Skip to content
Threat Feed

Product

Microsoft 365

3 briefs RSS
high advisory

ClickFix 'BackgroundFix' Campaign Delivers CastleLoader, NetSupport RAT, and CastleStealer

The 'BackgroundFix' ClickFix campaign uses social engineering to trick victims into downloading malware disguised as a free image-editing tool, leading to the deployment of CastleLoader, NetSupport RAT for remote access, and CastleStealer for credential theft.

Microsoft Windows +2 clickfix malware social-engineering rat infostealer castleloader netsupport
2r 3t 1i
medium advisory

Detection of Command and Control Activity via Commonly Abused Web Services

This rule detects command and control activity using common web services by identifying Windows hosts making DNS requests to a list of commonly abused web services from processes outside of known program locations, potentially indicating adversaries attempting to blend malicious traffic with legitimate network activity.

OneDrive +7 command-and-control windows threat-detection
2r 2t
medium advisory

Microsoft 365 Suspicious Email Delivery

This brief outlines a threat where Microsoft Defender for Office 365 identifies an email as malicious or suspicious but still delivers it to a user's inbox or junk folder, potentially bypassing initial security measures.

Microsoft 365 suspicious-email phishing microsoft365
2r 2t