Get on Slack/Teams RSS
Last updated: July 5, 2026 at 9:01 AM UTC
All 557 Vulnerability 199 Breach 106 Threat 245 Defense 7
Tag: m365 (2 articles)Clear
threat
2026-07-04

ARToken phishing service steals Microsoft 365 tokens and survives password resets

Cisco Talos detailed ARToken, a phishing-as-a-service platform tied to the EvilTokens operation that is built to compromise Microsoft 365. It abuses Microsoft's device-code sign-in flow to capture authentication tokens rather than passwords, bypassing multi-factor authentication, then upgrades to a Primary Refresh Token so access survives even after the victim resets their password. Its panel exposed more than eighty API endpoints for mailbox takeover, SharePoint and OneDrive theft, and automated business email compromise, including hidden inbox rules and multi-mailbox monitoring. The lures are targeted, abusing real vendor invoice relationships and pointing to look-alike SharePoint tenants on legitimate Microsoft infrastructure so the emails are harder to flag.

artokeneviltokensphishing-as-a-servicem365device-code-phishing
Check
Hunt for unexpected device-code authentication prompts during normal work, unusual device registrations, and new inbox forwarding or hiding rules, and audit which accounts hold Primary Refresh Tokens or long-lived sessions.
Affected
Microsoft 365 organizations, especially finance and accounts-payable staff hit by vendor-invoice lures; captured tokens bypass MFA and Primary Refresh Token persistence keeps attackers in even after a password reset.
Fix
Restrict or monitor the device-code authentication flow with Conditional Access, revoke sessions and Primary Refresh Tokens on suspicion, enforce phishing-resistant methods like passkeys, and train staff to treat unexpected device-code prompts warily.
threat
2026-07-02

Azure CLI password spray compromises 78 Microsoft accounts by bypassing MFA

Huntress is tracking a large automated password-spray campaign against Microsoft 365 that has made more than 81 million login attempts through the Azure CLI in two weeks and broken into 78 accounts across 64 organizations. The attackers replay old username and password pairs from breach data against an authentication flow that sends credentials straight to the token endpoint without triggering interactive multi-factor authentication, so weak or reused passwords give them direct access. Several victims had MFA, but it was scoped only to admins, only to certain apps, or only to untrusted locations, and so did not cover this path. The traffic comes from infrastructure whose address ranges trace back to China.

azure-clipassword-spraym365mfa-bypassropc
Check
Review whether your multi-factor authentication and Conditional Access policies cover every sign-in path, including the Azure CLI and token-endpoint flows, not just web portals and admin accounts, and hunt for password-spray bursts.
Affected
Microsoft 365 organizations with weak or reused passwords, incomplete MFA, or Conditional Access gaps; attackers use a credential flow that skips interactive MFA to break in through the Azure CLI.
Fix
Enforce phishing-resistant MFA across all users, apps, and authentication flows, block legacy and password-based credential grants, apply Conditional Access to CLI access, and monitor sign-in logs for spray patterns and suspicious networks.