Vajra

Vajra - Your Weapon To Cloud About Vajra Vajra is a UI based tool with multiple techniques for attacking and enumerating in target's Azure environment. The term Vajra refers to the Weapon of God Indra in Indian mythology God of Thunder & Storms. Its connection to the cloud makes it a perfect name...

oauthseeker

OAuthSeeker OAuthSeeker 是一款红队工具，用于通过恶意 OAuth 应用程序执行钓鱼攻击，以危害 Microsoft Azure 和 Office365 中的用户身份。 🚀 主要功能 OAuthSeeker 提供以下核心功能： Azure App OAuth 钓鱼： 针对 Microsoft Azure 和 Office365 用户执行 OAuth 钓鱼攻击，以获取 Microsoft Graph API 和 Microsoft Azure 资源的访问权限。 管理控制面板 ：提供管理控制面板，默认在 localhost 接口上可访问，并默认启用身份验证。 令牌刷新器...

o365-attack-toolkit

o365-attack-toolkit 是什么 o365-attack-toolkit 允许操作者执行 OAuth 钓鱼攻击。 我们决定从静态定义的旧模式转向与账户进行完全“实时”交互。 一些变化 交互式邮件搜索 - 允许你像拥有完全访问权限一样搜索用户邮件。 发送邮件 - 允许你从用户邮箱发送包含附件的 HTML/TEXT 邮件。 交互式文件搜索和下载 - 允许你使用特定关键词搜索文件并离线下载。 文件替换 - 作为宏后门功能的替代方案实现。 架构 该工具包由几个组件组成 钓鱼端点 钓鱼端点负责提供执行 OAuth 令牌钓鱼的 HTML 文件。 后端服务...

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. Thes...

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More

Monday hit like a cron job with anger issues. A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI loweri...

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region. The campaign has been attributed to TA416 , a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich,...

A week in security (March 2 – March 8)

Last week on Malwarebytes Labs: One click on this fake Google Meet update can give attackers control of your PC Beware of fake OpenClaw installers, even if Bing points you to GitHub Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets Windows File Shredder: When deleting a file...

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional phishing defenses implemented in email and browsers. The activity, the company said, targets government and public-sector organizations with the end goal of...

Do We Really Need The OWASP NHI Top 10?

The Open Web Application Security Project has recently introduced a new Top 10 project - the Non-Human Identity NHI Top 10. For years, OWASP has provided security professionals and developers with essential guidance and actionable frameworks through its Top 10 projects, including the widely used...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

SaaS Attacks: Lessons from Real-Life Misconfiguration Exploits

It’s unfortunate but true: SaaS attacks continue to increase. You can’t get around it, COVID-19 accelerated the already exploding SaaS market and caused industries not planning on making a switch to embrace SaaS. With SaaS apps becoming the default system of record for organizations, it has left...