Microsoft says a threat actor gained access to cloud tenants hosting Microsoft Exchange servers in credential stuffing attacks, with the end goal of deploying malicious OAuth applications and ...

Microsoft Corp. researchers today detailed a recent attack involving malicious OAuth applications that were deployed on compromised cloud tenants to control Exchange servers and spread spam. The ...

This malicious campaign demonstrates how long-lived token theft can become the first step in a much broader breach. The post When Salesforce Becomes a De Facto Credential Repository: Lessons from the ...

Phishing attackers bypassed Microsoft's verified publisher checks to create apps that dupe victims into granting access to their online accounts.

Microsoft has an update for Office 365/Microsoft 365 Exchange Online Basic Auth retirement in the case of SMTP.