexpected application changes for signs of earlier compromise.
• Check third-party extensions and exposed administrative interfaces.

CISA's November 10 remediation deadline applies to covered US federal agencies. Businesses should not treat that date as a safe waiting period.

Patching closes the vulnerability. Investigating whether it was already exploited is a separate task.

A simple Markdown file could turn your AI coding assistant against you.Security researchers at Forever Security discover...
10/26/2026

A simple Markdown file could turn your AI coding assistant against you.
Security researchers at Forever Security discovered a malicious AGENTS.md file in a customer's Downloads folder. It looked like ordinary engineering guidance. Its real purpose was to make an AI coding agent change its configuration and install a malicious npm package.

The attempted installation was blocked. But the researchers then reproduced the attack in controlled tests.

With OpenAI Codex, the planted instructions could register a malicious MCP server and trigger code ex*****on. With Claude Code, a related attack using CLAUDE.md could redirect API traffic and expose an OAuth token.

The important distinction: this was not evidence of widespread compromise of either product. It was a demonstrated attack path that exploits how coding agents interpret local instructions.

Why does this matter for businesses?
AI coding assistants can access source code, developer environments, credentials, and tools. When untrusted files are treated as operational instructions, a harmless-looking document can become a route to compromise.

Security teams should review where agents run, audit unexpected instruction files and MCP configurations, and keep approval and sandbox controls enabled.
Red teaming also needs to evolve: test what AI agents will obey, not just what applications will execute.

As AI agents gain more autonomy, are your security controls keeping pace?

Cybersecurity This Week: AI-Powered Intrusions, Critical PHP Flaws, and Major Business DisruptionOctober 19–23 brought a...
10/23/2026

Cybersecurity This Week: AI-Powered Intrusions, Critical PHP Flaws, and Major Business Disruption

October 19–23 brought a mix of rapidly automated attacks, exposed enterprise systems, and real operational consequences. Here are seven developments worth watching:

1. Microsoft links AI-driven attacks to ConnectWise compromise
Microsoft attributed a supply-chain compromise involving ConnectWise cloud applications to Storm-0940. Its research describes the use of ARTEX to accelerate attacks, with privileged cloud access achieved in under three hours in multiple cases.

2. PHP2Shell exploitation preceded disclosure
AWS observed an attempted exploit on October 17, four days before the October 21 public disclosure of two critical PHP remote-code-ex*****on vulnerabilities.

The situation continues to evolve. On October 23, reports emerged of another PHP remote-code-ex*****on vulnerability, CVE-2026-115560, affecting specific configurations. Organizations should prioritize PHP updates, review their exposure, and monitor for suspicious activity.

3. Quest Diagnostics investigates unauthorized access
On October 22, the US laboratory operator disclosed unauthorized access to its Quanum LSM platform. Certain patient records may have been accessed, but the scope remains under investigation.

4. Ahold Delhaize details retail disruption
In an October 19 update on an incident first disclosed October 12, the retailer confirmed malicious activity and precautionary shutdowns of websites and apps across US and European brands. Physical stores remained open.

5. Cisco patches a critical Expressway vulnerability
Cisco disclosed CVE-2026-76466, rated CVSS 9.8, which could allow remote command ex*****on under specific conditions. The advisory does not establish active exploitation.

6. Lazarus evolves its espionage toolkit
Kaspersky published new findings on Operation FlashHole, a campaign active since at least 2025, describing phishing, legitimate-software abuse, and newly documented malware components.

7. Oracle releases its October security updates
Oracle's October Critical Patch Update covers a wide range of enterprise products, including databases, Java, and business applications. Asset visibility and risk-based patch prioritization remain essential.

The common thread: attackers are moving faster, while trusted integrations, unpatched systems, and operational dependencies continue to expand the impact of security incidents.

A New Era of Phishing: Hackers Are Targeting Not Just People, but Their AI Assistants. You spotted a phishing email and ...
10/22/2026

A New Era of Phishing: Hackers Are Targeting Not Just People, but Their AI Assistants. You spotted a phishing email and ignored it. But what if your AI assistant didn't?

Cybercriminals are finding new ways to exploit artificial intelligence by embedding malicious instructions directly into emails.

Researchers at Barracuda have identified attacks designed to manipulate not only human recipients but also AI assistants that process corporate emails.

How does it work?
🔶 An employee receives a phishing email requesting a payment or a change in banking details.
🔶 The employee recognizes the suspicious message and ignores it.
🔶 However, an AI assistant analyzing the inbox may process hidden instructions embedded in the email.
As a result, the AI could present the fraudulent request as a legitimate business task and recommend transferring money to the attacker.

This technique is known as Prompt Injection — manipulating AI systems through malicious instructions hidden in the content they process.

Why should businesses care?

AI assistants are increasingly integrated into corporate email, CRM systems, financial workflows, and business operations.

This creates a new attack surface.

Cybercriminals no longer need to convince an employee directly. They can attempt to manipulate the AI tools employees rely on for information and recommendations.

And when a fraudulent request comes from a trusted AI assistant, it may appear far more credible.

Traditional phishing awareness is no longer enough. Businesses also need to assess how their AI tools handle untrusted content, what systems they can access, and whether malicious instructions can influence business decisions.

At ESKA Security, we help organizations identify vulnerabilities, assess potential attack paths, and strengthen their security posture through pe*******on testing and security assessments.

Because attackers are evolving their techniques. Your security strategy needs to evolve too.

If your company has no CISO, these are the 7 decisions someone still needs to own.Not every company needs a full-time CI...
09/15/2026

If your company has no CISO, these are the 7 decisions someone still needs to own.
Not every company needs a full-time CISO.
But every company needs someone who can answer:

🔸 Which cybersecurity risks are we willing to accept?
🔸 What systems, data, and processes should we protect first?
🔸 Who should have access to critical systems?
🔸 Which security controls do we actually need?
🔸 What happens when a security incident occurs?
🔸 Which security and compliance requirements must we meet?
🔸 How do we know our security controls actually work?

In many growing companies, these decisions are split between the CTO, IT, DevOps, Legal, and management.

The problem is when no one owns the whole picture.

You may not need the CISO title yet. But you do need clear security ownership.

Read the full article https://www.eskasecurity.com/post/if-your-company-has-no-ciso-these-are-the-7-decisions-someone-still-needs-to-own to see what that ownership should look like and when a vCISO can fill the gap.

What Red Team Specialists Check in the First 30 Minutes of a Pe*******on Test?Usually, they don’t start by exploiting vu...
09/14/2026

What Red Team Specialists Check in the First 30 Minutes of a Pe*******on Test?Usually, they don’t start by exploiting vulnerabilities.

First, they try to understand the environment from an attacker’s perspective:

🔸 What systems and services are exposed to the Internet?
🔸 Are there forgotten subdomains, staging environments, or admin panels?
🔸 What technologies and software are running?
🔸 Where are the authentication entry points?
🔸 Are there obvious misconfigurations or information leaks?
🔸 Which assets could become the easiest path to something more valuable?

By the end of those first 30 minutes, a pentester is already forming the first attack hypotheses and deciding where to dig deeper.

Because a good pentest isn’t about finding as many vulnerabilities as possible.

It’s about finding the ones an attacker could actually use and understanding where they could lead.

Read the full article https://www.eskasecurity.com/post/what-pentesters-check-in-the-first-30-minutes-of-an-engagement to see what happens at the beginning of a professional pe*******on test.

What is a BEC attack?BEC stands for Business Email Compromise — a type of social engineering attack where criminals impe...
09/08/2026

What is a BEC attack?
BEC stands for Business Email Compromise — a type of social engineering attack where criminals impersonate a CEO, CFO, employee, supplier, or business partner to trick someone into transferring money, changing bank details, or sharing sensitive information.

Unlike traditional phishing, BEC emails often contain no malware, no suspicious attachment, and no malicious link.

That is exactly what makes them dangerous.

Attackers may study how a company communicates, who approves payments, which suppliers it works with, and even how executives write emails. In some cases, they compromise a real corporate mailbox and send fraudulent instructions from a legitimate account.

A typical scenario looks simple:

🔸 a finance employee receives an urgent email from the “CEO”
🔸 the message asks to use new banking details
🔸 the request looks legitimate and time-sensitive
🔸 the payment is made
🔸 the money goes to an attacker-controlled account

SPF, DKIM, and DMARC are important, but they cannot stop every BEC attack, especially when a legitimate mailbox has already been compromised.

Effective BEC protection requires several layers: MFA, email security, employee awareness, account monitoring, SIEM/SOC visibility, and clear payment verification procedures.

In our new article https://www.eskasecurity.com/post/business-email-compromise-bec-how-attackers-impersonate-executives-and-steal-company-funds, we explain how BEC attacks work, why employees fall for them, how attackers bypass common email protections, and what companies can do to reduce the risk.

A cyber incident is only the beginning of the story. After containment, organizations face the most important questions:...
06/11/2026

A cyber incident is only the beginning of the story. After containment, organizations face the most important questions:

🔸 What exactly happened?
🔸 How did the attackers gain access?
🔸 What systems and data were affected?
🔸 How long were they inside the environment?
🔸 What is the real business impact?

Without forensic analysis, these questions often remain unanswered, leaving organizations exposed to repeated attacks, regulatory issues, legal disputes, and reputational damage.

Digital forensics helps reconstruct the attack timeline, identify compromised assets, preserve evidence, determine the root cause, and provide the facts needed for remediation and decision-making.

In many cases, understanding what happened is just as important as stopping the attack itself.

In our latest article https://www.eskasecurity.com/post/after-the-breach-how-forensic-analysis-determines-what-happened-who-did-it-and-what-it-cost, we explain how forensic investigations work, what evidence analysts collect, and how organizations can use forensic findings to reduce future risks.

We are getting more and more requests for a service that barely existed three years ago: helping companies respond to se...
06/09/2026

We are getting more and more requests for a service that barely existed three years ago: helping companies respond to security questionnaires from potential clients and partners.

This is a direct consequence of supply chain requirements. GDPR, DORA, NIS2 push large companies to verify vendors before signing. That pressure flows to everyone in the supply chain.

The problem is that many companies encounter these questionnaires for the first time mid-deal, answer optimistically, or run them through an AI tool. The issue is not the formatting. It is that the answers become part of the contractual record — and clients can audit you during the contract.

Newer agreements include penalty clauses and liability provisions tied specifically to third-party incidents. An inaccurate answer is no longer just a reputational risk.

Someone needs to understand the consequences of each formulation and be accountable for it.

We handle this as part of our vCISO service. Full article https://www.eskasecurity.com/post/what-you-don-t-know-can-hurt-you-cybersecurity-due-diligence-in-m-a-and-business-partnerships

Address

2900 Highway 7, Concord, Ontario
Vaughan, ON
L4K0G3

Website

Alerts

Be the first to know and let us send you an email when ESKA Security posts news and promotions. Your email address will not be used for any other purpose, and you can unsubscribe at any time.

Shortcuts

Share

Category

Other Information Technology Companies in Vaughan

Show All