Blahalla

Malicious Next.js Repos Target Developers Via Fake Job Interviews

www.darkreading.com · 5 months ago

There are malicious Next.js repositories posing as legitimate projects and technical assessment materials that deliver remote code execution and establish persistent command and control on developer machines, linked to North Korean fake job recruitment campaigns. Microsoft Defender researchers traced the activity after suspicious Node.js outbound connections and found trojanized repositories that use two execution paths: Visual Studio Code workspace automation that runs tasks when a workspace is opened and trusted, and obfuscated code that triggers during standard build or development server commands, both fetching and in memory executing attacker controlled JavaScript that stages a C2 channel. The objective is to gain execution on developer systems to access high value assets such as source code, environment secrets, and build and cloud resources and to poison the software supply chain. Recommended defenses include enforcing strict IDE trust policies, deploying attack surface reduction rules to constrain risky script execution behaviors, and prioritizing visibility into unexpected Node.js execution patterns and anomalous outbound connections from developer endpoints.

The Blast Radius Problem: Stolen Credentials Are Weaponizing Agentic AI

www.securityweek.com · 5 months ago

A 2025 threat index tracking 400,000 vulnerabilities found that 56 percent required no authentication before exploitation and identified 300,000 ChatGPT credentials on the dark web, likely stolen by infostealers. Attackers are using artificial intelligence to discover weak access points, craft convincing deepfakes, run immediate scams, and, if they obtain API keys for agentic AI, expand the blast radius of a compromise from data theft to potential control of systems. The index also reports a fourfold increase in supply chain and third party breaches over five years and warns that stronger access controls, visibility into exposed credentials, and mapping of critical assets and dependencies are needed to prevent cascading compromises.

One Identity Appoints Michael Henricks as Chief Financial and Operating Officer

gbhackers.com · 5 months ago

One Identity has appointed Michael Henricks as Chief Financial and Operating Officer effective February 25, 2026. Henricks brings more than 30 years of experience in technology, business services, and financial services and most recently served as Chief Executive Officer and previously Chief Financial Officer at Momentive Software, and his remit will extend beyond traditional CFO duties to strategic planning and operational-financial integration. He will oversee global finance operations, financial planning, and operational efficiency as One Identity scales to support more than 11,000 organizations and over 500 million identities while maintaining a reported 97 percent customer satisfaction rate.

Google Disrupts Chinese Hackers Targeting Telecoms, Governments

www.securityweek.com · 5 months ago

Google has disrupted a significant cyberespionage campaign linked to China, impacting organizations in over 42 countries. The threat actor, known as UNC2814, has been active since 2017 and uses a new backdoor called GridTide, which leverages Google Sheets for command and control. This allows malicious traffic to appear legitimate by utilizing cloud-hosted products. Google and its partners eliminated infrastructure, sinkholed domains, and disabled accounts to disrupt the operation and have notified victims.

Cisco UCS Manager Software Privilege Escalation Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the NX OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated local attacker with read only privileges to modify files and perform limited privileged actions on affected systems. The issue exists because read only users are granted unnecessary privileges and can exploit the NX OS CLI by authenticating to a device and connecting to that interface. Cisco has released software updates to address the issue, there are no workarounds, the security impact rating is Medium, and the flaw is tracked as CVE-2026-20037.

Cisco UCS Manager Software Command Injection Vulnerability

sec.cloudapps.cisco.com · 5 months ago

A vulnerability in the command line and web management interfaces of Cisco UCS Manager Software could allow an authenticated remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system. The flaw is caused by insufficient input validation of command arguments, and exploiting it requires authenticating to the device and submitting crafted input to the affected command, which could lead to execution of commands with root level privileges. Cisco has released software updates to address the issue, reports no available workarounds, assigns a Security Impact Rating of Medium, and tracks the vulnerability as CVE-2026-20036.

Marquis sues SonicWall over backup breach that led to ransomware attack

www.bleepingcomputer.com · 5 months ago

Marquis Software Solutions is suing SonicWall, alleging negligence led to a ransomware attack impacting over 70 banks. Hackers breached Marquis's network after compromising SonicWall’s MySonicWall cloud backup service, gaining access to sensitive data including names, addresses, Social Security numbers, and financial account information. The breach exploited a security gap introduced via an API code change in February 2025, and state-sponsored hackers carried out the attack. Marquis is facing multiple class action lawsuits related to the incident and seeks damages from SonicWall.

Medical device firm UFP says backup data systems deployed following cyberattack

therecord.media · 5 months ago

UFP Technologies, a medical device manufacturer, recently disclosed a cyberattack to regulators. The incident, discovered February 14th, led to the isolation of IT systems and the use of data backups to restore functionality. Hackers accessed and potentially stole or destroyed company data, impacting billing and label creation for customer deliveries, and an investigation is underway to determine the scope of sensitive information involved. The company expects most costs to be covered by cyber insurance.

SolarWinds Patches Four Critical Serv-U Vulnerabilities

www.securityweek.com · 5 months ago

SolarWinds has released patches to address four critical vulnerabilities in its Serv-U file transfer solution. These vulnerabilities, identified as CVE-2025-40538 through CVE-2025-40541, each have a CVSS score of 9.1 and could lead to remote code execution. The flaws include a broken access control issue, type confusion vulnerabilities, and an insecure direct object reference. Successful exploitation requires administrative privileges on the affected system, though the risk is lessened on Windows due to default service account privileges, and users are urged to update to version 15.5.4.

Chinese prosecutors raise alarm about growth of domestic IP theft

therecord.media · 5 months ago

Chinese prosecutors are increasing enforcement against commercial espionage and technology leaks to safeguard domestic innovation. Authorities have handled over 1,200 business secret infringement cases between 2021 and 2025, targeting sectors like artificial intelligence, biomanufacturing, and energy. A recent case involved 14 individuals accused of stealing advanced chip technology from Huawei’s HiSilicon unit, valued at 45 million dollars. This action follows longstanding accusations of China’s intellectual property practices and estimates that technology theft costs the U.S. economy hundreds of billions of dollars annually.

SLH Offers $500–$1,000 Per Call to Recruit Women for IT Help Desk Vishing Attacks

thehackernews.com · 5 months ago

Cybercriminals associated with the Scattered LAPSUS$ Hunters group are recruiting women for voice phishing campaigns targeting IT help desks. The group is offering financial incentives, ranging from $500 to $1,000 per call, and providing scripts for these attacks. This tactic aims to increase the success rate by leveraging the assumption that attackers don't typically have female voices. The group has a history of using social engineering techniques, including impersonation and leveraging legitimate tools to gain access and exfiltrate data.

The OpenClaw Hype: Analysis of Chatter from Open-Source Deep and Dark Web

www.bleepingcomputer.com · 5 months ago

Security researchers are closely examining OpenClaw, an AI-powered automation framework, due to potential security risks. The platform’s modular design, including a skills marketplace, creates a supply chain vulnerability where malicious plugins can deliver malware. Several critical vulnerabilities have been identified, including CVE-2026-25253, enabling remote code execution and credential theft. While underground forums show discussion, widespread exploitation hasn't yet materialized, but experts warn the risk of weaponization remains a significant concern.

Top 5 Ways Broken Triage Increases Business Risk Instead of Reducing It

thehackernews.com · 5 months ago

false

Large-Scale Online Deanonymization with LLMs

simonlermen.substack.com · 5 months ago

Researchers have demonstrated that large language model agents can deanonymize users from their anonymous online posts across platforms like Hacker News, Reddit, and LinkedIn. The models infer personal details, such as location and profession, by analyzing a few comments and then searching the web to identify individuals. This deanonymization process is increasingly practical and scalable, potentially impacting user privacy and enabling misuse like targeted phishing. Platforms are advised to restrict data access, while individuals should be mindful of the specific details shared online to avoid identification.

Why 'Call This Number' TOAD Emails Beat Gateways

www.darkreading.com · 5 months ago

Researchers have identified a growing phishing technique called Telephone-Oriented Attack Delivery, or TOAD, that bypasses email security gateways. These emails contain only a phone number, impersonating entities like PayPal and prompting victims to call for fake billing notifications. Attackers then attempt to extract credentials or manipulate victims into fraudulent transactions, and these attacks are becoming increasingly sophisticated, utilizing numerous evasion combinations. Experts recommend organizations improve detection coverage and employee training to address this threat, emphasizing that legitimate requests will not require phone calls or QR code scans.

Medical Device Maker UFP Technologies Hit by Cyberattack

www.securityweek.com · 5 months ago

UFP Technologies, a medical device manufacturer, recently reported a cybersecurity incident that began February 14th. Attackers gained access to their systems, stole files, and disrupted IT functions like billing and delivery label creation. The company is investigating the scope of the data compromise and implementing backup systems to maintain operations. While it appears to be a ransomware attack, no group has claimed responsibility.

Ex-US Defense Contractor Executive Jailed for Selling Exploits to Russia

www.securityweek.com · 5 months ago

A former executive at Trenchant, a division of L3Harris, has been sentenced to over seven years in prison for stealing cyber exploits from his employer. Peter Williams, an Australian national, sold the stolen information, which included components of software associated with national security, to a Russian cyber-exploit broker. He received cryptocurrency payments for the trade secrets, which he used to purchase luxury goods. Williams' actions resulted in approximately 35 million dollars in losses for the defense contractor and potentially impacted the US government and allied governments.

Zyxel warns of critical RCE flaw affecting over a dozen routers

www.bleepingcomputer.com · 5 months ago

Zyxel has released security updates to address a critical command injection vulnerability, CVE-2025-13942, affecting multiple router models. The flaw allows unauthenticated attackers to execute commands if UPnP and WAN access are enabled. Two additional high-severity command-injection vulnerabilities, CVE-2025-13943 and CVE-2026-1459, were also patched, requiring authentication. Shadowserver is tracking almost 120,000 internet-exposed Zyxel devices, making them a frequent target for attackers. Zyxel is not patching vulnerabilities in several end-of-life routers, CVE-2024-40891 and CVE-2024-40892, and advises users to replace those devices.

Malicious NuGet Packages Stole ASP.NET Data; npm Package Dropped Malware

thehackernews.com · 5 months ago

Cybersecurity researchers have identified four malicious NuGet packages, NCryptYo, DOMOAuth2, IRAOAuth2.0, and SimpleWriter, that target ASP.NET developers to steal sensitive data and create backdoors. These packages, published by a single threat actor, exfiltrate ASP.NET Identity data, manipulate authorization rules, and facilitate hidden process execution. Separately, a malicious npm package named ambar-src has been discovered with over 50,000 downloads, utilizing scripts to download payloads and establish reverse shells across Windows, Linux, and macOS systems. Both campaigns aim to compromise deployed applications rather than developers’ machines directly.

Tracking DPRK operator IPs over time by snooping on mailboxes

kmsec.uk · 5 months ago

false

CarGurus Data Breach Impacts Over 12 Million Users

www.securityweek.com · 5 months ago

More than 12 million CarGurus users are impacted by a recent data breach. The extortion group ShinyHunters claimed responsibility, initially reporting 1.7 million records stolen but later releasing a 6.1 gigabyte archive containing data for approximately 12.5 million accounts. Compromised information includes names, addresses, email addresses, phone numbers, and IP addresses. ShinyHunters is known for using sophisticated voice phishing tactics and has previously targeted organizations like Optimizely, Figure, Panera Bread, and Crunchbase.

I rendered 1,418 Unicode confusable pairs across 230 system fonts. 82 are pixel-identical, and the font your site uses determines which ones.

paultendo.github.io · 5 months ago

false

Hackers Exploit Cortex XDR Live Terminal for C2 Communications

gbhackers.com · 5 months ago

Hackers are exploiting the Cortex XDR Live Terminal feature, a built-in response tool, to establish covert command-and-control (C2) channels. Attackers can abuse the feature's remote execution capabilities and trusted communications to blend malicious activity into normal traffic, potentially bypassing prevention rules. Two methods have been identified: cross-tenant hijacking where an attacker leverages a compromised Cortex tenant, and server-side reimplementation where an attacker replicates the Live Terminal's WebSocket logic. The protocol lacks cryptographic command signing or mutual authentication, making it vulnerable to redirection to attacker-controlled servers.

Poisoning AI Training Data

www.schneier.com · 5 months ago

A fake article about tech journalists and hot dog eating quickly spread through several artificial intelligence chatbots. The article, created on a personal website, was initially presented as fabricated but was still repeated by Google's Gemini and ChatGPT. Anthropic's Claude chatbot correctly identified the article as false, demonstrating varying levels of AI trustworthiness. This incident highlights the ease with which AI training data can be manipulated and the potential for misinformation.

SecurityWeek Report: 426 Cybersecurity M&A Deals Announced in 2025

www.securityweek.com · 5 months ago

false

'Richter Scale' Model Measures Magnitude of OT Cyber Incidents

www.darkreading.com · 5 months ago

A new method, the Operational Technology Incident or OTI Impact Score, is being developed to measure the business impact of OT cybersecurity incidents. Inspired by the Richter Scale, the score assesses incidents based on severity, reach, and duration, aiming to provide clarity for stakeholders and ensure appropriate response. Experts say a standardized scoring system will help shift the conversation away from technical details and toward the business ramifications of attacks. The Colonial Pipeline cyberattack received a score of 3.9, while a 2024 incident at a Texas water utility received a score of 0.0.

Wynn Resorts Confirms Data Breach After Hackers Remove It From Leak Site

www.securityweek.com · 5 months ago

Wynn Resorts has confirmed a data breach impacting employee information. Hackers initially claimed to have stolen over 800,000 records, including Social Security numbers, and listed the company on a data leak site. Wynn Resorts has since been removed from the site, suggesting a possible ransom payment of approximately one point five million dollars. The company is offering credit monitoring and identity protection services to affected employees and is investigating the incident, which reportedly involved the cybercrime group ShinyHunters.

CISA Issues Alert on Active Exploitation of FileZen Vulnerability

gbhackers.com · 5 months ago

The Cybersecurity and Infrastructure Security Agency has added a vulnerability affecting FileZen to its Known Exploited Vulnerabilities catalog. This vulnerability, identified as CVE-2026-25108, is an OS Command Injection flaw that allows attackers to execute system commands. Federal agencies are required to address this vulnerability within a specific timeframe, and all organizations are encouraged to prioritize remediation. Security teams should audit systems for unauthorized activity.

Moscow man accused of posing as FSB officer to extort Conti ransomware gang

therecord.media · 5 months ago

A Moscow man, Ruslan Satuchin, is accused of attempting to extort the Conti ransomware group by falsely claiming to be an FSB officer. The alleged scheme began in September of 2022, with Satuchin demanding payment to prevent prosecution. Conti, linked to Russian-speaking cybercriminals and significant attacks worldwide, fractured in 2022 following a data leak. Satuchin faces up to 10 years in prison if convicted.

Microsoft warns of job‑themed repo lures targeting developers with multi‑stage backdoors

www.csoonline.com · 5 months ago

Microsoft has identified a coordinated cyber campaign targeting software developers through malicious repositories disguised as Next.js projects and technical assessments. Attackers use job-themed lures to blend into routine workflows like cloning and building, retrieving malicious code from remote servers and minimizing traces. The backdoors offer multiple triggers for remote control, including simply opening the project in Visual Studio Code, and operate in stages to establish persistence and enable data exfiltration. Organizations are advised to contain endpoints, hunt for suspicious activity, and strengthen developer trust boundaries to mitigate the risk.

Manual Processes Are Putting National Security at Risk

thehackernews.com · 5 months ago

More than half of national security organizations are still using manual processes to transfer sensitive data, creating significant vulnerabilities. These manual processes introduce risks like human error, policy inconsistencies, and security blind spots, impacting mission readiness and operational integrity. Experts recommend automating these processes and implementing a Cybersecurity Trinity of Zero Trust Architecture, Data-Centric Security, and Cross Domain Solutions to improve security and accelerate mission success. Addressing this requires leadership buy-in, training, and a shift from manual oversight to policy management.

Critical SolarWinds Serv-U Vulnerabilities Enable Remote Root Access

gbhackers.com · 5 months ago

SolarWinds has released a critical security update for its Serv-U file transfer software to address four vulnerabilities. These flaws, including CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541, could allow attackers to execute code with root-level privileges. The vulnerabilities range from broken access control to type confusion and insecure direct object references, all carrying a CVSS score of 9.1, signifying critical severity. Affected organizations should immediately upgrade to Serv-U version 15.5.4, as older versions, specifically 15.5.1 and below, have reached End-of-Engineering.

US sanctions Russian broker for buying stolen zero-day exploits

www.bleepingcomputer.com · 5 months ago

The U.S. Treasury Department has sanctioned a Russian exploit broker, Operation Zero, and its owner, Sergey Zelenyuk, for acquiring stolen hacking tools. This action, taken under the Protecting American Intellectual Property Act, follows the sentencing of Peter Williams, a former employee of a U.S. defense contractor, who stole and sold zero-day exploits to Operation Zero. Operation Zero offers bounties for exploits targeting U.S. software and sells these tools primarily to Russian entities. The sanctions freeze assets and expose those who conduct transactions with the sanctioned individuals and companies to enforcement actions.

TURN Server Security Best Practices - hardening checklist, IP range tables, and deployment patterns

www.enablesecurity.com · 5 months ago

false

Reddit Hit With $20 Million UK Data Privacy Fine Over Child Safety Failings

www.securityweek.com · 5 months ago

British regulators have fined Reddit nearly 20 million dollars for mishandling the personal information of children. The Information Commissioner’s Office found that Reddit unlawfully collected and used data from users under 13, potentially exposing them to inappropriate content. The platform lacked age verification measures until July 2025, relying on user self-declaration which is easily bypassed. Reddit plans to appeal the decision, arguing the fine conflicts with their commitment to user privacy.

Can A.I. Detection Tools Really Spot Fake Images and Videos?

www.nytimes.com · 5 months ago

false

Claude’s New AI Vulnerability Scanner Sends Cybersecurity Shares Plunging

www.securityweek.com · 5 months ago

Anthropic has introduced Claude Code Security, a new capability for its AI coding assistant that scans code for vulnerabilities and suggests patches. This announcement has caused significant drops in the stock prices of major cybersecurity companies, including CrowdStrike, Cloudflare, and Palo Alto Networks, sparking concerns about AI potentially replacing existing security solutions. Industry leaders are downplaying these fears, emphasizing that AI serves as a tool to enhance, not replace, cybersecurity efforts and that AI itself requires security. Experts also point out the reliance on third-party code in production environments, highlighting that AI’s role is to automate tedious tasks rather than eliminate the need for comprehensive security measures.

Ukrainian convicted for helping fake North Korean IT workers

www.csoonline.com · 5 months ago

A Ukrainian man has been sentenced to five years in prison for helping North Korean IT workers obtain remote jobs in American companies. He stole identities from hundreds of people and sold them to foreign workers, facilitating their employment at approximately 40 US companies. The man also provided proxy identities and managed laptop farms to conceal the workers’ true locations. He has agreed to surrender assets valued at over one point four million dollars.

Cybercriminals Exploit Fake Avast Website to Steal Users Credit Card Information

gbhackers.com · 5 months ago

Cybercriminals are using a fake Avast website to steal credit card information from French-speaking users. The fraudulent site mimics the real Avast portal and displays a notice of a supposed €499.99 charge, pressuring visitors to submit financial details to request a refund. The site uses a refund form to collect personal and credit card information and even employs a live chat widget to interact with and reassure victims. Users are advised to be wary of refund offers, requests for credit card details, and instructions to uninstall security software.

Defense Contractor Employee Jailed for Selling 8 Zero-Days to Russian Broker

thehackernews.com · 5 months ago

A former L3Harris employee, Peter Williams, has been sentenced to over seven years in prison for selling eight zero-day exploits to Russian exploit broker Operation Zero for millions of dollars in cryptocurrency. The stolen tools, intended for U.S. government and ally use, could have been used for cybercrime, espionage, and offensive military operations against a wide range of targets. The U.S. government has sanctioned Operation Zero, its director Sergey Sergeyevich Zelenyuk, and related entities for their involvement in the trade secret theft and distribution of harmful cyber tools. Authorities believe Operation Zero has also sought exploits for Telegram, Android, and iPhone devices, and has attempted to recruit hackers and develop relationships with foreign intelligence agencies.

Ad Tech Company Optimizely Targeted in Cyberattack

www.securityweek.com · 5 months ago

Ad tech company Optimizely confirmed a cyberattack involving a sophisticated voice phishing technique. Threat actors gained access to internal business systems, including Zendesk and Salesforce CRM, but were unable to escalate privileges or install backdoors. Optimizely states no sensitive customer data was compromised, but business contact information was accessed, and customers have been notified. The company has engaged cybersecurity experts and law enforcement to investigate.

Ex-L3Harris exec jailed for selling zero-days to Russian exploit broker

www.bleepingcomputer.com · 5 months ago

A former executive of the U.S. defense contractor L3Harris has been sentenced to over seven years in prison for selling stolen zero-day exploits to a Russian broker. Peter Williams, the former general manager of Trenchant, a cybersecurity unit of L3Harris, stole at least eight exploit components and sold them for $1.3 million in cryptocurrency. The stolen tools, which could potentially access millions of devices, caused an estimated $35 million in losses to L3Harris. The U.S. Treasury Department has sanctioned the Russian broker, identified as Operation Zero, for its role in reselling hacking tools.

Operation Red Card 2.0 Leads to 651 Arrests in Africa

www.darkreading.com · 5 months ago

Law enforcement agencies across 16 African countries, supported by Interpol and private companies, recently concluded Operation Red Card 2.0, resulting in 651 arrests and the recovery of over $4.3 million. The operation targeted investment fraud, mobile loan fraud, and a cybercrime syndicate compromising a telecommunications provider's internal operations. Efforts are focused on harmonizing legal frameworks, standardizing investigative methods, and increasing public awareness to combat the growing cybercrime problem, which increasingly exploits mobile financial services and digital connectivity. Private-sector partnerships, such as those with Trend Micro and Team Cymru, were crucial in providing threat intelligence and identifying criminal infrastructure.

Windows 11 KB5077241 update improves BitLocker, adds Sysmon tool

www.bleepingcomputer.com · 5 months ago

false

Android RAT SURXRAT Grants Hackers Full Device Control and Data Exfiltration

gbhackers.com · 5 months ago

A new Android Remote Access Trojan, SURXRAT, is being sold as a malware-as-a-service on Telegram, offering attackers full device control and data theft capabilities. The RAT utilizes a tiered reseller and partner system, allowing buyers to generate customized malware builds while maintaining central control. SURXRAT collects extensive device data, including SMS messages, contacts, and location, and includes a ransomware-style screen locker for extortion. Researchers have found code references to “ArsinkRAT,” suggesting SURXRAT is an evolved fork of that family.

SolarWinds Patches 4 Critical Serv-U 15.5 Flaws Allowing Root Code Execution

thehackernews.com · 5 months ago

SolarWinds has released an update to address four critical vulnerabilities in Serv-U file transfer software. These flaws, rated 9.1 on the CVSS scale, could allow attackers to execute code as root. The vulnerabilities include broken access control, type confusion, and an insecure direct object reference. The affected versions are Serv-U 15.5 and the fix is available in version 15.5.4; the vulnerabilities are CVE-2025-40538, CVE-2025-40539, CVE-2025-40540, and CVE-2025-40541.

Boards don’t need cyber metrics — they need risk signals

www.csoonline.com · 5 months ago

false

Threat Actors Exploit Apache ActiveMQ Vulnerability to Gain RDP Access, Deploy LockBit Ransomware

gbhackers.com · 5 months ago

Threat actors exploited a vulnerability in Apache ActiveMQ, specifically CVE-2023-46604, to gain initial access to a Windows environment. The attackers used a malicious XML file to execute code, establishing a beachhead and escalating privileges to SYSTEM. They then deployed LockBit ransomware over Remote Desktop Protocol, after a total of 419 hours from initial access, with encryption beginning just 90 minutes after their return. The attackers also used AnyDesk for persistence and cleared system event logs to evade detection.

Starkiller Phishing Kit: Why MFA Fails Against Real-Time Reverse Proxies — Technical Analysis + Rust PoC for TLS Fingerprinting

bytearchitect.io · 5 months ago

A new phishing technique, facilitated by platforms like Starkiller, uses reverse proxies to impersonate legitimate login pages and steal credentials, MFA tokens, and session cookies. This sophisticated approach circumvents common security measures, requiring a shift towards analyzing user session behavior for anomalies. Security experts recommend prioritizing FIDO2/Passkeys, implementing session binding, continuous access evaluation, and monitoring post-authentication activity to defend against these advanced attacks. Organizations should focus on understanding the threat and implementing fundamental security measures rather than relying solely on vendor solutions.

OAuth Vulnerabilities in Entra ID Could Exploit ChatGPT to Breach User Email Accounts

gbhackers.com · 5 months ago

Microsoft Entra ID OAuth consent attacks are enabling attackers to gain access to user email accounts, even through trusted applications like ChatGPT. Threat actors can trick users into approving consent screens that grant persistent API access, allowing them to read emails, harvest data, and potentially engage in business email compromise. Detection involves analyzing Entra Audit Logs, specifically correlating "Add service principal" and "Consent to application" events, and alerting on non-admin consent for new applications requesting risky scopes like Mail.Read. Organizations can mitigate this risk by revoking OAuth grants, removing service principals, and tightening Entra user consent settings.