CERT-In issued a critical advisory as Microsoft monitors evolving phishing and identity threats targeting Microsoft 365 environments, aiming to compromise organisational accounts.

In February 2025, the Microsoft Threat Intelligence Center warned that Russian hackers were targeting Microsoft 365 accounts using device code phishing. In December, ProofPoint reported similar ...

A new phishing-as-a-service (PhaaS) campaign is abusing Microsoft’s device code authentication flow to gain unauthorized access to user accounts. Sekoia researchers first spotted the toolkit ...

Beware this highly sophisticated Microsoft 365 attack. Update, March 15, 2025: This story, originally published March 13, has been updated with further technical detail regarding the Microsoft 365 ...