How a small code mistake allowed hijacking the Microsoft accounts of everyone in a Teams meeting.

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Learn how Phantom Labs escaped the Microsoft Copilot Studio Code Interpreter sandbox, bypassed AI guardrails, and uncovered platform-wide security risks.

A Kali365 device-code phishing campaign targeted financial and insurance firms via voicemail lures, Google Sites, and Tencent-hosted panel infrastructure.

A ZeroBEC research blog on a reusable DEBULL PhaaS framework, Microsoft Authentication Broker phishing, Turkish code-lineage markers, and GraphSpy-driven post-authentication behavior.

1. Overview A server-side request forgery (SSRF) vulnerability exists in Microsoft Exchange Server’s Exchange Web Services (EWS) InstallApp operation. When an authenticated user submits a ManifestUrl parameter via the InstallApp SOAP request, Exchange downloads the manifest from the supplied URL. The intranet address check that prevents SSRF is gated on the isBposUser flag, which is false for all on-premises Exchange deployments. This means the check is bypassed entirely in non-cloud environments, allowing an authenticated user to force the Exchange server to make HTTP requests to arbitrary internal or external URLs. Microsoft addressed this vulnerability in the June 2026 security update (KB5094139).

After a long week, the Eye Security Research Team thought it was time for a small light-hearted distraction. So we rooted Copilot.

This research introduces two key contributions: first, the weaponization of Cloudflare Workers as a serverless transparent proxy platform that operates on trusted Content Delivery Network (CDN) infrastructure with zero forensic footprint; second, an Authentication Downgrade Attack technique that forces victims to fall back to phishable authentication methods (such as push notifications or OTPs) even when FIDO2 hardware keys are registered.

Walkthrough the ConsentFix (a.k.a. AuthCodeFix) attack mechanics, and learn about mitigations and detections strategies.

Discover how attackers can escalate privileges in Entra ID using Azure VMs, PRT theft, and device identity abuse. Learn how the “Evil VM” attack unfolds, and how you can defend against it.

How I could’ve broken into any Microsoft building, leaking guest/visitor and employee PII.

Threat actors behind the gift card fraud campaign Jingle Thief target retail via phishing and smishing, maintaining long-term access in cloud environments.

⚠ Важно: Все материалы предоставлены исключительно в образовательных целях.

In Microsoft Teams - "Attackers didn’t break in — they joined the meeting..."

I previously blogged about spoofing Microsoft 365 using the direct send feature enabled by default when creating a business 365 Exchange Online instance (https://www.blackhillsinfosec.com/spoofing-microsoft-365-like-its-1995/). Using the direct send feature, it […]

Steve Borosh // Why Phishing? Those of us on the offensive side of security often find ourselves in the position to test our clients’ resilience to phishing attacks. According to […]