allegationSaid on 2026-11-06
In three of these campaigns, the common point was abuse of Microsoft's Device Code Authentication, a method by which an attacker, by deceiving the user, can gain access to their Microsoft 365 account without stealing a password and even while directly bypassing MFA.
A allegation by intsec, said on 2026-11-06. Statements are as reported by the cited publishers — not verified by DecisionGateway.
نکته مشترک در سه مورد از این کمپینها، سوءاستفاده از قابلیت Device Code Authentication مایکروسافت بود؛ روشی که مهاجم با فریب کاربر میتواند بدون سرقت گذرواژه و حتی دور زدن مستقیم MFA، به حساب Microsoft 365 او دسترسی پیدا کند.
Related claims
Fake versions of tools such as ChatGPT and Claude were used to steal users' login information and session cookies.intsec · allegationFor security teams, the message of this report is clear: merely protecting passwords and endpoints is not enough; control of authentication processes, active sessions, and changes to defensive tool settings must also be taken seriously.intsec · statementIn October 2026, five active cyber campaigns targeted American organizations, focusing on stealing corporate identity, sensitive information, and weakening defensive tools.intsec · allegationClicking the link in the email is not required; no authentication is required, no user interaction is needed, and MFA does not help.turansecurity · allegationWKLP malware, by manipulating Microsoft Defender settings, stopping security processes, and stealing information, provides the attacker with the ability to persist on the system.intsec · allegationBecause authentication checks in the Repository commits API are insufficient, a remote unauthenticated attacker can read arbitrary files on the server, including configurations, tokens, keys and credentials.Turan Security xavfsizlik byulleteni · allegation
More claims by intsec
The rumor of a cyber attack on the capital's electricity network is rejected.denialA news report was published claiming that cyber attacks on Tehran's electricity network had begun.statementThe full RedShell article examines all five campaigns and countermeasures against them.statementFor security teams, the message of this report is clear: merely protecting passwords and endpoints is not enough; control of authentication processes, active sessions, and changes to defensive tool settings must also be taken seriously.statementWKLP malware, by manipulating Microsoft Defender settings, stopping security processes, and stealing information, provides the attacker with the ability to persist on the system.allegation
All claims by intsec