Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Microsoft 365 Security. Show all posts
Public Wi-Fi Security
CaptiveCrunch Campaign CornFlake Malware Credential Theft Cyber Attacks Hotel Wi-Fi Attacks Microsoft 365 Security Midnight Blizzard Public Wi-Fi Security

Hotel Wi-Fi Attacks Linked to Russian Hackers Target Microsoft 365 Accounts With Custom Malware


In a sophisticated cyber campaign carried out by attackers using hotel and conference Wi-Fi networks, Microsoft uncovered the theft of Microsoft 365 credentials, and the deployment of custom malware. As reported by the company, CaptiveCrunch was carried out by Storm-2945, a subgroup of the Russian state-backed threat actor Midnight Blizzard (APT29). 

There have been several incidents of Wi-Fi networks being affected by the campaign in hotels, conference centers, and other venues that use captive portals. In the company's view, corporate travelers are the primary targets, since compromise of their Microsoft 365 accounts would allow attackers access to sensitive company information. 

A related phishing campaign has been conducted since at least May 2026, while the campaign is believed to have been active since then. Microsoft's investigation indicates that the attackers compromised shared network infrastructure used by hospitality Wi-Fi providers, allowing them to manipulate DNS and HTTP traffic. Using this technique, they were able to redirect users to fraudulent Microsoft 365 login pages, phishing portals containing device codes, or fake software update screens when connecting to hotel Wi-Fi. 

It is believed that the attackers gained access to infrastructure shared across multiple captive portal deployments, rather than isolated compromises at individual hotels, allowing the campaign to target multiple hospitality locations without having to target each venue individually. 

The attacks were carried out by CornFlake and ChocoShell malware families that had previously been undocumented. As a Go-based remote access trojan (RAT), CornFlake provides long-term access to infected systems by allowing attackers to execute commands remotely, log data, capture screenshots, steal credentials from websites, steal session tokens from Microsoft 365, monitor clipboards, and exfiltrate data. 

A fake Windows update or security scan screen is displayed during the installation process of the malware to avoid suspicion. Several persistence mechanisms are also established to survive system reboots. 

In addition, Microsoft noted that CornFlake provides secure command-and-control communication through modern cryptographic techniques, as well as support for dynamic reconfiguration, which allows attackers to modify infrastructure and targets without redeploying the malware. Further, the RAT utilizes multiple persistence mechanisms in order to remain active despite the removal of one method by security tools. 

ChocoShell is a PowerShell credential stealer that targets cookie files, passwords, Microsoft 365 tokens, and stored Wi-Fi credentials stored in memory. Additionally, Microsoft discovered a management panel controlled by attackers, dubbed FruitStone, that allowed administrators to remotely manage compromised devices, execute PowerShell commands, browse files, and capture screenshots and keystrokes. 

The malware has been identified as targeting access and refresh tokens for Microsoft 365 and Azure Active Directory, thereby allowing attackers to potentially hijack enterprise sessions without requiring users to enter their credentials again. Using ClickFix social engineering techniques, researchers observed fake updates to browsers and operating systems that tricked users into installing malware through these updates. 

Through the same infrastructure, attackers have attempted to distribute malicious Android APK files as well. Amid the campaign, Microsoft observed the scheme expanding to include Microsoft Entra device code phishing, in which the victims are tricked into completing a legitimate Microsoft authentication process that unknowingly allows the attackers' session to be authorized instead of their own. 

Upon analyzing both malware families, Microsoft believes artificial intelligence tools likely contributed to their development as analysts identified extensive AI-generated comments throughout the source code, demonstrating an increasing trend in malware development by threat actors incorporating AI into their code.

The Microsoft team recommends that users consider hotel and conference Wi-Fi networks to be untrustworthy, use mobile or managed network connections whenever possible, avoid installing software provided through captive portals, and use phishing-resistant authentication methods such as passkeys and multi-factor authentication whenever possible to reduce the risk of compromise. 

The organization is also advised to disable Microsoft Entra device code authentication where it is not necessary and to avoid using corporate credentials when registering for guest Wi-Fi services. Furthermore, security experts advise against registering for guest Wi-Fi services using company email addresses, since this may expose enterprise identities to targeted phishing attempts. 

Using trusted public Wi-Fi networks for cyber-espionage is an extremely dangerous practice. As attackers continue to perfect phishing and malware techniques, organizations and travelers alike must take additional precautions when connecting to public networks and implement stronger authentication measures.
Read more »
Microsoft data breach
Cyber Attacks data security Data Theft Malware attacks Microsoft Microsoft 365 Security Microsoft data breach

HollowGraph Malware Abuses Microsoft 365 Calendars for Covert Command-and-Control

 

The malware component HollowGraph is using Microsoft 365 mailbox calendars to hide its C2 channels and traffic, enabling the bad actors to communicate with the malware and exfiltrate the data. Group-IB researchers note that HollowGraph is a part of the Cavern command-and-control framework used by the Iranian nation-state actor previously observed targeting Israeli organizations. Researchers note that at least 12 Microsoft 365 mailboxes were compromised using HollowGraph, and three of them established communication with the attackers’ C2 servers between June 3 and July 9. 

Additionally, based on the infrastructure and victims’ location, Group-IB experts suggest that Israel is the likely target of this malware. The HollowGraph malware component is designed to self-register in the Microsoft Graph API using the credentials stolen from the Microsoft 365 mailbox. It stores the configuration data in the logAzure.txt file, which contains the Microsoft Entra ID information, client credentials, mailbox addresses of the victims, domains controlled by the attackers, and keys required to communicate with the C2 infrastructure. 

The attackers have taken measures to ensure that this file is not suspicious; specifically, it is placed in the known location used by Microsoft Entra ID and has the standard log file name. The malware communicates with its C2 server using the Microsoft 365 calendars. Specifically, HollowGraph creates events scheduled on May 13, 2050, and uses their titles and attachments to exchange data with the attackers. There are two types of such events: GET and SEND. The first one is used to retrieve the encrypted commands by extracting the contents of the event’s title. 

In turn, the SEND type of events is used to exfiltrate the stolen data by adding it as an attachment. Researchers note that the mailbox calendars are used as a “dead drop” to store the data; hence, HollowGraph does not use traditional C2 servers to avoid detection. It implements a strong encryption scheme to protect the command and data exfiltration channels and uses a combination of RSA and AES_256_GCM encryption algorithms. The RSA public key is embedded into the calendar event, whereas the HollowGraph malware uses the AES key to encrypt the data. 

Besides the Microsoft Graph API, HollowGraph also uses the Domain Name System (DNS) to communicate with its C2 servers. Specifically, the malware resolves the domains controlled by the attackers to extract the IPv6 AAAA records, which contains the updated Microsoft Entra ID credentials required to maintain persistence on the compromised mailboxes. Similar to the information stored in the logAzure.txt file, these credentials include the Microsoft Entra ID tenant, client ID and secret, and the mailbox information. 

All of these credentials are extracted from the DNS responses and stored in the malware configuration. Group-IB researchers conclude that HollowGraph is a sophisticated backdoor that utilizes various cybersecurity technologies to compromise targeted Microsoft 365 mailboxes and remain undetected for as long as possible. While the technical capabilities of this malware component overlaps with the ones attributed to the Lyceum Iranian nation-state actor, the researchers are not certain about its origin. 

Nevertheless, Group-IB experts note that there is a high likelihood that HollowGraph belongs to the Cavern framework used by Lyceum. To detect and prevent similar attacks, the cybersecurity experts recommend that organizations monitor the Microsoft Graph API activity and Microsoft 365 audit logs for any suspicious activities related to the creation of the calendar events. Specifically, defenders should pay attention to the events created by applications using the Microsoft Graph API scheduled far in the future, with the suspicious subjects and attachments. 

The researchers also recommend that organizations add the cloudlanecdn[.]com domain to their threat intelligence platforms and continuously monitor their Microsoft 365 environments for any unauthorized OAuth client credential applications. In addition, Group-IB experts note that Microsoft Entra ID Conditional Access policies and outbound DNS traffic should be reviewed to detect and block similar恶意 activities, such as DNS tunneling. This report highlights the importance of the growing threat landscape in cloud environments caused by the increasing reliance on the collaborative software in enterprise networks. 

Malware components like HollowGraph demonstrate that the attackers do not limit themselves to traditional network security tools and can use the trusted infrastructure to launch attacks against various organizations. In particular, the attackers utilize the cloud infrastructure as a part of their mitigation strategy. In turn, the defenders should shift their focus from traditional network perimeter security to inspecting individual hosts and applications for detecting malicious activities.
Read more »
Microsoft Security Response
Cyber Security Data protection Data Records data security Microsoft Microsoft 365 Security Microsoft Security Response

Windows Telemetry Explained: What Diagnostic Data Microsoft Collects and Why It Matters

 

Years after Windows 10 arrived, a single aspect keeps stirring conversation - telemetry. This data gathering, labeled diagnostic info by Microsoft, pulls details from machines without manual input. Its purpose? Keeping systems stable, secure, running smoothly. Yet reactions split sharply between everyday users and those watching privacy trends. 

Early on, after Windows 10 arrived, observers questioned whether its telemetry might double as monitoring. A few writers argued it collected large amounts of user detail while transmitting data to Microsoft machines. Still, analysts inspecting how the OS handles information report minimal proof backing such suspicions. 

Beginning in 2017, scrutiny from the Dutch Data Protection Authority revealed shortcomings in how Windows presented telemetry consent choices. Although designed to gather system performance details, the setup failed to align with regional privacy expectations due to unclear user permissions. 

Instead of defending the original design, Microsoft adjusted both interface wording and backend configurations. Following these updates, oversight bodies acknowledged improvements, noting no evidence emerged suggesting private information was gathered unlawfully. Independent analysts alongside regulatory teams had previously flagged the configuration, yet after revisions, compliance concerns faded gradually. 

What runs behind the scenes in Windows includes a mix of telemetry types - mainly split into essential and extra reporting layers. Most personal computers, especially those outside corporate control, turn on the basic tier automatically; there exists no standard menu option to switch it off entirely. This baseline layer gathers only what Microsoft claims is vital for stability and core operations. 

Though hidden from typical adjustments, its presence supports ongoing performance checks across devices. Basic troubleshooting relies on specific diagnostics tied to functions like Windows Update. Information might cover simple fault summaries, setup traits of hardware, software plus driver footprints, along with records tracking how updates succeed or fail. 

As noted by Microsoft, insights drawn support better stability fixes, safety patches, app alignment, and smoother running systems. Some diagnostic details go beyond basics, capturing patterns in app use or web habits. These insights might involve deeper system errors, performance signs, or hardware traits. 

While such data helps refine functionality, access remains under user control via Windows options. Those cautious about personal information often choose to turn this off. Control sits within settings, letting choices match comfort levels. Occasionally, memory dumps taken during system failures form part of Optional diagnostic data, according to experts. 

When a crash happens, pieces of active files might get saved inside these records. Because of this risk, certain groups managing confidential material prefer disabling the setting altogether. In 2018, Microsoft rolled out a feature named Diagnostic Data Viewer to boost openness. This tool gives people access to review what information their machine shares with the company, revealing specifics found in diagnostics and system summaries. 

One billion devices now operate on Windows 11 across the globe. Because of countless variations in hardware and software setups, Microsoft relies on telemetry data - this information reveals issues, shapes update improvements, yet supports consistent performance. While tracking user interactions might sound intrusive, it actually guides fixes without exposing personal details; instead, patterns emerge that steer engineering decisions behind the scenes. 

Even though some diagnostic details are essential for basic operations, those worried about personal data might choose to limit what gets sent by turning off non-essential diagnostics in device preferences. Still, full function depends on keeping certain reporting active.
Read more »
Russia Linked Hackers
Account Takeover Threats Cyber Attacks Device Code Phishing Entra ID Security Microsoft 365 Security Nation State Cyber Attacks OAuth Authentication Abuse Russia Linked Hackers

Microsoft 365 Users Targeted by Russia-Linked Device Code Phishing Operations


The global network infrastructure is experiencing a wave of sophisticated cyber intrusions as states-sponsored and financially motivated hackers are increasingly exploiting a legitimate Microsoft authentication mechanism to seize control of enterprise accounts in a broad range of sectors. 

There has been a recent investigation which uncovered attackers with ties to both Russian and Chinese interests have been exploiting Microsoft's OAuth 2.0 device authorization grant flow in an effort to deceive users into unknowingly granting them access to their Microsoft 365 environments through this feature designed to simplify secure logins. 

Through the use of fraudulently masquerading institutions and convincing targets to authenticate using authentic Microsoft services, attackers are able to obtain valid access tokens that enable persistent account compromises without requiring the compromise of the target's password. The Russian-linked threat actor Storm-2372 has been targeting government bodies and private organizations since August 2024 and has been one of the most active groups in this regard. 

In order to get the highest level of effectiveness from the device code phishing tactics, it has been proven to be more effective than conventional spear-phishing tactics. It has been conducted throughout Africa, Europe, the Middle East, and North America. Government, defence, healthcare, telecommunications, education, energy, and non-government organizations have been included in the campaign. 

It has been determined that the scale, targeting patterns, and operational discipline of the activity strongly point towards a coordinated nation-state effort aligned with Russian strategic objectives, as confirmed by Microsoft's Threat Intelligence Center. 

The campaign is now more clearly connected to an organization believed to be aligned with the Russian government. It has been a sustained phishing operation that leveraged Microsoft's device code authentication workflow to compromise Microsoft 365 accounts by using a sustained phishing operation. Under the designation UNK_AcademicFlare, Proofpoint has tracked this activity since September 2025 under the designation UNK_AcademicFlare. 

Investigators believe the attackers used email accounts that had previously been compromised from government and military organizations so that they could lend legitimacy to their outreach efforts. In both the United States and Europe, the messages were targeted at individuals and organizations within government agencies, policy think tanks, higher education institutions, and transportation-related organizations. 

There are deliberate steps involved in the approach. It begins with seemingly innocuous correspondence tailored to the recipient’s professional background, usually framed as preparations for an interview or collaboration. In order for victims to be informed, the sender will offer a document purported to outline discussion topics. The document will be hosted at a link that appears to be a Microsoft OneDrive account impersonating the sender.

There is a link within the email that actually redirects users to a Cloudflare Worker, which redirects the user to Microsoft's legitimate account lock page, during which the user enters the provided authentication code, which unwittingly authorizes access and generates a valid token that enables full account hijacking. 

Researchers in the field of cybersecurity note that this technique has gained traction, having been extensively documented earlier this year by Microsoft and Volexity and linked to clusters that are associated with Russia, such as Storm-2372 and APT29. 

Recent warnings from Amazon Threat Intelligence and Volexity have shown that it is still being used by Russian attackers. According to the latest technical details published by Microsoft and independent researchers, there have been several mechanisms behind the campaign that can shed light on the mechanisms that operate behind it. 

A Microsoft disclosure dated February 14, 2025 confirmed that Storm-2372 had begun authenticating through a specific Microsoft Authentication Broker client ID while using the device code sign-in method, which in turn allowed attackers to get refresh access tokens with the new Authentication Broker client ID. 

A device registration token can be exchanged into credentials linked to the device registration service after it has been acquired by an adversary, which makes it possible for that adversary to enroll attacker-controlled systems into Microsoft Entra ID and maintain persistent access for massive email harvesting operations. 

As a result of investigations, high-profile institutions such as the United States Department of State, the Ukrainian Ministry of Defense, the European Parliament, and prominent research organizations have been impersonated in the activities. Researchers have concluded that APT29, a group of malicious actors also known as Cozy Bear, Midnight Blizzard, Cloaked Ursa, and The Dukes, may be the cluster that is driving this activity. 

According to Volexity's case studies, operators are exploiting real-time communication channels as a means of accelerating victim compliance through real-time communication channels. In one incident, UTA0304 contacted a victim via Signal before moving the conversation to Element, and ultimately directed the target to a legitimate Microsoft page asking for an account code, pretending to be a secure chat service provider. 

A malicious attacker might use immediacy and context to convince the victims to act quickly, a tactic similar to those employed by marketing groups to promote Microsoft Teams meetings held by groups related to the phishing attack. 

A response from Microsoft has been to disable the device code flow whenever possible, restrict Entra ID access to trusted networks and devices via Conditional Access, and actively monitor sign-in logs for anomaly activity related to device code, including rapid authentication attempts and logins that originate from unknown locations, in order to prevent this from happening.

It is highly likely that organisations will have to implement layered technical controls in order to reduce exposure to this evolving threat in light of the fact that employee awareness alone cannot counter this evolving threat. In its recommendation to enterprises, Proofpoint recommends explicitly limiting the use of device code authentication. This can be described as the most effective way to prevent misuse of the OAuth device flow by enterprises. 

The adoption of such control systems begins with auditing or report-only deployments, which allows security teams to evaluate potential operational impacts by analyzing historical sign-in data before implementing them in their entirety. 

Providing a more granular, allow-list-based approach where a complete block is not feasible, researchers recommend that device code authentication be limited to narrowly defined and approved scenarios, for example, specific users, operating systems that are trusted, or network locations that are well known.

In addition to these safeguards, additional safeguards can also be implemented by requiring Microsoft 365 sign-ins to originate from compliant or registered devices, particularly in environments that use device registration or Microsoft Intune as authentication methods. Proofpoint warns, however, that misuse of OAuth authentication mechanisms is likely to increase as organizations begin adopting FIDO-compliant multifactor authentication, thus highlighting the need to implement proactive policies and continuous monitoring of these systems. 

Furthermore, researchers have also discovered a broader ecosystem of infrastructure and social engineering techniques that are being used to maintain and expand the campaign, which is ongoing. During the analysis of the phishing URLs, researchers noted that some of them were temporarily inactive. However, the accompanying emails instructed recipients to copy and share the full URL of the browser in case of an error, which is consistent with the tactics used for OAuth device code phishing to extract usable authentication data.

Among the domains involved, ustrs[.]com, seems to have been purchased as a result of a domain auction or resale service. Though the domain was originally registered in early 2020, WHOIS records indicate that it was updated in late 2025, a strategy that has long been used as a way of evading reputation-based security controls that rely heavily on domain age as a signal of trustworthiness.

It was Volexity that observed the same sender approach additional organizations in November 2025, promoting a conference registration link on brussels-indo-pacific-forum[.]org, which has been created to mimic the Brussels Indo-Pacific Dialogue, in an attempt to fool the target audience.

As soon as the victims attempted to sign up for the site, they were presented with a Microsoft 365 authentication process disguised as a legitimate signup process, which then sent them to a benign confirmation page. According to research conducted in connection with Belgrade Security Conference earlier campaigns, subsequent access to compromised accounts was routed through proxy network infrastructures to conceal the attackers' origin, as seen in earlier campaigns. 

Further research has demonstrated that by exploiting standard professional courtesies, operators were systematically extending their reach. When targets declined event invitations, multiple times, as tracked as activity associated with UTA0355, they were urged to register for updates, to share contact details with colleagues who might be interested, and to share contact information with other colleagues who may have been interested as well. 

At least one example involved an unwitting intermediary introducing a new target to the threat actor through an unwitting intermediary, which enabled the attackers to gather new leads organically. In addition, domain registration data related to impersonated events revealed other infrastructure that may have been associated with the same cluster, according to WHOIS data for bsc2025[.]org, a domain resembling Belgrade Security Conference, which was registered using the address mailum[.]com, a relatively unknown e-mail service. 

The Volexity investigation was expanded to identify other domains masquerading as the World Nuclear Exhibition scheduled for November 2025, including world-nuclear-exhibition-paris[.]com, wne-2025[.]com, and confirmyourflight-parisaeroport[.]com, that gave the impression that the World Nuclear Exhibition was being held in Paris. In spite of the fact that researchers do not believe their domains were specifically utilized in confirmed attacks, they can assess that they might have assisted the campaign in its early stages. 

Overall, these findings illustrate a shift in how advanced threat actors are increasingly relying on trusted identity frameworks in place of traditional malware and credential theft in order to carry out their attacks. It has been demonstrated that these campaigns reduce the likelihood of detection, increase user compliance, and decrease the likelihood of detection by weaponizing legitimate authentication flows and embedding them within credible professional interactions.

Organisations may have to deal with longer-term risks associated with persistent access in addition to immediate account compromise, data exposure, internal reconnaissance, and follow-up attacks resulting from persistent access. As a result, security teams are urged to revisit assumptions regarding "trusted" login mechanisms, to improve identity governance, and to ensure visibility into events that do not involve interactive interaction and that are based on a device. 

An attack surface can be significantly reduced by taking proactive measures such as tightening OAuth permissions, auditing registered devices and applications, and stress testing Conditional Access policies. Moreover, leadership and security stakeholders need to be aware that modern phishing campaigns are increasingly modeled on legitimate business workflows, and that defense strategies must be complemented by context-aware user education in order to protect themselves. 

A number of low-friction, high-impact attack techniques are being refined by attackers to gain a higher degree of sophistication, which makes it more challenging for organisations that treat this aspect of their operations as a core operational priority to stop intrusions before they become systemic breaches.
Read more »
Subscribe to: Posts (Atom)