Microsoft OAuth App Impersonation Leads to MFA Phishing

Executive Summary Proofpoint discovered a widespread phishing campaign leveraging fake Microsoft OAuth applications to bypass multifactor authentication (MFA) and harvest Microsoft 365 credentials. The attackers impersonated reputable brands like RingCentral, Adobe, SharePoint, and DocuSign, by luring victims into approving minimal‑privilege access. Even if MFA was declined, victims were redirected through CAPTCHA and a phishing page using…

Read More

Cybersecurity in 2025: What CISOs in Retail & Hospitality Are Prioritizing

As the digital threat landscape continues to evolve, so too does the role of the CISO. The newly released 2025 RH-ISAC CISO Benchmark Report, developed in partnership with Accenture, offers a compelling snapshot of how cybersecurity leaders across retail and hospitality are adapting to new challenges, investing in resilience, and aligning security with business strategy….

Read More

Microsoft Warns of Active Exploitation of SharePoint via ToolShell Zero-Day

Executive Summary Microsoft has identified widespread, active exploitation of a new SharePoint remote code execution (RCE) vulnerability chain, designated ToolShell, tracked as CVE-2025-53770. This zero-day exploit, demonstrated publicly on X just days prior, allows unauthenticated attackers to compromise on-premises SharePoint servers globally, extracting cryptographic secrets and enabling full remote control. Microsoft, and CISA, has confirmed the active exploitation and…

Read More

Recent Compromises of Network-Separated Environments in South Korea Highlight Potential Security Gaps

Executive Summary Recent major cyber incidents several South Korean entities highlight a critical concern within network-separated, or air-gapped, environments. Despite the inherent security assumptions often associated with these isolated setups, these breaches demonstrate a dangerous decline in caution and a false sense of security. This has led to successful compromises, highlighting that even seemingly air-gapped…

Read More

Citrix Releases Emergency Patches for Actively Exploited CVE-2025-6543 in NetScaler ADC

Executive Summary Citrix has released urgent security updates for a critical memory overflow vulnerability, CVE-2025-6543, affecting its NetScaler ADC and Gateway products. This flaw, which can lead to unintended control flow and denial-of-service, is reportedly actively being exploited in the wild. Organizations using affected versions, especially those configured as Gateways or AAA virtual servers, are strongly advised to update…

Read More