How legitimate cloud platforms enable phishers to bypass MFA
2026-08-05T20:51:46Z•4a8eb87731696d959fa366ca11af2a6975bffff3a4151a0cd986ac6302bcb0a7
BitLockerC2 communications terms: Microsoft Graph, Outlook calendar, DNS,Cloudflare WorkersGitHub PagesIPFSMFA bypassMSSQLNetlifyRDPRMMUltravioletVerceladversary-in-the-middlebackdoorscloud platformscredential dumpingcyberespionagekeyloggingmemory-resident malwarenetwork scanningphishingprinter abuseransomwareservice workersweb shells
What happened
Kaspersky Securelist RSS feed covering recent threat research, including adversary-in-the-middle phishing that bypasses MFA through legitimate cloud platforms, tailored cyberespionage backdoors and malware campaigns, ransomware and BitLocker extortion, covert C2 over Outlook and DNS, supply-chain abuse of the ViPNet update system, and data theft targeting government and educational organizations. The feed highlights active espionage, credential theft, persistence, tunneling, keylogging, ransomware, and exfiltration techniques across multiple regions.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 4a8eb87731696d959fa366ca11af2a6975bffff3a4151a0cd986ac6302bcb0a7
- Enrichment time
- 2026-08-05T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.