Phishing with oauth redirect
leaking Microsoft employee secrets through diagnostic data | careful.net
a collaborative hunt: finding access tokens, Copilot chat logs, and other private information inside Microsoft employee diagnostic data
New Technique Bypass File Upload
New Technique Bypass File Upload This write-up focuses on bypass file upload. Introduction During my security research on Outlook Web, I encountered an unusual behavior that led me to discover a …
Kali365 Ringer: Targeting Financial and Insurance Sectors | ZeroBEC
A Kali365 device-code phishing campaign targeted financial and insurance firms via voicemail lures, Google Sites, and Tencent-hosted panel infrastructure.
DEBULL: Storm-2372-Style Microsoft Device-Code Phishing With GraphSpy Post-Exploitation
A ZeroBEC research blog on a reusable DEBULL PhaaS framework, Microsoft Authentication Broker phishing, Turkish code-lineage markers, and GraphSpy-driven post-authentication behavior.
Exchange Online Protection Improves Zero-Hour Auto Purge (ZAP) - Microsoft 365 for IT Pros
ZAP, or zero-hour auto purge, is an Exchange Online Protection (EOP) feature that's getting some extra features to deal better with spam and phish malware. New policy controls are available to control the feature.
Zero-hour auto purge in Microsoft Defender for Office 365 - Microsoft Defender for Office 365
Zero-hour auto purge (ZAP) in all organizations with cloud mailboxes handles messages in mailboxes retroactively identified as spam, phishing, or malware.
Authentication Downgrade Attacks: Deep Dive into MFA Bypass - IOActive
This research introduces two key contributions: first, the weaponization of Cloudflare Workers as a serverless transparent proxy platform that operates on trusted Content Delivery Network (CDN) infrastructure with zero forensic footprint; second, an Authentication Downgrade Attack technique that forces victims to fall back to phishable authentication methods (such as push notifications or OTPs) even when FIDO2 hardware keys are registered.
ConsentFix (a.k.a. AuthCodeFix): Detecting OAuth2 Authorization Code Phishing
Walkthrough the ConsentFix (a.k.a. AuthCodeFix) attack mechanics, and learn about mitigations and detections strategies.
How Outlook “autodiscover” could leak your passwords – and how to stop it
The Microsoft Autodiscover “Great Leak” explained – and how to prevent it
Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign
Threat actors behind the gift card fraud campaign Jingle Thief target retail via phishing and smishing, maintaining long-term access in cloud environments.
The Risks of the #MonikerLink Bug in Microsoft Outlook and the Big Picture - Check Point Research
Introduction Recently, Check Point Research released a white paper titled “The Obvious, the Normal, and the Advanced: A Comprehensive Analysis of Outlook Attack Vectors”, detailing various attack vectors on Outlook to help the industry understand the security risks the popular Outlook app may bring into organizations. As mentioned in the paper, we discovered an interesting […]
Microsoft 365 enumeration, spraying and exfiltration - TeamFiltration in the spotlight
TeamFiltration is self-defined as a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts. In this article, we will look at its capabilities and how we can potentially detect related events in Azure AD and Microsoft 365 logs. While the article focuses on TeamFiltration, the learnings apply to any similar toolset.
Exploiting CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability - MDSec
Date: 14th March 2023 Today saw Microsoft patch an interesting vulnerability in Microsoft Outlook. The vulnerability is described as follows: Microsoft Office Outlook contains a privilege escalation vulnerability that allows...