Weekly Briefing • August 21, 2026

Three of this week's cases end in the same place: somebody has access to a Microsoft 365 account, and at no point did they need a working password. In the first, the user completes a genuine Microsoft sign-in, approves a genuine MFA prompt, and the attacker collects the token. In the second, a fake login window passes the one-time code to the real service while the user is still typing it, and keeps the session that comes back. In the third, the malware never signs in to the tenant at all — it runs its command channel through SharePoint and Teams.

We flagged a smaller version of this in the last briefing: a trojan stealing session cookies, where nobody gets prompted for a second factor on a session that is already signed in. This week it is the whole pattern, and it changes what containing an incident has to mean. Here's what happened, and what each one is asking of your firm.

The Sign-In Page Was Real, and So Was the MFA Prompt

Huntress is tracking a run of Microsoft 365 account takeovers in which no password is ever captured. The technique abuses the OAuth device authorization flow — the sign-in path built for equipment that cannot handle a browser login, like smart TVs, conference room displays, and command-line tools. The device shows a short code, and the person signs in on a phone or laptop to finish the job. An attacker starts that flow himself, sends your user the code with a plausible reason to enter it, and the user completes an authentic sign-in on Microsoft's own page. The token that comes out the other end goes to whoever started the flow.

There is no counterfeit portal to spot, because the portal is microsoft.com/devicelogin. There is no password to steal, because the password goes to Microsoft. MFA fires and the user approves it, because from Microsoft's point of view the sign-in is legitimate — and it is. What the attacker walks away with is a token, and the token is the thing that actually opens mail, files, and Teams data. In your own tenant logs it records as an ordinary successful sign-in by a real employee.

Huntress reports an influx of this through 2026, and the volume is concrete. An earlier wave ran through Railway, a platform-as-a-service, and was attributed to a phishing-as-a-service kit called EvilTokens. A second wave came from a VPS reseller called BL Networks starting April 13, 2026. Between April 13 and April 30, Huntress identified 533 authentication events tied to BL Networks from a single address, 113 of them successful logins inside one 48-hour window on April 20 and 21. Between July 3 and July 27 it recorded 26 critical-severity incidents across 23 identities. The part that changes your exposure is the service model: when a kit packages the lure, the hosting, and the token handling for paying customers, the operator no longer needs to understand OAuth to run the attack, and several unrelated buyers can point it at the same tenant at once.

Microsoft's research on a parallel campaign fills in the lures: invoices, RFPs, shared documents, electronic signing requests, and voicemail notifications, with one observed subject theme of "Action Required: Password Expiration." It also found the attackers checking whether a mailbox existed and was active 10 to 15 days before the phishing attempt, which is usually longer than short log retention keeps. For your firm the teachable moment is narrower than it sounds: a message supplies a code and asks someone to enter it on a Microsoft page. Legitimate device sign-ins run the opposite direction — the code is displayed by the device sitting in front of you, and nobody emails it. Full detection and containment guidance: Device Code Phishing Evolves as EvilTokens PhaaS Kit and Kali365 Emerge, and the campaign Microsoft documented: AI-Enabled Device Code Phishing Campaign Abuses Device Code Sign-In Flow.

The Login Window That Is Not a Window

CTM360 has documented more than 3,000 phishing URLs in a campaign it tracks as RecruitTrap, impersonating recruiters at more than 50 organizations across 14 sectors. It opens with an unsolicited email or meeting invitation that appears to come from a recruiter at a company the recipient would recognize, references their actual professional background, and offers an interview slot. The landing page is a counterfeit Calendly-style scheduler or a branded careers portal, reusing the names, photographs, and job titles of genuine recruiters pulled from public profiles.

The technique doing the work is Browser-in-the-Browser. The target clicks "Continue with Google," and a login window opens on top of the page, address bar and padlock included. It is not a window. It is HTML and CSS drawn inside the page already open, and the address bar is a picture of a trustworthy URL rather than the real one. Checking the address bar is the single habit most security awareness training teaches, and in this campaign the address bar is a drawing of one.

In the more capable versions the operators relay the second factor in real time. The attacker signs in to the genuine service with the submitted password, the fake window mirrors whatever challenge the real service returns, and the victim's one-time code goes straight back to the operator. The kit also screens its own visitors: CAPTCHA gates and reload checks filter out automated traffic, and personal email domains are rejected so only corporate accounts advance, which means a security tool that visits one of these URLs with a consumer address is shown a harmless page.

Marketing staff made up the majority of observed targets, which in a practice means whoever runs the website, the ad account, and the social profiles — often the same person who handles the client list. But the qualifying condition is just a public professional profile and a reason to take a recruiter's call, and that covers most of an office. Note how it ends: the attacker holds an authenticated session, and the victim is redirected to a genuine Calendly page so the whole thing reads as a scheduling hiccup. Nobody reports a scheduling hiccup. Full analysis and hunting indicators: RecruitTrap Phishing Uses Browser-in-the-Browser Popups to Steal Logins.

Malware That Never Signs In to Your Tenant

Ontinue's Cyber Defense Center found a Python malware framework in July that runs most of its command-and-control traffic through Microsoft services your network already permits. Researchers track it as TWINLOOT. Routine tasking runs over SharePoint Online as a file-based dead drop, polling roughly every 15 seconds for new commands and writing results back the same way. Interactive access runs separately, through a reverse SOCKS5 tunnel over Microsoft Teams TURN infrastructure. A third path launches Microsoft Edge in headless mode and issues Graph API calls from inside the browser process, so the network telemetry reads as a legitimate Edge session talking to Microsoft. There is no attacker-owned domain anywhere in the chain, which is the entire design goal: blocklists and domain reputation feeds assume malicious traffic goes somewhere suspicious.

Two details decide how an investigation goes. The implant authenticates to an attacker-controlled Azure tenant rather than yours, so no sign-in event, no consent grant, and no audit record appears in your Entra ID logs — the identity trail an investigator normally starts from is simply absent, and the work falls back to endpoint and network artifacts. And for persistence it creates an NTUSER.MAN mandatory-profile hive offline, which needs no administrator privileges and generates no registry modification event. Alongside that, the malware displays a convincing Windows lock screen filled with the user's real account details, captures the password they type, returns the familiar incorrect-password message, and lets them in. The employee experiences a typo. The help desk never hears about it.

This is the case that survives the standard reflex. If the response to a suspected compromise is to reset the password and run an endpoint scan, the ticket gets closed while the foothold is still there, and there is no registry audit entry to say otherwise. Ontinue reports this as only the second observed case of Teams TURN abuse in the wild and the first to use actual WebRTC DataChannels, so it is early rather than widespread — the reason to read it now is that it shows where the traffic is going to hide. Full breakdown: TWINLOOT Malware Turns Microsoft Cloud Services Into Its Control Channel.

Also on Our Radar This Week

MacSync Stealer is taking credentials off Macs through pasted Terminal commands — the victim is talked into copying a command from a web page or chat window and running it themselves, so there is no exploit and no installer to inspect. It collects Keychain material, saved browser credentials, cookies and session data, SSH keys, and cloud access keys. The Mac in the office is not the exception people assume it is, and what leaves it includes live sessions.

A Mirai-based botnet is turning consumer routers into traffic relays — Fortinet has tracked Evooo1Bot since July hitting NETGEAR, D-Link, Tenda, Alcatel and other gateway devices, using both unpatched flaws and an SSH scanner that works through 150 username and password combinations. Default or shared admin credentials are enough on their own. The devices most likely to qualify are not in your office; they are the home routers your staff connect through.

Experian's 2026 identity and fraud report puts AI-generated deception at the center of account takeover — forged documents, cloned voices, and synthetic identities are now cheap enough to use at volume, and the report names account recovery and high-value payment authorization as the pressure points. The front-office version: a familiar voice on the phone asking to change where a payment goes is not verification, and has not been for a while.

Brian Sammons has managed IT environments for Ohio professional service firms — medical, dental, legal, accounting, and financial — since 2004. He writes the Weekly Briefing for the owners, administrators, and IT managers responsible for keeping those firms running: what happened in security this week, and what it means for yours.

Questions about how this affects your environment? Schedule 15 minutes and I'll walk you through it.