TA419 Phishing Campaign Poses as Anthropic Staff
A Chinese Spy Group Targets Trust, Not Bugs A Chinese cyber-espionage group has chosen a new way into the circle of American AI experts. It does not use a vulnerability. It uses trust. The...
Tagged: Microsoft 365
BigBear 2.0: Evilginx2 Phishing Platform Bypasses Microsoft 365 MFA at Scale
A user may enter the correct password, complete MFA verification, and still lose their Microsoft 365 account. The phishing platform BigBear 2.0 intercepts the authenticated session after the second factor and delivers the attacker...
Microsoft Teams Adds Policy to Fully Block External Bots From Meetings
Corporate video meetings are increasingly attracting attention not only from employees but from automated services as well, prompting Microsoft to roll out new protections within Teams. Administrators will now be able to fully block...
HollowGraph Malware Exploits Microsoft 365 Calendars
Unveiling the HollowGraph Threat A cloud calendar can conceal far more than mundane appointments; the HollowGraph malware exploits Microsoft 365 to clandestinely receive commands and transmit pilfered files. Cybersecurity experts at Group-IB have detected...
Payroll Pirate Attack Hijacks Microsoft 365 Sessions to Steal Pay
A new Payroll Pirate attack is quietly draining paychecks across multiple industries. Security Risk Advisors (SRA) recently flagged active intrusions inside several monitored client networks. Notably, the campaign skips malware entirely. Instead, it hijacks...
Hackers Hijack Microsoft 365 Accounts via Legitimate Device Code Flows
Both fraudulent actors and state-sponsored syndicates have commenced the large-scale deployment of a novel stratagem to usurp Microsoft 365 credentials. Eschewing traditional password theft, these adversaries coerce victims into voluntarily granting account access via...
The “EvilTokens” Surge: Why Device Code Phishing Exploded 37-Fold in 2026
The architecture of account exploitation is undergoing a profound metamorphosis, as adversaries increasingly eschew traditional subversion in favor of co-opting legitimate authorization frameworks. At a cursory glance, the procedure appears innocuous; however, therein lies...
EvilMist: The Ultimate Swiss Army Knife for Azure and Entra ID Red Teaming
EvilMist is a collection of scripts and utilities designed to support cloud security configuration audit, cloud penetration testing & cloud red teaming. The toolkit helps identify misconfigurations, assess privilege-escalation paths, and simulate attack techniques....
The Serverless Spectre: How TokenFlare is Redefining M365 Phishing with Built-In Intune Bypasses
TokenFlare Serverless AITM Phishing Simulation Framework for Entra ID / M365 Features Lean: Core logic (in src/worker.js only ~530 lines of JavaScript). Modular: Supports a number of OAuth flows, with Intune Conditional Access bypass support out of the...
Office Under Siege: Microsoft Rushes Emergency Fix for Active Zero-Day
Microsoft has issued an urgent, out-of-band security update for Microsoft Office to mitigate a high-stakes zero-day vulnerability that is currently being exploited in live environments. This flaw facilitates the circumvention of native security protocols...
The Insider Threat: How Tycoon 2FA Bypasses Microsoft 365 MFA via Spoofing
Occasionally, the most perilous phishing missives appear as though they were dispatched by a colleague in the adjacent office. This is precisely the strategy currently favored by adversaries who have mastered the art of...
The Raccoon’s End: Nigerian Police Arrest Mastermind Behind RaccoonO365 PhaaS
Nigerian authorities have arrested an individual believed to be one of the developers behind RaccoonO365, a phishing-as-a-service platform that enabled criminals to mass-produce fake Microsoft login pages and harvest victims’ usernames and passwords. Acting...
