Threat Intelligence Center

Professional cybersecurity illustration showing Evilginx phishing targeting Microsoft 365 due to server misconfiguration, emphasizing data protection and digital security.

A misconfigured server has exposed infrastructure details for three concurrent Evilginx phishing campaigns actively targeting Microsoft 365 users. Researchers identified the Kraken panel, MaDoO Blaster, SimpleHelp, and The Quarry tools deployed across operations attributed to threat actors including RockyBelling, black-queen, codemado, mail-argenta, red-queen, and saroula01.

Conceptual image depicting cybersecurity patch for CVE-2026-55040 SharePoint JWT token bypass, enhancing digital security.

Microsoft released a security patch for CVE-2026-55040, a JWT token authentication bypass vulnerability in SharePoint that could allow attackers to gain unauthorized access to enterprise environments. The vulnerability affects multiple SharePoint versions and requires immediate patching.

Conceptual image illustrating cybersecurity threat: Forged Phishing Tool bypassing M365 MFA for enterprise account hijacking.

Security researchers have identified Forg365, a phishing-as-a-service tool designed to lower technical barriers for attackers targeting Microsoft 365 environments. The toolkit, which includes the ForgCookie component, harvests user credentials and multi-factor authentication tokens through convincing phishing pages.

Conceptual image illustrating NAPTR Records' role in RCS and DNS spoofing attacks on enterprise networks, highlighting cybersecurity threats.

NAPTR (Naming Authority Pointer) records in DNS infrastructure present a significant attack surface for threat actors seeking to exploit RCS (Rich Communication Services) systems and conduct DNS spoofing campaigns. These DNS records, designed to map service identifiers to network resources, can be manipulated to redirect legitimate RCS traffic or facilitate man-in-the-middle attacks.

Conceptual image illustrating HTML comment stuffing in phishing attacks evading AI detection for enhanced data protection in cybersecurity.

Security researchers have identified a phishing evasion technique leveraging HTML comment stuffing to circumvent AI-based email filtering and attachment analysis. Attackers embed malicious payloads or obfuscated code within HTML comment tags, rendering the content invisible to standard parsing while remaining executable in browsers.

Conceptual image showing cybersecurity misconfigurations enabling EvilTokens to bypass MFA in 55 organizations, compromising data protection.

Security researchers have identified a campaign by EvilTokens and LSHIY LLC that successfully bypassed multi-factor authentication at 55 organizations by exploiting misconfigurations in Azure conditional access policies. Despite MFA being enabled, attackers leveraged policy gaps to gain unauthorized access to cloud environments.

Ransomware gangs monetizing attacks through RaaS model, illustrating cybersecurity threats and data protection in digital security.

Ransomware-as-a-service has transformed cybercriminal operations into structured business enterprises. Groups like Akira, Medusa, Qilin, and Ransomhub operate affiliate networks where they provide malware, infrastructure, and victim negotiation services in exchange for a percentage of ransom payments.

Threat Intelligence Center

Evilginx Phishing Operations Target Microsoft 365 After Server Misconfiguration Exposure

CVE-2026-55040 SharePoint JWT Token Authentication Bypass Patched

Forg365 Phishing Tool Bypasses M365 MFA to Hijack Enterprise Accounts

NAPTR Records Enable RCS and DNS Spoofing Attacks on Enterprise Networks

HTML Comment Stuffing in Phishing Attachments Bypasses AI Detection

Conditional Access Misconfigurations Let EvilTokens Bypass MFA at 55 Organizations

Ransomware Gangs Monetize Attacks Through RaaS Business Model

More Articles …

About Us

Areas We Serve

Get the latest news!