Talos details ARToken, a PhaaS panel tied to EvilTokens that supports device code phishing, BEC workflows, SharePoint theft, ...

Okta and Microsoft no longer define the CIAM market alone. Five developer-first, passwordless-native, and AI-ready platforms are growing fast by solving the specific problems the incumbents leave ...

Louis Mastelinck previews common Entra ID pitfalls around authentication, Conditional Access, privilege and app consent.

The latest email threats: real Microsoft login phishing, device code scams with a kill switch, split-click attacks, and the ...

If Microsoft shows Your account is temporarily locked to prevent unauthorized use, the sign-in system has paused access ...

Kali365 phishing attacks bypass Microsoft 365 MFA by stealing access tokens. Real Microsoft device sign-in pages make Kali365 phishing lures harder to detect. Defenders should restrict device code ...

The FBI warned that Kali365 can hijack Microsoft 365 accounts by abusing device code authentication and capturing OAuth tokens. A new phishing service is turning a legitimate Microsoft login process ...

Credential theft fell to 13% of breach vectors in 2026. Attackers now bypass MFA via help desk resets and OAuth token theft. Five attack surfaces mapped.

So, you've enabled multi-factor authentication. You've taught your staff never to type their passwords into dodgy-looking login pages. Surely your Microsoft 365 ...

A criminal subscription service called Kali365 is hijacking Microsoft 365 accounts at organizations across multiple sectors without ever touching a user's password — and it defeats multi-factor ...