Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

AlienVault OTX General

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Multiple threat clusters, including state-aligned and financially-motivated actors, are utilizing phishing tools to trick users into granting access to Microsoft 365 accounts via OAuth device code authorization. This technique leads to account takeovers, data exfiltration, and further compromises. Threat actors are leveraging the OAuth 2.0 device authorization grant flow to gain unauthorized access by approving various applications. Campaigns often begin with an initial message containing a URL, which initiates an attack sequence using Microsoft's legitimate device authorization process. Tools like SquarePhish2 and Graphish are being used to facilitate these attacks. Both cybercriminal groups and state-aligned actors have adopted this technique, with Russia-aligned threat actors being particularly active.

This threat campaign involves phishing attacks that exploit the OAuth 2.0 device authorization grant flow to gain unauthorized access to Microsoft 365 accounts. Unlike traditional credential phishing, attackers send users a URL that initiates the OAuth device code authorization process, a legitimate Microsoft mechanism designed for devices with limited input capabilities. Users are tricked into approving malicious applications requesting access to their accounts. Once authorized, attackers gain OAuth tokens that allow them to access email, files, and other resources without needing passwords. The campaign is facilitated by phishing tools like SquarePhish2 and Graphish, which automate the attack sequence and help bypass traditional security controls. Multiple threat clusters, including financially motivated cybercriminals and state-aligned groups such as Russia-aligned TA2723, are actively using this technique. The attackers leverage a variety of malicious domains and URLs that impersonate legitimate Microsoft or file-sharing services to increase the likelihood of user interaction. The attack chain begins with a phishing message containing a URL, leading to the OAuth device code approval prompt. Because the process uses legitimate Microsoft OAuth flows, it is difficult for security solutions to detect based solely on network traffic or authentication logs. The compromised accounts can be used for data exfiltration, lateral movement, and further compromise within the victim organization. The campaign does not rely on exploiting software vulnerabilities but rather on social engineering and abusing OAuth protocols. No known CVEs or exploits in the wild are associated with this technique, but the impact on confidentiality and integrity is high. The attack requires user interaction to approve the OAuth permissions, which is a critical factor in the attack's success. The medium severity rating reflects the balance between the attack's impact and the required user involvement.

Detailed information about Access granted: phishing with device code authorization for account takeover. Get real-time updates, technical details, and mitigatio

Access granted: phishing with device code authorization for account takeover - Live Threat Intelligence - Threat Radar | OffSeq.com

Access granted: phishing with device code authorization for account takeover

Threats Tagged 'squarephish2'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'squarephish2'

Lead Pen Test Professional