The short version
Today in 5 stories
- ConnectWise cloud backup breach exposes Microsoft 365 tenants via app identityA ConnectWise vendor integration breach let attackers access Microsoft 365 tenants through trusted application identities.
- FBI and CISA warn AI-enhanced phishing is targeting election and campaign officialsFederal agencies warn AI-generated phishing and impersonation are targeting election and campaign officials.
- NSA urges zero trust approach for ageing industrial and operational technologyNSA guidance pushes zero trust and segmentation to protect ageing industrial control systems.
- OAuth consent phishing lets attackers skip passwords entirelyAttackers are using fake app authorization requests to gain account access without stealing a password.
- Encrypted messaging apps do not verify who is actually messaging youFBI warns encrypted apps protect messages in transit but do not prove who is sending them.
ConnectWise cloud backup breach exposes Microsoft 365 tenants via app identity
Attackers gained unauthorized access to application identities in ConnectWise's Cloud Backup environment, with researchers reporting sign-ins across 173 partner and customer tenants. Investigators found attacker-added credentials used to sustain access, and warned that employee MFA does not cover these third-party application identities.
FBI and CISA warn AI-enhanced phishing is targeting election and campaign officials
A joint advisory warns that phishing, impersonation and synthetic audio/video are being used against election officials and campaigns to steal credentials and sensitive data. Related FBI advisories describe attackers using OAuth consent phishing to gain account access without needing passwords, and impersonation over encrypted apps like Signal and WhatsApp.
NSA urges zero trust approach for ageing industrial and operational technology
New NSA guidance urges defence and critical infrastructure operators to apply zero trust principles to operational technology, noting that legacy equipment often lacks modern authentication or patching capability. The guidance recommends controlled access, segmentation, monitoring and clear ownership of remote access as compensating controls.
OAuth consent phishing lets attackers skip passwords entirely
An FBI advisory describes attackers sending malicious links that lead to a legitimate service's authorization screen, tricking users into granting a malicious application access to email, messages or files. Because the application gets its own permissions, changing a password does not remove its access; the application must be removed and its access revoked.
Encrypted messaging apps do not verify who is actually messaging you
FBI reporting describes attackers impersonating officials by starting contact on text messaging, then moving conversations to Signal, Telegram or WhatsApp to build credibility before requesting documents, money transfers or authentication codes. The advisory notes that encryption protects communication in transit but does not confirm a correspondent's identity.
The takeaway
What to do this week
This week's lesson is that trust granted to applications, vendors and encrypted channels can be abused without a password ever being stolen. Review third-party app permissions and confirm sensitive requests through independently verified channels.
Where this comes from
Compiled by Cyentrix from 3 newsletters received 17 to 18 October 2026 ("The Cyber Security Hub™ via LinkedIn"). Summaries are drafted with AI assistance from the newsletter text and edited for length; follow the source links for the full reporting. Cyentrix is not the original reporter of these items.