60
45
45
60
30
57
42
60
45
57
30
60
57
30
57
30
30
30
30
55
30
60
45
55
60
30
60
30
57
30
60
57
60
60
60
55
60
60
GhostCode Phishing Kit Bypasses Microsoft 365 MFA to Hijack Accounts in 78 Seconds
eSentire identified GhostCode, a phishing kit abusing Microsoft 365 OAuth device-code sign-in to steal tokens and take over accounts in seconds.
eSentire analysts identified GhostCode in late August, a phishing kit that uses business contact-form messages and an NDA pretext to deliver a password-protected HTML attachment leading victims to a Microsoft device-code sign-in. Victims authenticate on legitimate Microsoft pages, letting the kit obtain a Primary Refresh Token in 32 seconds and register three devices in 78 seconds, with residential proxies matching the victim's location. The kit hides its redirect with encrypted addresses, junk data, and scanner-filtering challenges, and uses GHOSTnet-linked infrastructure during device enrolment. eSentire recommends blocking device-code authentication via Conditional Access, invalidating tokens, and reviewing newly enrolled devices.
72
Most chief audit executives can’t tell you what AI is worth yet
Gartner finds 93% of audit leaders use AI, but 54% of chief audit executives have not started measuring its value.
Gartner polls of 142 and 161 chief audit executives in May found 54% have not started measuring the value of AI in audit, only 7% tie AI to cost metrics, and just 38% have an AI strategy at any level, with 39% more building one. Among 743 respondents, 60% use AI for engagement preplanning and for drafting audit issues or reports, while only 30% apply it to audit testing, where hallucinations carry higher stakes. Unclear expectations for AI tool use (48%) was the most common barrier, ahead of technology and tool problems. Gartner recommends structured use cases for high-value workflows, which 12% of respondents are currently piloting.
12