Microsoft released PowerShell scripts that let IT admins view, export, and delete Windows settings backup data through ...

TWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure.

Cavern uses DNS A records to switch between direct HTTPS and Google Apps Script for C2, expanding an Iranian-linked toolkit ...

The Thunderbird team has officially released Thunderbird 154, delivering several useful new features alongside a substantial ...

A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, ...

TWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure. Security researchers are warning of a newly ...

AitM phishing hijacks Microsoft 365 accounts, then uses residential proxies and Microsoft Graph API access to collect payroll and finance email.

Surf AI, the agentic operations platform for modern security teams, today announced an integration with Claude’s Compliance API, alongside the general availability of Exposure Reduction Operations, ...

ZoomInfo's headless GTM context layer now connects to Microsoft 365 Copilot, surfacing 500M contacts, 100M companies, and billions of signals inside D ...

Modern organizations don't operate from a single server room anymore. Today's enterprise environment spans dozens of cloud services, SaaS applications, APIs, AI agents, and non-human identities, all ...

Malware used by North Korea's Lazarus group negotiated its command channel using a post-quantum key exchange before pulling down a Windows zero-day exploit, in a campaign against defense and aerospace ...

China-linked Jewelbug used shared infrastructure to conduct government espionage and cryptocurrency fraud, logging more than ...