token-theft

2 posts tagged with "token-theft"

Device Code Phishing Campaign — Infrastructure Update

Mar 18, 2026

A follow-up investigation mapping 1,337 phishing URLs across 326 workers.dev hostnames, confirming a PhaaS multi-tenant architecture, encrypted client-side payloads, and new lure variants targeting Adobe, DocuSign, and Outlook branding.

Threat Hunting entra microsoft threat hunting

Uncovering a New Device Code Phishing Campaign

Mar 10, 2026

Uncovering a phishing campaign abusing Microsoft Device Code Authentication and Cloudflare Worker Pages, with detection hunts for Entra and Microsoft 365.

Threat Hunting entra microsoft threat hunting