When Updates Backfire: RCE in Windows Update Health Tools
What if a Microsoft‑tool meant to protect Windows machines, actually opened up remote code execution (RCE) by re-using…
Battling Shadow AI: Prompt Injection for the Good
LLMs and AI agents have become an integral part of businesses worldwide, altering the way we communicate, conduct…
WSUS Deserialization Exploit in the Wild (CVE‑2025‑59287)
Today, our morning coffee was rudely interrupted by a critical alert from a customer’s Windows Server Update Services…
ClickFix Block: protect against fake CAPTCHA attacks | Eye Security
Rise of the “ClickFix” Social Engineering Attack In recent months, we here at Eye Security and other cybersecurity…
Consent & Compromise: Abusing Entra OAuth for Fun and Access to Internal Microsoft Applications
This blog is about how I got access to over 22 internal Microsoft services and how you might…
How we Rooted Copilot
Read how we explored the Python sandbox in Copilot and got root on the underlying container
SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704)
From SOC Alert Triage to SharePoint Mass Exploitation On the evening of July 18, 2025, Eye Security was…
STORIES FROM THE SOC: Eye see you, Axios
Eye Security investigates new threat actors and their methods, focusing on business email compromise (BEC). For example, an alert was triggered when a phishing attempt bypassed multi-factor authentication. Analysts quickly revoked access, limiting damage to a stolen password. Their rapid response ensures threats are mitigated effectively.
STORIES FROM THE SOC: Pentest or a real threat?
A Monday afternoon. Our SOC is alerted by Defender for Endpoint: suspicious PowerShell activity, lateral movement with hands-on…
Sneaky2FA: Use This KQL Query to Stay Ahead of the Emerging Threat
Challenges in business are a given, but it’s our response to them that defines our trajectory. Looking beyond the immediate obstacle, there lies a realm of opportunity and learning.