Yeji Hwang
@yezyizhere0 followers0 downloads56 copies1 like167 views
4 intel reports
Filters
Last updated
All Time
Adversaries
1
1
1
1
1
CVEs
1
1
1
1
Malware / Tools
1
1
1
1
1
MITRE Techniques
2
2
2
2
2
Publisher
1
1
1
1
1
Device-code OAuth Phishing Exploiting Microsoft Identity Flows
Attackers are abusing legitimate Microsoft device-code OAuth workflows via deceptive document-verification pages to steal access tokens and bypass MFA.
Social Engineering Campaign Exploiting Quick Assist and MSI Sideloading
Threat actors use Microsoft Teams social engineering and Quick Assist to deploy a two-component relay and reverse shell via DLL sideloading and WMI execution.
TWINLOOT Framework Abuses Microsoft Cloud Services
TWINLOOT is a modular Python implant using Microsoft SharePoint, Teams, and headless Edge browsers for stealthy command-and-control and lateral movement.
ClickFix Infostealer Deployment via WebDAV and Pcalua
ClickFix campaign leverages pcalua.exe and WMI to mount remote WebDAV shares for executing infostealer DLLs via rundll32.exe.