Catan and Mouse

Cisco Talos blog roundup covering multiple research and analysis items. Notable findings: ARToken — an EvilTokens-derived phishing-as-a-service panel targeting Microsoft 365 with 80+ API endpoints enabling device-code phishing, Primary Refresh Token (PRT) persistence, email access, BEC workflows, and SharePoint exfiltration; discovery of four heap-based buffer overflow vulnerabilities in MediaArea’s MediaInfoLib; a DICOM-focused white paper demonstrating heap overflow exploitation in medical imaging stacks (pydicom, GDCM, Orthanc); an overview of COM usage by Windows threats and a new workflow