Browse public community intelligence reports, source analysis, and threat research.
62 intel reports
The Kali365 phishing kit abuses Microsoft and Google device code authentication flows to steal OAuth access tokens from US organizations across multiple sectors.
The threat actor ShinyHunters and affiliated clusters are targeting SaaS platforms, specifically Salesforce, using vishing and OAuth integration abuse for data exfiltration and extortion.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
An active Microsoft 365 phishing campaign abuses the legitimate OAuth 2.0 Device Authorization Grant flow to bypass traditional credential theft and gain account access.
The EvilTokens and ARToken Phishing-as-a-Service (PhaaS) platforms use Microsoft Device Code flows and browser-side decryption to bypass MFA and achieve persistent Microsoft 365 account takeovers.
ARToken is an EvilTokens-linked Phishing-as-a-Service platform that uses Microsoft OAuth Device Code grants to capture Primary Refresh Tokens (PRTs) for persistent access and BEC operations.
Threat actors are weaponizing the Microsoft Device Authorization Grant flow to bypass MFA and maintain persistent access to corporate Microsoft 365 environments.
The HellCat ransomware group is increasingly exploiting Jira credentials harvested by infostealers like StealC and Amadey to facilitate corporate breaches and data exfiltration.
The ToddyCat APT group utilizes Umbrij malware to compromise corporate Gmail accounts by leveraging a technique called Shadow Token via Remote Debug (STRD) to steal OAuth tokens.
An unauthenticated remote code execution vulnerability in the Argo CD repo-server component allows attackers with internal network access to take over Kubernetes clusters.
