60
55
30
42
30
55
57
57
42
57
60
60
Impersonating IT support: how threat actors turn a remote session into enterprise-wide access
Microsoft details Teams IT-support impersonation campaigns deploying Node.js implants, AD reconnaissance, and WinRM lateral movement toward domain controllers.
Microsoft Threat Intelligence describes a human-operated campaign where attackers impersonate IT/helpdesk staff via Microsoft Teams external collaboration, talk users into granting remote sessions, and use RMM tools for interactive access. During the session they run PowerShell to silently install a malicious MSI that stages a portable Node.js runtime and obfuscated JavaScript implant for C2, executing follow-on payloads via rundll32. Operators then perform host and Active Directory reconnaissance, capture desktop screenshots, and pivot via WinRM on port 5985 to domain controllers and certificate authorities. The hands-on-keyboard chain, which can precede data theft and ransomware, blends into normal operations by relying on Teams, Quick Assist, msiexec, and Node.js; Microsoft shares hunting and mitigation guidance.
82
60
42
30
30
55
60
30
IT help-desk vishing tricks executives into handing over Microsoft 365 access
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.
68
30
42
60
57
30
60
60
Risky Bulletin: BEC campaign steals €35 million from French notaries
Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.
A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.
72
BigBear phishing crew nets thousands of Microsoft 365 credentials
CloudSEC accessed the BigBear 2.0 phishing panel, finding 5,137 stolen Microsoft 365 records across 461 organizations, including 474 MFA-bypassed sessions.
CloudSEC researchers got inside the admin panel of BigBear 2.0, an Evilginx2-based phishing-as-a-service operation run by someone known as 'General Boss'. The panel contained 5,137 records tied to 461 organizations: 1,032 plaintext passwords and 4,148 session cookies, with 474 complete MFA-bypassed authentications. The adversary-in-the-middle proxy captures Microsoft 365 session cookies that can be replayed to access email, Teams, SharePoint, and OneDrive, potentially pivoting into Entra ID and federated SaaS. The operation was still active, used custom JavaScript to disable FIDO2/WebAuthn on phishing pages, and routed logins through a residential proxy pool spanning 69 countries.
60
30
42
30
57
57
57
30
60
55
Attackers use passkey-themed scams to hijack Microsoft 365 accounts
Microsoft tracks ongoing M365 cloud intrusions since May using passkey-themed helpdesk vishing, AiTM phishing, and device-code abuse.
Microsoft Security Research has tracked active cloud intrusions since May in which attackers posing as IT helpdesk staff lured employees with fake passkey/MFA enrollment requests. Attacks used adversary-in-the-middle phishing pages, device-code authentication flows, and Teams messages from compromised accounts. Attackers registered their own MFA methods, enumerated tenants via Microsoft Graph, and accessed SharePoint, OneDrive, and Exchange Online data, throttling activity below 1000 files/emails per hour.
78