Microsoft Defender observed the Storm-2372 device code phishing campaign that abused the OAuth device code flow, dynamic on-demand code generation, and short-lived cloud infrastructure to bypass MFA and evade signature- and reputation-based controls. The campaign used automation platforms (e.g., Railway.com), cloud hosting (Vercel, Cloudflare Workers, AWS Lambda), clipboard hijacking, Microsoft Graph reconnaissance, and malicious inbox rules to maintain persistence and exfiltrate high-value email data. #Storm2372 #RailwayCom

The first ThreatsDay Bulletin of 2026 lands on a day that already feels symbolic — new year, new breaches, new tricks. If the past twelve months taught defenders anything, it’s that threat actors don’t pause for holidays or resolutions. They just evolve faster. This week’s round-up shows how subtle shifts in behavior, from code tweaks to job scams, are rewriting what “cybercrime” looks like in