Microsoft published a warning about a documented and recurring attack pattern where threat actors use the external collaboration feature in Microsoft Teams to initiate conversations with enterprise employees, presenting themselves as internal IT support or helpdesk staff. The tactic exploits the fact that Teams allows cross-tenant messaging by default, meaning anyone with a Microsoft account can reach employees at other organizations unless the receiving organization has restricted this. The attack chain Microsoft observed follows a consistent playbook. An employee receives a Teams message from what appears to be internal IT support, often citing a security issue, expired password, or pending update requiring assistance. The attacker guides the employee into opening a Quick Assist remote session, handing over direct control of the machine. From there, the attacker performs reconnaissance using Command Prompt and PowerShell, checks privileges and network reachability, then drops a payload bundle in user-writable directories such as ProgramData. The payload executes by sideloading a malicious DLL through a trusted, signed application including Autodesk, Adobe Reader, or Windows Error Reporting, so the process tree looks legitimate. Command and control communication runs over HTTPS and blends into normal traffic. Lateral movement uses Windows Remote Management to reach domain-joined systems and domain controllers. Data exfiltration uses Rclone to transfer filtered, high-value files to external cloud storage. Microsoft's incident response team confirmed at least one real-world case where this chain ran to completion. The entire campaign relies on no software vulnerabilities. Every step uses legitimate tools and user-approved actions.

Forescout Research Vedere Labs disclosed a set of 22 vulnerabilities across popular models of serial-to-Ethernet converters from Lantronix and Silex, collectively naming the research BRIDGE:BREAK. Serial-to-IP converters are hardware devices that allow legacy serial equipment to be accessed and managed over an IP network. In industrial and operational technology environments they serve as the bridge between legacy programmable logic controllers, sensors, and control systems that only speak serial protocols and the modern IP-based networks those environments now run on. Researchers identified nearly 20,000 of these devices exposed directly on the internet. The vulnerabilities include flaws that allow full device takeover, credential theft, and in some cases direct manipulation of the serial traffic flowing through the device. An attacker who compromises one of these converters gains the ability to send arbitrary commands to whatever industrial equipment is connected on the other end. Affected firmware versions span multiple product lines from both vendors. Patches are available from both Lantronix and Silex for the most severe vulnerabilities, though many of these devices run in environments where firmware updates are operationally difficult.