Cyber News: Week Ending May 23, 2026

This week brought a clear reminder that attackers are not waiting for exotic methods. They are going after the tools individuals and small businesses already depend on every day: Microsoft 365, VPNs, routers, developer extensions, cloud platforms, and trusted software downloads.

The theme is simple: access is the target. If attackers can steal a Microsoft 365 token, bypass VPN multi-factor authentication, compromise a router, poison a developer tool, or make malware look like a legitimate download, they can move faster than most small businesses can respond.

Here’s what happened, why it matters, and what you need to do about it.

1. FBI Warns About Kali365 Stealing Microsoft 365 Access Tokens
The FBI issued a public warning about Kali365, a phishing-as-a-service platform first seen in April 2026 that is being distributed through Telegram. Unlike basic phishing kits that only steal usernames and passwords, Kali365 is built to capture Microsoft 365 OAuth access tokens and bypass multi-factor authentication without directly stealing the user’s password. Once attackers capture those tokens, they can access Outlook, Teams, and OneDrive without needing another MFA prompt.

This is dangerous for small businesses because Microsoft 365 often holds everything: email, invoices, contracts, client files, Teams chats, SharePoint folders, and password reset messages. If an attacker gets into one mailbox, they can send fake invoices, reset third-party accounts, search for banking details, and impersonate employees or vendors.

The scam works by tricking a user into entering a device code on a real Microsoft page. The login page is legitimate, but the code authorizes the attacker’s device. That is why this type of attack can fool even careful users who have been trained to look for fake login pages.

BET-R Actions: Start by reviewing Microsoft 365 sign-in logs for unusual device-code activity, unfamiliar locations, and new sessions that do not match normal user behavior. If your licensing supports it, restrict or block device code flow except where there is a documented business need. Audit active sessions, revoke suspicious tokens, and require users to reauthenticate if there is any sign of compromise. Train staff that a code-based login request they did not initiate is a red flag, even if the Microsoft page itself looks real.

2. SonicWall VPN MFA Bypass Shows “Patched” Does Not Always Mean Safe
Threat actors have been bypassing MFA on SonicWall Gen6 SSL-VPN appliances when organizations applied firmware updates but did not complete the required LDAP reconfiguration steps. According to reporting on the issue, attackers brute-forced VPN credentials, bypassed MFA, performed reconnaissance, tested credential reuse, reached internal systems, and attempted to deploy tools associated with ransomware operations.

This matters because VPNs are front doors into a business network. Many small businesses rely on VPN appliances for remote workers, vendors, managed IT providers, and administrators. If attackers can get through the VPN, they may not need to exploit a workstation first. They can start inside the network.

The key lesson is that some vulnerabilities require more than installing an update. In this case, SonicWall Gen6 devices needed the firmware update plus specific LDAP configuration cleanup. The article also notes that Gen6 SSL-VPN appliances reached end-of-life on April 16, 2026, which means businesses still relying on them should treat replacement as a security priority.

BET-R Actions: Do not stop at “the firewall says it is updated.” Confirm the full vendor remediation steps were completed. For SonicWall Gen6 SSL-VPN, review the LDAP configuration, remove vulnerable userPrincipalName settings, clear cached LDAP users, reboot, recreate the LDAP configuration safely, and create a fresh backup. Review VPN logs for scripted authentication indicators, suspicious VPS or VPN source IPs, and logins from unexpected locations. If you still run end-of-life remote-access hardware, build a replacement plan now.

3. Microsoft Defender Zero-Days Put Endpoint Updates Back in the Spotlight
Microsoft released fixes for two Microsoft Defender vulnerabilities that had already been exploited as zero-days. One flaw, CVE-2026-41091, affects the Microsoft Malware Protection Engine and can allow attackers to gain SYSTEM privileges. The other, CVE-2026-45498, affects the Microsoft Defender Antimalware Platform and can allow denial-of-service conditions on unpatched Windows devices. CISA added both to its Known Exploited Vulnerabilities catalog and directed federal agencies to secure affected Windows endpoints and servers by June 3.

This is a wake-up call because Defender is supposed to be part of the protection layer. When attackers exploit the security tool itself, outdated endpoints become even more exposed. Microsoft says default configurations should update Defender automatically, but small businesses often have devices that are offline, misconfigured, blocked by policy, or unmanaged.

For individuals, this is also a reminder that “Windows updates are annoying” is not a security strategy. Your computer, browser, antivirus engine, and apps need to update quickly because attackers reverse-engineer patches and move fast once vulnerabilities are public.

BET-R Actions: Verify Defender engine and platform versions across every Windows device, not just the devices that checked in recently. Confirm automatic updates are working, investigate endpoints that have not reported in, and prioritize laptops that travel or connect remotely. If you use a managed service provider, ask for a current endpoint compliance report. For home users, open Windows Security and Windows Update, install available updates, and reboot.

4. Ubiquiti UniFi Flaws Put Small-Business Routers and Network Controllers at Risk
Ubiquiti released security updates for three maximum-severity UniFi OS vulnerabilities that can be exploited by remote attackers without privileges. The flaws include improper access control, path traversal, and command injection issues. Ubiquiti also patched a critical command injection flaw and a high-severity information disclosure vulnerability. Censys was tracking nearly 100,000 internet-exposed UniFi OS endpoints, with nearly 50,000 in the United States.

This is high-impact for small businesses because UniFi gear is common in offices, restaurants, clinics, churches, warehouses, schools, and home offices. These devices often manage Wi-Fi, cameras, door access, phones, and network traffic. If a UniFi console is exposed to the internet and not updated, attackers may be able to change settings, access files, or execute commands.

Routers, firewalls, and network controllers are especially attractive because they sit at the edge of the network. They may not have the same visibility or endpoint detection coverage as laptops and servers, and many businesses forget to include them in regular patch cycles.

BET-R Actions: Log in to UniFi and apply the latest UniFi OS updates immediately. Remove unnecessary internet exposure, restrict management access to trusted IPs or VPN-only access, and disable remote access features you do not actively use. Inventory every network device, including cloud keys, gateways, switches, cameras, and access controllers. If you are not sure whether your UniFi console is exposed, have it checked before attackers do it for you.

5. 7-Eleven Breach Highlights Cloud and Franchisee Data Risk
7-Eleven confirmed that an unauthorized third party accessed systems used to store franchisee documents on April 8, 2026. The ShinyHunters extortion group claimed responsibility and alleged that it stole more than 600,000 records containing corporate data and personally identifiable information after breaching the company’s Salesforce environment. The company did not disclose the number of affected individuals.

This matters to small businesses because cloud platforms like Salesforce, Microsoft 365, Google Workspace, QuickBooks, CRMs, help desks, and payment systems often hold the most valuable business data. A breach does not always start on your laptop or server. It can start inside a cloud system, an integration, a vendor account, or a contractor login.

For franchisees and individuals, exposed documents can create long-term risk. Personal information may be used for phishing, impersonation, loan fraud, account takeover, or targeted scams that reference real business relationships.

BET-R Actions: Review which cloud systems store sensitive documents and who has access to them. Remove stale users, enforce MFA, limit administrator roles, and review connected apps or integrations. For any CRM or document platform, turn on alerts for bulk exports, unusual login locations, and access from new devices. If you receive breach notification letters, save them, monitor credit and financial accounts, and be alert for follow-up phishing that uses real company details.

6. Poisoned VS Code Extension Shows Developers Are Now a Prime Target
GitHub said internal repositories were impacted after an employee device was compromised through a poisoned Visual Studio Code extension. GitHub detected and contained the compromise, removed the malicious extension version, isolated the affected endpoint, and rotated critical secrets. The incident may be related to a malicious Nx Console extension version, and Nx leadership said the number of users who received the malicious package could be significantly higher than Microsoft’s initial estimate of 28 installs, potentially over 6,000 installs. GitHub said it had no evidence that customer data outside the affected repositories was impacted.

This is not just a “big tech” story. Small software companies, MSPs, agencies, freelancers, and internal IT teams use code editors, browser extensions, npm packages, Python packages, Docker images, and build tools every day. A poisoned developer tool can sit close to source code, API keys, customer data, deployment scripts, and cloud credentials.

If your business builds software, maintains websites, automates workflows, or manages client systems, developer workstations are high-value targets. Attackers know that compromising one developer can open the door to many customers.

BET-R Actions: Inventory approved developer extensions and remove anything that is unused, abandoned, or installed from an unverified publisher. Rotate secrets if a developer workstation may have been exposed. Store API keys in a secrets manager, not in code repositories or local text files. Require MFA on GitHub, GitLab, Bitbucket, cloud consoles, and package registries. Treat developer laptops as privileged systems, not ordinary workstations.