Unit 42 says Falcon C2 compromised government sites via browser JavaScript
The framework stole credentials and cookies, sideloaded Chrome extensions, and delivered the Antino implant over OneDrive.
Stories per day · 30 days
2 RSS
Relatedbrowser1browser-tools1c21command-line1endpoint-management1falcon1google-drive1government1microsoft-3651presentations1watering-hole1
5 stories, newest first · one card per story
Stories tagged #onedrive
Microsoft previews OneDrive CLI for checking sync state
The odsync tool reports accounts, policy and Folder Backup as JSON, but is not yet generally available.
2
Revoking the token didn’t kill the backdoor
Analysis of the GraphWorm implant shows Webworm operators rotate OAuth credentials to survive token revocation, using OneDrive dead-drop C2 invisible to network defenses.
1
Secure enterprise sharing with access reviews for Microsoft 365
tenfold-sponsored article warns Microsoft 365 file sharing often outlives its purpose and pitches its identity governance platform for access reviews.
3
ZDI-26-704: (0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability
ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92204, CVSS 7.7) in Airbyte's OneDrive connector, requiring authentication.