MFA is essential, but it cannot replace OAuth governance, least-privilege scopes, consent monitoring, and rapid revocation.

Sentire uncovers the GhostCode phishing kit abusing Microsoft OAuth to steal tokens, register attacker devices and access ...

A new phishing kit abuses a legitimate Microsoft device authorization flow intended for use with printers or smart TVs to steal authentication tokens, register attacker-controlled devices and gain ...

A phishing campaign abuses Microsoft OAuth and Teams to redirect victims to fake login pages generated inside their browsers.

The Thunderbird team has officially released Thunderbird 156, bringing another round of new features, security improvements, ...

What Enterprise Problems Must MCP Deployments Address? Run an agent-heavy workflow inside a real organization, and you ...

Passkey-themed social engineering is being used to compromise identities and enable broader cloud attacks. Learn how threat actors establish MFA persistence, abuse Microsoft Graph for reconnaissance, ...

Microsoft says threat actors linked to ShinyHunters, Helix, and other extortion gangs are using passkey and single ...

See how Microsoft Defender detects and disrupts AI-themed phishing, malware, and multi-stage attacks across the attack chain.

Browser Phishing Exploits Microsoft Services and Blob URLs ### Barracuda reveals how cybercriminals route unsuspecting targets through trusted Microsoft infrastructure to assemble elusive phishing ...

The Federal Bureau of Investigation issued the warning about a technique known as OAuth consent phishing, according to ...

CloudSEK found 4,148 stolen session cookies and 1,032 plaintext passwords in an operation targeting 461 organizations across ...