Category: Cyber Threat Intelligence

Threat actors are increasingly leveraging Microsoft Entra ID’s Self-Service Password Reset (SSPR) feature to conduct highly targeted, identity-driven attacks. Advanced threat groups, such as Storm-2949, have demonstrated how legitimate account recovery functionality can be manipulated to gain access to high-value executive and IT accounts. Once access is obtained, attackers move beyond traditional account compromise, targeting… Read more

The Shai-Hulud Worm: What is it? How is it different? Shai-Hulud is a novel, self‑propagating software supply chain worm that targets the NPM (Node Package Manager) ecosystem and associated development, CI/CD, and cloud-connected environments. Historically, supply chain compromises required a human threat actor to breach a vendor, modify a product or update mechanism, and then… Read more

The second half of the year came with several waves of Salesforce-related breach incidents. Starting in August, researchers first linked the threat actors UNC6395/ShinyHunters. They were conducting a widespread campaign that targeted Salesforce environments by using compromised OAuth tokens linked to Salesloft’s Drift AI customer-engagement integration. The second wave can be considered more of a… Read more

Of the various forms of e-commerce fraud, one of the lesser-known yet prevalent kinds is the brushing scam. This scam appears harmless; receivers will simply get a package they never ordered. However, behind every “free gift” is a manipulative operation abusing personal data and online trust. Description:The goal behind brushing scams are to generate fake… Read more

There are many different types of session hijacking, including session fixation, man-in-the-middle attacks, and active session hijacking. In active session hijacking, an attacker takes over a live session by stealing the session ID while the victim is already logged in. This can be done through methods such as network sniffing or cross-site scripting. The goal… Read more