Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure. The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May Read more…
Attackers Exploit Microsoft Teams and AnyDesk to Deploy DarkGate Malware A new social engineering campaign has leveraged Microsoft Teams as a way to facilitate the deployment of a known malware called DarkGate. “An attacker used social engineering via a Microsoft Teams call to impersonate a user’s client and gain remote Read more…
Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks A new phishing campaign has been observed employing tax-themed lures to deliver a stealthy backdoor payload as part of attacks targeting Pakistan. Cybersecurity company Securonix, which is tracking the activity under the name FLUX#CONSOLE, said it likely starts Read more…
Microsoft MFA AuthQuake Flaw Enabled Unlimited Brute-Force Attempts Without Alerts Cybersecurity researchers have flagged a “critical” security vulnerability in Microsoft’s multi-factor authentication (MFA) implementation that allows an attacker to trivially sidestep the protection and gain unauthorized access to a victim’s account. “The bypass was simple: it took around an hour Read more…
Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability Microsoft closed out its Patch Tuesday updates for 2024 with fixes for a total of 72 security flaws spanning its software portfolio, including one that it said has been exploited in the wild. Of the 72 flaws, 17 are Read more…
Corrupted Microsoft Office documents used in phishing campaign Corrupted Microsoft Office documents and archive files have been used to evade detection in a recent phishing campaign, according to ANY.RUN. The files are intentionally corrupted to prevent scanning by email filters and antivirus software, and to prevent them from launching properly Read more…
Microsoft Fixes AI, Cloud, and ERP Security Flaws; One Exploited in Active Attacks Microsoft has addressed four security flaws impacting its artificial intelligence (AI), cloud, enterprise resource planning, and Partner Center offerings, including one that it said has been exploited in the wild. The vulnerability that has been tagged with Read more…
Phishing-as-a-Service "Rockstar 2FA" Targets Microsoft 365 Users with AiTM Attacks Cybersecurity researchers are warning about malicious email campaigns leveraging a phishing-as-a-service (PhaaS) toolkit called Rockstar 2FA with an aim to steal Microsoft 365 account credentials. “This campaign employs an AitM [adversary-in-the-middle] attack, allowing attackers to intercept user credentials and session Read more…
Microsoft Launches Windows Resiliency Initiative to Boost Security and System Integrity Microsoft has announced a new Windows Resiliency Initiative as a way to improve security and reliability, as well as ensure that system integrity is not compromised. The idea, the tech giant said, is to avoid incidents like that of Read more…
Microsoft, Meta, and DOJ Disrupt Global Cybercrime and Fraudulent Networks Meta Platforms, Microsoft, and the U.S. Department of Justice (DoJ) have announced independent actions to tackle cybercrime and disrupt services that enable scams, fraud, and phishing attacks. To that end, Microsoft’s Digital Crimes Unit (DCU) said it seized 240 fraudulent Read more…