Browse public community intelligence reports, source analysis, and threat research.
10 intel reports
Threat actors utilized Adversary-in-the-Middle (AitM) relays to steal and replay Microsoft 365 session tokens, registering rogue devices and MFA methods for persistence.
An unattributed threat actor used AiTM phishing and device code flows to steal M365 session tokens, replaying them to register rogue devices and wipe MFA methods across 79 organizations.
ARToken is a Phishing-as-a-Service platform that abuses Microsoft's OAuth 2.0 device code flow to bypass MFA and achieve full Entra tenant takeover.
Storm-2755 (Payroll Pirates) uses AiTM phishing and Microsoft Graph reconnaissance to hijack Microsoft 365 sessions and divert employee salaries.
The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.
Storm-2755 (Payroll Pirates) uses AiTM phishing and residential proxies to compromise Microsoft 365 accounts for financial data theft and payroll diversion.
Threat actor UAT-11764 and ransomware groups Sinobi and Warlock are weaponizing QR phishing and legitimate RMM tools like MeshAgent to bypass MFA and maintain persistent access.
Threat actors Storm-2755 and Storm-2657 utilize AiTM session theft and Microsoft Graph API reconnaissance to execute financial theft by redirecting payroll payments.
The Kali365 Live PhaaS platform enables large-scale device code phishing and AitM session capture targeting Microsoft 365 environments across multiple sectors.
Storm-2755 uses AiTM techniques and SEO poisoning to hijack user sessions and divert payroll payments within Canadian organizations.
