Decoding UserAuthenticationMethod in Microsoft 365 audit logs: the bitfield mapping
This undocumented field of sign-in events is a number where each bit represents a different authentication method.
Global analysis of Adversary-in-the-Middle phishing threats
This report explores current trends in the AitM phishing landscape and the prevalence of leading kits.
Sneaky 2FA: exposing a new AiTM Phishing-as-a-Service
In this blog post, learn about Sneaky 2FA, a new Adversary-in-the-Middle (AiTM) phishing kit targeting Microsoft 365 accounts.
Mamba 2FA: A new contender in the AiTM phishing ecosystem
Discover Mamba 2FA, a previously unknown adversary-in-the-middle (AiTM) phishing kit, sold as phishing-as-a-service (PhaaS).
Solving the 7777 Botnet enigma: A cybersecurity quest
Discover 7777 botnet (aka Quad7) and its activity, targets, and use of TP-Link routers in Microsoft 365 attacks in our latest investigation.
Unveiling the depths of Residential Proxies providers
Discover the growing threat of residential proxies, their role in hiding among legitimate traffic and the challenges they pose in cyberspace.
Adversary infrastructures tracked in 2023
Sekoia.io C2 Trackers identified more than 85,000 IP addresses used as C2 servers in 2023, an increase of more than 30% compared to 2022.