oauth vulnerabilities

An alarming surge in sophisticated hacker activity is threatening the security of Microsoft accounts worldwide, with cybercriminals successfully bypassing even advanced defenses such as two-factor authentication. Security researchers at Proofpoint have unearthed an ingenious credential phishing...

A critical vulnerability uncovered in Synology’s Active Backup for Microsoft 365 (ABM) has sparked concern throughout the global IT security community, shedding light on the intertwined risks associated with SaaS backup providers and cloud application supply chains. The flaw, now catalogued as...

A critical authentication flaw within Microsoft’s Entra ID ecosystem continues to threaten tens of thousands of enterprise applications worldwide, illustrating a profound challenge for the current state of SaaS security two years after its discovery. The vulnerability, dubbed “nOAuth,” first...

Security researchers have uncovered a significant vulnerability within Microsoft OneDrive's File Picker feature—a discovery that casts a long shadow across the landscape of cloud-based file management and third-party integration. OneDrive, widely used by both consumers and enterprises for its...

A new development in the realm of cloud security threats has emerged, offering threat actors a novel way to obtain Microsoft Entra (formerly Azure Active Directory) refresh tokens from compromised endpoints, potentially bypassing even robust multi-factor authentication (MFA) mechanisms. This...

Russian cyber threat actors have recently exploited OAuth 2.0 authentication flows to compromise Microsoft 365 accounts belonging to employees involved with Ukraine-related and human rights organizations. This sophisticated attack, tracked since early 2025, is predominantly attributed to...

Windows users and IT professionals need to take extra caution as attackers continuously refine their phishing playbook. Recent reports reveal that sophisticated adversaries are leveraging vulnerabilities in OAuth 2.0 redirection flows to target Microsoft 365 environments. In these OAuth-themed...

Russian threat actors have once again raised the bar for cyber espionage, turning attention toward OAuth 2.0 authentication flows in Microsoft 365, hijacking accounts connected to Ukraine and human rights organizations. Their tactics, as uncovered by cybersecurity firm Volexity, fit into a...

Russian hackers have figured out a way to weaponize OAuth 2.0 authentication—yes, that protocol you trusted implicitly last Tuesday when you breezed through another Microsoft 365 login screen—turning what should be a knight in shining armor into a digital Trojan horse galloping straight through...

There’s a certain poetic irony in the fact that OAuth 2.0—a framework specifically engineered to keep our digital lives safe from password theft—is now being bent and twisted by Russian hackers to hijack entire Microsoft 365 accounts. If that isn’t progress in the field of offensive...