By exploiting stolen authentication tokens instead of passwords, a cyber campaign targeting Microsoft 365 compromised email accounts for 79 organizations. During the period July 14-22, 2026, cybersecurity firm Huntress reported unauthorized access to business accounts was gained by replaying stolen login sessions for ten weeks, using stolen login sessions.  Research indicated that there were approximately 497 successful login attempts during the investigation, compared to more than 200,000 failed login attempts. The campaign relied on infrastructure provided by 1337 Services GmbH, a hosting provider based in Hamburg, Germany. Microsoft Entra ID Protection also flagged several IP addresses associated with the activity, indicating that portions of the infrastructure had been identified as suspect. This attack highlights the vulnerability of conventional account protection.  Although multi-factor authentication (MFA) was enabled during legitimate sign-ins, attackers exploited this mechanism to capture authentication tokens after the user completed the verification process. As a result of these tokens, Microsoft 365 services could be accessed without the attacker having to enter the account password or repeat the MFA challenge.  Stolen Authentication Tokens Bypass MFA Protection There have been several techniques employed by researchers to obtain valid authentication tokens, including adversary in the middle (AiTM) phishing, device-code phishing, and social engineering. In AiTM attacks, victims are directed to fraudulent sign-in pages that relay requests to Microsoft's genuine login service.  Once the user enters their credentials and completes MFA, the relay captures the session token resulting from that action. Having successfully authenticated a user, the token can be reused by an attacker without requiring the user to complete the original verification process again. Another method is device-code phishing, which tricked the victim into entering a code on Microsoft's valid sign-in page, enabling the attacker to control the session without being aware.  According to Huntertress, token spray is an approach to attempting access at scale by reusing stolen tokens across multiple organizations in a similar manner to password spraying. In place of repeatedly guessing passwords, attackers used already authenticated sessions to attempt access to multiple organizations.  The stolen sessions were often used within minutes of being stolen. During one incident on July 21, the attacker accessed a hijacked session 12 minutes after the victim reached the MFA prompt. During another incident on September 22, the interval was only four minutes. The campaign also involved repeated changes to its infrastructure.  Attackers rotated between six IP addresses within the range 193.26.115.0/24, returning in multiple waves separated by periods of inactivity, rotating between the six IP addresses in succession. Using this approach, it was difficult to block specific addresses since activity could continue from another address in the same range.  After gaining initial access, attackers attempted to maintain control over compromised accounts and conceal suspicious activity, increasing the risk that further business email compromises will occur.  Attackers Compromise 79 Organizations Through Microsoft 365 Token Replay A number of methods were also used to maintain access after the initial compromise by Huntress, including identifying 48 unauthorized devices registered in the Microsoft Entra directories of victims. The attackers were able to retain access even after stolen sessions expired by removing existing multi-factor authentication (MFA) methods and registering new ones within three hours of the first suspicious sign-in in 19 organizations. A password reset alone will not remove these unauthorized devices or authentication methods, leaving compromised accounts exposed unless administrators review and remove them. However, they can create their own authenticator methods to complete future login verification. As well as creating concealed inbox rules for hiding messages from account owners, attackers also created concealed inbox rules.  A number of rules automatically marked incoming emails as read, deleted them, or moved them into folders such as RSS Feeds and Conversation History. These rules typically contained short names or punctuation, which rendered them less visible during routine checks. An external accountant was contacted by an e-mail relating to payroll related issues using a compromised mailbox.  Using the attacker's rule, he was able to capture messages containing terms such as "payroll," "direct deposit," "bank," and "bonus," and then added another rule to hide the accountant's responses. As a result of this approach, fraudulent payment requests may continue, without the account owner being aware of the conversation.  Attack Infrastructure Shifted Across Multiple Phases Over the course of four phases from July 14 to September 22, 2026, Hunters tracked the operation. In order to capture and replay sign-in tokens, the attackers rotated between six IP addresses associated with German hosting provider 1337 Services GmbH, using separate infrastructure.  In addition to 497 successful sign-ins across 79 organizations, over 200,000 unsuccessful attempts were recorded as part of the investigation. The Microsoft Entra ID Protection system flagged several addresses associated with the activity during a four-day burst in September. One address recorded hundreds of successful sign-ins from dozens of organizations. The campaign utilized scripted token replays as well as browser-based session replays.  A device-code phishing scheme, which involves tricking users into entering a code on Microsoft's legitimate sign-in page, was also employed in the campaign, enabling hackers to authorize sessions without obtaining account credentials. Huntress did not attribute the campaign to a specific threat group or country.  The findings emphasize instead how stolen session tokens can compromise account security even with multi-factor authentication enabled. Conditional Access Policies Can Help Limit Exposure Using Conditional Access policies, Hunters recommends requiring multi-factor authentication (MFA) or blocking access to all users, cloud applications, and client applications. These policies were able to stop more than a thousand sign-in attempts from a single attacker-controlled address across four organizations during the observed campaign, demonstrating their effectiveness when properly configured.  When a token replay incident is suspected, administrators need to revoke active sessions, reset passwords, and audit Entra devices and MFA methods registered with the network. Checkbox rules for unusual names, unexpected message deletions, and rules that redirect payroll or banking correspondence to avoid unusual names. Additionally, organizations should review suspicious sign-ins and restrict device-code authentication in situations where it is not necessary. According to the campaign, addressing token theft involves more than simply changing passwords.  In order to prevent attackers from returning to compromised Microsoft 365 accounts, it is also necessary to remove unauthorized authentication methods, invalidate sessions, and identify concealed mailbox activity. Microsoft 365 accounts need to be secured through more than password protection and multi-factor authentication, according to this campaign. It is imperative to revoke compromised sessions, audit registered devices and authentication methods, and identify suspicious inbox rules in order to prevent persistent access and reduce the risk of business email compromise.

Two former U.S. Air Force members were sentenced for carrying out multi-year business email compromise and phishing schemes that stole credentials and rerouted corporate wire transfers. Their fraud helped divert more than $2.4 million from victims, with the Justice Department and FBI warning that BEC remains a major source of financial loss. #ChijiokeTimothyOdimegwu #HarafatMogaji #DoverAirForceBase #BusinessEmailCompromise

https://www.osintinvestigate.com Cybercriminals sent more than one million emails impersonating CEOs, CFOs and company executives in an attempt to trick employees into approving payments of nearly $50,000. Discover how this sophisticated business email compromise campaign used fake invoices, lookalike domains, executive impersonation and possible AI-assisted templates to make fraudulent payment requests appear legitimate—and what organizations can do to stop similar attacks.

AI-powered social engineering is helping attackers bypass traditional phishing defenses by using deepfakes, vishing, smishing, and business email compromise across email, calls, and video meetings. Gartner says CISOs should make verification the default for risky requests, harden account recovery and privileged access, and correlate suspicious activity across channels to spot multimodal impersonation. #Gartner #CraigPorter #Deepfake #BusinessEmailCompromise #Vishing #Smishing #HongKong

We recently highlighted the unfortunate facts involved when a South Carolina beach town The immediate loss is bad enough, but the harder question that...

"AI-driven cyber attacks" isn't hype, it's a turbo button for the scams you've seen for years. The new tools don't invent brand-new crimes.

The Ultimate Cyber Con You ever hear the one about the thief who never had to break in? No crowbars and no alarms tripped. No ski masks, just a well-worded email, a little deception and boom, millions...

  In the wake of a massive unsecured MongoDB database, researchers have rekindled their interest in the risks associated with corporate intelligence and lead generation ecosystems. Researchers discovered that the MongoDB instance had been exposed, containing about 16 terabytes of data and approximately 4.3 billion professional records, according to the researchers.  It is noteworthy that the dataset, which largely mirrored LinkedIn-style information, such as name, title, employer and contact information, is one of the largest known exposures of its type and has serious implications for large-scale social engineering and phishing campaigns utilizing artificial intelligence. Security researcher Bob Diachenko discovered the database by working with the nexos.ai company on November 23, 2025, and it was secure two days later after a responsible disclosure was conducted. In addition, as a result of the lack of access logs and forensic indicators, it remains impossible to determine whether malicious actors were able to access or exfiltrate the data prior to remediation, leaving affected individuals and organizations with lingering questions about the possibility of misuse.  In terms of scale and organization, security analysts describe the exposed repository as one of the largest lead-generation datasets on the open internet in recent history, not only because of its enormous size but also because of its organization. According to the structure of the database, scraping and enrichment operations were carried out deliberately and systematically, with evidence suggesting that a large portion of the information was gathered from professional networking sites, such as LinkedIn, in order to enrich the database.  The records, which are grouped into nine distinct data collections, encompasse a wide range of personal and professional attributes, including full names, e-mail addresses, phone numbers, URLs for LinkedIn profiles, employment histories, educational backgrounds, geographical details, and links to other social media accounts, among other details.  Researchers point out that the dataset's granularity significantly increases its potential for abuse, especially given the presence of a dedicated collection labeled "intent" containing more than two billion documents in addition to other collections.  A number of analysts point out that the level of detail the leak has reveals makes it a highly valuable social-engineering asset, enabling cybercriminals to create highly tailored spear-phishing attacks and business email compromise campaigns, able to convince clients that they are trustworthy contacts in order to attack organizations and professionals around the world.  It has been characterized by cybersecurity experts as the largest lead generation data collection ever discovered publicly accessible by cybersecurity experts, distinguished not only by its sheer size but also by its unusually methodical structure.  Using the way the information was segmented and enriched, there is evidence to suggest that a large-scale scraping operation may have been used to gather the information, with indicators suggesting that professional networking platforms such as LinkedIn may have served as primary sources in this case.  In total, the data for the report appears to be distributed over nine separate collections and consists of billions of individual records detailing full names, email addresses, phone numbers, LinkedIn profile links, employment history, educational background, location information and social media accounts which are associated with those records.  In light of such comprehensive profiling, analysts have warned that the risk of exploitation is significant, particularly since one collection—the "intent" collection which contains over two billion entries—seems to be aimed at capturing behavioral or interest-based signals as well. The depth of insight they offer is, they point out, an exceptionally powerful foundation for spear-phishing and business email compromise schemes that can be launched against organizations and professionals throughout the world.  In summary, the exposed database was divided into nine distinct collections, bearing labels such as "intent," "profiles," "people," "sitemaps," and "companies," a layout that researchers say reflects a sophisticated data aggregation pipeline with the hallmarks of machine learning. It was based on this organizational structure that investigators concluded that the information was probably obtained through large-scale scraping from professional platforms, like LinkedIn, and Apollo's artificial intelligence-driven sales intelligence service, in order to gather the information.  The records contained in at least three collections had extensive amounts of personally identifiable data, totaling nearly two billion records, each of which contained extensive amounts of information. There was a wide range of information that was exposed, including names, email addresses, phone numbers, LinkedIn profiles and handle links, job titles, employers, detailed employment histories, educational backgrounds, degrees and certifications, location information, languages, skills, functional roles, links to other social media accounts, images, URLs, email confidence scores, and Apollo-specific identifiers associated with each individual.  In addition to profile photographs, some collections were made up of personal information that further compounded the sensitivity of the disclosure. It is believed that the scope and depth of the leaked information significantly increased the risk of identity theft as well as financial fraud.  The Cybernews report noted that it was unable to identify a specific organization that had generated the database, but multiple indicators indicate that it was a commercial lead generation operation. Despite the fact that no formal agreement has been established for who owns the exposed dataset, researchers cautioned against drawing definitive conclusions based on it.  Investigators discovered that there were several sitemap references that pointed to a lead-generation operation, including those linking “/people” and “/company” pathways to a commercial site that advertised access to more than 700 million professional profiles, a figure that closely matches the number of unique profiles reported by the database.  A noteworthy aspect of this incident was that after the database was first reported, it was taken offline within one day of the incident. Nonetheless, a number of researchers stressed that attribution remains uncertain, suggesting that the company itself may have been a downstream victim, rather than the original source of the data.  It is widely acknowledged that security experts warn that the real risk is not simply the extent of the exposure, but the precision it permits. With a dataset of this magnitude and structure, it is possible to use it to launch a highly targeted phishing campaign, a business email compromise scheme, a CEO fraud scheme, and a detailed corporate reconnaissance campaign, particularly against executives and employees of Fortune 500 companies and corporations.  A massive database of records makes it possible for attackers to automate personalization at a massive scale, dramatically reducing preparation time and maximizing success rates. Cybernews pointed out that modern large language models can produce persuasive, individual messages based on profile information, enabling tens of millions of targeted emails to be sent at minimal cost, where the compromise of a single high-value target is enough for the entire operation to be justified.  A further concern noted by researchers was that datasets of this nature often serve to enrich other breaches in the process of enrichment, allowing threat actors to assemble extensive, searchable profiles that may ultimately include passwords, device identifiers, and cross-platform account links, making it significantly easier for hackers to conduct social engineering and credential stuffing attacks.  Despite the fact that cybercriminals can quickly take advantage of large, unprotected databases of this type, security experts warn that these types of databases are highly lucrative assets. The wide variety of information allows attackers to conduct targeted phishing campaigns with precise targeting, including executive fraud schemes that impersonate senior leaders to encourage employees to authorize fraudulent financial transfers.  As a result of the same data, security teams can also use it to conduct detailed corporate reconnaissance, which is a technique commonly used by cybersecurity teams to assess organization resilience to social engineering threats. However, it can also be effectively utilized by malicious actors in order to identify vulnerable areas for exploiting.  As a result of the high value placed on enterprise-related data on underground markets, multinational organizations remain particularly attractive targets for cyber criminals. Several analysts have noted that it is highly likely that the dataset includes employees from Fortune 500 companies, which makes it possible for threat actors to isolate specific companies and individuals, and tailor attack techniques to increase their chances of successfully compromising networks or causing financial loss.  A growing need for better accountability and governance across the lead generation and data brokerage industries is becoming apparent, especially as these datasets continue to intersect with advanced automation and artificial intelligence technologies in a fashion that is unprecedented in the past.  The security experts say that this incident serves as a reminder that organizations taking care of highly confidential or personal data, as well as encrypting the data, are required to treat access controls, encryption, and continuous monitoring as baseline requirements, and not as optional measures.  In light of this event, it is imperative that enterprises strengthen their internal defenses by training employees about how to identify social engineering attacks before they take place, improving the process of verifying financial requests, and conducting regular audits to detect social engineering risks before they become exploited.  Additionally, regulators and industry organizations may be under increasing pressure to clarify accountability standards when it comes to data aggregation practices that rely on large-scale scraping and enrichment on a large scale.  It is likely that, even though the database was secured, there will be repercussions to the greater extent that the database was exposed, demonstrating how lapses in data stewardship can have a far broader impact beyond a single incident and reshape the threat landscape for businesses and professionals.

  kAustralia witnessed a sharp 30% rise in phishing emails last year, as cybercriminals increasingly targeted the Asia-Pacific (APAC) region, according to a recent study by security firm Abnormal Security. The APAC region’s expanding presence in critical…

Business Email Compromise (BEC) ist eine gefährliche Bedrohung. Entdecken Sie, warum klassische E-Mail-Security versagt.

Summer vacation schedules and reduced staffing create openings for attackers, who use the slower pace to hide suspicious activity, extend dwell time, and exploit phishing and Business Email Compromise attempts. Organizations can reduce these seasonal risks by using AI-driven automation, continuous monitoring, and automated response to keep security coverage strong year-round. #Kaseya #BusinessEmailCompromise #AI