The phishing-as-a-service toolkit leverages legitimate authentication to capture tokens and access Microsoft 365 services.

Device code phishing targets 340+ Microsoft 365 orgs since Feb 2026 via OAuth abuse, enabling persistent token hijacking and ...

EvilTokens, a newly identified phishing-as-a-service operation, is offering cybercriminals a ready-made way to hijack Microsoft accounts by abusing a legitimate sign-in process rather than stealing ...

The Trivy incident exposed a credential architecture failure, not just a supply chain one. Here’s the case for workload ...

Hackers aren't "breaking" your MFA anymore — they’re just riding shotgun during your login to steal the session token right ...