1. SaaS-to-SaaS Lateral Movement
Attackers have realized that breaching a laptop is hard, but hijacking a connected app is easy. With the explosion of low-code automation tools like n8n and Zapier, a single compromised API key can grant an attacker access to your entire suite of tools.
- The Threat - An attacker compromises a minor marketing tool and uses its "read/write" permissions to move laterally into your M365 tenant or CRM.
- The Defense - Implement strict OAuth app governance. Review which third-party tools have "Global Admin" or "Mail.ReadWrite" permissions and revoke anything that hasn't been used in 30 days.
2. Dynamic "Quishing" (QR Code Phishing) 2.0
Standard email filters have gotten better at catching malicious links, but they still struggle with images. We are seeing a surge in Dynamic QR codes that change their destination based on the device scanning them.
- The Threat - A user scans a QR code in a "standard" security notification. If scanned by a security sandbox, it shows a harmless page; if scanned by a mobile phone, it redirects to a pixel-perfect M365 credential harvester.
- The Defense - Disable the automatic rendering of images for external senders and educate staff that NOCTeam or Microsoft will never ask you to scan a QR code to verify your identity.
3. Session Token Theft (AiTM Attacks)
As phishing-resistant MFA (like FIDO2) becomes the standard, attackers are pivoting to Adversary-in-the-Middle (AiTM) attacks. They don't want your password; they want your active session cookie.
- The Threat - A user is lured to a proxy site that looks exactly like the M365 login page. As the user logs in, the attacker captures the session token in real-time, allowing them to bypass MFA entirely.
- The Defense - Enable Conditional Access policies that require compliant, managed devices for access to sensitive data. If the device isn't recognized by your MDM, the session token is useless to the attacker.
The NOCTeam Standard: Staying One Step Ahead
In 2026, security isn't a "set and forget" configuration. It’s an ongoing process of hardening, monitoring, and adapting. Whether it’s securing your Cloudflare edge or auditing your Exchange Online PowerShell policies, the goal is to make your infrastructure too expensive and too difficult to attack.
Is your perimeter as tight as you think it is?
Don't wait for a "discovery" event to find your weak points. We are offering a limited number of comprehensive deep-dives to help local businesses move from reactive to proactive defense.
Contact us at [email protected] today for a free security checkup.
#CyberSecurity2026 #M365Security #IdentityProtection #SaaS #InfoSec #NOCTeam #ManagedServices #ZeroTrust
Originally published on LinkedIn.