Canadian help-desk vishing campaign bypasses MFA in real time
Callers send staff to branded relay pages, then register MFA methods and steal Microsoft 365 data before extortion.
72
Product
OneDrive
- Mentions · 7d2
- Mentions · 30d16
- All mentions33
- First seenAug 13, 2026
- Last mentioned2d ago
Timeline
33 articles · newest first2026 buyer’s guide ranks 12 secure file-sharing platforms
The guide scores Microsoft, Egnyte, Box, Nextcloud, Kiteworks and others on governance, encryption and deployment, not on a new incident.
18
Box tops a 2026 ranking of secure file-sharing platforms
The editorial list scores ten vendors on governance, usability, encryption, compliance evidence and pricing, with no lab testing.
18
Microsoft previews OneDrive CLI for checking sync state
The odsync tool reports accounts, policy and Folder Backup as JSON, but is not yet generally available.
28
Microsoft disrupts phishing network behind more than a billion scam messages
Microsoft disrupted YAM Store phishing kits tied to more than one billion scam messages since January 2026.
80
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
82
tenfold CE: Our free Identity Governance tool just got 2 new features
tenfold's free Community Edition IGA tool adds Microsoft 365 sharing reviews and identity event auditing.
16
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 phished U.S. AI policy experts using Microsoft adversary-in-the-middle credential theft.
78
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
China-linked UAT-11587 used the Antino backdoor and Microsoft 365 to spy on Asian governments.
78
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign
Cisco Talos says China-nexus UAT-11587 deployed the Antino backdoor against Asian government and policy organizations.
78
Chinese spies impersonate White House, Anthropic figures to phish AI policy experts
China-aligned TA419 phished US AI policy experts by impersonating White House and Anthropic figures.
74
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
China-linked TA419 used AiTM phishing to steal Microsoft 365 sessions from U.S. AI policy experts.
74
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Chinese state-backed groups phished AI researchers and used the Antino backdoor against Asian governments, hitting about 350 endpoints.
76
Chinese Hackers Posing as Senior Anthropic Employee Targeting US AI Policy Experts
China-linked TA419 impersonated an Anthropic employee to phish US AI policy experts for Microsoft 365 sessions.
76
China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders
China-linked TA419 phishes US AI-policy staff using expert impersonation and a Microsoft 365 session-stealing proxy.
76
Hackers Target 5,700 Microsoft 365 Accounts Using Forgotten Service Accounts With No MFA
Proofpoint says UNK_CondorFiltration password-sprayed 5,700 Microsoft 365 accounts and breached seven MFA-less service accounts in Chile.
74
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
76
Revoking the token didn’t kill the backdoor
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
48
Secure enterprise sharing with access reviews for Microsoft 365
tenfold-sponsored article warns Microsoft 365 file sharing often outlives its purpose and pitches its identity governance platform for access reviews.
12
N0va Phishkit Targets US and EU Businesses: A New Challenge for Identity Security
N0va phishkit targets US and EU organizations with trusted-brand lures, capturing tokens via legitimate authentication flows to gain SSO access to corporate resources.
58
ZDI-26-704: (0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92204, CVSS 7.7) in Airbyte's OneDrive connector, requiring authentication.
38
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
78
Attackers call employees’ personal phones to break into Microsoft 365 accounts
Microsoft tracks vishing campaigns by Storm-3121 and Storm-3032 that impersonate IT staff, phish Microsoft 365 credentials, and steal cloud data.
74
Hackers Use Passkey-Themed Phishing to Hijack Microsoft 365 Accounts and Steal Cloud Data
Microsoft reports passkey-themed phishing campaigns hijacking Microsoft 365 accounts via AiTM and device-code flows, then exfiltrating cloud data.
66
Hackers Pose as IT Support to Hijack Microsoft 365 Accounts With Fake Passkey Alerts
Microsoft warns of vishing campaigns by Storm-3121 and Storm-3032 hijacking Microsoft 365 accounts via fake passkey alerts, adding attacker-controlled MFA and exfiltrating cloud data.
72
Passkey-themed social engineering leads to identity and cloud compromise
Microsoft tracks ongoing cloud intrusions where passkey-themed helpdesk lures enable AiTM credential theft, MFA persistence, and SharePoint data theft.
76
New N0va Phishkit Targets North America and EU: A Growing Identity Risk for SOCs
ANY.RUN researchers uncovered the N0va phishkit targeting government, technology, consulting, and healthcare organizations across North America and the EU via device code phishing.
56
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
60
IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
68
IT Help Desk Impersonation Lets Hackers Bypass MFA
Arctic Wolf tracks PREY-0058 posing as IT help desk to steal Microsoft 365 sessions via AiTM panels, then extorting executives after SaaS data theft.
72
Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
Arctic Wolf tracks PREY-0058, a vishing and AitM token-theft crew targeting Microsoft 365 executives for data theft and extortion.
76
Srsly Risky Biz: Data Theft Extortion Is Booming! Hooray!
Google's Threat Intelligence Group reports data theft extortion is surging, with Silent Ransom extracting $10M and $18M from two law firms and BlackFile taking $10M.
75
Related CVEs
by mentions- Authenticated SSRF in Airbyte OneDrive Connector
Appears with
- Microsoftvendor · 30
- SharePointproduct · 21
- Microsoft 365product · 20
- Proofpointorganization · 9
- Microsoft Graphproduct · 8
- Microsoftorganization · 7
- Microsoft Teamsproduct · 5
- Googlevendor · 5
- Anthropicorganization · 5
- TA419threat actor · 5
- Claudeai model · 4
- Exchange Onlineproduct · 4
- Entra IDproduct · 4
- Google Driveproduct · 3
- Storm-3119threat actor · 3
- PREY-0058threat actor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.