Browse public community intelligence reports, source analysis, and threat research.
61 intel reports
An unattributed threat actor used AiTM phishing and device code flows to steal M365 session tokens, replaying them to register rogue devices and wipe MFA methods across 79 organizations.
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Helix extortion group uses vishing and device code phishing to compromise identities and automate bulk data exfiltration from SharePoint environments.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
The Kali365 Phishing-as-a-Service platform exploits Microsoft's device code authentication flow to bypass MFA and capture persistent OAuth tokens for M365 environments.
The EvilTokens phishing-as-a-service platform uses OAuth device-code flows to bypass MFA and maintain persistent access to Microsoft 365 environments.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
Storm-2992 operates EvilTokens, an AI-driven Phishing-as-a-Service platform targeting Microsoft 365 through device code authentication abuse to facilitate business email compromise.
