Browse public community intelligence reports, source analysis, and threat research.
62 intel reports
MadApe is an undocumented phishing kit that abuses Microsoft Device Code authentication via business-themed PDF lures and multi-stage redirects to compromise Microsoft 365 accounts.
SkyW4lker is a device-code phishing kit targeting Microsoft 365 users, primarily in the US technology and manufacturing sectors, to bypass MFA and obtain access tokens.
An unattributed threat actor used AiTM phishing and device code flows to steal M365 session tokens, replaying them to register rogue devices and wipe MFA methods across 79 organizations.
Unknown threat actors compromised ConnectWise Cloud Backup application identities to gain unauthorized access to Microsoft 365 tenants across multiple sectors.
Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.
Helix extortion group uses vishing and device code phishing to compromise identities and automate bulk data exfiltration from SharePoint environments.
Midnight Blizzard-linked actor GTG-20006 utilized AI-assisted code generation to modify PowerShell stagers and Go backdoors targeting government and defense organizations via device-code phishing.
The Kali365 Phishing-as-a-Service platform exploits Microsoft's device code authentication flow to bypass MFA and capture persistent OAuth tokens for M365 environments.
The EvilTokens phishing-as-a-service platform uses OAuth device-code flows to bypass MFA and maintain persistent access to Microsoft 365 environments.
ShinyHunters has evolved from a credential-theft crew into a resilient extortion brand and SaaS supply-chain threat, most recently exploiting PeopleSoft zero-days and third-party OAuth tokens.
