#microsoft-365
-
Microsoft 365 Token-Replay Campaign Hits 79 Organizations
Huntress detailed a campaign in which attackers captured sign-in sessions via an adversary-in-the-middle relay and replayed the stolen tokens, breaking into 97 accounts.
-
Stolen ConnectWise Credential Opens Door to 173 Microsoft 365 Tenants
Attackers abused a compromised ConnectWise Cloud Backup credential to sign in to its customers' Microsoft 365 environments, inheriting the legitimate app's sweeping permissions.
-
CSuite Phishing Targets US Firms, Steals Microsoft 365 Sessions and Plants RMM Tools
ANY.RUN researchers detailed a US-focused phishing campaign called CSuite that pairs Microsoft 365 session theft with the deployment of legitimate remote-access tools.
-
TeamFiltration Campaign Cracks Seven Microsoft 365 Accounts via Default Passwords
The UNK_CondorFiltration password-spraying campaign hit more than 5,700 accounts across 28 Microsoft 365 tenants, mostly at Chilean retail and financial firms. All seven accounts that fell were forgotten service accounts with default passwords and no MFA.
-
Passkey-Themed Phishing: How Data Is Stolen from Microsoft 365
Microsoft is tracking a wave of attacks in which ransomware groups use the pretext of an “urgent passkey update” to coax access out of corporate accounts and methodically siphon data from the cloud.
-
BigBear 2.0: Phishing Service Bypassed MFA at 258 Organizations
The phishing-as-a-service platform BigBear 2.0 intercepted more than 5,000 Microsoft 365 credentials, bypassing multi-factor authentication with an adversary-in-the-middle attack.
-
Microsoft blames a network maintenance system bug for the massive Microsoft 365 outage
A bug in an automated maintenance-request system removed IP routes from more devices than intended, disrupting Azure and Microsoft 365.
-
Server Misconfiguration Exposed Three Phishing Campaigns Against Microsoft 365
France's Lexfo uncovered three Evilginx-based phishing operations targeting Microsoft 365 users, thanks to an accidental slip by one of the attackers. The leak was caused by an unsecured web server with directory listing enabled.
-
New Forg365 Phishing Platform Uses AI to Steal Microsoft 365 Accounts
Researchers have uncovered Forg365, a phishing platform that uses AI to generate lures for stealing Microsoft 365 credentials. The service runs on a phishing-as-a-service model and combines several defense-evasion techniques.
-
ARToken platform uncovered — an affiliate of the EvilTokens phishing service
Researchers have uncovered a new phishing-as-a-service platform called ARToken, operating as an affiliate of the EvilTokens service. This offered a look inside an extensive toolkit for compromising Microsoft 365 accounts.