News
The New Phishing Click: How OAuth Consent Bypasses MFA
2 months ago
The New Phishing Click: How OAuth Consent Bypasses MFA
By info@thehackernews.com (The Hacker News)
In February 2026, a phishing-as-a-service (PhaaS) platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries. The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogin and complete their normal MFA challenge, then walked away believing they had verified a
More from The Hacker News
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
4 hours from now
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
2 hours from now
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
1 hour from now
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
40 minutes from now
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
9 minutes ago