Intel Exchange

Threat actors utilized Adversary-in-the-Middle (AitM) relays to steal and replay Microsoft 365 session tokens, registering rogue devices and MFA methods for persistence.

APT28 (Swallowtail) is executing a complex cyber espionage campaign targeting NATO naval and aerospace manufacturers using the Hookedge backdoor and a novel reflective loader.

Scattered Spider and related affiliates use vishing to trick employees into enrolling adversary-controlled passkeys, enabling mass data exfiltration from Microsoft 365 environments.

An unattributed threat actor used AiTM phishing and device code flows to steal M365 session tokens, replaying them to register rogue devices and wipe MFA methods across 79 organizations.

Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.

Varonis Threat Labs identified TrustSink, a post-compromise technique where attackers with high privileges register rogue External Authentication Methods (EAM) in Microsoft Entra to capture plaintext passwords during legitimate MFA flows.

Attackers can leverage leaked GitLab incoming email tokens to push code, execute CI/CD jobs, and bypass IP restrictions by spoofing merge request emails.

GhostCode is a novel phishing kit that abuses the Microsoft Device Code authorization flow to bypass MFA and achieve persistent access to M365 environments.

NovaCookies is an $320/month Adversary-in-the-Middle (AiTM) service that proxies Microsoft 365 logins to capture authenticated session cookies and bypass MFA.

Gunra is a sophisticated RaaS variant derived from Conti source code that utilizes Fortinet exploits and multi-threaded encryption to target global critical infrastructure.