Threat Research

In early September 2025, Cloudflare partnered with Microsoft to dismantle the RaccoonO365 phishing-as-a-service (PhaaS) operation. The campaign targeted Microsoft 365 users using sophisticated phishing kits with CAPTCHA and anti-bot measures....

Detects the execution of AADInternals Cmdlet, a tool used for administering Azure AD and Office 365. Threat actors can exploit this tool to target Azure AD or Office 365 environments for malicious activities....