Live

* CISA Exposes Secrets, Credentials in ‚Private‘ Repo* AI Agents Are Shifting Identity Security Budget Dynamics* GitHub Confirms Breach, 4K Internal Repos Stolen* Canvas Breach Disrupts Schools & Colleges Nationwide* It’s Patch Tuesday for Microsoft & Not a Zero-Day In Sight* CISA Admin Leaked AWS GovCloud Keys on Github* Why Chargebacks are Just One Piece of the Fraud Puzzle* Former US execs plead guilty to aiding tech support scammers* US and Canada arrest and charge suspected Kimwolf botnet admin* Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access* CISA Exposes Secrets, Credentials in ‚Private‘ Repo* AI Agents Are Shifting Identity Security Budget Dynamics* GitHub Confirms Breach, 4K Internal Repos Stolen* Canvas Breach Disrupts Schools & Colleges Nationwide* It’s Patch Tuesday for Microsoft & Not a Zero-Day In Sight* CISA Admin Leaked AWS GovCloud Keys on Github* Why Chargebacks are Just One Piece of the Fraud Puzzle* Former US execs plead guilty to aiding tech support scammers* US and Canada arrest and charge suspected Kimwolf botnet admin* Turla Turns Kazuar Backdoor Into Modular P2P Botnet for Persistent Access

Medium 22. Mai 2026

The New Phishing Click: How OAuth Consent Bypasses MFA

In February 2026, a phishing-as-a-service (PhaaS) platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries.

The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then walked away believing they had verified a

Original lesen

🛒