Executive Overview

This week’s IronCORE Recon points to identity abuse, exposed enterprise platforms, and trusted collaboration infrastructure as the dominant themes. Ransomware-linked actors are tied to Fortinet credential theft, Microsoft 365 attacks are shifting toward OAuth and session token abuse, ClickFix campaigns are turning verification prompts into malware delivery, and SharePoint plus Oracle E-Business Suite remain active exploitation concerns.

Key Articles & Threat Summaries

1. FortiBleed credential-theft campaign linked to Lynx ransomware

Source: Bleeping Computer

FortiBleed credential theft has been tied to INC and Lynx ransomware operations, including Fortinet credential harvesting and ransomware negotiation panel access.

Why It Matters:

Edge credentials should be treated as ransomware precursors.

2. ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds

Source: Bleeping Computer

ConsentFix abuses Microsoft 365 OAuth flows to steal session access without traditional credential phishing.

Why It Matters:

Identity defense must include OAuth consent governance, token monitoring, and conditional access validation.

3. Fake Google and Cloudflare verification pages spread multiple malware families

Source: MalwareBytes

Malwarebytes found ClickFix campaigns using fake Google and Cloudflare verification pages to deliver multiple malware families.

Why It Matters:

Routine user prompts are becoming malware-delivery infrastructure.

4. CISA: Microsoft SharePoint RCE flaw now actively exploited

Source: Bleeping Computer

CISA warned that CVE-2026-45659 is now actively exploited, with more than 10,000 SharePoint servers exposed online.

Why It Matters:

Collaboration platforms remain high-value targets when exposed and unpatched.

5. Over 900 Oracle E-Business instances exposed to ongoing attacks

Source: Bleeping Computer

Roughly 950 Oracle E-Business Suite instances are exposed while attackers exploit CVE-2026-46817.

Why It Matters:

ERP exposure creates direct operational and financial risk.

6. DHS confirms hackers breached HSIN info-sharing platform

Source: Bleeping Computer

DHS confirmed an incident affecting HSIN, an unclassified information-sharing environment used by public and private-sector partners.

Why It Matters:

Trusted coordination platforms can carry strategic impact even when classified systems are not affected.

Bottom Line Conclusion Summary

The week’s core trend is trust abuse. Attackers are exploiting identity flows, sessions, edge credentials, collaboration platforms, and enterprise systems that organizations depend on every day.

For immediate assistance with securing AI, network intrusion, ransomware
attack, or BEC, please contact: IrongateResponse@irongatesecurity.com