Browse public community intelligence reports, source analysis, and threat research.
13 intel reports
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
The Storm-1747 threat actor uses the Tycoon 2FA AiTM phishing kit to bypass multi-factor authentication and maintain persistence in Microsoft 365 and Google Workspace environments.
Storm-1747 utilizes Tycoon 2FA to bypass MFA and maintain persistence through device registration and session token theft targeting Microsoft and Google cloud environments.
