Hackers used a stolen ConnectWise Cloud Backup credential to sign in to 173 Microsoft 365 partner and customer tenants, ...

Attackers used a compromised ConnectWise Cloud Backup credential for unauthorized sign-ins across 173 Microsoft 365 tenants.

Seit Mai 2026 täuschen Angreifer Beschäftigte mit gefälschten IT-Anfragen und stehlen Daten aus Cloud-Diensten.

A three-step Power Automate flow built with the BastionGPT connector: a new email arrives, BastionGPT summarizes and flags it, and the summary is emailed to the care team. The action picker shows the ...

Microsoft says threat actors posing as IT helpdesk staff are tricking employees into phishing and device-code attacks that lead to persistent cloud access. Attackers are using passkey-themed social ...

Attackers are calling or texting employees on their personal phones, posing as internal IT staff, in a social engineering campaign that tricks them into handing over access to corporate cloud accounts ...

The activity, observed since May 2026, relies heavily on social engineering. Victims may receive a phone call, SMS message, or Microsoft Teams message from someone impersonating the organization’s IT ...

Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume ...

A newly discovered Python implant called “TWINLOOT” abuses multiple trusted Microsoft services to hide its command-and-control (C2) communications from security tools, Ontinue reported Tuesday. The ...

Ontinue’s Cyber Defense Center has identified a Python-based implant that keeps most of its command traffic inside Microsoft services, making malicious activity resemble normal Microsoft 365 use.

A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, ...