Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Microsoft 365. Show all posts
Microsoft 365 phishing
Cyber Attacks Cyber Phishing Data Breaches Data Extortion data security leaked sensitive data MFA Microsoft 365 Microsoft 365 phishing

Helix Data Extortion Group Targets Microsoft SharePoint Using Vishing and MFA Abuse

 

Cybersecurity researchers have discovered a new data extortion group called Helix that has been targeting companies by using user credentials rather than software vulnerabilities. Helix has been employing voice phishing (vishing), device code phishing, and multi-factor authentication (MFA) abuse to target Microsoft 365 and steal data from the company’s SharePoint service. 

According to the researchers at ReliaQuest, Helix has been attacking the company by first calling an employee and posing as their manager or another executive and tricking them into approving device code authentication and granting access to their Microsoft accounts. In some cases, the attackers used the manager’s name or changed the caller ID to disguise their location as the manager’s office. The attackers then register their own MFA Authenticator application on the victim’s account to ensure continued access to the Microsoft 365 platform even if the user changes their password. 

The intruders then proceed to conduct reconnaissance on the SharePoint servers, enumerating and downloading all the available data, including documents, before the company detects the breach. The data is then used to demand ransom from the victim organization by threatening to publish the information if the company does not pay a certain amount of cryptocurrency. In some instances, the attackers sell the data to other bad-actor groups. 

Researchers have noted that Helix’s automated SharePoint discovery has been one of the group’s most identifiable features. In one of the attacks, the attackers used automated search queries to find the SharePoint content before launching a large-scale data exfiltration campaign from the same IP address using a Python Requests user agent. ReliaQuest researchers suspect that Helix may be linked to the ShinyHunters and BlackFile data extortion groups due to the similarity in attack techniques. 

Although there is no conclusive evidence that the groups are connected, researchers have discovered similar infrastructure and tactics used by Helix and ShinyHunters. Some of the organizations that have fallen victim to Helix include Medtronic, Nissan, the National Association of Insurance Commissioners (NAIC), Kodak, Infinite Campus, and the University of Nottingham. These companies were previously targeted by the ShinyHunters group and confirmed the breach on their websites. 

In addition, ReliaQuest researchers discovered that one of the Helix’s exfiltration servers was hosted on an autonomous system previously used by the BlackFile infrastructure. Since BlackFile’s servers were shut down earlier this year, researchers suspect that Helix may have links to the BlackFile group or be an offshoot of the former group. However, other data extortion groups such as Pink and Redact may also be linked to BlackFile. 

The campaign that targets Microsoft 365 is similar to the ShinyHunters ransomware attack in several ways, including impersonating employees, targeting the Microsoft 365 platform, stealing data from SharePoint servers, and using social engineering to trick employees into giving access to the company’s network. Researchers have also discovered that Helix uses the NICENIC domain registrar, which has been used in some of the ShinyHunters attacks. 

Experts recommend that organizations disable device code authentication if possible and only allow managed devices to access the Microsoft SharePoint service. In addition, the company should monitor Microsoft 365 authentication activities and restrict all communications except those from trusted domains to protect their data from being exfiltrated by Helix or other cybercriminal groups. 

The discovery of the Helix campaign shows how cybercriminals are increasingly targeting user credentials to access sensitive information rather than exploiting software vulnerabilities.
Read more »
vishing attack
Cyber Fraud Microsoft 365 Microsoft Entra ID Okta passkey phishing phishing campaign vishing attack

Okta Uncovers Vishing Campaign Using Fake Microsoft Entra ID Pages to Hijack Microsoft 365 Accounts

 

Okta has identified a sophisticated vishing campaign targeting organizations across multiple industries, where attackers attempt to steal Microsoft 365 credentials by directing victims to fraudulent Microsoft Entra ID login pages.

The campaign, which began in April, uses voice calls to persuade employees that they need to register a new passkey for their Microsoft account. Victims are then guided to convincing fake Microsoft Entra ID pages designed to capture their credentials.

The threat activity, tracked as O-UNC-066 and also referred to as CL-CRI-1147 or Pink, has primarily targeted organizations in the automotive, aviation, construction, food and beverage, healthcare, and technology sectors. The group's primary objective appears to be data extortion.

To support the campaign, the attackers have registered multiple domains containing the word "passkey" and created phishing pages that closely imitate Microsoft's legitimate passkey enrollment experience.

“It appears engineered to convince a targeted user they are in the process of enrolling a passkey with Microsoft, while the threat actor simultaneously registers their own passkey in the targeted user’s Microsoft account,” Okta says.

According to Okta, the fake Microsoft Entra ID login portals are customized for each intended victim through the phishing kit's backend. These pages incorporate authentic Microsoft branding and even load content directly from Microsoft's content delivery network to appear legitimate.

Unlike conventional phishing kits that automatically harvest usernames, passwords, MFA tokens, and session cookies, this toolkit relies on a manually operated PHP control panel. The attacker actively interacts with victims in real time, adjusting the phishing pages throughout the authentication process to accommodate different multi-factor authentication methods.

“It is likely that the threat actor uses the kit to take over the user account and trick the user into approving an attacker-initiated registration of a passkey,” Okta notes.

Throughout the attack sequence, the phishing pages conduct anti-analysis checks, collect usernames without redirecting users to federated identity providers, and prompt victims to enter their passwords. The attackers are believed to use these credentials immediately to access the targeted Microsoft account.

After the initial login, victims are shown a processing screen while the attacker determines which MFA method is enabled, such as SMS one-time passwords, time-based one-time passwords (TOTP), or push notifications, and modifies the phishing flow accordingly.

As part of the deception, victims are eventually redirected to a fake passkey registration page. There, they are instructed to save a recovery key generated from a list of attacker-controlled BIP-39 seed phrases before verifying the final word in the phrase.

“The phishing kit appears to prey on the lack of user familiarity with passkey authentication. In a real passkey registration ceremony, the user might expect a system dialog to register a passkey on their device. The passkey pages in this phishing kit appear to mimic this process without registering a passkey,” Okta notes.

Okta points out that BIP-39 seed phrases have no apparent role in Microsoft Entra passkey registration, suggesting that this step is merely a distraction while attackers secretly enroll their own passkeys into compromised accounts.

The company also highlighted that Microsoft automatically sends legitimate email notifications whenever a new passkey is registered. However, because the attackers complete the enrollment directly with Microsoft, they can assign the passkey an innocent-looking name, reducing the likelihood of raising suspicion.

“Any time a user enrolls a passkey with Microsoft, the owner of the compromised account receives a legitimate Microsoft email to notify them that a new passkey has been registered in their account. During an attack, the passkey was actually enrolled by the threat actor directly with Microsoft, and the threat actor is in a position to name the passkey with something the targeted user would view as benign,” Okta explains.
Read more »
Phishing
Authentication DEBULL Government Healthcare Identity Attacks Microsoft 365 Phishing

Microsoft 365 Users Targeted in New Device Code Phishing Campaign

 



Cybersecurity researchers have revealed a phishing campaign that is exploiting Microsoft's legitimate device authentication process to seize control of Microsoft 365 accounts, reflecting a broader shift in how cybercriminals are conducting identity-focused attacks. Rather than stealing passwords through counterfeit login pages, the operation manipulates victims into completing a genuine Microsoft authentication process, allowing attackers to obtain valid authentication tokens that grant direct access to compromised accounts.

The campaign, tracked by email security firm ZeroBEC, was observed between the final week of June and early July 2026. Investigators found that the attackers relied on collaboration-themed phishing lures that directed recipients to Microsoft's authentic device login experience instead of fraudulent credential harvesting websites. Behind the scenes, a backend broker generated Microsoft device authentication codes and continuously polled the authentication process until victims completed the sign-in sequence, enabling the attackers to capture valid authentication tokens without ever collecting passwords.

Researchers noted that the activity closely resembles techniques previously documented by Microsoft in its investigation of the threat cluster known as Storm-2372. That campaign, first disclosed in February 2025, used fake Microsoft Teams invitations and messaging-themed social engineering to persuade victims to enter attacker-generated device codes. Once authentication was completed, the attackers received valid access tokens that allowed them to take over Microsoft 365 accounts. Microsoft said Storm-2372 had targeted organizations across government, defense, healthcare, telecommunications, higher education, information technology, energy, and non-governmental sectors spanning Europe, North America, Africa, and the Middle East. The company also stated that the attacks abused legitimate authentication functionality rather than exploiting vulnerabilities in Microsoft products.

Although the latest campaign mirrors many of Storm-2372's tactics, ZeroBEC believes the operation is powered by a reusable phishing framework called DEBULL rather than the original threat actor itself. The researchers concluded that techniques once associated with advanced threat groups are now being packaged into reusable infrastructure that enables multiple operators to launch similar attacks with far less effort. This evolution reflects the continuing commercialization of identity-focused phishing operations, where sophisticated attack methods are increasingly offered through phishing-as-a-service platforms instead of being developed independently by individual threat actors.

At the center of the campaign is device code phishing, an attack technique that abuses the OAuth 2.0 Device Authorization Grant, a legitimate authentication mechanism designed for devices that cannot easily support traditional browser-based sign-ins. The workflow is commonly used by devices such as smart televisions, printers, conference room equipment, and other systems with limited input capabilities. Instead of entering credentials directly on those devices, users receive a short verification code that must be entered on another device through Microsoft's official authentication portal to complete the login process.

Threat actors exploit the separation between the device requesting authentication and the browser used to authorize it. Rather than creating counterfeit Microsoft login pages, attackers initiate their own device authentication session, obtain a legitimate verification code from Microsoft, and deliver that code to victims through convincing phishing emails. When recipients unknowingly enter the supplied code into Microsoft's authentic login page and complete the sign-in process, they authorize the attackers' session instead of their own, handing over valid authentication tokens that can be used to access Microsoft 365 resources. Because the victim is interacting with a genuine Microsoft service, traditional indicators of phishing, such as suspicious URLs or fake login portals, are largely absent.

Security researchers have increasingly warned that device code phishing represents a natural evolution of identity attacks. As organizations strengthened defenses against conventional credential phishing and adversary-in-the-middle attacks, threat actors shifted toward abusing trusted authentication workflows that require no password theft and can effectively circumvent multi-factor authentication protections by obtaining legitimate session tokens directly from users. Proofpoint recently reported a sharp increase in device code phishing activity during 2026, attributing the growth to publicly available criminal toolkits and the rapid expansion of phishing-as-a-service platforms that have made these techniques accessible to a wider range of cybercriminals.

Read more »
password spray attack
Azure CLI Cyber Security Cybersecurity Huntress MFA Bypass Microsoft 365 OAuth ROPC password spray attack

Massive Azure CLI Password Spray Campaign Targets Microsoft 365, Over 81 Million Login Attempts Detected

 

Cybersecurity company Huntress has uncovered a large-scale password spray campaign targeting Microsoft 365 environments through the Azure CLI, resulting in millions of malicious login attempts and multiple account compromises.

According to the company, between June 12 and June 21, attackers carried out more than 81 million login attempts against customer environments. The campaign led to the compromise of 78 user accounts across 64 organizations.

During the two-week period, threat actors were found compromising between two and four accounts each day. However, activity surged around June 22, when 23 organizations were reportedly affected in a single spike.

Huntress' investigation revealed that the majority of the login attempts originated from Autonomous System (AS) 32167, which is associated with internet hosting provider LSHIY LLC.

“These attacks are part of a large wave of credential spray attacks across a few different ASNs. In the past six months, Huntress has observed the volume of credential spray attacks increase by over 155 times across our customer base,” the cybersecurity company says.

The company also observed a sharp increase in password spray attacks during late May and early June, impacting multiple organizations. Huntress believes the campaign primarily relied on previously compromised username-password combination lists.

As part of the attack, the threat actors exploited the OAuth Resource Owner Password Credentials (ROPC) authentication flow to validate user credentials. Although this authentication method has been deprecated in OAuth 2.1, it still allows attackers to obtain a new user-delegated access token when valid credentials are provided.

Because of this authentication flow, attackers were able to compromise accounts even when multi-factor authentication (MFA) was enabled, provided that MFA policies were not configured to protect the OAuth ROPC authentication process.

“ROPC is considered problematic for several reasons, but one of those reasons is that it doesn’t offer support for modern auth flows like MFA or SSO. That means, as we saw in this campaign, ROPC sends the password straight to the /token endpoint with no interactive MFA prompt,” Huntress explains.

Further analysis of the affected environments showed several weaknesses in MFA implementation. In some organizations, MFA was applied only to specific cloud applications or user groups. Others enforced MFA only for logins from untrusted locations, while some had deployed MFA policies that were never actively enforced.

“It’s worth noting that eight businesses impacted by the campaign had no MFA policy at all. While threat actors in this campaign were able to get in despite MFA being set up, the takeaway should not be that MFA doesn’t work at all; instead, organizations should ensure that their MFA policies are properly configured to address the authorization flow used across these incidents,” the cybersecurity firm notes.

Huntress also traced the attack traffic to IPv6 address ranges linked to LSHIY, an internet infrastructure provider registered in Hong Kong, Wuhan, China, and New York. Previous reports have also associated IPv6 ranges operated under AS32167 and AS955 with infrastructure originating from China.

The cybersecurity firm said it reported the malicious activity to LSHIY through the provider's abuse reporting mechanism but did not receive any response.
Read more »
Ransomware
Cyber Crime Iran Microsoft 365 password spraying Ransomware

Microsoft 365 Accounts Targeted in Large Iran-Linked Cyber Campaign


A cyber operation believed to be linked to Iranian threat actors has been identified targeting Microsoft 365 environments, with a primary focus on organizations in Israel and the United Arab Emirates. The activity comes amid ongoing tensions in the Middle East and is still considered active.

According to research from Check Point, the campaign was carried out in three separate waves on March 3, March 13, and March 23, 2026. More than 300 organizations in Israel and over 25 in the U.A.E. were affected. Investigators also observed limited targeting in Europe, the United States, the United Kingdom, and Saudi Arabia.

The attackers focused on cloud-based systems used across a wide range of sectors, including government bodies, municipalities, transportation services, energy infrastructure, technology firms, and private companies. This broad targeting indicates an effort to access both public-sector systems and critical commercial operations.

The primary method used in the campaign is known as password spraying. In this technique, attackers attempt a small number of commonly used passwords across many accounts instead of repeatedly targeting a single account. This approach increases the chances of finding weak credentials while avoiding detection systems such as account lockouts or rate-limiting controls.

Security researchers noted that similar techniques have previously been associated with Iranian groups such as Peach Sandstorm and Gray Sandstorm. The current activity appears to follow a structured sequence. It begins with large-scale scanning and password attempts routed through Tor exit nodes to conceal the origin of the traffic. This is followed by login attempts, and in successful cases, the extraction of sensitive data, including email content from compromised accounts.

Analysis of Microsoft 365 logs revealed patterns consistent with earlier operations attributed to Gray Sandstorm. Investigators observed the use of red-team style tools and infrastructure, as well as commercial VPN services linked to hosting providers previously associated with Iran-linked cyber activity in the region.

To reduce risk, organizations are advised to monitor sign-in activity for unusual patterns, restrict authentication based on geographic conditions, enforce multi-factor authentication for all users, and enable detailed audit logs to support investigation in the event of a breach.


Renewed Activity from Pay2Key Ransomware Operation

In a related development, a U.S.-based healthcare organization was targeted in late February 2026 by Pay2Key, an Iran-linked ransomware group with connections to a broader threat cluster known by multiple aliases. The group operates under a ransomware-as-a-service model and was first identified in 2020.

The version used in this attack represents an upgrade from campaigns observed in July 2025, incorporating improved techniques for evasion, execution, and anti-forensic activity. Reports from Beazley Security and Halcyon indicate that no data was exfiltrated in this instance, marking a shift away from the group’s earlier double-extortion strategy.

The intrusion is believed to have begun through an unknown access point. Attackers then used legitimate remote access software such as TeamViewer to establish a foothold. From there, they harvested credentials to move laterally across the network, disabled Microsoft Defender Antivirus by falsely indicating that another antivirus solution was active, and interfered with system recovery processes. The attackers then deployed ransomware, issued a ransom note, and cleared logs to conceal their activity.

Notably, logs were deleted at the end of the attack rather than at the beginning, ensuring that even the ransomware’s own actions were removed, making forensic analysis more difficult.

The group has also adjusted its affiliate model, offering up to 80 percent of ransom payments, compared to 70 percent previously, particularly for attacks aligned with geopolitical objectives. In addition, a Linux variant of the ransomware has been identified in the wild. This version is configuration-driven, requires root-level access to execute, and is designed to navigate file systems, classify storage mounts, and encrypt data using the ChaCha20 encryption algorithm in either full or partial modes.

Before encryption begins, the malware weakens system defenses by stopping services, terminating processes, disabling security frameworks such as SELinux and AppArmor, and setting up a scheduled task to execute after system reboot. These steps allow the ransomware to run more efficiently and persist even after restarts.

Further developments point to coordination among pro-Iranian cyber actors. In March 2026, operators associated with another ransomware strain encouraged affiliates to adopt an alternative tool known as Baqiyat 313 Locker, also referred to as BQTLock, due to a surge in participation requests. This ransomware, which operates with pro-Palestinian motives, has been used in attacks targeting the U.A.E., the United States, and Israel since July 2025.

Cybersecurity experts note that Iran has a long history of using cyber operations as a response to political tensions. Increasingly, ransomware is being integrated into these efforts, blurring the line between financially motivated cybercrime and state-aligned cyber activity. Organizations need to adopt continuous monitoring, strong authentication measures, and proactive defense strategies to counter emerging threats.

Read more »
User Privacy
Cyber Fraud Microsoft 365 phishing Sophisticated Attack User Privacy

Microsoft 365 Phishing Bypasses MFA via OAuth Device Codes

 

A recent wave of phishing attacks is bypassing traditional security protections on Microsoft 365, even when multi‑factor authentication (MFA) is enabled. Instead of stealing passwords directly, attackers are abusing legitimate Microsoft login flows to trick users into granting access to their own accounts, effectively sidestepping the security codes that many organizations rely on for protection. These campaigns have already compromised hundreds of organizations, highlighting how modern phishing has evolved beyond simple fake login pages into sophisticated, session‑based attacks. 

The core technique leverages Microsoft’s OAuth 2.0 device authorization flow, a feature designed for devices like printers and TVs that cannot display a full browser. Users receive a phishing email or SMS that looks like a legitimate Microsoft prompt, often claiming that a “secure authorization code” must be entered on a Microsoft login page. When the victim goes to the real Microsoft domain and inputs the code, they quietly grant an attacker‑controlled application long‑lived OAuth tokens that provide full access to their Microsoft 365 mailbox, OneDrive, and Teams. 

Because the login happens on an actual Microsoft site, common phishing filters and user instincts often fail to detect anything unusual. The attacker never needs to capture a password or intercept an SMS code; they simply harvest the access and refresh tokens issued by Microsoft after the user completes MFA. This means that even changing passwords or waiting for a code to expire does not immediately cut off the attacker, since the stolen tokens can persist for extended periods unless explicitly revoked. 

From there, threat actors typically move laterally inside the environment, reading sensitive emails, staging more phishing messages to contacts and colleagues, and sometimes preparing for business email compromise or invoice fraud. In some cases, compromised accounts are used to send follow‑up phishing emails that appear to come from within the organization, making them harder to flag and more likely to succeed. This “inside‑out” style of attack undermines trust in internal communications and can significantly slow down detection and response. 

To counter these threats, organizations must go beyond standard MFA and focus on identity‑centric protections, including conditional access policies, risky‑sign‑in monitoring, and regular review of granted OAuth applications. Users should be trained to treat any unexpected authorization or device‑code request as suspicious, especially if they did not initiate a login, and to report such messages immediately. Combining strong technical controls with continuous security awareness remains the most effective way to reduce the risk of these advanced phishing campaigns on Microsoft 365.
Read more »
Telus Digital
Data Breach Data Exposure Microsoft 365 Salesforce ShinyHunters Telus Digital

Telus Digital Faces Scrutiny Following Claims of Large-Scale Data Extraction

 



Canadian outsourcing and digital services firm Telus Digital has confirmed that it experienced a cybersecurity incident after threat actors alleged they had extracted an enormous volume of data, estimated at nearly one petabyte, over a prolonged period of unauthorized access.

Telus Digital operates as the outsourcing and digital solutions division of Telus. The company provides services such as customer support, content moderation, artificial intelligence data operations, and other business process outsourcing functions to organizations around the world. Because firms in this sector often manage customer interactions, billing systems, and internal authentication tools on behalf of multiple clients, they are frequently targeted by attackers aiming to gain access to large datasets through a single compromise.

The breach has been linked to a threat group known as ShinyHunters, which claims it obtained a wide range of customer-related data connected to Telus Digital’s outsourcing services, along with call records tied to Telus’ consumer telecommunications operations.

Reports about a possible breach had surfaced earlier this year, and inquiries were made to the company at the time, though no response was received then. Telus has now acknowledged the incident, stating that it is investigating what information may have been accessed and which customers could be affected.

In its official statement, the company said unauthorized access was identified in a limited number of systems. It added that immediate steps were taken to contain the activity and prevent further intrusion. Telus also stated that its operations remain fully functional, with no evidence of disruption to customer connectivity or services. The company confirmed that external cyber forensics specialists have been engaged and that law enforcement authorities are involved. It further noted that additional safeguards have been implemented and that affected customers will be notified where appropriate.

Sources indicated that the attackers attempted to extort the company, but Telus did not engage in communication with them.


Attack Method and Data Exposure Claims

After learning that the company was not negotiating, the attackers were contacted for further details regarding the incident.

According to their claims, the intrusion began with access to Google Cloud Platform credentials that were previously exposed in data linked to the Salesloft Drift breach. In that earlier incident, attackers extracted Salesforce data belonging to approximately 760 organizations, including customer support tickets. These records were then examined to locate credentials, authentication tokens, and other sensitive information, which could be reused to access additional systems.

The threat actors stated that they identified credentials associated with Telus within that dataset. These credentials allegedly enabled them to access multiple internal systems, including a large BigQuery data environment. After extracting initial data, they reportedly used the tool trufflehog to scan for further secrets, allowing them to expand their access into additional parts of the company’s infrastructure.

The group claims that the total amount of data taken is close to one petabyte, though this figure has not been independently verified. They also shared the names of 28 well-known companies that they allege were affected. However, these claims have not been confirmed, and the identities of those organizations remain undisclosed.

The data described by the attackers covers a wide range of business operations. This includes information related to customer support services, call center activities, agent performance metrics, AI-powered support systems, fraud detection mechanisms, and content moderation processes. In addition, they claim to have accessed source code, financial records, Salesforce data, background verification documents, and recordings of customer service calls.

The breach is also said to affect Telus’ telecommunications operations, particularly its consumer fixed-line services. The allegedly exposed data includes detailed call logs, voice recordings, and campaign-related information. Samples of these call records reportedly contain timestamps, call durations, originating and receiving numbers, and technical metadata such as call quality indicators.

Overall, the nature of the exposed data appears to vary significantly depending on the organization, indicating that multiple business functions across different clients may have been impacted.

The attackers stated that they began extortion attempts in February, demanding $65 million in exchange for not releasing the stolen data. The company did not respond to these demands.

Telus has indicated that further updates may be provided as its investigation progresses.


Who Are ShinyHunters

The name ShinyHunters has been associated with various individuals and cyber incidents over time, but the group currently operating under this identity has emerged as one of the more active data extortion actors in recent months. Their operations have largely focused on compromising cloud-based platforms, particularly those connected to enterprise software ecosystems.

The group has been linked to incidents involving major organizations such as Google, Cisco, and Match Group, among others.

More recently, their tactics have expanded to include voice phishing, or vishing, attacks. In these cases, employees are contacted by individuals posing as IT support staff and are persuaded to reveal login credentials or multi-factor authentication codes through fraudulent websites. The group has also been observed using device code phishing techniques to obtain authentication tokens linked to identity platforms such as Microsoft Entra.

Once valid credentials and authentication codes are obtained, attackers can take control of single sign-on accounts and gain access to interconnected enterprise services, including Salesforce, Microsoft 365, Google Workspace, SAP, Slack, Adobe, Atlassian, Zendesk, and Dropbox.


Security Implications

This incident reflects a broader trend in which attackers reuse previously stolen data to launch new intrusions. It also highlights the elevated risk associated with outsourcing providers that centralize sensitive operations for multiple organizations.

Cybersecurity experts increasingly note that modern attacks often occur in stages, where one breach creates opportunities for subsequent compromises. As businesses continue to rely on cloud platforms and third-party service providers, the potential scale and impact of such incidents continue to grow.

The situation is currently under investigation, and additional verified details are expected as more information surfaces.

Read more »
Varonis
Cyber Attacks Data Leak Microsoft 365 Native Phishing User Privacy Varonis

Native Phishing Emerges as a New Microsoft 365 Threat Vector

 

A recent cybersecurity threat report highlights a tactic known as "native phishing," where attackers exploit the trusted, built-in features of Microsoft 365 to launch attacks from within an organization. This method moves beyond traditional phishing emails with malicious attachments, instead leveraging the trust users have in their own company's systems. 

The core of native phishing is its subtlety and legitimacy. After compromising a single user's Microsoft 365 account, an attacker can use integrated apps like OneNote and OneDrive to share malicious content. Since these notifications come from a legitimate internal account and the links point to the organization’s own OneDrive, they bypass both security systems and the suspicions of trained users.

Modus operandi

Attackers have found Microsoft OneNote to be a particularly effective tool. While OneNote doesn't support macros, it is not subject to Microsoft's "Protected View," which typically warns users about potentially unsafe files. Its flexible formatting allows attackers to create deceptive layouts and embed malicious links . 

In a typical scenario, an attacker who has gained access to a user's credentials will create a OneNote file containing a malicious link within the user's personal OneDrive. They then use the built-in sharing feature to send a legitimate-looking Microsoft notification to hundreds of colleagues. The email, appearing to be from a trusted source, contains a secure link to the file hosted on the company's OneDrive, making it highly convincing. 

Victims who click the link are directed to a fake login page, often a near-perfect replica of their company's actual authentication portal. These phishing sites are frequently built using free, AI-powered, no-code website builders like Flazio, ClickFunnels, and JotForm, which allow attackers to quickly create and host convincing fake pages with minimal effort. This technique has shown an unusually high success rate compared to other phishing campaigns. 

Mitigation strategies 

To combat native phishing, organizations are advised to take several proactive steps: 

  • Enforce multi-factor authentication (MFA) and conditional access to reduce the risk of account takeovers. 
  • Conduct regular phishing simulations to build employee awareness.
  • Establish clear channels for employees to report suspicious activity easily. 
  • Review and tighten Microsoft 365 sharing settings to limit unnecessary exposure.
  • Set up alerts for unusual file-sharing behavior and monitor traffic to known no-code website builders.
Read more »
Zero Day Vulnerabilities
CIS CISA Cyber Exploits Cyber Security CyberCrime DNA Global Attacks Malicious Software Microsoft 365 SharePoint Storm 2603 Zero Day Vulnerabilities

SharePoint Exploit Emerges as Root of Global Cyber Threat

 


A global cybersecurity crisis has been triggered by a newly discovered and unpatched vulnerability in Microsoft SharePoint Server, prompting the Governments of the United States, Canada, and Australia to conduct urgent investigations. In what experts are calling a coordinated and large-scale zero-day attack, which is a breach that takes advantage of a previously unknown security vulnerability, an exploit that enables remote code execution without the user's input, a critical flaw has been exploited to exploit a critical flaw that enables remote code execution without user interaction. 

A widely used enterprise platform called SharePoint, which facilitates the sharing and collaboration of documents and ideas, has been identified as one of the latest attack vectors by threat actors looking to gain access to high-value systems. Thousands of servers are said to be vulnerable to the attack, with organisations across the public and private sectors scrambling to protect their systems since there has been no official security patch available from Microsoft for some time. 

After this incident, concerns over Microsoft's security posture continue to grow, coming after a Chinese spying campaign in 2023 compromised email accounts belonging to U.S. government officials, including those belonging to the highest levels of the executive branch. As a result of the review, both the U.S. government and industry experts heavily criticised the company's security practices. 

The latest breach highlights persistent vulnerabilities in widely-used platforms, as well as raising serious concerns about whether the global infrastructure is sufficiently prepared for sophisticated, evolving cyber threats that are rapidly evolving in complexity. There has been an increase in threats surrounding the SharePoint vulnerability following the emergence of a ransomware attack by the threat actor referred to as Storm-2603. 

The group has changed its strategy from initially focusing on cyber-espionage operations to one focused on more destructive tactics, which is a troubling development in its campaign strategy. It appears that Storm-2603 is currently exploiting a vulnerable SharePoint flaw in order to infiltrate vulnerable systems and spread ransomware payloads. This is a worrying shift in the group's strategy. 

By encrypting entire networks with malicious software, this malicious software demands cryptocurrency payments to restore access, effectively paralysing the operations of the targeted businesses. As a result of this strategic pivot, Microsoft announced this in a blog post released late Wednesday. During its extended analysis, it found that the transition from silent data theft to overt disruption and extortion had occurred over the past couple of years. 

A ransomware campaign using this same zero-day vulnerability not only amplifies the threat posed by the campaign but also demonstrates that cybercriminal groups are blurring the line between espionage and financially motivated attacks as they become more prevalent in the world. As analysts warn, this dual-purpose exploitation could result in a greater financial and operational impact, especially for organisations that have not yet implemented compensating control or detection measures, which will lead to greater operational damage. 

Moreover, this incident underscores the urgency of timely patching, comprehensive threat monitoring, as well as cross-border cybersecurity collaboration, which are all imperative to preventing any future attacks on SharePoint. Microsoft has attributed the ongoing exploitation of the SharePoint vulnerability to a threat group known as Storm-263, which is rated as based in China with moderate confidence. 

Storm-2603 has not been directly connected to any other known Chinese threat actors, but has been linked to the attempted exfiltration of sensitive data, including MachineKeys, via on-premises SharePoint flaws. As of July 18, 2025, Microsoft has been observing the group actively deploying ransomware using the exploited vulnerability, despite not being directly linked to any Chinese threat actors. 

An attack chain for this attack starts when a malicious payload (spinstall0.aspx) is executed on internet-exposed SharePoint servers in order to enable the execution of commands through the w3wp.exe process. In addition to conducting reconnaissance through tools such as whoami, cmd.exe, and batch scripts, Storm-2603 disables Microsoft Defender by altering the system registry. 

An actor maintains persistence by installing web shells, creating scheduled tasks, and manipulating IIS components in a way that allows malicious .NET assemblies to be loaded and to maintain persistence. In order to move around and steal credentials, tools such as Mimikatz, PsExec, Impacket, and WMI are employed. 

Ultimately, the operation results in the installation of the Warlock ransomware using modified Group Policy Objects (GPOs). Moreover, Microsoft warns that other threat actors may exploit the same vulnerability, which emphasises the necessity of organisations to implement security mitigations and apply patches without delay to prevent further damage from occurring. 

According to the CVSS scale, CVE-2025-53770 is the critical zero-day vulnerability at the centre of the ongoing exploitation campaign. It has been assigned a severity score of 9.8 on the CVSS scale, meaning it is a critical zero-day flaw. There has been a classification given by security researchers for this vulnerability that which is a variation of the CVE-2025-49704 vulnerability that has been patched in the past, with a slightly less severe rating of 8.8. This vulnerability entailed code injection and remote code execution within Microsoft SharePoint Server. 

Although Microsoft's Patch Tuesday release of July 2025 addressed the earlier flaw, the newly discovered variant has not been patched, which leaves many SharePoint environments running on-premises at risk. A Microsoft advisory issued on July 19 says that the core problem stems from the derivation of untrusted data, which could lead to attackers remotely executing arbitrary code over a network without authenticating themselves. 

According to the company, the exploit is a serious one, and a comprehensive fix is in the process of being developed and undergoing extensive testing at the moment. Viettel Cyber Security has been credited with discovering the vulnerability via Trend Micro Zero Day Initiative (ZDI). The issue was reported to Trend Micro via the Zero Day Initiative (ZDI) and has been credited with the discovery. 

As outlined in a separate security bulletin released by Microsoft on the following weekend, Microsoft has confirmed that an active exploit of the vulnerability is still in progress, specifically targeting on-premise deployments. However, according to the company, SharePoint Online services within Microsoft 365 are not affected by the threat. 

A zero-day vulnerability known as CVE-2025-53770 has become a growing threat to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a result of its increasing threats. Earlier this week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a list of the Known Exploited Vulnerabilities (KEV) catalogue. 

Federal agencies have a limited timeframe—until Monday—to implement immediate mitigations. As a consequence of the active exploitation, according to Chris Butera, Acting Executive Assistant Director for Cybersecurity, the agency was alerted to the issue by a trusted partner, who promptly coordinated with Microsoft to resolve it. 

Researchers have attributed this vulnerability to the broader version of CVE-2025-49706, a vulnerability that was previously patched by Microsoft for spoofing. This vulnerability has been referred to as "ToolShell" by researchers. As the first cybersecurity firm to notice the attacks in action, Eye Security, a Dutch cybersecurity firm, reported that several high-profile targets, including multinational corporations, government institutions, and major banks, have already been compromised across several countries, including the United States, Germany, France, and Australia. 

It has been stated by Eye Security CTO Piet Kerkhofs that attackers are executing large numbers of exploit waves to gain unauthorised control through the use of the remote code execution (RCE) flaw. As a result of a technical analysis, it has been discovered that attackers are using the exploit to install web shells on compromised SharePoint servers and then to retrieve cryptographic keys from those servers. 

Through these keys, adversaries can forge authentication tokens and retain privileged access even after patches have been applied. Microsoft has advised organisations to make sure that all SharePoint servers have Defender Antivirus installed and that the Antimalware Scan Interface (AMSI) is integrated into SharePoint.

In case AMSI implementation is not possible, Microsoft recommends that vulnerable SharePoint instances be temporarily disconnected from the internet until a full security update is made available. Note that this vulnerability does not affect users of SharePoint Online within Microsoft 365, which is the cloud-based version of SharePoint. 

It has been reported that the CISA was first notified by a private cyber research firm on Friday of an active exploit of the SharePoint vulnerability, and Microsoft has been immediately notified, according to a spokesperson for the agency. A number of critical questions have been raised once again regarding Microsoft’s vulnerability management procedures as a result of this incident. 

There has previously been controversy surrounding the company due to its narrowly focused patches that do not often address similar attack paths, leaving organisations vulnerable to follow-up attacks that target similar exploits. It has been reported that Microsoft, one of the largest technology providers to global governments, has experienced a number of cybersecurity failures over the past two years, including attacks on its corporate infrastructure and executive email accounts, among other high-profile incidents. 

The Chinese government-backed threat actors were able to access federal official emails by exploiting a programming flaw in Microsoft's cloud services in one major incident. In addition, controversy was sparked after investigative outlet ProPublica reported Microsoft had hired engineers based in China to work on Department of Defence cloud projects. In response to the report, Defence Secretary Pete Hegseth immediately inspected the Pentagon cloud contracts and a formal review was initiated. 

Additionally, the nonprofit Centre for Internet Security (CIS) warned more than 100 vulnerable organisations, including public schools and universities, that they were at risk of being compromised by the threat. While Randy Rose, Vice President of CIS, indicated that incident response efforts had been significantly delayed as a result of a 65% cut to funding, CISA has had to significantly reduce its threat intelligence staffing.

In the future, this incident should serve as a crucial turning point for enterprises as they attempt to develop a comprehensive cybersecurity strategy beyond immediate containment. Organisations will need to adopt a mindset of continuous vigilance, integrating secure architecture with timely intelligence sharing, and automating threat detection into their operational DNA. 

When threat actors are constantly adapting and repurposing vulnerabilities, it is no longer sufficient to rely on vendor assurances without independent validation, especially in an environment where threat actors are constantly adapting and repurposing vulnerabilities. To minimise the blast radius in the event of a breach, organisations should prioritise scenario-based resilience planning, routine red teams, and strict access governance. 

Additionally, a close alignment between cybersecurity, legal, and executive leadership is essential in order to make informed decisions at the speed of modern threats. There is more to security than patchwork responses, as the threat matrix is evolving; it requires a security-first culture that is backed by investment, accountability, and strategic planning.
Read more »
stealth malware
Cyber Attacks CyberCrime Cyberhackers CyberThreat Microsoft 365 NCSC Russian Gru stealth malware

UK Connects Stealth Malware Targeting Microsoft 365 to Russian GRU

 


A series of sophisticated cyber espionage activities has been officially attributed to Russia's military intelligence agency, the GRU, in an important development that aims to strengthen the cybersecurity of both the United Kingdom and its allied countries. On 18 July, the United Kingdom government announced sanctions against three specific units of the GRU along with 18 Russian intelligence agents and military personnel. 

A wide range of actionisre being taken in order to hold cyber actors accountable for persistent and targeted cyber attacks targeting Western democracies. It has been discovered, in the National Cyber Security Centre (NCSC), a division of GCHQ, that Russian military intelligence operatives werutilisingng a previously unknown strain of malware in conducting surveillance operations on a number of occasions. 

AUTHENTIC ANTICS was a malicious program created specifically to steal email credentials from users, enabling prolonged unauthorised access to private communications through the use of covert infiltration and extraction of these credentials. It has been identified that the threat actor responsible for the deployment of this malware is APT28, a well-known cyber espionage group associated with the 85th Main Centre of Special Services of the GRU and also designated as military unit 26165. 

In the past few decades, this group has been known to target governmental, political, and military institutions in the Western world. According to the UK intelligence community, these activities are not only putting the nation's security at risk but also threatening the cybersecurity infrastructure of allied nations. APT28 tactics and tools are being exposed, and sanctions are being imposed against the individuals involved, in an effort by British authorities to disrupt hostile cyber operations and reaffirm their commitment in collaboration with international partners to safeguard democratic processes and information integrity. 

In contrast to previous disclosures that frequently provide high-level assessments, the National Cyber Security Centre's (NCSC) latest findings offer an uncommonly comprehensive insight into the GRU's cyber operations. This includes the cyber operations attributed to the group known in Western intelligence circles as Fancy Bear and its associated groups. 

Not only does this report provide insight into the technical capabilities of the operatives involved in the cyber campaigns, but it also sheds light on the broader strategic objectives behind the campaign as a whole. Several Russian intelligence officers and commanding figures have been publicly named and subjected to financial sanctions as a result of this public action. 

A total of 18 of these individuals are affiliated with the GRU units 29155 and 74455, as well as Unit 26165, which has been associated with cyber operations under the APT28 designation for some time. In an unprecedented move towards deterring state-sponsored cyberattacks by holding individual operatives accountable for their actions, this unprecedented level of attribution marks a significant step forward in international efforts to deter state-sponsored cyberattacks. 

In 2016, APT28, also known as Fancy Bear, made waves following high-profile cyberattacks that took place around the world, such as the 2016 breach of the World Anti-Doping Agency (WADA) and the infiltration of the Democratic National Committee (DNC) during the U.S. presidential election — events that had a huge impact on international affairs. NCSC has reported that, in the years since the attack, the group has continued its offensive operations, including targeting the email accounts of Sergei and Yulia Skripal. 

The compromised emails were discovered in the weeks leading up to the attempted assassination of a former Russian double agent in Salisbury and his daughter in 2018. It is clear that the GRU has been taking aggressive actions, according to David Lammy, which he described as part of a broader strategy that aims to undermine Ukrainian sovereignty, destabilise Europe, and endanger British citizens' safety. Lammy stated that the Kremlin should be clear about what they are trying to do in the shadows. 

This is a critical part of the government's Change Plan, he stressed, reinforcing the UK's commitment to the protection of its national security while standing firm against hostile state actors operating as cyberwarfare actors. In a report published by the National Cyber Security Centre (NCSC), detailed technical insights into the AUTHENTIC ANTICS malware have been released, which highlights a sophisticated design and stealthy method that makes it extremely challenging to detect and eliminate this malware. 

It was first observed in active use in 2023 when the malware was embedded into Microsoft Outlook. This method allows the malware to intercept authentication data without being able to see it because it is embedded directly in the Outlook process. When the malware has been installed, it prompts the user repeatedly for their sign-in credentials aauthorisationion tokens so that it can gain access to their email accounts by capturing them. 

 As a key advantage of the malware, it can take advantage of tenant-specific configurations of Microsoft 365 applications, which is one of the malware's key advantages. Moreover, according to the NCSC, this flexibility suggests that the threat is not confined to Outlook alone, but may also extend to other integrated services, including Exchange Online, SharePoint, and OneDrive, potentially exposing a wide range of data that would otherwise be unprotected by the company. 

The attackers at AUTHENTIC ANTICS are particularly insidious in their method of exfiltrating stolen data: they are using the victim's Outlook account to forward the stolen data to an account controlled by the attacker. As a method to hide such outgoing messages, the malware disables the "save to sent" function, so that the user remains unaware that unauthorised activity has taken place. This malware's architecture is modular, and its components include a dropper that initiates the installation process, an infostealer that gathers credentials and other sensitive information, a PowerShell script that automates and extends the malware's functionality, and a set of customised scripts that automate and extend its functionality. 

It is interesting to note that this malware does noutiliseze traditional command-and-control (C2) infrastructure, but rather relies on legitimate Microsoft services to communicate over the network. The result of this approach is a drastically reduced digital footprint, making it extremely difficult to trace or disrupt. In order to maximize its stealth, AUTHENTIC ANTICS minimizes the time and space that it spends on the victim's computer. 

It keeps important information in Outlook-specific registry locations, a method that allows it to avoid conventional endpoint detection mechanisms, sms, as it does not write significant data to disk. Based on the NCSC's technical analysis, these abilities allow the malware to remain infected for a long time, allowing it to keep gaining access to compromised accounts despite operating almost entirely undetected. This is an important turning point in the global cybersecurity landscape with the discovery that AUTHENTIC ANTICS was used as a tool by Russian state-sponsored cyber operations. 

As a result of this incident, it has been highlighted that advanced persistent threats are becoming increasingly sophisticated and persistent, and also underscores the need for more coordinated, strategic, and forward-thinking responses both from the public and private sectors in order to combat these threats. Increasingly, threat actors are exploiting trusted digital environments for espionage and disruption to enhance their effectivenesOrganisationstions must maintain a high level of security posture through rigorous risk assessments, continuous monitoring, and robust identity and access management strategies. Further, national and international policy mechanisms need to be enhanced to ensure that attribution is not only possible but actionable, reinforcing that malicious cyber activity will not be allowed to go unchallenged in the event of cyberattacks. 

It is essential for maintaining the stability of national interests, economic stability, and trust that is the basis of digital ecosystems to strengthen cyber resilience. This is no longer a discretionary measure but rather a fundamental obligation. The United Kingdom's decisive action in response to the attacks is a precedent that can be followed by others, but for progress to be made, it is necessary to maintain vigilance and strategic investment, as well as unwavering cooperation across industries and borders.
Read more »
Microsoft Teams
Black Basta Cyber Attacks Cybersecurity Precautions Hackers MFA Microsoft Microsoft 365 Microsoft Office vulnerability Microsoft Teams

Hackers Exploit Microsoft Teams for Phishing and Malware Attacks

 

Cybercriminals are increasingly targeting Microsoft Teams, utilizing the platform for sophisticated phishing, vishing, and ransomware campaigns. Exploiting Teams' widespread use, attackers employ social engineering tactics to deceive users and extract sensitive data. Methods range from fake job offers to malicious file sharing, aiming to infiltrate accounts and compromise organizational networks.

Bypassing Multifactor Authentication

One notable tactic involves bypassing multifactor authentication (MFA). Threat actors, reportedly linked to the SolarWinds attack, create fraudulent “onmicrosoft.com” subdomains designed to mimic legitimate security entities. They send chat requests via Microsoft Teams, prompting users to enter a code into the Microsoft Authenticator app. This action grants attackers unauthorized access to Microsoft 365 accounts, enabling data theft or the integration of malicious devices into corporate networks.

The Black Basta ransomware group employs a different strategy by overwhelming users with spam emails and impersonating IT support staff on Teams. Claiming to assist with email issues, they persuade victims to install remote desktop tools, providing attackers with direct access to deploy malware. This includes Trojans and ransomware designed to exfiltrate sensitive data and compromise systems.

Another prevalent scheme involves fake job offers. Scammers contact individuals with fabricated employment opportunities, sometimes conducting entire interviews via Microsoft Teams chat. These scams often escalate to requests for personal information, such as Social Security numbers or tax details. In some cases, victims are asked to pay for materials or services, resulting in financial loss and potential identity theft.

Attackers also impersonate HR personnel, sending phishing messages about urgent policy updates. These messages frequently include malicious files disguised as legitimate updates. Once downloaded, malware like DarkGate is installed, granting attackers control over the victim’s system and network.

Additionally, compromised Microsoft 365 accounts are used to distribute malicious files through Teams chats. These files often appear as PDFs with double extensions, deceiving users into downloading executable malware. Once activated, these programs can breach data and facilitate deeper network infiltration.

Mitigation Strategies for Organizations and Users

Vigilance is essential in countering these threats. Users should verify unexpected messages, invitations, or file-sharing requests, especially those containing links or urgent calls to action. Tools that check link safety and domain age can help detect phishing attempts.

Organizations should prioritize employee education on recognizing scams and enforcing robust cybersecurity protocols. By staying informed and cautious, users can mitigate risks and safeguard against cyberattacks targeting Microsoft Teams.

Read more »
Privacy
Edge Browser Microsoft 365 Password Privacy

Microsoft Edge’s New Password Update: What It Means for Your Online Security

 



Microsoft has finally turned a page in making the internet safer by offering protection against shared passwords. The establishment of sharing the same password among different users, for account management or accessing team resources, was a common practice but unsafe in the past. Such practices increase the likelihood of illegal access to data that might lead to a breach. At the Ignite 2024 developer conference, Microsoft revealed the solution to this problem: encrypted password sharing for users on Microsoft 365.


Simplifying Password Sharing for Microsoft 365 Users 

Soon, a new feature for Microsoft 365 Business Premium, E3, and E5 subscribers will roll out. It lets administrators deploy encrypted passwords in the browser Microsoft Edge for both corporate and web sites. This will be shared amongst designated users, thus allowing them to log on smoothly at these web sites without ever having to see the actual passwords.

According to group product manager for Edge enterprise at Microsoft, Lindsay Kubasik, this feature diminishes the possibility of unauthorized access and enhances organizational security. Because the encrypted passwords are uniformly distributed and only to a configured group of users, it keeps any organization from being exposed to security threats. The deployment will be gradual over the next few months with the idea of improving password management for enterprise users.


Essential Security Tips for Microsoft Edge Users 

While firms benefit from shared encrypted passwords, Microsoft recommends that personal consumers of the Edge browser eliminate password sharing outright. Shared password use may increase vulnerabilities and become an entry point for many cyberattacks.

For users, Edge will automatically encrypt sensitive data such as passwords, credit card details, and cookies when stored locally on a device. This means such data will stay safe, with access limited only to the logged-in user. Even if an attacker gains admin access to the device, they cannot retrieve plaintext passwords unless they also obtain the user’s operating system credentials.  


Best Practices for Password Security

Microsoft is keen on proper security practice, recommending that all users employ strong passwords, two-factor authentication, and even password managers as online account protection tools. Another alternative: passkeys, essentially biometric or device-based authentication methods, can eliminate reliance on a traditional password altogether.


The Bottom Line

Microsoft’s encrypted password sharing marks a pivotal advancement in digital security for enterprise users, setting a new standard for password management. For individual users, adopting recommended security practices remains crucial to staying protected in an increasingly digital world.


Read more »
Sextortion Scam
Bitcoin Cyber Security Email Scams Fraud Email Internet scammers Microsoft Microsoft 365 Ransom Demand Sextortion Scam

Beware of Fake Microsoft Emails Exploiting Microsoft 365 Vulnerabilities

 

The internet is rife with scams, and the latest involves hackers exploiting vulnerabilities in the Microsoft 365 Admin Portal to send fraudulent emails directly from legitimate Microsoft.com accounts. These emails bypass spam filters, giving them an appearance of credibility, but their true purpose is extortion. These scam emails claim to have sensitive images or videos of the recipient in compromising situations. To prevent this alleged content from being shared, the recipient is asked to pay a ransom—often in Bitcoin. This type of cybercrime, known as “sextortion,” is designed to prey on fear and desperation, making victims more likely to comply with the scammer’s demands. 

Unfortunately, sextortion scams are becoming increasingly common. While tech companies like Microsoft and Instagram implement protective measures, hackers find new ways to exploit technical vulnerabilities. In this case, scammers took advantage of a flaw in the Microsoft 365 Message Center’s “share” function, commonly used for legitimate service advisories. This loophole allows hackers to send emails that appear to come from a genuine Microsoft.com address, deceiving even cautious users. To identify such scams, it is crucial to evaluate the content of the email. Legitimate companies like Microsoft will never request payment in Bitcoin or other cryptocurrencies. 

Additionally, scammers often include personal information, such as a birthday, to make their claims more believable. However, it is important to remember that such information is easily accessible and does not necessarily mean the scammer has access to more sensitive data. Victims should also remember that scammers rarely have the incriminating evidence they claim. These tactics rely on psychological manipulation, where the fear of exposure often outweighs rational decision-making. Staying calm and taking deliberate action, such as verifying the email with official Microsoft support, can prevent falling prey to these schemes. Reporting such emails not only protects individual users but also helps cybersecurity teams track and combat the criminals behind these campaigns. 

Microsoft is actively investigating this criminal activity, aiming to close the exploited loopholes and prevent future scams. In the meantime, users must remain vigilant. Keeping software up to date, enabling multi-factor authentication, and using strong passwords can help mitigate risks. A scam email may look convincing, but its demands reveal its true intent. Always approach threatening emails critically, and when in doubt, seek guidance from the appropriate channels. By cultivating a habit of skepticism and digital hygiene, users can strengthen their defenses against cybercrime. Awareness and timely action are essential for navigating the modern threat landscape and ensuring personal and organizational security.
Read more »
Software
CrowdStrike Cyber Security Global Airlines IT system Microsoft 365 Software

Global IT Outage Disrupts Airlines, Hospitals, and Financial Institutions

 



A major IT outage has affected a wide array of global institutions, including hospitals, major banks, media outlets, and airlines. The disruption has hindered their ability to offer services, causing widespread inconvenience and operational challenges.

International airports across India, Hong Kong, the UK, and the US have reported significant issues, with numerous airlines grounding flights and experiencing delays. In the US, major airlines such as United, Delta, and American Airlines implemented a "global ground stop" on all flights, while Australian carriers Virgin and Jetstar faced delays and cancellations. According to aviation analytics firm Cirium, over 1,000 flights worldwide have been cancelled due to the outages.

At Indira Gandhi International Airport in Delhi, passengers experienced "absolute chaos," with manual processes replacing automated systems. Similar situations were reported in airports in Tokyo, Berlin, Prague, and Zurich, where operations were significantly hampered.

Emergency services and hospitals have also been severely impacted. In the US state of Alaska, officials warned that the 911 system might be unavailable, and some hospitals have had to cancel surgeries. In Australia, however, authorities confirmed that triple-0 call centres were unaffected.

Hospitals in Germany and Israel reported service disruptions, while GP services in the UK were also affected. These interruptions have raised concerns about the ability of medical facilities to provide timely care.

The media sector did not escape the impact, with many broadcast networks in Australia experiencing on-air difficulties. Sky News UK went off air for a period but has since resumed broadcasting. Retail operations were also disrupted, with supermarkets like Coles in Australia facing payment system failures, forcing the closure of self-checkout tills.

Cybersecurity firm CrowdStrike has confirmed that a defective software update for its Microsoft Windows hosts caused the outage. In a statement, CrowdStrike assured that the issue had been identified, isolated, and a fix deployed, emphasising that the incident was not a cyberattack. They advised organisations to communicate with CrowdStrike representatives through official channels to ensure proper coordination.

Earlier in the day, a Microsoft 365 service update had noted an issue impacting users' ability to access various Microsoft 365 apps and services. Microsoft later reported that most services were restored within a few hours.

The outage has highlighted the vulnerabilities of global IT systems and the widespread reliance on third-party software. A spokesperson for Australia's home affairs ministry attributed the issues to a technical problem with a third-party software platform used by the affected companies. The country's cybersecurity watchdog confirmed that there was no evidence of a malicious attack.

As companies scramble to resolve the issues, the incident serves as a stark reminder of the critical need for robust IT infrastructure and effective crisis management strategies. The global scale of the disruption underscores the interconnected nature of modern technology and the potential for widespread impact when systems fail.

This incident will likely prompt a reevaluation of cybersecurity measures and disaster recovery plans across various sectors, emphasising the importance of resilience and preparedness in the digital age.


Read more »
Microsoft 365
Command and Control(C2) Cyber Security Google Microsoft Hackers Microsoft 365

Rising Threat: Hackers Exploit Microsoft Graph for Command-and-Control Operations

 


Recently, there has been a trend among nation-state espionage groups they are tapping into native Microsoft services for their command-and-control (C2) operations. Surprisingly, different groups, unrelated to each other, have reached the same conclusion that It is smarter to leverage Microsoft's services instead of creating and managing their own infrastructure. This approach not only saves them money and hassle but also lets their malicious activities blend in more seamlessly with regular network traffic. In this regard, the Microsoft graph plays a major role. 
 
Microsoft Graph is like a toolbox for developers, offering an interface to connect to various data like emails, calendars, and files stored in Microsoft's cloud services. While it is harmless in its intended use, it has also become a tool for hackers to set up their command-and-control (C2) infrastructure using these same cloud services. Recently, Symantec found a new type of malware called "BirdyClient" being used against an organization in Ukraine. This malware sneaks into the Graph API to upload and download files through OneDrive. However, we are still waiting to hear from Microsoft about this.   
 
O'Brien emphasizes that organisations must be vigilant regarding unauthorized cloud account usage. Many individuals access personal accounts, like OneDrive, from work networks, which poses a risk as it makes it harder to detect malicious activities. To mitigate this risk, organizations should ensure that connections are limited to their enterprise accounts and implement strict access controls. 

In response to the concerning trend of hackers exploiting Microsoft Graph for command-and-control operations, organizations must prioritize proactive measures to fortify their cybersecurity posture. Firstly, staying vigilant with updates and patches for all Microsoft applications, particularly those related to Microsoft Graph, is imperative. Regularly monitoring network traffic for any anomalies or unauthorized access attempts can also help in the early detection of suspicious activities. Implementing robust access controls and multi-factor authentication protocols can significantly mitigate the risk of unauthorized access to sensitive data through Microsoft Graph. 

Additionally, conducting thorough employee training programs to raise awareness about the potential threats posed by such exploits and promoting a culture of cybersecurity consciousness throughout the organization are indispensable steps in bolstering defenses against cyber threats. By adopting these preventive measures, organizations can effectively safeguard their systems and data from the nefarious intentions of cyber adversaries.
Read more »
Tycoon
Gmail malware MFA Bypass Microsoft 365 multifactor authentication phishing kit Safety Security Tycoon

'Tycoon' Malware Kit Bypasses Microsoft and Google Multifactor Authentication

 

An emerging phishing kit called "Tycoon 2FA" is gaining widespread use among threat actors, who are employing it to target Microsoft 365 and Gmail email accounts. This kit, discovered by researchers at Sekoia, has been active since at least August and received updates as recent as last month to enhance its evasion techniques against multifactor authentication (MFA).

According to the researchers, Tycoon 2FA is extensively utilized in various phishing campaigns, primarily aimed at harvesting Microsoft 365 session cookies to bypass MFA processes during subsequent logins. The platform has amassed over 1,100 domain names between October 2023 and late February, with distribution facilitated through Telegram channels under different handles such as Tycoon Group, SaaadFridi, and Mr_XaaD.

Operating as a phishing-as-a-service (PhaaS) platform, Tycoon 2FA offers ready-made phishing pages for Microsoft 365 and Gmail accounts, along with attachment templates, starting at $120 for 10 days, with prices varying based on the domain extension. Transactions are conducted via Bitcoin wallets managed by the "Saad Tycoon Group," suspected to be the operator and developer of Tycoon 2FA, with over 1,800 recorded transactions as of mid-March.

The phishing technique employed by Tycoon 2FA involves an adversary-in-the-middle (AitM) approach, utilizing a reverse proxy server to host phishing webpages. This method intercepts user inputs, including MFA tokens, allowing attackers to bypass MFA even if credentials are changed between sessions.

Despite the security enhancements provided by MFA, sophisticated attacks like Tycoon 2FA pose significant threats by exploiting AitM techniques. The ease of use and relatively low cost of Tycoon 2FA make it appealing to threat actors, further compounded by its stealth capabilities that evade detection by security products.

Sekoia researchers outlined a six-stage process used by Tycoon 2FA to execute phishing attacks, including URL redirections, Cloudflare Turnstile challenges, JavaScript execution, and the presentation of fake authentication pages to victims.

The emergence of Tycoon 2FA underscores the evolving landscape of phishing attacks, challenging the effectiveness of traditional MFA methods. However, security experts suggest that certain forms of MFA, such as security keys implementing WebAuthn/FIDO2 standards, offer higher resistance against phishing attempts.

To assist organizations in identifying Tycoon 2FA activities, Sekoia has published a list of indicators of compromise (IoCs) on GitHub, including URLs associated with Tycoon 2FA phishing campaigns.
Read more »
Subscribe to: Posts (Atom)