Threat Intelligence Center

A phishing operation aimed at US targets uses the CSuite toolkit to steal active Microsoft 365 sessions, sidestepping the login step entirely once a token is captured. Attackers then deploy trusted remote monitoring and management software, including Action1 and ScreenConnect, to establish durable remote access that blends in with normal IT administration traffic and survives password resets.

Executive and leadership accounts function as the keys to the kingdom within an organization's identity infrastructure. Executive Threat Detection is a monitoring capability built around that reality, focused on the credentials and accounts belonging to leadership.

AI agents are designed to act without waiting for a human to approve each step, and that same autonomy is what makes their spending hard to predict. An agent that loops on a failed task, retries a tool call, or spawns subtasks can burn through API calls, tokens, and compute far faster than a human-driven workflow.

The latest ThreatsDay roundup collects 16 stories spanning AI search poisoning, an AI coding tool that leaked repositories, and a one-click code execution issue.

Corp MDM is a spyware package distributed under the identifier com.corp.mdm that presents itself in the same way as remote monitoring and management software. Once installed, it intercepts newly received SMS messages and redirects phone calls, giving operators access to message content and call routing on affected devices.

Microsoft's disruption of EvilTokens has put a spotlight on how criminal operations are folding artificial intelligence into their tooling. The action names EvilTokens as both the threat actor and the associated toolset, and the reporting around it offers an uncommon look at how AI-assisted cybercrime is being built, operated, and scaled by the people behind it.