SessionShark Steals Session Tokens to Slip Past Office 365 MFA

Security researchers here at SlashNext recently uncovered a promotional image on a cybercrime network showcasing a service called “SessionShark O365 2FA/MFA.” SessionShark is a phishing-as-a-service toolkit built to bypass Microsoft…

Continue ReadingSessionShark Steals Session Tokens to Slip Past Office 365 MFA

How Attackers Abuse Trusted Cloud Apps—and Why URL Analysis Matters

It’s no secret that cybercriminals love to exploit our trust in well-known brands. From big-name retailers to popular online services, attackers will latch onto anything that seems safe. In this…

Continue ReadingHow Attackers Abuse Trusted Cloud Apps—and Why URL Analysis Matters

Devil-Traff: A New Bulk SMS Platform Driving Phishing Campaigns

Employees in most organizations receive countless communications daily—emails, Slack messages, or ticket updates, for example. Hidden among these routine interactions are phishing scams designed to exploit trust and compromise security.…

Continue ReadingDevil-Traff: A New Bulk SMS Platform Driving Phishing Campaigns

Threat Actors are Exercising New Attack Techniques to Bypass Machine Learning Security Controls

"Conversation Overflow” attacks are the latest attempt to get credential harvesting phishing emails into your inbox SlashNext threat researchers have uncovered a dangerous new type of cyberattack in the wild…

Continue ReadingThreat Actors are Exercising New Attack Techniques to Bypass Machine Learning Security Controls