Guardian Digital, Inc.

The Open Source Internet Security Company

[Guardian Digital, Inc. @gdlinux]

🛠️ Toolkit Time! 🛠️
Every sysadmin needs a reliable toolkit. Our newsletter is your virtual Swiss Army knife for combating email threats. Stay equipped and informed with the latest insights and strategies.

Subscribe now and unpack the essentials!

https://t.co/GMz13LV4Co

[Guardian Digital, Inc. @gdlinux]

@Vamzzz93 @Vamzzz93 It's frustrating that reporting doesn’t help, as you mentioned. Do you think Meta’s approach is more reactive than proactive when it comes to these security threats?

[Guardian Digital, Inc. @gdlinux]

Multiple disclosed vulnerabilities were reportedly observed under active exploitation after publication.

That increases pressure on monitoring long before patch cycles catch up.

For Microsoft 365 teams, compromised endpoints often become a path to cloud identity abuse and lateral access.

Conditional Access exclusions remain a common blind spot.

Review exception policies regularly.

https://t.co/SoLYAkCnQt

#microsoft365 #CyberThreats #TechSecurity

[Guardian Digital, Inc. @gdlinux]

Every retained email becomes another record that may need to be searched, preserved, or produced later.

In Microsoft 365 environments, retention decisions directly affect eDiscovery scope, compliance workloads, and incident response timelines.

Many organizations inherit retention settings that nobody has reviewed in years.

https://t.co/ihNxp3Qz6n

#microsoft365 #Cybersec #TechSecurity

[Guardian Digital, Inc. @gdlinux]

Roughly 20% of phishing emails were marked clean by Microsoft 365 EOP and delivered to inboxes.

That matters because attackers only need one message to reach a user.

In many M365 environments, phishing campaigns are built around trusted infrastructure and legitimate-looking workflows.

Most admins discover these messages after a user reports them.

Review messages that bypass filtering, not just blocked ones.

https://t.co/ozEpHhEOj7

#microsoft365 #Cybersec #InfoSec

[Guardian Digital, Inc. @gdlinux]

Many thread hijacking attacks succeed because the malicious email inherits the context of an existing trusted conversation.

Users see familiar subjects, participants, and reply history.

Operationally, this often follows account compromise through password reuse or token theft in Microsoft 365 tenants.

Organizations usually discover the issue only after tracing unusual sign-in behavior across locations.

Conditional access exclusions deserve closer review.

https://t.co/KOAiQx6MtT

#microsoft365 #InfoSec #CyberAttack

[Guardian Digital, Inc. @gdlinux]

@ai_for_success @ai_for_success You’re right, letting a chatbot handle email changes without strong verification is risky. Should multi-factor checks be mandatory for all sensitive actions handled by AI agents?

[Guardian Digital, Inc. @gdlinux]

@benryanwriter @benryanwriter Yes, phishing is getting more creative. Maybe better sender verification and more secure RSVP systems could help reduce confusion. Are people still mostly using email for birthday invites these days?

[Guardian Digital, Inc. @gdlinux]

@PabloSabbatella @pablosabbatella That’s frustrating, especially since you offered them an exact fix. Curious, can you share what the vulnerability was and which password manager you're talking about?

[Guardian Digital, Inc. @gdlinux]

@nickisanders @nickisanders The detail about attackers manipulating the AI support bot is revealing. Should companies develop new layers of verification specifically for AI agents to prevent social engineering on this scale?

[Guardian Digital, Inc. @gdlinux]

@MoneroKaiser @monerokaiser That sounds stressful, especially with those OG handles. Do you think stronger MFA requirements could help here, or does the reported AI access potentially bypass those protections? This definitely raises some significant privacy and account security concerns.

[Guardian Digital, Inc. @gdlinux]

@WesRoth @wesroth That’s really concerning, especially since even high-profile accounts were affected. Do you think AI support should always have an easy fallback to a human, especially for critical issues like this?

[Guardian Digital, Inc. @gdlinux]

@osint_based The fact that network fees were sent from another phishing-linked wallet is very concerning. Do you think mixing this way is getting more common, and how might teams better detect these patterns?

[Guardian Digital, Inc. @gdlinux]

@Cointelegraph Thanks for highlighting the issue with fake interview software. Are there any signs candidates should watch for in recruiter communications to help avoid these malware traps before downloading anything?

[Guardian Digital, Inc. @gdlinux]

@pubity It’s concerning that the AI Support Assistant could be tricked like that. Do you think these AI systems need stronger authentication steps to prevent similar breaches in the future?

[Guardian Digital, Inc. @gdlinux]

Keeping email indefinitely sounds harmless until retention policies collide with legal holds, storage growth, and security exposure.

In Microsoft 365, stale mailboxes often become long-term repositories of sensitive data.

Most tenants discover how much data they’re holding only when an investigation or eDiscovery request starts.

Regular retention reviews usually reveal more risk than expected.

https://t.co/ihNxp3Qz6n

#microsoft365 #InfoSec #CyberDefense

[Guardian Digital, Inc. @gdlinux]

Researchers reported that proof-of-concept code was published alongside unpatched vulnerabilities.

That gives operators a blueprint before defenders have remediation options.

In Microsoft 365 incidents, initial access frequently turns into OAuth abuse, mailbox access, or session token persistence.

Many organizations discover this only after investigating suspicious cloud activity.

https://t.co/SoLYAkCnQt

#microsoft365 #CyberDefense #InfoSec

[Guardian Digital, Inc. @gdlinux]

Thread hijacking campaigns frequently abuse existing mailbox sessions instead of triggering obvious credential theft alerts.

This lets attackers operate quietly inside normal business communication.

In Microsoft 365, compromised accounts are often used to harvest contacts, review conversations, and identify financial workflows.

Mailbox rule persistence still shows up regularly during investigations.

Review inbox rules tied to external forwarding.

https://t.co/KOAiQx6MtT

#microsoft365 #Cybersec #TechSecurity

[Guardian Digital, Inc. @gdlinux]

Several Microsoft vulnerabilities were publicly disclosed before patches were available.

That shortens the window between disclosure and active exploitation.

In Microsoft 365 environments, attackers often pivot from endpoint access into token theft and mailbox persistence.

Most teams only notice after reviewing Entra ID sign-in activity.

Review unusual authentication patterns.

https://t.co/SoLYAkCnQt

#microsoft365 #Cybersec #InfoSec

[Guardian Digital, Inc. @gdlinux]

Email thread hijacking often bypasses traditional phishing indicators because the sender and conversation are already legitimate.

That changes how users evaluate trust inside Microsoft 365 environments.

Attackers commonly leverage compromised accounts to monitor conversations before injecting malware links or payment requests.

Many tenants still rely heavily on user-reported phishing to catch this activity.

Entra ID sign-in logs usually tell the real story.

https://t.co/KOAiQx6MtT

#microsoft365 #CyberDefense #CyberThreats

[Guardian Digital, Inc. @gdlinux]

@wongmjane @wongmjane That sounds really concerning, especially with the repeated password reset attempts. Are you enabling two-factor authentication now, or considering any additional steps for your online security after this?