🧰 Microsoft 365

The items that name it 58

• AI, Scripts, Operator: Inside the ConnectWise Attack
  writeupas classification.technologies2026-10-26
• CISA Publishes Significant Updates to ScubaGear and ScubaGoggles
  articleas affected products2026-10-26It is written here as Microsoft 365 (M365).

  M365

• China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  articleas classification.technologies2026-10-23
• Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  articleas affected products2026-10-22It is written here as Microsoft 365 (tokens targeted by all three phishing kits Huntress analyzed).

  tokens targeted by all three phishing kits Huntress analyzed

• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
  articleas classification.technologies2026-10-22
• M365 Token Spray and Replay Campaign Compromises Business Email Accounts
  writeupas affected products2026-10-22
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.technologies2026-10-21
• Parasitizing trust: How legitimate infrastructure becomes a delivery pipeline for attackers
  writeupas classification.technologies2026-10-21
• ConnectWise Suspends Cloud Services in Response to Cyberattack
  articleas classification.technologies2026-10-19
• Microsoft Threat Intelligence (@MsftSecIntel) on X
  advisoryas classification.technologies2026-10-17
• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
  writeupas classification.technologies2026-10-16
• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  articleas classification.technologies2026-10-14
• Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
  articleas affected products2026-10-14
• Microsoft Patches Record 1,413 Vulnerabilities, Including Exploited Windows Zero-Day
  articleas classification.technologies2026-10-14
• Ned Peterson (@NedPeterson99) on X
  threadas affected products2026-10-09
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue RMMs
  writeupas classification.technologies2026-10-07
• China-aligned TA419 impersonates Anthropic employee, ex-White House official to phish AI policy experts
  articleas classification.technologies2026-10-02
• Huntress Tragic Quadrant: Top Cyber Threats Wrecking Businesses
  articleas affected products2026-10-01

  Login page targeted by AiTM (adversary-in-the-middle) attacks that steal session tokens in transit

• China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
  writeupas affected products2026-09-30It is written here as Microsoft 365 (Outlook, OneDrive, Microsoft Graph API).

  Abused as dead-drop C2 channel by Antino via graph.microsoft.com and login.microsoftonline.com

• Check Point Research — 28th September Threat Intelligence Report
  articleas classification.technologies2026-09-28
• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas affected products2026-09-09

  Suite including SharePoint Online, OneDrive for Business, and Exchange Online targeted for data collection and exfiltration.

• [tl;dr sec] #344 - VMs won't contain Cyber-capable Agents, AWS AI Security Analyst, Decompilers vs LLMs
  articleas affected products2026-09-08
• Inside Knight Office, a New M365 AiTM Phishing Kit
  writeupas affected products2026-09-02

  Account targeted in the AiTM attack; post-MFA authentication events observed against the Microsoft Authentication Broker app

• Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
  articleas classification.technologies2026-08-28
• Insights into Suspected DPRK Workers
  writeupas affected products2026-08-26

  Workloads including Exchange, SharePoint, and sign-ins analyzed via Unified Audit Logs during investigation of suspicious DPRK worker accounts

• What Good Identity Hardening Looks Like
  articleas classification.technologies2026-08-25
• Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
  articleas classification.technologies2026-08-20
• A Detection Engineer's Guide for Delegating Work to AI
  articleas affected products2026-08-19

  Attacker used a stolen Microsoft 365 session to take over an account without tripping any detections

• How to Spot and Stop Rogue Device Joins
  writeupas affected products2026-08-18

  Target of post-compromise access after rogue device registration, e.g. accessing resources, exfiltrating emails

• Critical One-Click Vulnerability in Atlassian's Rovo AI Exposed Enterprise Data
  articleas classification.technologies2026-08-08
• [tl;dr sec] #340 - Anthropic and Meta Agents be Hackin', Agentic Incident Response Notebooks, Figma's AI Code Scanning
  articleas classification.technologies2026-08-07
• UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
  articleas affected products2026-08-06
• Device Code Phishing Keeps Evolving. Here’s What to Watch For
  writeupas affected products2026-07-31

  Authentication/sign-in flows abused via device code phishing to obtain and replay stolen tokens without stealing passwords directly.

• 5 Modern Threats You Need to Watch
  articleas affected products2026-07-14

  Employee mailbox compromised via sign-in from an unusual device; attacker set up an inbox rule redirecting/hiding replies in the 'Conversation History' folder to monitor invoice/payment conversations undetected.

• Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
  articleas affected products2026-07-09

  Anomalous logins and account compromise across dozens of organizations via OAuth token abuse

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeupas affected products2026-07-01

  Identity platform monitored by Huntress Managed ITDR for lateral movement/identity anomalies

• No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
  writeupas affected products2026-06-30

  Targeted environments; credential/token spray attacks against tenants

• The Hacker's 2026 Playbook: Dark Web Tactics Targeting You
  articleas affected products2026-06-29

  Account/session hijacked via stolen OAuth tokens obtained through the ConsentFix flow; affects access to email, OneDrive, Teams, and other Microsoft 365 resources.

• We Need to Talk About Device Code Phishing
  articleas classification.technologies2026-06-22
• SearchLeak: How We Turned M365 Copilot Into a One-Click Data Exfiltration Weapon
  writeupas classification.technologies2026-06-15
• New attack turned Microsoft 365 Copilot into 1-click data theft tool
  articleas classification.technologies2026-06-15
• Anatomy of a Deno-Based Proxy & RAT
  writeupas affected products2026-06-15

  Unified Audit Log generated TeamsImpersonationDetected operation

• Inside Kali365, a Device Code Phishing Ecosystem | Huntress
  writeupas affected products2026-06-11

  Primary target; sessions/tokens captured via device code phishing and AiTM

• From Cookies to Keys: The Threat of Session Hijacking
  articleas affected products2026-05-26

  Session cookies harvested by infostealers; valid M365 sessions sell for $100-$500+.

• Prompt Injection Attack Compendium (2026 Edition)
  articleas classification.technologies2026-05-11
• Why the Stryker Attack Still Matters. And Five Steps You Can Take Today
  articleas classification.technologies2026-04-08
• OpenClaw, Rogue Agents, and Application Hygiene
  writeupas classification.technologies2026-04-01
• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas affected products2026-03-23

  Identities targeted via device code phishing across 340+ organizations

• Phishing Techniques Spotted: Email Examples & Red Flags
  articleas classification.technologies2026-03-16
• #ShadyHacks with Kyle Hanslovan
  writeupas affected products2025-11-26

  Target of the demonstrated account takeover; identity/session hijacking bypasses MFA and grants access to email, files, and connected applications.

• 6 Months of Researching OAuth Application Attacks | Huntress
  writeupas affected products2025-02-10

  Tenants targeted by malicious OAuth applications

• Device Code Phishing: OAuth 2.0 Attacks in Google & Azure
  writeupas classification.technologies2025-02-06
• DMARC Identifier Alignment: relax, don't do it, when you want to go to it
  writeupas classification.technologies2023-01-25
• CISA AA26-281A: Chinese Government-linked Actors Combine Automated and Hands-on Hacking Tools to Steal Data
  advisoryas classification.technologies
• Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
  articleas affected products

  Platform whose Graph API is used natively by Antino's C2 channel.

• Sift — Open-Source Secrets/Credential Scanner
  repoas classification.technologies
• Detecting and countering misuse of AI: September 2026
  articleas classification.technologies
• Copirate 365 at DEF CON: Plundering in the Depths of Microsoft Copilot (CVE-2026-24299) · Embrace The Red
  writeupas classification.technologies