SecuriTricks - microsoft 365

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

An active phishing campaign has been identified targeting organizations using Microsoft 365 and Okta for single sign-on. The campaign employs modern techniques to bypass multi-factor authentication and hijack legitimate SSO flows. It uses lookalike domains to impersonate Okta authentication pages a…

phishing

credential theft

adversary-in-the-middle

Published: December 10, 2025

Downloadable IOCs: 1

Analysis of a JavaScript-based Phishing Campaign Targeting Microsoft 365 Credentials

A sophisticated JavaScript-based credential harvesting campaign has been discovered, utilizing fake voicemail notifications to capture Microsoft 365 credentials. The attackers employ HTML smuggling, obfuscation, and encryption techniques to evade detection. The phishing emails contain PDF attachmen…

phishing

credential harvesting

Published: March 4, 2025

Downloadable IOCs: 0

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

Russian threat actors are conducting social-engineering and spear-phishing campaigns to compromise Microsoft 365 accounts using Device Code Authentication phishing. This method has proven more effective than traditional techniques. Campaigns have targeted organizations with politically-themed lures…

device code authentication

Published: February 14, 2025

Downloadable IOCs: 0

HTTP Client Tools Exploitation for Account Takeover Attacks

This analysis reveals a growing trend of attackers repurposing legitimate HTTP client tools to compromise Microsoft 365 environments. The report highlights two main attack campaigns: one using Axios client with a 43% success rate in compromising user accounts, and another using Node Fetch client fo…

adversary-in-the-middle

Published: January 30, 2025

Downloadable IOCs: 6

Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)

This analysis explores the Rockstar 2FA phishing-as-a-service kit, focusing on real-world email campaign examples. It highlights various techniques used by attackers, including the abuse of legitimate services for FUD (Fully Undetectable) links, such as Microsoft OneDrive, OneNote, Dynamics 365, At…

phishing-as-a-service

Published: December 4, 2024

Downloadable IOCs: 51

Mamba 2FA: A new contender in the AiTM phishing ecosystem

Mamba 2FA is a newly discovered adversary-in-the-middle (AiTM) phishing kit being sold as phishing-as-a-service (PhaaS). It features capabilities similar to other popular AiTM phishing services, including handling two-step verifications for non-phishing-resistant MFA methods, supporting various aut…

multi-factor authentication

mamba 2fa

Published: October 7, 2024

Downloadable IOCs: 0

Solving the 7777 Botnet enigma: A cybersecurity quest

Sekoia.io investigated the mysterious 7777 botnet (aka Quad7 botnet), which compromised TP-Link routers to relay password spraying attacks against Microsoft 365 accounts. The investigation involved intercepting network communications and malware deployed on a compromised router in France. The findi…

Published: July 23, 2024

Downloadable IOCs: 4

Tag: microsoft 365

Attack reports

Investigating an adversary-in-the-middle phishing campaign targeting Microsoft 365 and Okta users

Jingle Thief: Inside a Cloud-Based Gift Card Fraud Campaign

Microsoft 365 Direct Send Abuse: Phishing Risks & Security Recommendations

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Analysis of a JavaScript-based Phishing Campaign Targeting Microsoft 365 Credentials

Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication

HTTP Client Tools Exploitation for Account Takeover Attacks

Rockstar 2FA: A Driving Force in Phishing-as-a-Service (PaaS)

Mamba 2FA: A new contender in the AiTM phishing ecosystem

Solving the 7777 Botnet enigma: A cybersecurity quest