Microsoft Graph Archives • Daily CyberSecurity

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel

Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel

Do Son July 21, 2026

Kaspersky details Project CAV3RN, an OilRig-linked cyberespionage framework. Its new module hides C2 in Outlook calendar events, with DNS AAAA fallback.

The Payroll Pirate Campaign Leverages AiTM Session Hijacking to Target HR Departments Payroll Pirate campaign, AiTM session hijacking

The Payroll Pirate Campaign Leverages AiTM Session Hijacking to Target HR Departments

Do Son June 15, 2026

The active Payroll Pirate campaign uses AiTM session hijacking and token replay to target corporate payroll and HR personnel across multiple industries.

New AI-Driven Phishing Campaign Subverts Microsoft’s Device Code Flow EvilToken Device Code Phishing

New AI-Driven Phishing Campaign Subverts Microsoft’s Device Code Flow

Do Son April 10, 2026

Microsoft uncovers EvilToken, an AI-powered PhaaS toolkit using Dynamic Device Code Generation to bypass MFA and breach high-value accounts. Patch now!

Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C2 North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

Lazarus Group Attacks with DreamLoader Malware, Leveraging DLL Sideloading and Microsoft Graph API for Stealth C2

Do Son October 28, 2025

Lab52 exposed Lazarus Group using DreamLoader malware via fake job lures. The modular tool chain abuses DLL sideloading and the Microsoft Graph API for stealthy C2 communications.

The Master Key: Exposed JSON File Gives Attackers Full Control of Azure AD Azure AD, misconfiguration

The Master Key: Exposed JSON File Gives Attackers Full Control of Azure AD

Do Son September 2, 2025

A new report reveals a dangerous misconfiguration: exposed appsettings.json files can contain Azure AD credentials, giving attackers full access to a company's cloud kingdom.

Aviation Industry Alert: 50,000+ Azure AD Records Exposed via Misconfigured API Azure AD, Data Exposure

Aviation Industry Alert: 50,000+ Azure AD Records Exposed via Misconfigured API

Do Son June 2, 2025

Over 50,000 Microsoft Azure AD user records from the aviation industry were exposed due to a misconfigured, unauthenticated API, revealing sensitive data and posing major risks.