Azure Hacking research: Entra ID, cloud identity security, offensive techniques & detection.

Azure API Connections are silently stored bearer tokens, service principal secrets, and OAuth refresh tokens that sit in plain-ARM sight, and any attacker with Microsoft.Web/connections/listConnection...

In-flight Wi-Fi security doesn't get much attention, but Delta's captive portal exposes passengers to account takeover, token forgery, and an end-of-life API gateway riddled with unpatched CVEs. We au...

A soft-deleted file in a public blob container, still retrievable through versioning, leaks a SAS token that exposes an entire file share, ultimately cascading into a complete Azure tenant takeover th...

WhiteRabbitNeo is an AI company focused on cybersecurity.

CrowdStrike customers now have access to no-cost fundamentals training for world-class cybersecurity education. Learn more!

Google Gemini 2.0 Flash is now available to all Copilot users in public preview

In this article, we will walk through a solution to automate the process of adding new members to a GitHub organization

Introduction Hello, I’m RyotaK ( @ryotkak ), a security engineer at GMO Flatt Security Inc. In October 2024, I was hunting bugs for the GitHub Bug Bounty program. After investigating GitHub Enterprise...

In this article, I’m excited to introduce a project I’ve been working on to securely share secrets using only Azure resources.

In this blog post, I will explain how to detect brute force attacks using Kusto Query Language (KQL) in Microsoft Defender. I will provide…

SpearTip Security Operations Center, together with the SaaS Alerts team, identified an emerging threat involving the fastHTTP library

Windows 11 with KB5050009, KB5050021 and Windows 10 with KB5049981, KB5050008, KB5049993, KB5050013

Contribute to azurekid/blackcat development by creating an account on GitHub.

Coinbase is a secure online platform for buying, selling, transferring, and storing cryptocurrency.

Just before the year starts to wrap up, we are getting the final 2024 release out! This contains a wide range of updates and changes, which are in already in effect, ready for immediate download, or u...

Just in time for the holidays, sharper tools for faster defense

Critical vulnerability could have allowed malicious actors to gain unauthorized access to users’ Microsoft accounts.

The zero-day (CVE-2024-49138), plus a worryingly critical unauthenticated RCE security vulnerability (CVE-2024-49112), are unwanted gifts for security admins this season.

Critical CVE-2024-10905 in SailPoint's IdentityIQ (CVSS 10.0) risks unauthorized file access. Update now

YouTube video by Microsoft Security Response Center (MSRC)

ShadowHound is a PowerShell tool designed for mapping Active Directory environments without using known malicious binaries. It utilizes legitimate PowerShell modules for data collection through two…

Cross-IdP impersonation is a method of hijacking SSO to access downstream apps — without needing to compromise accounts on your company’s main IdP.

NTLM attacks on Microsoft products show flaws that Microsoft won't patch. Learn about these risks and why disclosure matters.

As users are flocking to BlueSky from social media platforms like X/Twitter, so are threat actors. BleepingComputer has spotted cryptocurrency scams popping up on BlueSky just as the decentralized mic...

Complete list of LPE exploits for Windows (starting from 2023) - MzHmO/Exploit-Street

Attackers can use Microsoft Dev Tunnels as a means of tunnelling C2 traffic through legitimate Microsoft infrastructure undetected.

BlueHat 2024 - Oct 29-30, 2024. Redmond, WA USA

A new type of two-step phishing attack leverages Microsoft Visio files (.vsdx) and SharePoint to evade detection and steal credentials.

Learn how to access the Security Copilot audit log

Azure Application Proxy offers a groundbreaking solution for remote users needing access to on-premises web applications. By integrating seamlessly with Microsoft Entra ID for one-time sign-on, it sim...

Maester is a PowerShell based Microsoft Security test automation framework designed to help you maintain control over your Microsoft…

Cyble’s weekly IT vulnerability report highlights vulnerabilities in Fortinet, SonicWall, Grafana Labs, CyberPanel and more.

Since August 2023, Microsoft has observed intrusion activity targeting and successfully stealing credentials from multiple Microsoft customers that is enabled by highly evasive password spray attacks....