News

A new NYT Connections puzzle appears at midnight each day for your time zone – which means that some people are always playing 'today's game' while others are playing 'yesterday's'. If you're looking for Tuesday's puzzle instead then click here: NYT Connections hints and answers for Tuesday, August 4 (game #1150).

Good morning! Let's play Connections, the NYT's clever word game that challenges you to group answers in various categories. It can be tough, so read on if you need Connections hints.

What should you do once you've finished? Why, play some more word games of course. I've also got daily Strands hints and answers and Quordle hints and answers articles if you need help for those too, while Marc's Wordle today page covers the original viral word game.

SPOILER WARNING: Information about NYT Connections today is below, so don't read on if you don't want to know the answers.

Today's NYT Connections words are…

• LUCKY
• MISSION
• RANCH
• CATTLE
• WRANGLER
• INVESTMENT
• GAP
• STEER
• BROTH
• PILOT
• CAPE COD
• MERCHANDISE
• DRIVE
• DIESEL
• TUDOR
• MANEUVER

What are some clues for today's NYT Connections groups?

• YELLOW: Plot a path
• GREEN: Purveyors of denim
• BLUE: Types of home buildings
• PURPLE: The common link rhymes with “lock”

Need more clues?

We're firmly in spoiler territory now, but read on if you want to know what the four theme answers are for today's NYT Connections puzzles…

What are the answers for today's NYT Connections groups?

• YELLOW: NAVIGATE
• GREEN: JEANS BRANDS
• BLUE: HOUSE STYLES
• PURPLE: WHAT "STOCK" MIGHT REFER TO

Right, the answers are below, so DO NOT SCROLL ANY FURTHER IF YOU DON'T WANT TO SEE THEM.

The answers to today's Connections, game #1151, are…

• YELLOW: NAVIGATE: DRIVE, MANEUVER, PILOT, STEER
• GREEN: JEANS BRANDS: DIESEL, GAP, LUCKY, WRANGLER
• BLUE: HOUSE STYLES: CAPE COD, MISSION, RANCH, TUDOR
• PURPLE: WHAT "STOCK" MIGHT REFER TO: BROTH, CATTLE, INVESTMENT, MERCHANDISE

• My rating: Hard
• My score: 1 mistake

I fell for the obvious trap and linked WRANGLER, CATTLE, RANCH, and STEER today. But unable at that point to see any alternative groups, I went for it anyway.

Thankfully, after this mistake I found my way to the four tiles that made up NAVIGATE.

Not for the first time I’d take issue with Connections and protest that GAP, while being a seller of jeans, is not exactly one of the top JEANS BRANDS. Very misleading. Oh well, I Guess I will have to Levi it there as it’s onLee a game.

• YELLOW: LONG CYLINDRICAL THINGS: CIGARETTE, FOAM ROLLER, POOL NOODLE, PRETZEL ROD
• GREEN: ICONIC NYC SIGHTS: BODEGA, PIGEON, SUBWAY STATION, TAXI CAB
• BLUE: THINGS WITH PEDALS: PIANO, SEWING MACHINE, SWAN BOAT, UNICYCLE
• PURPLE: V-SHAPED THINGS: ANGLE BRACKET, CHEVRON, GOOSE FORMATION, PEACE SIGN

NYT Connections is one of several increasingly popular word games made by the New York Times. It challenges you to find groups of four items that share something in common, and each group has a different difficulty level: green is easy, yellow a little harder, blue often quite tough and purple usually very difficult.

On the plus side, you don't technically need to solve the final one, as you'll be able to answer that one by a process of elimination. What's more, you can make up to four mistakes, which gives you a little bit of breathing room.

It's a little more involved than something like Wordle, however, and there are plenty of opportunities for the game to trip you up with tricks. For instance, watch out for homophones and other word games that could disguise the answers.

It's playable for free via the NYT Games site on desktop or mobile.

• Phishing campaign used fake Teams notifications to route victims to a genuine Microsoft sign-in page
• Rather than stealing passwords, attackers asked victims to approve permissions for an attacker-controlled app, gaining access to mail, files, Teams, SharePoint, OneDrive and calendars without defeating MFA
• Check Point says the technique has been commoditized in 2026 into a rentable service; the practical defense is restricting app consent rather than relying on users to spot a fake

A phishing campaign that ran from late June into July 2026 did something that breaks most of the advice organizations have spent a decade teaching their staff: it sent victims to a real Microsoft login page.

Check Point's email research team, which disclosed the campaign, identified more than 200 phishing emails targeting users across roughly 120 organizations worldwide.

The lure was a fake Microsoft Teams notification with a genuine destination; what actually compromised accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily.

Check Point noted in its brief that what actually compromised the accounts was not a stolen password but a permissions prompt that the victim clicked through voluntarily. This is a reminder of a stark change in attackers' tactics: they have stopped forging Microsoft's front door and started walking through it.

The email appeared to be a Microsoft Planner task-assignment notification. The sender name read "There's New Activity On Team," the subject line claimed that HR had sent three messages via Teams chat, and the body referenced a payroll and benefits update, along with a counter showing four overdue employee tasks.

To someone who works in security, the message had its own telltale signs of being a typical phishing attempt: every link in the email, including both call-to-action buttons, routed through the same redirect. And the visible sender address belonged to the recipient's own organization, meaning the email appeared to have been sent to the same person it came from.

The link opened a real OAuth authorization URL on login.microsoftonline.com, not a look-alike domain. Signing in displayed a permissions prompt asking the user to approve the permissions or accept them on behalf of their organization.

If they did, Microsoft redirected the browser to the redirect address specified in the original request, which in this particular campaign was an AWS API Gateway endpoint under the attackers' control. The authorization code was delivered there, and the attackers exchanged it for access. No password was stolen at any point, and there was no fake page to spot.

This is not unlike how the phishing-as-a-service Kali365 platform compromises Microsoft accounts, but instead of stealing session cookies or OAuth tokens, it opts for a more permanent illicit grant of consent.

This runs counter to the usual security training checklist, which emphasizes adhering to norms rather than going against the grain; users are told to check the URL, look for the padlock, and watch for misspelled domains. None of those measures matter because there is nothing forged to catch. The domain and certificate are Microsoft's, while the sign-in page is the one the user sees every morning, offering a false sense of security to a user not looking for this particular attack vector.

Multi-factor authentication does not help either; it protects the login sequence but not access to the user's data post-login. The attacker never needs the password or the second factor because they walk away with a token granted by the user's valid session, a technique called 'consent phishing'.

There are many ways to prevent this, but the simplest two are asking users to check every single permission/consent screen they click (the phishing attempt still requires users to allow it) and limiting access to permissions for user accounts that applications can request via Microsoft Entra at the system administrator level.

It would be prudent to do the latter at a minimum, even as Check Point notes that the campaign is no longer active because the underlying technique it used is not going anywhere.