A sophisticated threat actor tracked as O-UNC-066 by Okta is targeting organizations across multiple sectors with a voice-based phishing (vishing) scheme that…
A recent EvilTokens campaign is exploiting a new 'ghost phishing' technique that hides malicious content until it decrypts inside the victim's browser,…
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
DEBULL is a reusable tooling layer that packages Storm-2372-style identity tradecraft into a PhaaS platform. It provides campaign-facing and operator-facing infrastructure, using…
GraphSpy is a tool used for post-exploitation of Microsoft 365 and Entra environments, often integrated into PhaaS platforms like DEBULL. It enables…
EvilTokens is a phishing kit that steals Microsoft 365 tokens through the OAuth device code flow. It also provides AI-powered analytics services…
Microsoft 365 is a productivity and collaboration suite that is a primary target for NovaCookies and other phishing kits. The AitM relay…