Microsoft 365

Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Environments in Supply Chain Attack

A compromised credential from ConnectWise Cloud Backup, formerly known as SkyKick Backup, was abused to access at least 173 partner and customer Microsoft 365 environments. Microsoft Threat Intelligence classified the incident as an active supply chain attack. The attacker bypassed password and multi-factor authentication by using a client assertion issued from the vendor environment, impersonating an already-approved application identity to obtain Microsoft Graph tokens. Access occurred on October 15 between 06:13 and 08:34 UTC, with the intruder enumerating environment identifiers sequentially at short intervals, indicating automated scripting against a prepared target list. The backup application's permissions covered Exchange, OneDrive, SharePoint, Teams, and directory information. In one environment, another vendor application was granted global administrator rights and planted secrets in two trusted applications valid until 2028. ConnectWise later disabled seven application identities, revoked affected certificates, and suspended Cloud Backup services.

Microsoft Defender Misclassifies Legitimate Google Search Links as Threats

Microsoft is investigating a false positive issue in Defender for Office 365 where legitimate Google search result links are incorrectly flagged as unsafe. Users attempting to open these links receive a warning stating the website may be insecure, and the problem persists even when copying and pasting URLs directly into browsers. The incident, tracked under advisory MO1465962, stems from erroneous classification by the Safe Links feature, which rewrites and rechecks URLs in email, Teams, and Microsoft 365 applications. The misclassification affects not only end users but also generates alerts for administrators in the Microsoft Defender Portal and Microsoft Sentinel SIEM platform. Safe Links is designed to protect against phishing by validating links at click time, but in this case it overreacted by blocking entire Google search URLs. Microsoft has not disclosed the number of impacted customers or affected regions and continues working on a fix for the erroneous classification.

Cordial Spider Deploys Work Panel Platform for Tech Support Scams Against Corporate Identities

A criminal platform called Work Panel is turning fake technical support calls into structured operations aimed at taking over corporate accounts. The service combines target research, page cloning, telephony, and credential capture within a single control panel. It is linked to the group tracked as O-UNC-045, also known as Cordial Spider. Campaigns target users of multiple identity providers and combine telephone social engineering with fake authentication pages. Operators research names, job titles, corporate emails, phone numbers, and professional profiles before calling to impersonate help-desk staff. While one operator keeps the victim on the line, a manager monitors the phishing session in real time. Captured credentials are sent only to operation managers via Telegram, reducing internal theft risks among the criminals themselves.

HollowGraph Malware Abuses Microsoft 365 Calendars to Conceal Stolen Files and C2 Traffic

A newly discovered espionage malware called HollowGraph turns compromised Microsoft 365 calendars into hidden channels for receiving commands and exfiltrating stolen data. The implant schedules events for 13 May 2050, a distant future date chosen to reduce the likelihood of discovery by account owners. Developed as a Windows DLL, HollowGraph leverages the Microsoft Graph API to blend its traffic with legitimate corporate service activity, eliminating the need to contact attacker-controlled servers directly. It supports two primary commands: “get” to retrieve instructions attached to operator-created appointments and “send” to encrypt collected data with RSA and AES-256-GCM before uploading it as calendar attachments. Separate encryption keys are used for inbound commands and outbound data, while stolen files are written to a disguised logAzure.txt file. Researchers have identified at least 12 compromised systems, three of which remained active, with operations observed between 3 June and 9 July 2026 and primarily targeting Israeli entities.