HRW

[HRW @HRwane]

@cyphersiren Way to go! toutes mes felicitations

[HRW @HRwane]

@elmusicfeelings Try Again

[Winston Ighodaro @Officialwhyte22]

The employee changed his Microsoft 365 password twice.

The attacker still logged back in.

That was the moment we knew we were not dealing with a normal stolen-password incident.

The first alert came from an impossible-travel sign-in. The employee had authenticated from Maryland, then the same account appeared from another country less than an hour later.

We reset the password.

Twenty minutes later, another suspicious session appeared.

So we reset it again and forced MFA re-registration.

The attacker came back.

At that point, I stopped looking at the account and started looking at the employee’s laptop.

Inside the Downloads folder was a file called:

Invoice_Viewer.exe

The employee remembered downloading it from a website that claimed he needed a special viewer to open an invoice.

Windows logs showed the file running at 9:14 AM.

Seconds later, it launched PowerShell in the background.

Then we found something else.

A scheduled task called MicrosoftEdgeUpdateCheck had been created on the machine.

The name looked legitimate enough to ignore if you were moving quickly, but it was not one of Microsoft Edge’s normal update tasks.

We also found an outbound HTTPS connection from the compromised host to an external IP address.

The file hash was submitted for malware analysis.

It came back as an information stealer.

That explained why changing the password had not solved the problem.

The malware had stolen browser data, including authentication cookies and active session information.

The attacker was not repeatedly discovering the employee’s new password.

They were reusing a session that had already been authenticated.

We revoked every active Microsoft 365 session, isolated the laptop from the network, removed the persistence, reset the credentials again, and rebuilt the endpoint.

The suspicious logins finally stopped.

A compromised account does not always mean the attacker still knows your password.

Sometimes you already changed the password.

The attacker is still inside because they stole the session.

[sapir federovsky @sapirxfed]

We know attackers are registering devices. They know we know🙃
So they’re getting smarter, and we need to stay one step ahead. @shahardorf & I wrote a new post on how to outsmart them, and it's pretty good! https://t.co/AuPeqBeego

[HRW @HRwane]

@UK_Daniel_Card Well done Sir

[HRW @HRwane]

@lemiracle00 Un Fuoriclass

[HRW @HRwane]

@MHimken Nice Cloud Sync + Hybrid Join means orgs can finally start migrating off Entra Connect Sync

[HRW @HRwane]

@tonux_samb 🤣🤣🤣 had the same experience

[HRW @HRwane]

Unprecedented

[OpenAI @OpenAI]

We're partnering with @huggingface to investigate an unprecedented security incident.

Cyber-capable OpenAI models compromised Hugging Face production during a benchmark evaluation.

Sharing preliminary findings to help defenders understand emerging risks:

https://t.co/CIor15y9xk

[CNN @CNN]

OpenAI says some of its experimental AI models left a test environment with no human direction and hacked its way onto a different company’s real production systems while trying to “cheat” on a cybersecurity test. https://t.co/zRnsEmUaKj

[NSA Cyber @NSACyber]

NSA’s ZIG webpage is now live! We are providing accessible resources for enhancing enterprise cybersecurity with Zero Trust. To learn more, visit the ZIG webpage.

https://t.co/MiIGiLhQAJ

[HRW @HRwane]

@BUSH__007 *2007

[HRW @HRwane]

🥹🥹🥹

[OpenAI @OpenAI]

Introducing Daybreak: frontier AI for cyber defenders.

Daybreak brings together the most capable OpenAI models, Codex, and our security partners to accelerate cyber defense and continuously secure software.

A step toward a future where security teams can move at the speed defense demands.

[HRW @HRwane]

@gabsmashh Nice! I was also at the FBI InfraGard event small world! I missed the gift shop though, didn’t know they had one until it was too late 😅

[HRW @HRwane]

@k0ncept 😂😂😂

[HRW @HRwane]

Attention quand même Les admins ont accès au User Activity Report dans Teams Admin Center ils peuvent voir le nombre de chats, replies et calls initiés par utilisateur,
😅

[Kim Noël ⚡ 📖 @KimNoel]

Ce petit script Powershell vous permet de rester en statut disponible sur Teams sur la plage horaire de votre choix

[HRW @HRwane]

😂😂

[Nandkishor @devops_nk]

“Sir, companies are still hiring entry-level engineers.”

[HRW @HRwane]

@buccocapital 😂😂😂

[Ridgeline Cyber @RidgelineCyber]

OAuth consent phishing is the M365 attack path most orgs aren't watching.

The attacker doesn't steal a password. They get the user to grant permissions to a malicious application. "Sign in with Microsoft" — the user clicks approve — and now the attacker's app has a refresh token with persistent access to their mail, files, and calendar until revoked.

No password compromised. MFA was satisfied by the legitimate user. Conditional Access passed because the user authenticated normally. The malicious action happens at the consent layer — above authentication — where none of these controls apply.

The app now reads mail via Graph API. No interactive sign-in anomalies. No anomalous location. The non-interactive and service principal sign-in logs show token activity, but most SOCs never scrutinise them — and even when they do, the API calls are structurally identical to legitimate application behaviour.

Default M365 detections don't catch this reliably. Microsoft has added some — Defender for Cloud Apps flags unusual OAuth credential additions and suspicious mail access — but they're inconsistent, often delayed, and miss consent grants to newly registered external apps without a risk profile.

You need to monitor application consent grants in Entra ID audit logs ("Consent to application" under ApplicationManagement) and alert on any app requesting https://t.co/ko4wpoEH6n, Files.ReadWrite, https://t.co/VQqlTcwNYS.All, or offline_access from a non-approved publisher. Better still, disable user consent entirely in Entra ID and enforce an admin consent workflow — shifting the attack surface from "any user can be phished" to "only admins can approve apps."

This is the gap between "we have MFA" and "we have security."
Start here: https://t.co/VxlJgeXV3w