OnTrac Breach, Hermes AI Abuse, Hotel Wi-Fi DNS Hijacks, and New Azure Criticals Lead Today’s Threat Digest

Top Stories

OnTrac notifies customers of data breach after network hack

Parcel delivery company OnTrac says attackers breached its corporate network and may have accessed customer personal data, according to BleepingComputer (source).

Why it matters:
Logistics providers sit on dense collections of customer identity and shipment data. Even when payment data is not mentioned, exposed names, addresses, phone numbers, and delivery context can fuel phishing, package scams, business email compromise pretexting, and follow-on fraud.

What to do next: - Watch for brand-themed phishing tied to deliveries, missed packages, and address verification. - If your users interact with shipping vendors, brief help desks to expect customer-reported scam traffic. - Hunt for email messages or SMS campaigns impersonating shipping providers within secure email gateways and mobile messaging awareness workflows. - Review any B2B integrations with shipping vendors for credential reuse and API token hygiene.

Technical Notes

Example mail gateway queries to surface likely delivery-themed phishing:

grep -Ei "ontrac|delivery|package|shipment|address verification|missed delivery" /var/log/mail.log

Microsoft 365 Defender advanced hunting example for suspicious delivery lures:

EmailEvents
| where Subject has_any ("OnTrac","delivery","package","shipment","address verification")
| project Timestamp, SenderFromAddress, RecipientEmailAddress, Subject, NetworkMessageId
| order by Timestamp desc

---

Hermes AI agent reportedly used to automate attack activity against Thailand’s Ministry of Finance

BleepingComputer reports a threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation work during an alleged breach of Thailand’s Ministry of Finance (source).

Why it matters:
This is the operational shift defenders have been anticipating: AI used less as novelty and more as force multiplication after initial access. Even if the initial compromise path is unchanged, automation can compress attacker dwell time and speed up privilege discovery, lateral movement prep, and data triage.

What to do next: - Reduce the blast radius of compromised admin sessions with just-in-time access and short-lived credentials. - Tighten PowerShell, shell, and RMM telemetry retention so rapid post-exploitation still leaves useful traces. - Review EDR detections for bursts of command execution, scripted reconnaissance, and chained administrative actions. - Prioritize detections around behavior, not just malware families.

Technical Notes

Behaviors worth alerting on: - A sudden spike in short-lived shell processes from a single parent process. - Repeated identity, host, share, and permission enumeration commands in quick succession. - Remote execution followed by compression, staging, or bulk file access.

Linux examples to review auth and shell activity:

last -a
journalctl -u ssh --since "24 hours ago"
grep -R "sudo\|su:" /var/log/auth.log*

Windows event IDs commonly useful in post-exploitation hunts: - 4624: successful logon - 4648: logon with explicit credentials - 4688: process creation - 4104: PowerShell script block logging - 7045: new service creation

---

Hackers hijack hotel Wi-Fi DNS to steal Microsoft 365 accounts

Attackers are reportedly changing DNS settings on Wi-Fi devices at hotels and conference centers to redirect users to fake Microsoft 365 login pages, per BleepingComputer (source).

Why it matters:
This is a strong reminder that phishing infrastructure does not always begin with email. If an attacker controls DNS resolution on captive portal or edge gear, even cautious users can be pushed toward convincing credential harvest pages.

Who is most exposed: - Traveling executives and sales staff - Conference attendees - Contractors using unmanaged devices - Organizations without phishing-resistant MFA

What to do next: - Enforce phishing-resistant MFA for Microsoft 365 where possible. - Require VPN on untrusted networks. - Train users to avoid re-auth prompts on hotel or conference Wi-Fi unless they initiated the session. - Review conditional access to challenge unusual sign-ins from travel destinations and unfamiliar network contexts. - Consider DNS-over-HTTPS policies and device posture controls on managed endpoints.

Technical Notes

Quick DNS sanity checks from a managed endpoint:

nmcli dev show | grep DNS
resolvectl status
nslookup login.microsoftonline.com
dig login.microsoftonline.com

Check for suspicious Microsoft 365 sign-in patterns in Entra ID: - Impossible travel - Multiple failed logins followed by success - Sign-ins from anonymizing infrastructure - MFA fatigue or repeated prompt denials

Example KQL pattern in Microsoft Sentinel:

SigninLogs
| where AppDisplayName has "Office" or AppDisplayName has "Microsoft"
| summarize Attempts=count(), IPs=dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h)
| where Attempts > 10 or IPs > 3
| order by TimeGenerated desc

---

Microsoft says maintenance bug caused major Microsoft 365 outage

Microsoft attributes Thursday’s large Microsoft 365 outage to a bug in its automated network maintenance request system, which mistakenly removed IP routes from more devices than intended, affecting Azure and Microsoft 365 services, according to BleepingComputer (source).

Why it matters:
This is not a breach story, but it is a resilience story. For defenders and IT admins, major SaaS outages can look like security incidents at first: failed sign-ins, unreachable apps, abnormal traffic patterns, and a flood of support tickets.

What to do next: - Separate outage triage from compromise triage in incident playbooks. - Make sure identity and business continuity runbooks include provider-status validation. - Validate fallback communications for email-dependent teams. - Test offline access, alternate collaboration channels, and local admin break-glass procedures.

Technical Notes

During major SaaS disruption, capture evidence before making changes:

curl -I https://portal.office.com
nslookup portal.office.com
traceroute portal.office.com

Keep an internal checklist: 1. Confirm provider status page. 2. Check multiple networks and regions. 3. Validate whether failures are authentication-only, routing-only, or application-wide. 4. Preserve timestamps for incident review.

---

Chick-fil-A says more than 13,000 customers were hit in credential stuffing attacks

Chick-fil-A confirmed that over 13,000 customer accounts were breached in credential stuffing attacks targeting its website and mobile app between June 17 and June 19, per BleepingComputer (source).

Why it matters:
This is a classic reminder that account takeover remains a high-volume, low-cost attack path. The root cause is often not a breach of the targeted company itself, but password reuse from unrelated compromises.

What to do next: - Enforce MFA where customer experience allows. - Deploy bot detection and rate limiting on login endpoints. - Monitor for password spraying and login failure spikes. - Check whether exposed user populations overlap with known credential dumps. - Encourage password manager adoption and block weak or known-compromised passwords.

Technical Notes

Common indicators of credential stuffing: - Many login attempts from a small IP set - High failure rate followed by isolated successes - Uniform user-agent strings - Bursts against /login, /auth, or mobile API auth endpoints

Example NGINX review:

grep 'POST /login' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr | head

Example fail2ban-style thresholding concept:

# Pseudocode concept
if failed_logins_from_ip > 25 in 5m:
    block_ip()

Critical Vulnerabilities

CVE-2026-56163: Microsoft Azure Kubernetes Service missing authentication for critical function

• CVSS: 10.0
• Summary: Microsoft describes this as missing authentication for a critical function in Azure Kubernetes Service that could allow unauthorized privilege elevation over a network (MSRC).

So what?
AKS is often connected to sensitive workloads, CI/CD pipelines, secrets, and internal services. A critical auth flaw in managed Kubernetes infrastructure deserves same-day review.

Priority actions: - Check Microsoft’s guidance and mitigation status in your tenant. - Inventory all AKS clusters and exposed management integrations. - Review RBAC, cluster admin assignments, and service principal permissions. - Hunt for anomalous control-plane or management-plane actions around the disclosure window.

Technical Notes

Useful starting points for Azure inventory:

az aks list --output table
az role assignment list --all --output table
az ad sp list --display-name kubernetes

---

CVE-2026-57106: SSRF in Microsoft Data Quality

• CVSS: 10.0
• Summary: Microsoft lists a server-side request forgery issue in Data Quality that could allow unauthorized privilege elevation over a network (MSRC).

So what?
SSRF is especially dangerous in cloud and service-oriented environments because it can become a stepping stone to metadata access, internal API reachability, or trust-boundary bypass.

Priority actions: - Identify any deployment of the affected service. - Restrict outbound access from application components where feasible. - Review logs for unusual internal HTTP requests or requests to metadata endpoints. - Apply vendor-provided remediations as they become available.

Technical Notes

Patterns often worth hunting in logs:

169.254.169.254
metadata
localhost
127.0.0.1
http://10.
http://172.16.
http://192.168.

Example grep:

grep -R "169.254.169.254\|localhost\|127.0.0.1" /var/log/*

---

CVE-2026-58630: Improper access control in Azure App Service

• CVSS: 10.0
• Summary: Microsoft says improper access control in Azure App Service could allow unauthorized privilege elevation over a network (MSRC).

So what?
App Service is widely used for internet-facing workloads. Critical access control issues in PaaS environments can affect apps, deployment workflows, and potentially downstream identities or secrets.

Priority actions: - Enumerate App Service instances and deployment slots. - Review publish profiles, managed identities, and deployment credentials. - Check for unusual deployment events or configuration changes. - Validate network restrictions and authentication settings on admin endpoints.

Technical Notes

Quick App Service inventory:

az webapp list --query "[].{name:name, resourceGroup:resourceGroup, state:state, hostNames:defaultHostName}" -o table
az webapp deployment list-publishing-profiles --name <app-name> --resource-group <rg>

---

CVE-2026-15704: Eclipse BaSyx Go Components trailing-slash authorization bypass

• CVSS: 9.8
• Summary: Eclipse disclosed an authorization bypass in ABAC-enabled deployments caused by inconsistent trailing-slash handling between middleware and the HTTP router. A request like /shells/ could bypass intended ABAC enforcement for /shells in affected versions up to and including 1.0.0 (release, pull request).

So what?
This is the kind of bug defenders miss because the application “looks authenticated” while edge-case normalization breaks policy enforcement. If you operate industrial or digital-twin-related services using these components, prioritize review.

Priority actions: - Upgrade to version 1.0.1 or later where applicable. - Test protected routes with and without trailing slashes. - Review reverse proxy normalization behavior. - Confirm ABAC policy decisions are logged for both route forms.

Technical Notes

Simple validation concept:

curl -i https://target.example/shells
curl -i https://target.example/shells/

Look for inconsistent status codes or missing policy checks between the two.

---

CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 authentication bypass

• CVSS: 9.8
• Summary: CISA’s advisory says the device web interface does not validate credentials server-side correctly, allowing login with empty username and password fields and resulting in administrative access (CISA advisory, CSAF).

So what?
This is an OT and edge infrastructure concern. Administrative access to power relay management, reboot functions, remote access configuration, and network settings can translate into operational disruption and potentially physical consequences.

Priority actions: - Identify exposed TPDIN-Monitor-WEB2 devices immediately. - Remove internet exposure and restrict management interfaces. - Segment affected devices from broader IT networks. - Apply vendor guidance from the advisory and monitor for unauthorized config changes.

Technical Notes

Fast asset discovery ideas: - Search CMDB and procurement records for model references. - Scan management networks for web interfaces only from authorized internal hosts. - Review firewall rules for direct inbound access to OT management interfaces.

Example internal-only discovery:

nmap -sV -p 80,443 <authorized-ot-subnet>

What Defenders Should Do Today

1. Review Microsoft cloud exposure now.
   Inventory AKS and App Service usage, track vendor guidance for CVE-2026-56163, CVE-2026-57106, and CVE-2026-58630, and prepare emergency change windows where required.

2. Harden identity against credential theft.
   Push phishing-resistant MFA for Microsoft 365 admins and high-risk users, especially frequent travelers and conference attendees.

3. Treat public and guest Wi-Fi as hostile.
   Require VPN on untrusted networks, disable unnecessary auto-join behavior, and educate users about captive portal and fake re-auth prompts.

4. Tune for account takeover patterns.
   Credential stuffing remains effective. Add rate limits, bot defenses, anomaly detection, and impossible-travel review for consumer and workforce identities.

5. Verify resilience playbooks.
   The Microsoft 365 outage is a reminder that not every access disruption is malicious. Ensure your incident processes distinguish provider outages from compromise.

6. Check third-party and OT footprints.
   Logistics vendors, consumer apps, and edge management interfaces continue to create downstream risk. Confirm segmentation, alerting, and vendor notification paths.

Final Takeaway

Today’s cybersecurity threats show three themes clearly: identity remains the easiest target, cloud control planes demand immediate attention when critical flaws land, and AI is starting to accelerate attacker operations after access is gained. The practical response is straightforward: tighten MFA and conditional access, reduce administrative exposure, review cloud inventories, and keep hunting focused on attacker behavior rather than branding alone.

For today, the highest-priority actions are Microsoft cloud review, Microsoft 365 identity hardening, and travel-user phishing prevention.

This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.