Blog & Guides
Practical cybersecurity articles, step-by-step guides, and quick-reference cheat sheets — from Active Directory hardening to Microsoft 365 and zero trust. Written by someone who's done the work. No hype, no fluff.
2 results for “business email compromise” · Clear
Ghost Phishing: How the EvilTokens Campaign Hides in the Browser to Hijack Microsoft 365 Accounts
A new "ghost phishing" wave from the EvilTokens kit is slipping past email security by keeping its payload AES-encrypted until it renders in the victim's browser, then using Microsoft device-code phishing to take over Microsoft 365 accounts without ever stealing a password. This guide breaks down how the technique works, why traditional URL and email controls miss it, who is being hit, and the concrete detection and hardening steps to defend your tenant.
Building a Microsoft 365 Incident Response Console in PowerShell
Why Microsoft 365 incident response is spread across three PowerShell surfaces and several portals, and how a single-file WPF console consolidates the first-hour actions — email purge via Purview, account containment via Graph/Entra, and BEC investigation — into one window. Includes the platform changes that broke a lot of scripts in 2025 and the open-source tool on GitHub.