Cyber ​​Security Hub

Directly targeting Microsoft 365 services, the sophisticated phishing kit Mirage2FA does not stop at stealing passwords – it also hijacks login session "keys." As a result, hackers can open the doors wide to corporate systems without worrying about the two-factor authentication (2FA) layer.

By tampering with the login process, attackers gained access to the mailbox and redirected vendor payments. Notably, this campaign used no malware, infostealers, or remote access tools on the victim's device.

A sophisticated voice phishing (vishing) campaign is directly targeting Microsoft 365 users. Notably, attackers are exploiting the recent wave of security upgrades to turn them into a perfect trap for hijacking corporate accounts.

Researchers have uncovered ARToken, a phishing toolkit abusing Microsoft 365 OAuth Device Code Flow to steal access tokens without passwords. Learn how it works and how to stay protected

Microsoft has officially released critical patches to address a series of severe security vulnerabilities in Outlook and Word.

Recently, researchers discovered a critical vulnerability dubbed "FlagLeft" within the Microsoft 365 application ecosystem for the Android operating system. This issue threatens the information security of billions of users globally, paving the way for malicious applications to silently hijack account access without requiring any user interaction or permission.