Monday, November 2, 2026 · 1 MIN READ
Fake IT Support and Critical Flaws Put Business Access at Risk
IT BRIEFING FOR BUSINESSES
Today’s stories put employee trust and privileged access at the center of business IT risk. Attackers impersonating IT support on Microsoft Teams persuaded staff to hand over remote control of their PCs, then exploited insecure certificate-service settings to gain privileged access. Separately, the VOLTA Windows infostealer collects browser passwords and cookies, Outlook profile data, and Slack workspace data, using AI to rank stolen information by financial value. For business owners, the priorities are practical: require staff to verify support requests through an established channel before granting remote access, review remote-control permissions on devices, and have IT check Active Directory Certificate Services configurations. Include Teams alongside email in staff awareness training and review how Microsoft 365 accounts and connected applications are protected.
The infrastructure stories warrant a targeted software inventory and access review. Langflow versions 1.0.0 through 1.12.8 contain critical flaws, with version 1.13.0 identified as the fix. A separate critical flaw in LXD and MicroCloud allows trusted-client impersonation under specific network-access and certificate conditions. Ask IT whether these products are deployed, prioritize the documented Langflow upgrade, and review who can reach infrastructure management interfaces over the network. Reports of government Linux and cloud compromises also make server and cloud-access monitoring relevant to the day’s review. Keep backup restoration checks on the operational checklist, while treating data theft as a separate risk that recovery alone cannot resolve. For teams considering AI security agents, assess readiness before expanding deployment rather than letting adoption figures drive the decision.
Teams Impersonation Leads to Privileged Access
Microsoft investigated two intrusions in which attackers impersonated IT support through Microsoft Teams and persuaded employees to grant remote control of their PCs. The attackers then exploited insecure Active Directory Certificate Services settings to obtain login certificates for privileged accounts, including a domain controller account; one intrusion resulted in company data theft.
SOURCES:The Hacker News
Critical Flaws Affect AI Workflows and Virtual Infrastructure
IBM disclosed two critical Langflow flaws that could allow unauthenticated attackers to bypass authentication or execute code, affecting versions 1.0.0 through 1.12.8 and fixed in 1.13.0. Separately, a critical LXD and MicroCloud flaw allows an attacker with network access to the HTTPS API and a trusted client’s public certificate to impersonate that client without its private key, gaining the client’s access to the cluster and virtual machines.
SOURCES:The Hacker News The Hacker News
VOLTA Uses AI to Sort Stolen Data
Researchers identified VOLTA-AUTODOXER, also called VOLTA, as a Windows infostealer that uses large language models to rank stolen information by its potential financial value. Its collection capabilities include passwords and cookies from Chromium-based browsers, Outlook profile data, and Slack workspace data.
SOURCES:The Hacker News
Espionage Campaigns Target Cloud and Linux Systems
Dream Research Labs reported that the state-aligned DarkBlinders espionage campaign compromised a high-profile individual and a government cloud environment between August and October 2026. In a separate investigation, Palo Alto Networks Unit 42 tracked activity against government-linked Linux infrastructure from October 2025 through April 2026 under the designation CL-UNK-1211, involving SysGoRAT and suspected AI-generated scripts.
SOURCES:The Hacker News The Hacker News
Survey Tracks AI Adoption in Security Operations
Prophet Security’s State of AI in Security Operations 2026 survey of more than 250 security executives, operations leaders, and practitioners found that 40% of security teams use AI daily, 56% are testing it, and 4% have no adoption plans. The accompanying report examines security operations readiness for deploying AI agents.
SOURCES:The Hacker News