Microsoft Dismantles AI-Powered EvilTokens Network Behind 12,000 Email Account Takeovers
Microsoft seized 50 sites to dismantle EvilTokens, an AI phishing service that abused device-code flow to hijack 12,000 inboxes for BEC fraud.
Cloud Security
More news
Page 2 / 4 · 34 articles
Stolen Cloudflare Key Turned Brevo Widgets Into a ClickFix Delivery Channel
Stolen Cloudflare API key let attackers hijack Brevo widgets via edge Worker, exposing up to 100,000 sites to ClickFix lures on Sept 14, 2026.
Vishing Crews Use Personal Phones to Break Into Microsoft 365 Without Touching Corporate Devices
Attackers target personal phones with vishing to steal Microsoft 365 credentials, bypass MFA, enumerate environments via Graph and exfiltrate data.
Phishing Campaign Hides Behind Multi-Hop Google Redirects to Steal Credentials
Phishing campaign abuses Google Meet, DoubleClick and Search redirects to evade gateways, personalize fake logins and steal credentials via Telegram.
PREY-0058 Uses Help-Desk Calls and Residential Proxies to Defeat Microsoft 365 MFA
PREY-0058 impersonates IT help desks to steal Microsoft 365 session tokens via AiTM phishing and residential proxies, targeting executives for data theft.
BigBear 2.0 Phishing Service Hijacked Microsoft 365 Sessions at 258 Organizations
BigBear 2.0 phishing service compromised Microsoft 365 at 258 organizations using AiTM proxies to steal sessions after MFA and hijack accounts.
Spring Ring: the Microsoft Teams vishing campaign targeting Windows domain control
Spring Ring vishing used fake Teams help desk calls to deploy Quick Assist, RMM tools and NTLM relay attacks on Windows domain controllers.
JetBrains Cadence Breach Exposed AWS Credentials After TeamCity RCE Exploitation
JetBrains disclosed a Cadence breach via CVE-2026-63077 TeamCity RCE, exposing AWS credentials, backups and S3 files from Aug 8-24, 2026.
Coder Registry Compromised: Malicious Terraform Modules Stole Cloud Credentials and AI Tokens
Coder registry was hijacked on Aug 31, 2026 to serve malicious Terraform modules stealing cloud credentials, AI keys and tokens. Learn impact and fixes.