token-theft

Blog All categories All authors All tags
Preview image for a blog post

Critical Flaw in Microsoft Authenticator for Android: Unsanctioned Apps Exploited Work Account Tokens (CVE-2026-80097)

Microsoft Authenticator vulnerability (CVE-2026-80097) allowed zero-permission Android apps to steal work account tokens, fixed in version 6.2606.4246.
Preview image for a blog post

Midnight Blizzard's Evolving Threat: Hijacking Captive Portals for Token Exfiltration

Midnight Blizzard (Storm-2945) exploits hotel captive portals with fake updates to steal sensitive user tokens.
Preview image for a blog post

M365 MFA Bypass: Deconstructing the OAuth 2.0 Device Code Phishing Campaign

Deep dive into a sophisticated phishing campaign abusing OAuth 2.0 Device Authorization Grant flow to bypass M365 MFA and steal tokens for persistent access.