New Ghost Phishing Wave Using EvilTokens Bypasses Traditional Email Security
A recent EvilTokens campaign is exploiting a new 'ghost phishing' technique that hides malicious content until it decrypts inside the victim's browser,…
Tag: Microsoft
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
Storm-2372: Microsoft-Identified Threat Actor Behind Device Code Phishing Campaigns
Storm-2372 is a threat actor documented by Microsoft in February 2025, known for using messaging and Teams-style lures to trick victims into…
EvilTokens Phishing Kit
EvilTokens is a device code phishing kit used in campaigns targeting Microsoft accounts, often delivered through multi-hop infrastructure including Mailjet and Cloudflare…
GitHub Copilot
GitHub Copilot is an AI-powered code completion tool developed by GitHub and OpenAI. It was part of the Developer Tools category with…
Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker in Jewelry Retailer Breach
U.S. prosecutors have linked an alleged member of the Scattered Spider cybercriminal group to a May 2025 intrusion at a luxury jewelry…
SkillCloak Technique Lets Malicious AI Agent Skills Evade Static Scanners with Self-Extracting Packing
Researchers at the Hong Kong University of Science and Technology have developed a technique called SkillCloak that allows malicious AI agent skills…
Armored Likho Targets Government and Power Sector with BusySnake Stealer
A previously undocumented threat actor, Armored Likho, has been attributed to cyber attacks targeting government agencies and the electric power sector across…
CVE-2025-9491: Windows Shortcut Vulnerability Exploited by Armored Likho
CVE-2025-9491 is a now-patched Windows shortcut vulnerability (ZDI-CAN-25373) that allows remote code execution. Addressed by Microsoft in November 2025 Patch Tuesday, it…
ToddyCat APT Deploys Umbrij Malware to Hijack Gmail via OAuth Token Theft
A new malware strain named Umbrij, attributed to the advanced persistent threat (APT) group ToddyCat, is abusing OAuth 2.0 tokens to gain…