OAuth Attacks on Microsoft 365 and GitHub are escalating fast. Discover how fake Adobe, DocuSign, and GitHub apps are compromising user...

Microsoft Defender observed the Storm-2372 device code phishing campaign that abused the OAuth device code flow, dynamic on-demand code generation, and short-lived cloud infrastructure to bypass MFA and evade signature- and reputation-based controls. The campaign used automation platforms (e.g., Railway.com), cloud hosting (Vercel, Cloudflare Workers, AWS Lambda), clipboard hijacking, Microsoft Graph reconnaissance, and malicious inbox rules to maintain persistence and exfiltrate high-value email data. #Storm2372 #RailwayCom

Phishing campaigns abusing Microsoft's OAuth Device Code flow have rapidly increased, with ANY.RUN analysts detecting more than 180 phishing URLs in a single week that trick victims into approving attacker-initiated device authorizations. Because victims complete authentication on legitimate Microsoft pages and traffic runs over encrypted HTTPS, attackers receive OAuth tokens for...

Discover the critical identity security gap in DevOps & how to protect your CI/CD pipelines from OAuth attacks.

Dem Angriff auf den US-Versicherer Allianz Life folgt jetzt die Veröffentlichung von 2,8 Millionen Datensätzen mit sensiblen Kunden- und Partnerinformationen. Hinter der Attacke steht mutmaßlich die H...