Cybersecurity articles tagged #Microsoft 365 on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/q2-2026-ir-trends-phishing-mfa-bypass-rmm-tool-abusehttps://runtimerebel.com/blog/q2-2026-ir-trends-phishing-mfa-bypass-rmm-tool-abuseTalos Q2 2026 incident response data shows rising phishing and MFA bypass, with new actors like UAT-11764 and Sinobi ransomware leveraging RMM tools.Sat, 08 Aug 2026 00:57:13 GMTPhishingMFA BypassRansomwareMicrosoft 365UAT 11764https://runtimerebel.com/blog/greatness-phaas-adds-device-code-phishing-for-mfa-bypasshttps://runtimerebel.com/blog/greatness-phaas-adds-device-code-phishing-for-mfa-bypassGreatness PhaaS now supports device code phishing, abusing OAuth 2.0 to bypass MFA and seize accounts on Microsoft 365, Google Workspace, and more.Tue, 04 Aug 2026 17:30:11 GMTPhaaSMFA BypassOAuth 2 0Microsoft 365Greatnesshttps://runtimerebel.com/blog/persistent-prompt-injection-risks-in-microsoft-365-copilot-for-wordhttps://runtimerebel.com/blog/persistent-prompt-injection-risks-in-microsoft-365-copilot-for-wordResearchers demonstrate how hidden instructions in Word documents can persist through Microsoft 365 Copilot drafting, creating risks of malicious prompt propagation.Thu, 30 Jul 2026 14:05:35 GMTMicrosoft 365CopilotPrompt InjectionAI SecurityDocument Securityhttps://runtimerebel.com/blog/microsoft-365-outage-how-an-automated-network-maintenance-bug-impacted-azurehttps://runtimerebel.com/blog/microsoft-365-outage-how-an-automated-network-maintenance-bug-impacted-azureTechnical analysis of the Microsoft 365 and Azure outage caused by a bug in the automated network maintenance system, resulting in accidental IP route removal.Fri, 24 Jul 2026 17:41:26 GMTMicrosoft 365AzureNetwork OutageAutomated MaintenanceService Disruptionhttps://runtimerebel.com/blog/microsoft-fixes-exchange-online-erroneous-mailbox-quarantine-issuehttps://runtimerebel.com/blog/microsoft-fixes-exchange-online-erroneous-mailbox-quarantine-issueMicrosoft is mitigating a service disruption where Exchange Online mailboxes were incorrectly quarantined, causing delivery failures and access issues.Thu, 23 Jul 2026 10:25:47 GMTMicrosoft 365Exchange OnlineMailbox QuarantineService Health Disruptionhttps://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-uses-microsoft-graph-for-stealthy-c2HollowGraph malware leverages Microsoft Graph API calendar features for covert command-and-control and data exfiltration from Microsoft 365 environments.Mon, 20 Jul 2026 18:05:43 GMTHollowGraphMicrosoft GraphMicrosoft 365C2Data ExfiltrationAPI Abusehttps://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2https://runtimerebel.com/blog/hollowgraph-malware-leverages-microsoft-365-calendar-for-stealthy-c2HollowGraph, a new espionage malware, hides C2 commands and exfiltrates data via legitimate Microsoft 365 calendar events, mimicking normal Graph API traffic.Mon, 20 Jul 2026 18:05:24 GMTHollowGraphMicrosoft 365Microsoft Graph APIEspionageC2Data ExfiltrationGroup IBhttps://runtimerebel.com/blog/forg365-phaas-bypassing-mfa-in-microsoft-365-via-aitm-attackshttps://runtimerebel.com/blog/forg365-phaas-bypassing-mfa-in-microsoft-365-via-aitm-attacksForg365 PhaaS enables attackers to compromise Microsoft 365 accounts using AI-assisted lures and device code phishing to bypass multi-factor authentication.Mon, 13 Jul 2026 14:38:14 GMTForg365Microsoft 365PhaaSAitMDevice Code Phishinghttps://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kitshttps://runtimerebel.com/blog/evilginx-operations-exposed-misconfigured-server-leaks-m365-phishing-kitsA misconfigured Python server exposed three live Evilginx phishing operations targeting Microsoft 365, revealing the attacker's toolkit and session cookies.Mon, 13 Jul 2026 11:18:10 GMTEvilginxMicrosoft 365PhishingAitMMFA Bypasshttps://runtimerebel.com/blog/forg365-phaas-leverages-ai-aitm-for-microsoft-365-account-compromisehttps://runtimerebel.com/blog/forg365-phaas-leverages-ai-aitm-for-microsoft-365-account-compromiseForg365 PhaaS targets Microsoft 365 with AI-assisted AiTM and device code phishing.Thu, 09 Jul 2026 15:14:50 GMTForg365Phishing as a ServicePhaaSMicrosoft 365AitMAI PhishingDevice Code Phishinghttps://runtimerebel.com/blog/microsoft-365-entra-passkey-vishing-targets-account-takeover-riskhttps://runtimerebel.com/blog/microsoft-365-entra-passkey-vishing-targets-account-takeover-riskA sophisticated vishing campaign targets Microsoft 365 users, tricking them into enrolling malicious Entra passkeys for account takeover. Learn detection and prevention.Wed, 08 Jul 2026 17:39:23 GMTMicrosoft 365EntraPasskeyVishingSocial EngineeringAccount Takeoverhttps://runtimerebel.com/blog/eviltokens-ghost-phishing-targets-microsoft-365-via-browser-decryptionhttps://runtimerebel.com/blog/eviltokens-ghost-phishing-targets-microsoft-365-via-browser-decryptionAnalysis of the EvilTokens ghost phishing campaign targeting Microsoft 365 users via browser-side decryption to bypass traditional email security gateways.Wed, 08 Jul 2026 14:14:23 GMTEvilTokensPhishingMicrosoft 365Credential TheftBrowser Side Decryptionhttps://runtimerebel.com/blog/adfs-golden-saml-recovering-signing-keys-via-machine-dpapihttps://runtimerebel.com/blog/adfs-golden-saml-recovering-signing-keys-via-machine-dpapiLearn how ADFS configuration drift allows attackers to recover active signing keys from Machine DPAPI, enabling SAML assertion forgery and MFA bypass.Wed, 08 Jul 2026 10:43:58 GMTADFSGolden SAMLMachine DPAPICredential TheftMicrosoft 365https://runtimerebel.com/blog/artoken-phaas-exposes-eviltokens-m365-phishing-toolkithttps://runtimerebel.com/blog/artoken-phaas-exposes-eviltokens-m365-phishing-toolkitARToken PhaaS, an affiliate of EvilTokens, offers advanced Microsoft 365 phishing capabilities, including MFA bypass. Learn about its TTPs and how to defend.Fri, 03 Jul 2026 17:28:05 GMTARTokenEvilTokensPhaaSPhishingMicrosoft 365MFA BypassCredential HarvestingThreat Intelligencehttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistencehttps://runtimerebel.com/blog/chinese-apt-unc5221-deploys-new-malware-for-m365-persistenceChinese APT UNC5221 leverages new malware, Plenet and AgentPSD, alongside Brickstorm backdoor to maintain persistent access in compromised Microsoft 365 environments for…Fri, 05 Jun 2026 20:41:36 GMTUNC5221Microsoft 365BRICKSTORMPlenetAgentPSDAPTEspionagehttps://runtimerebel.com/blog/microsoft-exchange-online-outage-north-america-and-germany-impactshttps://runtimerebel.com/blog/microsoft-exchange-online-outage-north-america-and-germany-impactsMicrosoft Exchange Online outage disrupts mail flow in North America and Germany, causing email delays and NDR errors. Learn how to monitor service health.Tue, 02 Jun 2026 17:38:31 GMTExchange OnlineMicrosoft 365Mail FlowService OutageNorth AmericaGermanyhttps://runtimerebel.com/blog/microsoft-teams-and-office-web-file-access-disruptions-mitigation-guidehttps://runtimerebel.com/blog/microsoft-teams-and-office-web-file-access-disruptions-mitigation-guideMicrosoft is investigating a service incident impacting file access in Teams and Office for the web, causing operational delays for global enterprises.Mon, 01 Jun 2026 18:07:22 GMTMicrosoft 365TeamsOffice for the WebService DisruptionCloud Infrastructurehttps://runtimerebel.com/blog/fbi-warns-of-kali365-phaas-targeting-microsoft-365-accountshttps://runtimerebel.com/blog/fbi-warns-of-kali365-phaas-targeting-microsoft-365-accountsThe FBI issues an advisory on Kali365, a Phishing-as-a-Service platform exploiting OAuth device code flows to bypass MFA and hijack Microsoft 365 accounts.Mon, 25 May 2026 13:18:04 GMTKali365Microsoft 365PhaaSOauth AbuseMFA Bypasshttps://runtimerebel.com/blog/eviltokens-phaas-bypassing-mfa-via-oauth-device-code-flowhttps://runtimerebel.com/blog/eviltokens-phaas-bypassing-mfa-via-oauth-device-code-flowThe EvilTokens platform has compromised 340+ Microsoft 365 organizations by weaponizing OAuth Device Code Flows to bypass multi-factor authentication.Tue, 19 May 2026 13:15:26 GMTEvilTokensMicrosoft 365Oauth PhishingDevice Code FlowPhaaShttps://runtimerebel.com/blog/tycoon2fa-phishing-kit-targets-microsoft-365-via-device-code-flowhttps://runtimerebel.com/blog/tycoon2fa-phishing-kit-targets-microsoft-365-via-device-code-flowTycoon2FA phishing kit now leverages Microsoft 365 device code flows and Trustifi URL abuse to bypass MFA and hijack enterprise accounts.Sun, 17 May 2026 16:26:13 GMTTycoon 2FAMicrosoft 365Phishing as a ServiceDevice Code Flowhttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionhttps://runtimerebel.com/blog/blackfile-analyzing-unc6671-vishing-cloud-data-extortionExamines UNC6671's BlackFile vishing, AiTM, and cloud data exfiltration tactics against Microsoft 365 & Okta. Actionable mitigations included.Fri, 15 May 2026 20:32:33 GMTUNC6671BlackFileVishingAitMMicrosoft 365OktaSharePointOneDriveData ExfiltrationExtortionSocial Engineeringhttps://runtimerebel.com/blog/aitm-phishing-attacks-target-us-organizations-with-conduct-reportshttps://runtimerebel.com/blog/aitm-phishing-attacks-target-us-organizations-with-conduct-reportsMicrosoft warns of a sophisticated AitM phishing campaign using fake conduct reports to bypass MFA and hijack Microsoft 365 user sessions.Tue, 05 May 2026 16:40:58 GMTPhishingAitMMicrosoft 365Session HijackingCredential Thefthttps://runtimerebel.com/blog/defeating-persistent-oauth-token-risks-in-google-and-microsoft-appshttps://runtimerebel.com/blog/defeating-persistent-oauth-token-risks-in-google-and-microsoft-appsLearn how persistent OAuth tokens create backdoors in AI tools and productivity apps. Discover strategies to detect and remediate long-lived token exposure.Tue, 05 May 2026 16:39:22 GMTOAuthGoogle WorkspaceMicrosoft 365App GovernanceToken Thefthttps://runtimerebel.com/blog/credential-theft-microsoft-details-phishing-campaign-targeting-35k-usershttps://runtimerebel.com/blog/credential-theft-microsoft-details-phishing-campaign-targeting-35k-usersMicrosoft warns of a global phishing campaign targeting 35,000 users with code-of-conduct lures to steal authentication tokens across 13,000 organizations.Tue, 05 May 2026 08:51:58 GMTMicrosoft 365PhishingToken TheftCredential Thefthttps://runtimerebel.com/blog/microsoft-teams-free-backend-change-disrupts-chat-and-callinghttps://runtimerebel.com/blog/microsoft-teams-free-backend-change-disrupts-chat-and-callingMicrosoft confirms a backend configuration change has broken core functionality for Microsoft Teams Free users, impacting global business communication.Wed, 29 Apr 2026 08:53:02 GMTMicrosoft TeamsSaaS OutageCloud AvailabilityMicrosoft 365Business Continuityhttps://runtimerebel.com/blog/microsoft-outlook-ios-authentication-issues-remediation-and-riskshttps://runtimerebel.com/blog/microsoft-outlook-ios-authentication-issues-remediation-and-risksMicrosoft resolves global Outlook.com outage but requires iOS Mail app users to re-authenticate. Learn how to secure accounts and mitigate phishing risks.Tue, 28 Apr 2026 08:57:14 GMTOutlookiOSMicrosoft 365PhishingIdentity Managementhttps://runtimerebel.com/blog/microsoft-outlook-com-sign-in-failures-analysis-of-ongoing-outagehttps://runtimerebel.com/blog/microsoft-outlook-com-sign-in-failures-analysis-of-ongoing-outageMicrosoft confirms an Outlook.com outage causing intermittent sign-in failures and mailbox access issues. Learn about the impact on enterprise productivity.Mon, 27 Apr 2026 12:47:26 GMTOutlook ComMicrosoft 365Authentication FailureService Outagehttps://runtimerebel.com/blog/microsoft-teams-abused-in-helpdesk-impersonation-attacks-ttps-mitigationshttps://runtimerebel.com/blog/microsoft-teams-abused-in-helpdesk-impersonation-attacks-ttps-mitigationsMicrosoft warns of helpdesk impersonation attacks via Teams external collaboration.Mon, 20 Apr 2026 16:32:32 GMTMicrosoft TeamsImpersonationSocial EngineeringHelpdeskPhishingIdentity AccessMicrosoft 365External Collaborationhttps://runtimerebel.com/blog/apt28-frostarmada-dns-hijack-campaign-steals-microsoft-365-loginshttps://runtimerebel.com/blog/apt28-frostarmada-dns-hijack-campaign-steals-microsoft-365-loginsAuthorities disrupt APT28's FrostArmada campaign, which used DNS hijacking of MikroTik and TP-Link routers to steal Microsoft 365 account credentials.Tue, 07 Apr 2026 16:28:36 GMTAPT28FrostArmadaDNS HijackingMicrosoft 365MikroTikTP LinkCredential Thefthttps://runtimerebel.com/blog/iran-linked-password-spraying-targets-300-israeli-organizationshttps://runtimerebel.com/blog/iran-linked-password-spraying-targets-300-israeli-organizationsIran-linked threat actors launched coordinated password-spraying attacks against Israeli and UAE Microsoft 365 environments in March 2026.Mon, 06 Apr 2026 20:17:19 GMTIran NexusPassword SprayingMicrosoft 365Azure ADIsraelUAEhttps://runtimerebel.com/blog/oauth-2-0-device-code-phishing-surge-protecting-m365-and-googlehttps://runtimerebel.com/blog/oauth-2-0-device-code-phishing-surge-protecting-m365-and-googleDevice code phishing attacks have surged 37x this year. Learn how adversaries abuse the OAuth 2.0 Device Authorization Grant to bypass MFA and hijack accounts.Sat, 04 Apr 2026 16:14:53 GMTOAuth 2 0PhishingMicrosoft 365MFA BypassAccount Takeoverhttps://runtimerebel.com/blog/exchange-online-service-change-solving-outlook-for-mac-access-issueshttps://runtimerebel.com/blog/exchange-online-service-change-solving-outlook-for-mac-access-issuesMicrosoft addresses a service disruption in Exchange Online caused by virtual account updates affecting Outlook for Mac and mobile device connectivity.Mon, 23 Mar 2026 12:23:10 GMTExchange OnlineMicrosoft 365OutlookService OutageVirtual Accountshttps://runtimerebel.com/blog/microsoft-exchange-online-outage-troubleshooting-access-failureshttps://runtimerebel.com/blog/microsoft-exchange-online-outage-troubleshooting-access-failuresMicrosoft Exchange Online service disruption prevents global users from accessing mailboxes and calendars. Review technical impacts and mitigation steps.Mon, 16 Mar 2026 16:28:36 GMTMicrosoft Exchange OnlineOutlookService OutageMicrosoft 365https://runtimerebel.com/blog/microsoft-investigates-classic-outlook-sync-connection-issueshttps://runtimerebel.com/blog/microsoft-investigates-classic-outlook-sync-connection-issuesMicrosoft is actively investigating widespread classic Outlook desktop client synchronization and connectivity problems impacting users globally.Fri, 13 Mar 2026 20:14:14 GMTMicrosoft OutlookEmail SynchronizationConnection IssuesMicrosoft 365Service Health