AzureGraph

AzureGraph AzureGraph is an Azure AD information gathering tool over Microsoft Graph. Thanks to Microsoft Graph technology, it is possible to obtain all kinds of information from Azure AD, such as users, devices, applications, domains and much more. This application, allows you to query this data...

offensive-azure

Collection of offensive tools targeting Microsoft Azure written in Python to be platform agnostic. The current list of tools can be found below with a brief description of their functionality. ./DeviceCode/devicecodeeasymode.py Generates a code to be entered by the target user Can be used for...

o365-attack-toolkit

What is o365-attack-toolkit o365-attack-toolkit allows operators to perform oauth phishing attacks. We decided to move from the old model of static definitions to fully "interactive" with the account in real-time. Some of the changes Interactive E-mail Search - Allows you to search for user e-mai...

M365Pwned

M365Pwned Red Team tooling for Microsoft 365 exploitation via Microsoft Graph API. Two WinForms GUI tools for enumerating, searching, and exfiltrating data from M365 environments using application-level OAuth tokens — no user interaction required. Tool| Target| What it does ---|---|---...

AzureRedOps

AzureRedOps A Swiss Army tool for Azure / Entra ID red teaming. Author: Mr.Un1k0d3r TrueCyber Inc Version: 0.1 Language: Python 3.12+ Overview AzureRedOps is a offensive security toolkit for assessing the security posture of Microsoft Entra ID and Azure tenants. It wraps the most common red-team...

Azure-AccessPermissions

Azure-AccessPermissions Easy to use PowerShell script to enumerate access permissions in an Azure Active Directory environment. Background details can be found in the accompanied blog posts: Untangling Azure Active Directory Principals & Access Permissions Untangling Azure Active Directory...

SharePointDumper

SharePointDumper SharePointDumper is a PowerShell-based extraction and auditing utility that enumerates SharePoint sites a user can access via Microsoft Graph and downloads files via SharePoint. It is designed for SOC / DLP testing, purple teaming, and non-sophisticated red-team assessments, and...

azureOutlookC2

Azure Outlook C2 Azure Outlook Command & Control that uses Microsoft Graph API for C2 communications & data exfiltration. Remotely Control a compromised Windows Device from your Outlook Mailbox. Creators: Bobby Cooke @0xBoku & Paul Ungur @C5pider CTI Threat update 02/13/22 Elastic Security Labs h...

reportly

Reportly is an EntraID user activity report tool. About the tool This is a tool that will help blue teams during a cloud incident. When running the tool, the researcher will enter as input a suspicious user and a time frame and will receive a report detailing the following: 1. Information about t...

APEX

APEX previously AzurePwn- Azure Post Exploitation Framework An attempt to ease up post ex tasks once we have access to some sort of credentials to an Azure related account. To be honest it is nothing new or spectacular. Just my old lazy ass doing some shortcuts so I don't need to remember all the...

GraphStrike

GraphStrike Release blog: GraphStrike: Using Microsoft Graph API to Make Beacon Traffic Disappear Developer blog: GraphStrike: Anatomy of Offensive Tool Development Introduction GraphStrike is a suite of tools that enables Cobalt Strike's HTTPS Beacon to use Microsoft Graph API for C2...

msteams

msteams A Mythic C2 Profile that uses the Microsoft Graph API to communicate through a Microsoft Teams channel. How It Works Agent Microsoft Teams Channel C2 Server Mythic 1. The agent authenticates to Microsoft Entra ID via OAuth2 client credentials 2. Posts its Mythic message base64-encoded,...

OneDrive-UDC2

OneDrive UDC2 A Cobalt Strike User-Defined C2 channel that uses OneDrive as the transport layer. What you need A Microsoft Entra ID tenant with a user that has OneDrive for Business. An app registration with the Files.ReadWrite.All application permission. Setup 1. Register an application In Azure...

reportly

Reportly es una herramienta de informes de actividad de usuarios de EntraID. Acerca de la herramienta Esta es una herramienta que ayudará a los equipos azules durante un incidente en la nube. Al ejecutar la herramienta, el investigador ingresará como entrada un usuario sospechoso y un período de...

Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign

Government and policy organizations across Asia have become the target of a new campaign orchestrated by a China-nexus threat actor. The activity, which has targeted government and policy organizations in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, and Myanmar, involves the...

China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor

Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as "Antino" in developer artifacts. Talos first observe...

Updated erlang package fixes security vulnerabilities

SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...

MGASA-2026-0457 Updated erlang package fixes security vulnerabilities

SSH SFTP server denial of service via extended channel data infinite loop. CVE-2026-54886 Plaintext APPLICATIONDATA injected during TLS handshake delivered to client application post-handshake in ssl. CVE-2026-54891 Plug: quadratic-time decoding of nested query/body parameters enables denial of...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...