Threat Analysis: AhsayCBS Exploits, Hospitality Phishing and What Microsoft's Email Crackdown Means for Your Domain
This is your Daily Threat Analysis for the 9th of November 2026.
Three items today. One is a confirmed active exploitation campaign targeting backup software with significant MSP exposure. One is a phishing operation that has refined personalisation to the point where your front-of-house staff will not spot it. And one is an infrastructure issue that is not a new threat but is suddenly biting businesses that never bothered to get their email authentication in order.
Let us start with the one that has been running for a month without enough attention.
AhsayCBS: Backup Software Exploited for Unauthenticated Remote Code Execution
Beginning on the 7th of October 2026, threat actors began actively exploiting two critical vulnerabilities in AhsayCBS, a cloud backup management platform used by managed service providers and IT resellers. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were chained together to achieve unauthenticated remote code execution with SYSTEM-level privileges on exposed systems.
The attack chain is straightforward and that is what makes it dangerous. CVE-2026-105133 bypasses authentication entirely. Once inside, CVE-2026-105134 provides code execution. No credentials required. No prior foothold needed. If the AhsayCBS management interface is internet-facing, the box is accessible to anyone who knows what to look for, and they clearly do.
Post-exploitation activity documented by Huntress includes deployment of JSP webshells for persistent access and installation of XMRig, a cryptominer that consumes system resources while the attacker uses your infrastructure for their own financial benefit. The webshells are the more serious concern. Cryptomining is noisy and detectable. A webshell sitting quietly on a backup server provides persistent, deniable access to everything that server can reach, and backup servers typically reach everywhere.
Why This Matters to UK SMBs
AhsayCBS is not a household name, which is exactly why this warrants attention. It is the kind of product that sits in an MSP’s stack, manages backups for dozens or hundreds of client environments, and receives zero scrutiny from the businesses it serves. You pay your monthly fee, the backups appear to run, and nobody asks what software is handling the job or whether it has been patched.
The advisory specifically flags MSP targeting. If your IT provider uses AhsayCBS, and the product has significant market share among smaller MSPs, then the question is not whether the vulnerability affects you. The question is whether your provider has patched their instance and whether that patching happened before the 7th of October.
This has been actively exploited for over a month. If your MSP had an unpatched AhsayCBS instance exposed to the internet during that window, your backup data and potentially your wider environment may already have been accessed.
What to Do
Contact your IT provider today and ask two specific questions: do you use AhsayCBS, and have CVE-2026-105133 and CVE-2026-105134 been patched? If they cannot answer immediately, escalate. If they confirm the product is in use but cannot confirm the patch status or when patching occurred, treat that as a potential compromise and ask for a review of backup server access logs going back to the 7th of October.
If you manage your own backups and use AhsayCBS directly, check your version against the vendor’s patched release and apply the update immediately. The management interface should not be internet-facing without VPN restriction regardless of patch status.
Hospitality Phishing: Personalised Fake Booking.com Pages with 3D Secure Bypass
Netcraft has documented a phishing campaign targeting hospitality customers through fake hotel reservation pages that impersonate Booking.com and other hotel services. The operation is worth covering in detail because the level of personalisation involved takes it well beyond the standard credential-harvesting phish.
The campaign uses two visual templates built on shared underlying code. What sets it apart is the content: the fake pages include the actual hotel name, the actual reservation dates, the actual quoted price, and genuine guest contact information. This is not a generic brand impersonation. Someone has obtained real reservation data, through compromise of hotel management systems, third-party booking platforms, or prior credential theft, and is using it to construct lures that look indistinguishable from legitimate correspondence.
The payload is payment card theft with a 3D Secure bypass component. The 3D Secure bypass is significant. That is the layer most banks use to add a second factor to online card transactions. Bypassing it suggests the operation has invested in infrastructure beyond a simple phishing page, either real-time phishing proxies that relay data to live transaction attempts, or a social engineering layer that walks victims through the bypass process themselves under the pretence of verifying the reservation.
The campaign is documented across multiple languages, which indicates this is not a narrowly targeted operation. It is industrialised.
Why This Matters to UK SMBs
Two groups are directly exposed.
The first is businesses in the hospitality sector, hotels, B&Bs, serviced apartments, holiday lets, whose customers may be targeted using data that originated from their own booking systems. If your property management software or booking platform has been compromised, your guests are receiving personalised phishing messages in your name. That is a reputational and potentially a regulatory problem, since guest data being used to defraud them is a data breach under UK GDPR regardless of whether it was your systems or a third-party platform that was compromised.
The second is any business that regularly books travel for staff. Your travel manager, office manager, or executive assistant may receive a reservation confirmation that matches a genuine upcoming booking exactly. The personalisation is designed to defeat the usual advice, look for generic greetings, wrong dates, unfamiliar hotel names. None of those indicators apply here.
What to Do
For hospitality businesses: audit your booking platform and property management system for signs of unauthorised access or data export. Review which third-party integrations have access to guest data and when they last had a security review. If you use a channel manager that connects to Booking.com and similar platforms, check whether that integration has appropriate access controls.
For businesses booking travel: brief your staff. The specific tell here is not in the email appearance, it is in the payment request. Legitimate hotel reservations do not require card re-entry via a link in an email after the booking is confirmed. Any reservation confirmation that asks for payment card details through an embedded link or redirected page should be treated as suspicious regardless of how accurate the booking details appear. Call the hotel directly using a number from their official website if there is any doubt.
If someone in your business has entered card details on one of these pages, treat it as a card compromise. Contact the bank, cancel the card, and report to Action Fraud.
Microsoft’s Email Authentication Crackdown: Legitimate Mail Getting Bounced
This one is not a new threat. It is an infrastructure enforcement issue that has become urgent.
Microsoft has implemented stricter email authentication requirements for Outlook.com, and legitimate email from domains with missing or misconfigured DMARC and SPF records is being bounced or treated as suspicious. The Register reported on this today. The practical effect is that businesses with poorly configured email authentication are suddenly finding their correspondence not arriving.
The NCSC has published guidance on email authentication, SPF, DKIM, and DMARC, and has recommended proper configuration for years. The fact that this is still causing widespread disruption in November 2026 tells you everything about how seriously organisations take it until something breaks.
SPF tells receiving mail servers which IP addresses are authorised to send email on behalf of your domain. DKIM provides a cryptographic signature that verifies the message has not been tampered with in transit. DMARC ties the two together and tells receiving servers what to do when messages fail, reject, quarantine, or report.
Without these records, your domain is trivially spoofable. Anyone can send email that appears to come from your business. With weak records, SPF without DMARC, for instance, the protection is partial and attackers who have studied your mail infrastructure can still find ways through.
Microsoft enforcing these standards more strictly is not the problem. Businesses that have not implemented them are suddenly experiencing the consequence of that delay.
What to Do
Check your domain’s DNS records today. Use MXToolbox or a similar tool to verify your SPF record is present and accurate, your DKIM is configured for all sending services including any third-party marketing platforms or CRM tools, and your DMARC record is in place.
If you use a third-party email platform, Mailchimp, HubSpot, Xero, any cloud service that sends email on your behalf, check that those services are covered by your SPF record and have DKIM configured. Many businesses implement SPF for their primary mail server and forget entirely about the finance system that sends invoices, or the CRM that sends client updates.
Start with a DMARC policy of p=none with a reporting address if you are uncertain what your mail flow looks like. This gives you visibility before you move to enforcement. Do not jump straight to p=reject without understanding your full mail sending profile first, that is what causes legitimate mail to disappear.
If your IT provider manages your DNS and they have not raised this with you, ask them why not.
A Note on the Wider Picture
All three items today share a common thread: they involve infrastructure that businesses assume is working correctly and therefore never examine. Backup software running in an MSP stack, booking platform integrations, DNS records set up years ago and forgotten. The attackers know this. The campaign playbook increasingly targets the components of your environment that receive the least active attention.
The AhsayCBS exploitation has been running since the 7th of October. That is over a month of active campaigning against a product category, managed backup, that is supposed to be your safety net. If the safety net itself has been compromised, the downstream consequences for ransomware recovery are severe.
If this briefing is useful to you, follow Threat Analysis wherever you listen so tomorrow’s briefing lands automatically, and pass it to someone who needs the heads-up. The people who most need this information are usually the ones who have not heard of it yet.
Sources
| Source | Title | URL |
|---|---|---|
| Huntress | AhsayCBS Flaws Exploit, Webshells and XMRig Cryptominer | https://www.huntress.com/blog/ahsaycbs-flaws-exploit |
| Netcraft | Hospitality Phishing Cluster Uses Personalized Hotel Reservations and Interactive Card Verification | https://www.netcraft.com/blog/hospitality-phishing-cluster-uses-personalized-hotel-reservations-and-interactive-card-verification |
| The Register | Outlook.com bounces legit emails as Microsoft’s authentication crackdown goes sideways | https://www.theregister.com/applications/2026/11/09/outlookcom-bounces-legit-emails-as-microsofts-authentication-crackdown-goes-sideways/5308428 |
| AlienVault OTX | Threat Actors Exploit Critical AhsayCBS Flaws, Pulse | https://www.huntress.com/blog/ahsaycbs-flaws-exploit |
| AlienVault OTX | Hospitality Phishing Cluster, Pulse | https://www.netcraft.com/blog/hospitality-phishing-cluster-uses-personalized-hotel-reservations-and-interactive-card-verification |