Microsoft 365 · page 2

German and US law enforcement agencies have dismantled the core infrastructure of the Kratos phishing kit, identified as one of the most prevalent criminal tools globally for stealing Microsoft 365 credentials.

A newly identified malware, named HollowGraph, has been observed utilizing the calendar functionality within compromised Microsoft 365 mailboxes to establish a command-and-control (C2) channel. This technique allows attackers to discreetly send commands to infected systems and exfiltrate sensitive data…

A novel espionage implant, identified as HollowGraph by cybersecurity firm Group-IB, has been discovered utilizing hijacked Microsoft 365 calendars to establish its command and control (C2) channel. This sophisticated malware embeds operator instructions and smuggles stolen files by attaching them…

ACR Stealer, an infostealer active since 2024, is successfully exfiltrating sensitive data from enterprise networks, including saved browser passwords, active session tokens, PDF documents, Microsoft 365 files, and data from synced OneDrive and SharePoint folders.

Two sophisticated phishing kits, identified as Jalisco and OmegaLord, have emerged, specifically targeting Microsoft 365 accounts with advanced evasion techniques. These kits are designed to circumvent multi-factor authentication (MFA), a critical security layer, making them a significant threat to user…

A novel phishing-as-a-service (PhaaS) operation, dubbed Forg365, has emerged, specifically targeting Microsoft 365 accounts. This operation employs a sophisticated multi-pronged approach that includes device code phishing, adversary-in-the-middle (AitM) session theft, and advanced antibot evasion techniques.

A misconfigured Python web server, left running with directory listing enabled on a public port, inadvertently exposed the operational toolkit for three active Evilginx phishing campaigns targeting Microsoft 365. The command used to launch the server, `python3 -m http.server 8080`…

A sophisticated threat actor, identified by Okta as O-UNC-066, is actively targeting organizations across various sectors by exploiting the Microsoft Entra passkey enrollment process. This campaign utilizes voice-based phishing tactics, commonly known as vishing, to trick Microsoft 365 users…

A novel phishing-as-a-service (PhaaS) operation named Forg365 has emerged, specifically targeting Microsoft 365 accounts. This platform combines sophisticated attack methods, including adversary-in-the-middle (AiTM) and device code techniques, with artificial intelligence to enhance its phishing campaigns.

A threat actor is actively targeting organizations across various sectors with a sophisticated voice phishing (vishing) campaign. The attackers impersonate Microsoft's Entra identity and access management service, specifically targeting users of Microsoft 365.

A recent Evil Tokens campaign, identified as "ghost phishing," is exploiting a new vulnerability in email security protocols, targeting businesses across the United States and Europe. This sophisticated attack method circumvents traditional security measures by keeping the malicious content hidden…

Microsoft has integrated its Copilot AI assistant extensively across Windows and Office applications, but adoption and usage rates remain significantly low. According to a report, fewer than 4.5% of commercial Microsoft 365 customers have opted to pay for the Copilot…

A sophisticated phishing campaign, dubbed DEBULL, has been actively targeting Microsoft 365 accounts by exploiting the legitimate Microsoft device code flow. This campaign, observed between the last week of June 2026 and early July, bypasses traditional credential harvesting methods.

A new phishing-as-a-service (PhaaS) platform named ARToken has been identified, operating as an affiliate of the EvilTokens phishing platform. This discovery provides cybersecurity researchers with detailed insights into a comprehensive toolkit specifically engineered to facilitate the compromise of Microsoft 365…

Microsoft 365 accounts are vulnerable to rapid hijacking through sophisticated phishing techniques known as ConsentFix and ClickFix. These attacks, which can compromise accounts in as little as three seconds, exploit the OAuth authorization framework to steal user tokens and bypass…

An aggressive password-spraying campaign targeting Microsoft 365 environments generated more than 81 million login attempts over a two-week period. This surge in malicious activity highlights a significant threat to cloud-based productivity suites.

The Federal Bureau of Investigation issued an urgent warning this week regarding a sophisticated phishing scheme targeting users of Microsoft 365 products, including Outlook, Teams, and OneDrive. This scam exploits a hacking platform known as Kali365, which allows cybercriminals…