Microsoft Disrupts Chinese-Language Phishing Kit Ecosystem Storm-2990
Microsoft uncovered a Chinese-language cybercriminal ecosystem: phishing kit operators tracked as Storm-2990 and an illicit marketplace tracked as Storm-3119 selling tools and infrastructure for large-scale phishing. Working with law enforcement agencies and partners worldwide, Microsoft's Digital Crimes Unit facilitated a disruption of the ecosystem, the company said in a Security Blog post.
Sources and evidence
Summary last validated Oct 14, 2026
Reader actions
Report an issue
Use this for an incorrect summary, wrong source, duplicate story, or wrong category. Submissions are private and do not change the story automatically.
Related coverage
- security
Microsoft adds agent risk controls to Microsoft 365 E7 and Project Perception
Microsoft announced new security capabilities in Microsoft 365 E7 and Project Perception aimed at containing agent risk and adapting protection continuously. The company framed AI agents as a new class of insider threat, saying security operations must match the speed at which agents act. No pricing, availability dates, or technical specifics were disclosed in the post.
- security
Microsoft and NVIDIA publish whitepaper on open-weight model risk
Microsoft and NVIDIA released a whitepaper for enterprises deploying open-weight AI models. It offers a shared taxonomy for classifying risks, evaluation methods, and security controls to help organizations manage those risks in enterprise deployments.
- security
CISA and FBI warn election officials of phishing threats ahead of 2026 midterms
CISA and the FBI issued a Public Service Announcement warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. Actors may use phishing and smishing to steal login credentials or install malware, targeting officials with access to voter registration data, government contacts, and campaign information. The agencies urge vigilance and recommended cybersecurity practices.
- security
CISA Adds Fortinet and BeyondTrust Flaws to Known Exploited Vulnerabilities Catalog
CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-61624, a path traversal flaw in multiple Fortinet products, and CVE-2026-102764, an authentication bypass by spoofing in BeyondTrust Remote Support. CISA said such flaws are frequent attack vectors and pose significant risks to the federal enterprise.
- security
CISA Urges Patching of Actively Exploited BeyondTrust Remote Support Flaw
CISA warned that CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support 26.2.3 and earlier, is being actively exploited for initial access, persistence, privilege escalation, and lateral movement. CISA added it to its Known Exploited Vulnerabilities catalog on Oct. 16, 2026, and urged self-hosted appliance operators to apply patch BT26-05-RS immediately.