LevelBlue SpiderLabs has been tracking multiple waves of Wazza, a newly observed multi-stage phishing kit that deploys device code phishing targeting Microsoft 365 accounts. In addition to recent reporting by The Hacker News, our analysis examines the kit's evolving techniques and infrastructure, highlighting key changes observed across analyzed variants.

A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn't need to be disabled to stop receiving updates, it just needs a much simpler dependency: disk space.

A recent trend has emerged where threat actor groups (e.g., ShinyHunters, PEAR, HELIX, etc.) have been leveraging phishing and vishing techniques to gain access to M365 email accounts. Through identity and token abuse, these actors have then automated large-scale file exfiltration and extortion campaigns targeting SharePoint, OneDrive, Microsoft Entra ID (formerly Azure AD), and email data through abuse of the Microsoft Graph API.

(Edit - Sept 17, 2026): The originally released PoC had issues that broke exploitation. That PoC has been revised by the author. We have reviewed the revised version of the exploit and have validated that it now functions as expected in our lab. We have added a section at the end of our original article discussing this update and our results.

To stay ahead of evolving threats, LevelBlue utilizes a machine-learning-based URL scanner that constantly evaluates the digital landscape. We closely monitor VirusTotal for instances where LevelBlue acts as the sole detection layer — a crucial tactic for spotting new phishing campaigns early. In this blog, we will unpack several notable phishing campaigns discovered through this method.

With contributions from Cris Tomboc.