Sitemap

Posts

• When Updates Backfire: RCE in Windows Update Health Tools
  What if a Microsoft‑tool meant to protect Windows machines, actually opened up remote code execution (RCE) by re-using…
• Battling Shadow AI: Prompt Injection for the Good
  LLMs and AI agents have become an integral part of businesses worldwide, altering the way we communicate, conduct…
• WSUS Deserialization Exploit in the Wild (CVE‑2025‑59287)
  Today, our morning coffee was rudely interrupted by a critical alert from a customer’s Windows Server Update Services…
• ClickFix Block: protect against fake CAPTCHA attacks | Eye Security
  Rise of the “ClickFix” Social Engineering Attack In recent months, we here at Eye Security and other cybersecurity…
• Consent & Compromise: Abusing Entra OAuth for Fun and Access to Internal Microsoft Applications
  This blog is about how I got access to over 22 internal Microsoft services and how you might…
• How we Rooted Copilot
  Read how we explored the Python sandbox in Copilot and got root on the underlying container
• SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704)
  From SOC Alert Triage to SharePoint Mass Exploitation On the evening of July 18, 2025, Eye Security was…
• STORIES FROM THE SOC: Eye see you, Axios
  Eye Security investigates new threat actors and their methods, focusing on business email compromise (BEC). For example, an alert was triggered when a phishing attempt bypassed multi-factor authentication. Analysts quickly revoked access, limiting damage to a stolen password. Their rapid response ensures threats are mitigated effectively.
• STORIES FROM THE SOC: Pentest or a real threat?
  A Monday afternoon. Our SOC is alerted by Defender for Endpoint: suspicious PowerShell activity, lateral movement with hands-on…
• Sneaky2FA: Use This KQL Query to Stay Ahead of the Emerging Threat
  Challenges in business are a given, but it’s our response to them that defines our trajectory. Looking beyond the immediate obstacle, there lies a realm of opportunity and learning.
• 8Base Ransomware Recovery: Key and File Retrieval
  Every business has a unique potential waiting to be tapped. Recognizing the keys to unlock this growth can set an enterprise on the path to unprecedented success.
• This Is How Threat Actors Use OneDrive Compromise to Infect Local Windows Hosts
  In the ever-evolving world, the art of forging genuine connections remains timeless. Whether it’s with colleagues, clients, or partners, establishing a genuine rapport paves the way for collaborative success.
• “Master” Malware – a new C2 framework
  A new malware sample was discovered during an incident response engagement, suggesting potential ransomware deployment while bypassing antivirus defenses. This malware, dubbed “Master,” is Python-based and acts as a C2 framework. It utilizes multiple encoding schemes common in Eastern Europe and supports diverse commands, highlighting flaws in traditional antivirus systems.
• How Microsoft might have lured unsuspecting end-users into the hands of criminals
  Eye Security conducted phishing simulations and tested Microsoft’s Attack Simulator. They discovered a vulnerability where links in simulation emails pointed to unregistered domains, allowing potential exploitation. After reporting to Microsoft, the issue was confirmed and addressed multiple times, highlighting the importance of vigilant cybersecurity measures and quick response capabilities.