oauthseeker

OAuthSeeker OAuthSeeker は、Microsoft Azure および Office365 内でのユーザー ID を侵害するために、悪意のある OAuth アプリケーションを使用してフィッシング攻撃を実行するレッドチームツールです。 🚀 主な機能 OAuthSeeker には以下の主要な機能があります: Azure アプリ OAuth フィッシング: Microsoft Azure および Office365 ユーザーを標的とした OAuth フィッシング攻撃を実行し、Microsoft Graph API および Microsoft Azure...

Vajra

Vajra - クラウドへの武器 Vajraについて Vajraは、Azure環境の攻撃と列挙のための複数のテクニックを備えたUIベースのツールです。 Vajraという名称は、インド神話における神インドラ（雷と嵐の神）の武器に由来します。クラウドとの関連性から、このツールにふさわしい名前となっています。 Vajraは現在、AzureおよびAWSのクラウド環境をサポートしており、将来的にはGoogle Cloud Platformと特定のOSINTのサポートを追加する計画があります。 現在利用可能な機能は次のとおりです: Azure 攻撃 1...

o365-attack-toolkit

o365-attack-toolkit とは o365-attack-toolkit を使用すると、オペレーターは OAuth フィッシング攻撃を実行できます。 従来の静的な定義モデルから、アカウントとリアルタイムで完全に「対話的」に動作するモデルに移行することにしました。 主な変更点 対話型メール検索 – ユーザーのメールを、まるで完全にアクセス権があるかのように検索できます。 メール送信 – ユーザーのメールボックスから、添付ファイル付きの HTML/TEXT メールを送信できます。 対話型ファイル検索とダウンロード –...

Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts

Three distinct suspected Russian cyber espionage threat clusters have been observed leveraging legitimate authentication flows to single out individuals working in academia, aerospace and defense, governments, and think tanks across Europe, as well as academia and think tanks within the U.S. Thes...

CVE-2026-75833 Grav API Plugin Open Redirect via Backslash Bypass

The Grav API plugin getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo. The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in...

⚡ Weekly Recap: New Linux Flaw, PAN-OS Exploit, AI-Powered Attacks, OAuth Phishing and More

Monday hit like a cron job with anger issues. A busted auth path here, a repo-side faceplant there, some "patched-ish" thing already getting chewed on in the wild, and then the usual bonus round: poisoned dev tools, sketchy forum chatter, phishing kits pretending to be productivity, and AI loweri...

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

A China-aligned threat actor has set its sights on European government and diplomatic organizations since mid-2025, following a two-year period of minimal targeting in the region. The campaign has been attributed to TA416 , a cluster of activity that overlaps with DarkPeony, RedDelta, Red Lich,...

A week in security (March 2 – March 8)

Last week on Malwarebytes Labs: One click on this fake Google Meet update can give attackers control of your PC Beware of fake OpenClaw installers, even if Bing points you to GitHub Fake CleanMyMac site installs SHub Stealer and backdoors crypto wallets Windows File Shredder: When deleting a file...

Microsoft Warns OAuth Redirect Abuse Delivers Malware to Government Targets

Microsoft on Monday warned of phishing campaigns that employ phishing emails and OAuth URL redirection mechanisms to bypass conventional phishing defenses implemented in email and browsers. The activity, the company said, targets government and public-sector organizations with the end goal of...

Do We Really Need The OWASP NHI Top 10?

The Open Web Application Security Project has recently introduced a new Top 10 project - the Non-Human Identity NHI Top 10. For years, OWASP has provided security professionals and developers with essential guidance and actionable frameworks through its Top 10 projects, including the widely used...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

Microsoft Incident Response lessons on preventing cloud identity compromise

Microsoft observed a surge in cyberattacks targeting identities in 2023, with attempted password-based attacks increasing by more than tenfold in the first quarter of 2023 compared to the same period in 2022. Threat actors leverage compromised identities to achieve a significant level of access t...

SaaS Attacks: Lessons from Real-Life Misconfiguration Exploits

It’s unfortunate but true: SaaS attacks continue to increase. You can’t get around it, COVID-19 accelerated the already exploding SaaS market and caused industries not planning on making a switch to embrace SaaS. With SaaS apps becoming the default system of record for organizations, it has left...