ANY.RUN's Malware Trends Tracker data shows that phishing-as-a-service kits now dominate the US threat landscape, with five of the top ten threats being AiTM or device-code phishing platforms that defeat MFA by stealing session cookies or OAuth tokens. Commodity RATs and info stealers remain in constant high-volume circulation, while legacy threats like Emotet and WannaCry persist on unpatched systems. Several top-ranked threats (Cobalt Strike, Qbot, Emotet, DonutLoader, Smoke Loader) function as ransomware precursors, meaning their detection should trigger urgent escalation rather than routine handling.
OAuth
12 posts
US Threat Landscape Alert: 30 Active Malware Families Ranked by Real Sandbox Data The Identity Problem Hiding in AI Agent Deployments The rapid deployment of AI agents in enterprises creates an identity problem: OAuth access tokens (RFC 9068) lack standardized fields to represent agent instance identity, the user on whose behalf an agent acts, and the delegation relationship between them. This gap can lead to coarse-grained authorization, over-privileged access, and the confused deputy problem in transitive agent call chains. The article calls for industry standardization of this identity context within or adjacent to OAuth tokens.
EvilTokens: How “Ghost” Code Threatens US and European Businesses The EvilTokens phishing kit utilizes browser-side AES-GCM decryption to conceal its malicious payload from static analysis tools. By abusing the Microsoft Device Code authentication flow, the kit tricks victims into authorizing attacker access to their Microsoft 365 accounts without directly harvesting credentials, creating a significant visibility gap for SOC teams.
Device code phishing bypasses password stealing An active Microsoft 365 phishing campaign is abusing the OAuth 2.0 Device Authorization Grant flow to achieve account takeover without stealing passwords. The attack utilizes ClickFix-style landing pages with Unicode obfuscation and tricks victims into authorizing an attacker-controlled device via legitimate Microsoft authentication portals, coordinating the flow via a 4-second beaconing mechanism.
Dangerous Invitations: Russian Threat Actor Spoofs European Security Events in Targeted Phishing Attacks Russian threat actor UTA0355 is conducting targeted phishing campaigns against foreign policy and government professionals by spoofing European security conferences. The attackers use rapport-building techniques and out-of-band messaging to trick victims into authorizing malicious Microsoft 365 OAuth applications and Device Code workflows, granting unauthorized access to their accounts.
One Is a Fluke, 3 Is a Pattern: MCP Back-End Vulnerabilities Security researchers discovered critical vulnerabilities in three widely used Model Context Protocol (MCP) servers—Apache Doris, Apache Pinot, and Alibaba RDS—stemming from insufficient back-end security validation. These flaws include SQL injection (CVE-2025-66335), missing authentication, and unauthenticated data exposure, allowing attackers to execute arbitrary commands or exfiltrate sensitive database metadata.
Token Bingo: Don’t Let Your Code be the Winner A widespread phishing campaign is leveraging the Kali365 Live Phishing-as-a-Service (PhaaS) platform to execute device code phishing and AiTM attacks. By tricking users into authorizing legitimate Microsoft device login requests, threat actors steal OAuth access and refresh tokens, bypassing traditional credential-based defenses and MFA to gain persistent access to Microsoft 365 environments.
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables A supply chain attack leveraging a compromised third-party OAuth application (Context.ai) allowed threat actors to breach Vercel's internal systems. The attackers exploited Vercel's environment variable sensitivity model to enumerate and expose unencrypted customer secrets, leading to potential downstream credential abuse across multiple cloud and SaaS platforms.
OpenClaw, Rogue Agents, and Application Hygiene The rapid adoption of AI agents like OpenClaw has introduced a new identity threat surface in Microsoft cloud environments. These applications are often granted sweeping tenant-wide permissions, effectively acting as highly privileged service principals that bypass traditional endpoint defenses and could allow attackers to inherit administrative control if the agent is compromised.
Riding the Rails: Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure Threat actors are leveraging the EvilTokens Phishing-as-a-Service platform hosted on Railway.com to conduct large-scale device code phishing campaigns against Microsoft 365 users. By abusing legitimate cloud infrastructure and multi-hop redirect chains, attackers successfully bypass email filtering and MFA to harvest persistent OAuth tokens.
Huntress Managed ITDR for Google Workspace: Defending the New Identity Attack Surface Threat actors are increasingly targeting Google Workspace as a foundational identity layer to pivot into interconnected SaaS applications. Modern attacks bypass traditional endpoint defenses by utilizing stolen credentials, OAuth abuse, and malicious inbox rules to conduct Business Email Compromise (BEC) and maintain persistent access.
OAuth Device Code Phishing: A New Microsoft 365 Account Breach Vector Threat actors are increasingly utilizing OAuth Device Code phishing to compromise Microsoft 365 accounts. By tricking victims into entering a verification code on the legitimate Microsoft device login page, attackers can obtain OAuth access and refresh tokens without ever harvesting the user's credentials. This technique bypasses traditional phishing defenses by operating over encrypted channels and legitimate Microsoft infrastructure.
