Stolen ConnectWise Secret Opens 173 Microsoft 365 Tenants
An active supply-chain attack abused a compromised ConnectWise Cloud Backup credential to enter 173 Microsoft 365 partner and customer tenants. Defenders need to inspect service-principal sign-ins and newly...
Google DevSite Bug Chain Turned Exposed Flask Secrets Into Remote Code Execution
Google fixed a critical DevSite vulnerability chain in which an OAuth secret exposed inside a Flask session cookie could be reused to forge sessions and reach unsafe Python...
Actively Exploited F5 BIG-IP OAuth Zero-Day Enables Unauthenticated RCE
F5 is warning that attackers are exploiting a critical BIG-IP APM zero-day that can provide unauthenticated remote code execution on certain OAuth authorization-server deployments. Organizations should identify exposed...
Inside GhostCode: The Phishing Kit That Turns MFA Approval Into Account Takeover
A newly identified phishing kit called GhostCode hijacks Microsoft 365 accounts by abusing the OAuth device-code sign-in flow, letting victims unknowingly approve an attacker's device during a completely...
Malicious Twitch Extension Leaks OAuth Tokens From 30,000 Browser Users
A Twitch helper extension installed by about 30,000 Chrome and Firefox users was found sending active account tokens through operator-controlled servers. The incident shows how a seemingly convenient...
New ARToken Phishing Kit Abuses Microsoft’s OAuth Device Code Flow to Hijack Microsoft 365 Accounts
Cisco Talos has uncovered ARToken, a phishing panel that abuses Microsoft's device code sign-in flow to steal Microsoft 365 session tokens without a password or MFA prompt. The...
Klue Supply Chain Hack Exposes Salesforce Data at Nine Cybersecurity Companies
A supply chain attack on market intelligence platform Klue has compromised Salesforce CRM data across at least nine organizations, including HackerOne, Huntress, and Recorded Future. The Icarus extortion...
Hackers Can Hijack Claude Code MCP Traffic to Steal OAuth Tokens — No Patch Coming
Researchers at Mitiga Labs demonstrated a five-step npm supply chain attack that rewrites ~/.claude.json to redirect Claude Code MCP traffic through attacker-controlled infrastructure, silently capturing OAuth tokens for...