oauth 2.0

Microsoft has announced significant changes to its High Volume Email (HVE) service within Microsoft 365, extending support for Basic Authentication until September 2028. This extension aims to provide organizations with additional time to transition to more secure authentication methods, such as...

For many enterprise IT leaders, the intersection of security and high-volume email workflows within Microsoft 365 represents a challenging balancing act. On one hand, organizations demand robust communications infrastructure for both internal and external use. On the other, the growing threat...

Microsoft is continuing its evolution of cloud-based identity management with the unveiling of OpenID Connect (OIDC) identity provider support for Entra External ID—a move poised to fundamentally reshape the way organizations blend security, scalability, and user experience in authentication...

Russian hackers have figured out a way to weaponize OAuth 2.0 authentication—yes, that protocol you trusted implicitly last Tuesday when you breezed through another Microsoft 365 login screen—turning what should be a knight in shining armor into a digital Trojan horse galloping straight through...

There’s a certain poetic irony in the fact that OAuth 2.0—a framework specifically engineered to keep our digital lives safe from password theft—is now being bent and twisted by Russian hackers to hijack entire Microsoft 365 accounts. If that isn’t progress in the field of offensive...

Windows users and IT professionals need to take extra caution as attackers continuously refine their phishing playbook. Recent reports reveal that sophisticated adversaries are leveraging vulnerabilities in OAuth 2.0 redirection flows to target Microsoft 365 environments. In these OAuth-themed...

In the high-stakes world of digital espionage, it’s sometimes not the zero-day exploits or the clever malware payloads that wreak the most havoc, but rather the subtle art of using what’s already trusted and built-in for malicious gain. This theater of subterfuge is playing out right now in the...

Every time the cybersecurity community thinks they’re getting ahead of attackers, someone comes along and turns a trusted workflow into a digital bear trap. That’s exactly what’s unfolding in the latest campaign orchestrated by Russian threat actors who are gleefully exploiting legitimate...

Security researchers and IT professionals are raising the alarm over a sophisticated new phishing variant that targets the OAuth 2.0 authorization code flow, particularly within Microsoft Azure Active Directory (Azure AD). In a detailed demonstration during the “Offensive Entra ID (Azure AD) and...