oauth

Microsoft’s release of a Windows SDK for Facebook — a native, open-source library that brings full Facebook login, Graph API access, feeds, photo uploads and Like functionality into Universal Windows apps — marks a deliberate push to make Windows a more attractive, social-first platform for...

A growing number of Microsoft account holders report successful sign‑ins from IP addresses inside Microsoft’s own network despite having two‑factor authentication enabled — an uptick of incidents first detailed in a German investigation and corroborated by threads on Reddit and Microsoft’s own...

A new, industrialized phishing service called VoidProxy is being used by multiple criminal groups to intercept Google and Microsoft sign-ins in real time, harvest credentials, MFA responses and — critically — session cookies that let attackers impersonate users without needing passwords or...

Microsoft’s Exchange team has given hybrid administrators a clear-but-urgent migration mandate: switch to the dedicated Exchange hybrid app and update on‑prem servers now, or face temporary disruptions in September and October followed by a permanent enforcement that will stop rich coexistence...

Microsoft has made the Model Context Protocol (MCP) a first‑class citizen in Visual Studio, shipping general availability support that lets Copilot Chat and other agentic features connect to local or remote MCP servers via a simple .mcp.json configuration — a major convenience for developers...

OpenAI’s ChatGPT can now reach into your Gmail inbox, read your Google Calendar, and look up people in Google Contacts — all from inside a single chat — marking a clear escalation in the product’s push from a conversational assistant toward a full-fledged, context-aware workspace tool. The...

Microsoft’s looming retirement of the Azure AD Graph API is no longer a warning on the horizon—it’s now a fixed endpoint for IT departments, software developers, and the entire Microsoft cloud ecosystem. As of early September 2025, according to Microsoft’s official communications, the legacy API...

Microsoft Active Directory Federation Services (AD FS) has been a cornerstone for organizations seeking to provide single sign-on (SSO) and secure access to a range of web applications—both on-premises and in the cloud. With the explosion of SaaS adoption, the importance of strong authentication...

Microsoft is set to implement significant security enhancements within its Microsoft 365 suite by blocking various legacy authentication protocols starting mid-July 2025. This initiative is part of the company's Secure Future Initiative (SFI) and Secure by Default strategy, aiming to bolster the...

Microsoft is drawing a definitive line under the era of legacy authentication protocols in Microsoft 365, setting the stage for a monumental shift in security posture across its cloud ecosystem. Starting from mid-July 2025, Microsoft will begin enforcing new default settings that block legacy...

Microsoft’s recent announcement regarding significant changes to High Volume Email (HVE) within the Microsoft 365 ecosystem has sent ripples through the IT community, especially among organizations that rely heavily on email automation for communication both internally and externally. This newly...

Microsoft has recently announced significant changes to its High Volume Email (HVE) service within Microsoft 365, alongside an extension of support for Basic Authentication until September 2028. These updates are designed to provide organizations with additional time to transition to more secure...

They say trust is the cornerstone of any relationship—especially if that relationship is between you, the internet, and a determined Russian adversary with a penchant for phishy invitations and suspicious requests for OAuth codes. Phishing in the OAuth Era: New Tricks for Old Hackers When we...

Innovative Phishing Tactics Threaten Critical Infrastructure Russian state-backed APT group Storm-2372 has triggered a new alarm in the cybersecurity community by leveraging an ingenious form of device code phishing to sidestep multi-factor authentication (MFA). This sophisticated attack...

Hackers are once again proving that even trusted platforms can be twisted for malicious purposes. A recent campaign, detailed by cybersecurity researchers, reveals that cybercriminals are employing fake OAuth applications—masquerading as popular services like Adobe Drive, Adobe Acrobat, and...

In today's rapidly evolving cybersecurity landscape, Microsoft 365 environments are facing a new breed of sophisticated attacks that exploit one of the most trusted authentication methods—OAuth. Recent investigations have revealed that threat actors are leveraging fake OAuth applications...

Microsoft 365 credentials are now squarely in the crosshairs of a new, sophisticated cyberattack. In a campaign dubbed the ClickFix attack—as first reported by SC Media and detailed by BleepingComputer—the threat actors are using fake OAuth apps to pilfer sensitive credentials from government...

Cybercriminals are now weaponizing trusted brands to hijack Microsoft 365 accounts. In a worrying twist that almost seems ripped from a spy movie, hackers are impersonating legitimate Adobe and DocuSign apps to gain unauthorized access to valuable data and deploy malware. The Anatomy of the...

In recent cybersecurity developments, malicious Adobe and DocuSign OAuth applications have been reported as potential threats targeting Microsoft 365 environments. In a detailed investigation, security professionals discovered that these harmful apps are abusing the trusted OAuth framework to...

Project Rome Overview Project Rome is a platform for creating experiences that transcend a single device and driving up user engagement – empowering a developer to create human-centric scenarios that move with the user and blur the lines between their devices regardless of form factor or...