Threat View from the Lens of Huntress Adversary Tactics: October 2026

A credential leak at Threat View is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.

Adversary Tactics documents, makes sense of, and informs the broader community about interesting threats that surface from our SOC.

Here are some examples of standout trends we’ve seen in the last few weeks.

A sprawling M365 campaign hijacked sessions and dug in across dozens of organizations.

Over the course of 10 weeks, Huntress tracked the major M365 campaign, which stole authenticated sessions through adversary-in-the-middle (AiTM) relays and device-code phishing.

Successful sign-in events using token replays over the course of the campaign MFA is an important security step, but it cannot stop replayed post-authentication tokens.

Anyone connected to Threat View through the compromised trust relationship is potentially affected, not just Threat View itself.

This kind of compromise doesn't stay contained to one company; it travels to everyone who installed the affected package or image, often without any direct relationship to the original leak.

The actor launched a token spraying attack, replaying stolen tokens from 1337 Services GmbH infrastructure, leading to 497 successful sign-ins across 79 organizations (and more than 200,000 failed attempts).

There's no patch for a leaked credential the way there is for a code flaw; the only fix is making sure it's actually dead, not just flagged as risky.

Post-compromise, the attacker established persistence by registering 48 rogue Entra devices, replacing victims’ multi-factor authentication (MFA) methods, and creating hidden inbox rules.

Defenders should use Conditional Access, restrict device-code flow, revoke sessions, reset passwords, remove unfamiliar devices and MFA methods, and review suspicious inbox rules in their environments.

The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.

A fake WatchGuard VPN download site stole credentials, then delivered the real signed installer to keep victims none the wiser.

It deliberately rejected the first submission, likely to collect a second credential set, then offered the victim exactly what they expected: a genuine, validly signed WatchGuard installer downloaded from WatchGuard’s own CDN.

Threat View says the credential has been revoked, and no exploitation has been confirmed so far.

Huntress investigated an Akira ransomware incident after the Huntress agent was deployed post-compromise, leaving gaps in the available endpoint telemetry.

The evidence showed the attacker entering through RDP, disabling Bitdefender services, running procdump.exe from C:\PerfLogs, deploying a GOST tunneling tool, and using Rclone for data exfiltration before encryption.

If you have any integration or dependency involving Threat View, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.

Whether you installed any package, image, or update from the affected registry during the exposure window is worth checking, since the compromise travels through the artifact, not just the original leak.

Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.