Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
CVE-2026-80097: Microsoft Authenticator for Android — Malicious Apps Stealing Work Account Tokens
Introduction Microsoft has patched a significant vulnerability in its Authenticator app for Android that allowed malicious applications—requ...
Gheist Campaign: Stolen GitHub Tokens Used to Exfiltrate Repository Secrets via Actions Logs — Detection and Response Guide
Introduction Cloud security firm Wiz has published an analysis of an automated campaign — tracked as Gheist — that is actively compromising ...
Token-Spraying Attacks on Microsoft 365: Detecting and Defeating Session-Token BEC Campaigns
The Threat: Stolen Session Tokens, Sprayed at Scale Security researchers have identified a widespread campaign in which threat actors are at...
EDR Blind Spot: How Browser-Based Attacks Steal Sessions, Abuse Extensions, and Evade Endpoint Telemetry — Detection and Hardening Guide
The Endpoint Telemetry Gap Is Now the Attacker's Front Door A recent analysis from NordLayer, covered by BleepingComputer, puts words to som...
EvilTokens PhaaS Takedown: Defending Entra ID Against Device Code Phishing and Token Theft
What Happened Microsoft's Digital Crimes Unit (DCU), working with industry partners, has facilitated a disruption of infrastructure belongin...
OAuth Consent Abuse: Why MFA Isn't Enough — Detection and Remediation Guide for Entra ID
Introduction Multi-factor authentication has become the default answer to identity attacks — and for password-based credential theft, it rem...
Help Desk Vishing + AitM Token Theft: Defending Microsoft 365 Against Executive-Targeted Data Theft and Extortion
The Threat: Voice-Based Social Engineering Meets Token Theft Threat hunters have disclosed a widespread data theft and extortion threat clus...
Kali365 Phishing Kit Weaponizes Microsoft Authentication: AiTM Detection and Defense Guide for Microsoft 365
Kali365 Weaponizes Microsoft Authentication: What Defenders Need to Know Now The emergence of the Kali365 phishing kit marks another escalat...
Storm-2945 'CaptiveCrunch': Hotel Wi-Fi DNS Hijacking and M365 Token Theft Defense
Storm-2945 'CaptiveCrunch': Hotel Wi-Fi DNS Hijacking and M365 Token Theft Defense Introduction Since early May 2026, a sophisticated cyber-...