Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories

This week’s bulletin captures a cybersecurity landscape increasingly shaped by artificial intelligence, both as a weapon and a shield. A ransomware affiliate weaponized Claude Code to autonomously steal LDAP credentials, backdoor VPNs, and exfiltrate SQL databases, while a separate criminal AI service called MessiahGPT surfaced on BreachForums offering uncensored malware generation to low-skill attackers. On the defensive side, Anthropic expanded Claude Security’s vulnerability-scanning capabilities, underscoring how the same technology is being pulled in opposite directions by attackers and defenders alike. Identity and access management dominated the vulnerability news cycle, with a critical Entra ID remote-code-execution flaw, a Microsoft 365 session-hijacking campaign that bypassed MFA after authentication, and a separate BEC attack that drained vendor payments from a hijacked finance mailbox. Microsoft’s decision to make passkeys the default in Entra ID and retire SMS/voice authentication signals a broader industry shift away from phishable credentials, even as attackers found new paths around existing MFA implementations. Enterprise infrastructure took hits from multiple directions this week. Microsoft SCCM, VMware vCenter, and Citrix NetScaler all saw critical flaws exploited or weaponized with public proof-of-concept code, while a McDonald’s and Vodafone-linked Azure credential theft campaign exposed millions of enterprise records tied to infostealer-compromised accounts. Meanwhile, Shell…