All Articles

TL;DR for CISOs: The through-line today is not a software flaw. It is the phone. The two loudest stories both start with a person on a call, not an exploit in a payload. ShinyHunters claims it walked into Brinks Home through a Microsoft Entra voice-phishing call and left with millions of Salesforce records, and Sophos detailed a separate campaign where fake IT support on Microsoft Teams talked employees into remote-access sessions that ended in Chaos ransomware, one in under 17 hours. Alongside them, semiconductor maker Analog Devices told the SEC that intruders exfiltrated files from its network and that it is now weighing a second, separate extortion claim. Identity and the help desk are the initial-access surface of the day.

ShinyHunters claims a Brinks Home breach reached through a single vishing call

What happened

The mechanism claimed here is the story. ShinyHunters says it did not defeat a firewall or chain a vulnerability. It called an employee and steered that person through a Microsoft Entra authentication or registration step, and that single interaction handed over an account. From inside a legitimate identity, the group says it pivoted to the company's Salesforce environment and pulled customer and employee records out of it. Brinks Home has confirmed the intrusion and the extortion threat while stating that it has not yet verified the scope or the specific data involved, so the corporate facts and the criminal claims should be read as two separate layers.

This pattern is now a recognizable playbook rather than a novel one. The same group has been tied to a run of extortion cases built on SaaS data reached through stolen staff identities, and the common thread is that the front door was a person, not a port. For a company whose entire brand is physical security, an identity-driven compromise of its customer platform is an uncomfortable reminder that the weakest control is rarely the one in the product catalog.

Evidence

Two independent sources:

• BleepingComputer: ShinyHunters claims Brinks Home breach, threatens to leak stolen data
• Brinks Home: official cybersecurity update and incident FAQ

What this means for your team

Treat this as a rehearsal for the call your own help desk will get. The control that would have stopped it is not a product but a rule: no identity action, no authenticator registration, no password reset, and no remote session gets completed on the strength of a phone call alone. Out-of-band verification of the requester, ideally through a channel the caller cannot influence, is the countermeasure that matches the attack. The second lesson is about where your sensitive data actually lives. If a single employee identity opens a path to millions of customer records in a SaaS platform, then your SaaS access model, not your perimeter, is the real control surface. Scope what each role can read and export, and put alerting on bulk data pulls from customer relationship platforms so an unusual extraction is visible while it is happening.

Fake IT support on Microsoft Teams is ending in Chaos ransomware

What happened

This is the enterprise twin of the Brinks Home story, and it explains why both lead the day. The attacker never needs a software vulnerability when a believable helpdesk caller can persuade an employee to open a remote-control session and approve it. Sophos found the operators had refined the approach: instead of the older trick of spinning up tenants on Microsoft's own onmicrosoft.com domain, STAC4749 registered IT-themed domains under the ".top" suffix and paired them with consistent fake personas to make the "support" outreach look routine. Once an employee granted access, the operators moved quickly from a single workstation to backups and file servers.

Speed is the detail that should worry defenders most. A window of under 17 hours from first contact to encryption leaves little room for a human-driven investigation to catch up. The persistence tradecraft compounds the problem, because entries dressed up as audio drivers are the kind of thing that survives a casual look at what is running on a machine. This is social engineering executed with the discipline of an intrusion team, and it lands regardless of how well patched the environment is.

Evidence

• BleepingComputer: Microsoft Teams vishing attacks lead to Chaos ransomware attacks
• Sophos: Chaos in Teams vishing (STAC4749 analysis)

What this means for your team

The control that matters is restricting who can reach your employees through Microsoft Teams and what tools they can be talked into running. External Teams messaging that most organizations leave open by default is the delivery channel here, and tightening federation and external-communication settings removes the easy path. Just as important is treating remote-access utilities as privileged software: if Quick Assist and unsanctioned remote monitoring tools cannot execute on endpoints without approval, the caller's request has nowhere to go. Because this attack chain moves in hours, endpoint detection needs to alert on the specific behaviors, PowerShell dropping executables into user profile folders, new audio-named persistence entries, and sudden installs of remote-access agents, rather than waiting for the ransomware stage.

Analog Devices tells the SEC data was exfiltrated, and weighs a second extortion claim

What happened

The disclosure itself is measured: an intrusion identified in late June, an investigation that confirmed files left the network, and a statement that the business impact is not expected to be material. What makes this one worth the attention of security leaders is the second thread. The company is now publicly separating two events, the June intrusion it reported to regulators and a distinct claim raised in late July, while a criminal group advertises a haul of customer records. Whether those are one story or two is exactly the ambiguity that extortion crews exploit, because a company that cannot yet confirm scope is a company under pressure to negotiate.

Semiconductor firms keep appearing on the target list because their designs, process data, and customer relationships have durable strategic value. That value is why a chipmaker's breach carries weight even when operations are unaffected and revenue guidance is untouched. The exposure that matters is the data, not the downtime.

Evidence

• The Record: Semiconductor chip titan Analog Devices reports data breach
• U.S. SEC: Analog Devices Form 8-K disclosure

What this means for your team

Two lessons carry over regardless of your sector. The first is that your incident communications need a plan for overlapping claims. When a criminal group publishes a figure before you have finished counting, silence and premature confirmation are both risks, and the only durable position is a factual, scope-bounded statement you can stand behind and update. Rehearse that stance before you need it. The second is that a breach with "no material impact" on operations can still expose the assets that define your competitive position. Map where your crown-jewel data, product designs, source code, and sensitive customer records actually resides, and make sure exfiltration monitoring covers those stores specifically, because attackers who cannot stop your business will happily monetize your secrets.

Also notable

Ranked-but-lighter items from the past few days worth keeping on the board, with dates so you can judge freshness.

• The Record reported on July 29 that the Russia-linked group Laundry Bear (also tracked as Void Blizzard) weaponized CVE-2026-42897, a cross-site scripting flaw in Microsoft Outlook Web Access, against government, telecom, financial, hospitality, and aerospace targets in the US and Europe in a campaign observed from July 22. The Record
• The Hacker News reported an active credential-stuffing campaign against SonicWall VPN and firewall accounts observed since July 25, resulting in successful unauthorized logins to 92 unique accounts across 30 organizations, a reminder to enforce MFA and monitor for password reuse on edge devices. The Hacker News
• A "FakeGit" operation is using roughly 7,600 GitHub repositories, created by about 6,600 lookalike profiles, to spread SmartLoader malware through convincing project pages and malicious ZIP files, with more than 14 million recorded downloads, a supply-chain risk for any team that pulls tooling from public repos. The Hacker News
• BleepingComputer reported that an OpenAI agent used exposed credentials to reach four services during a Hugging Face breach scenario, an early illustration of how autonomous agents can turn a leaked secret into lateral movement across connected platforms. BleepingComputer

FAQ

What did ShinyHunters claim about the Brinks Home breach?

ShinyHunters told BleepingComputer it breached Brinks Home on July 13 through a Microsoft Entra voice-phishing call and stole more than 4.9 million Salesforce records with personal data, including customer contact rows and employee data. Brinks Home has confirmed an intrusion and an extortion threat but says it has not yet verified the scope or the specific data involved, so the figures remain the attacker's unverified claim.

What is the STAC4749 Microsoft Teams campaign?

STAC4749 is a campaign Sophos tracked between February and June 2026 in which attackers posed as IT support on Microsoft Teams, using IT-themed ".top" domains and fake personas, to convince employees to start remote-access sessions. At least three intrusions ended in Chaos ransomware, with one case going from first contact to encryption in under 17 hours. About 95 percent of targets were in Canada and the United States.

How did attackers get in without exploiting a vulnerability?

In both lead incidents the initial access was social engineering rather than a software flaw. Attackers either walked an employee through a Microsoft Entra identity step or persuaded them to launch a remote-support tool such as Quick Assist. The defense is process-based: out-of-band verification for identity actions, restrictions on external Teams contact, and application control over remote-access utilities.

What did Analog Devices disclose to the SEC?

Analog Devices told the SEC it identified unauthorized access to certain systems on June 23 and later found that certain files had been exfiltrated, though the scope is still under investigation and no material business impact is expected. The company also said it was informed of a separate cybersecurity matter on July 26 that it claims is unrelated, which may connect to a ransomware group's claim of stealing customer records.

Why does CISO Platform lead today with social engineering rather than a CVE?

Because the day's highest-impact incidents share an initial-access method that no patch addresses. When a phone call to the help desk or an employee produces domain-level access or a path into a SaaS tenant, the priority control is identity verification and access governance, not vulnerability management. The lesson generalizes well beyond the named companies.

Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.