Tag: Microsoft 365
Defense supplier IEH exposes export-controlled data in phishing hit
IEH Corporation told the SEC that a phished employee's Microsoft 365 mailbox exposed engineering files and potentially export-controlled technical data.
Voicemail lures fuel AitM wave aimed at payroll inboxes
A voicemail-themed AitM phishing wave is taking over Microsoft 365 accounts to harvest payroll and finance email.
Prompt injection turns Word documents into self-spreading worms
Researcher Hakon Maloy showed how hidden instructions in a Word file can alter Copilot output and copy themselves into new…
Microsoft 365 accounts hijacked through compromised hotel Wi-Fi gateways
Threat actors compromised captive Wi-Fi gateways at hotels to silently redirect business travelers to fake Microsoft 365 login pages.
Hollowgraph malware turns Microsoft 365 calendars into covert spy channels
Group-IB discovered HOLLOWGRAPH, malware that uses Microsoft 365 calendars as covert command channels with events dated to 2050.
ACR Stealer uses ClickFix lures to steal browser tokens and Microsoft 365
Microsoft observed two ACR Stealer campaigns using fake error messages to trick users into running code that steals credentials and…
Okta warns of vishing attacks targeting Microsoft 365 user credentials
Okta warns of a rise in voice phishing attacks where callers impersonate IT support to steal Microsoft 365 credentials and…
Critical SearchLeak Chain Enabled One-Click Data Theft via Microsoft 365 Copilot
The SearchLeak chain weaponized three vulnerabilities in Microsoft 365 Copilot to exfiltrate sensitive data before server side sanitization could stop…