Sabitlenmiş Tweet
Olúwatóyìn
223 posts

Olúwatóyìn retweetledi
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi

If you are a lady, I just found an opportunity for you to learn AI skills for free and get a certification.
The duration is 3 hours and you will be taught by top women CEOs in different fields.
Don’t miss out on this life changing opportunity.
Link to Apply: founderz.com/ai-skills-4-wo…
Reshare for every woman to benefit from this.
English
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi

Use CV builders if you can't afford a PRO service:
1. novoresume.com
2. wtfresume.com
3. visualcv.com
4. resume.com
5. resumake.io
6. flowcv.io
BONUS: cutt.ly/BrenCV by @Momentswithbren
English
Olúwatóyìn retweetledi

God willing, this is the first song I’d whisper into the ears of my newborn.
I’d call them into a life of worship from the first day.
✞ Sᴜɴᴅᴀʏ@Survivor_Uganda
In your opinion, should parents introduce the idea of God to their children at a young age?
English
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi
Olúwatóyìn retweetledi

𝗨𝗿𝗴𝗲𝗻𝘁 𝗰𝗮𝗹𝗹 𝗳𝗼𝗿 𝗮𝗹𝗹 𝗖𝗜𝗦𝗢𝘀 𝗮𝗻𝗱 𝗘𝗺𝗽𝗹𝗼𝘆𝗲𝗲𝘀 𝗪𝗵𝗼 𝗨𝘀𝗲 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗧𝗼𝗼𝗹𝘀
I read about a newly identified 𝗣𝗵𝗶𝘀𝗵𝗶𝗻𝗴 𝘁𝗲𝗰𝗵𝗻𝗶𝗾𝘂𝗲 called "𝗖𝗼𝗣𝗵𝗶𝘀𝗵" and I thought to share.
This attack exploits Microsoft’s Copilot Studio agents to steal OAuth (access) tokens.
𝗪𝗵𝗮𝘁 𝗺𝗮𝗸𝗲𝘀 𝗶𝘁 𝘀𝗼 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀?
The link looks perfectly safe ( because it’s a real Microsoft URL) but behind it is a malicious chatbot asking you (or your admin) to "sign in" or "grant access."
Once you do, attackers can quietly steal your session token and access company data undetected.
𝗔 𝘀𝘂𝗺𝗺𝗮𝗿𝘆 𝗼𝗳 𝗵𝗼𝘄 𝘁𝗵𝗶𝘀 𝗮𝘁𝘁𝗮𝗰𝗸 𝘄𝗼𝗿𝗸:
- Attackers build fake Copilot agents using Microsoft’s Copilot Studio.
- These agents live on genuine Microsoft sites, making them appear trustworthy.
- When you log in or approve access, your authentication token is sent to the attacker.
- Since the URL is a legitimate one, it is easier for a user to fall for the trick and log in thinking it is just another Microsoft Copilot service.
- Because the token was sent from Copilot using Microsoft's IP address, the connection to the attacker will not show in the user's web traffic.
𝗪𝗵𝘆 𝘁𝗵𝗶𝘀 𝗺𝗮𝘁𝘁𝗲𝗿𝘀:
Phishing isn’t just about fake emails anymore. Trusted platforms are now being abused to bypass traditional defenses. What this means is that, "safe domain" doesn’t always mean "safe page."
𝗥𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻𝘀:
1. Set up rules in Microsoft Entra ID to ensure users cannot grant permissions to risky or unverified apps without an admin checking them first.
2. Disable default user app creation, preventing regular users from registering or deploying new applications unless necessary.
3. Security teams should closely monitor logs for new Copilot agents or app permission requests.
4. Train your employees to question unexpected consent or sign-in requests.
5. Encourage reporting by making it easy for employees to report anything odd.
6. Finally, review and revoke unused or suspicious OAuth tokens to reduce the attack surface and stop potential misuse of outdated credentials.
📌 Microsoft has confirmed a fix is coming, but awareness is our best defense right now.
📷 Below are images showing the Microsoft-hosted login page and how the CoPhish attack works.
𝗜𝗺𝗮𝗴𝗲 𝗦𝗼𝘂𝗿𝗰𝗲: Datadog
Tag every CISO and Security Analyst you know in the comments.
#CyberSecurity #Phishing #CoPhish


English
Olúwatóyìn retweetledi













