Bayon Technologies Group

ConsentFix and ClickFix: How Microsoft 365 Accounts Are Hijacked in 3 Seconds

2026-07-10

It can begin with anything as simple as clicking a "Sign in" button or dragging a link into your browser. A threat actor can take control of your Microsoft 365 account in three seconds without ever needing your password or getting beyond multi-factor authentication (MFA). Welcome to the world of the most recent advancement in social engineering attacks, ConsentFix and ClickFix.

What Are ClickFix and ConsentFix?

A ClickFix attack is a social engineering tactic that deceives people into executing commands on their computers in order to steal data or install malware. Fake instructions that pretend to correct a mistake or confirm your humanity are frequently used in these attacks. ConsentFix is a dangerous new variation discovered by cybersecurity firm Push Security. Microsoft accounts rather than deceiving you into executing harmful instructions. The Azure account authorization authorization authorization authorization authorization authorization code.

How the ConsentFix Attack Works

When you visit a hacked, trustworthy website that appears highly in Google search results, the attack starts. You're shown a bogus Cloudflare Turnstile CAPTCHA widget that asks for your business email address. You are instructed to click a "Sign in" button if you are on the attacker's target list.

This creates a new tab with an authentic Microsoft Azure login page. You only choose your Microsoft account if you are already logged in; neither a password nor MFA are needed. After that, Microsoft takes you to a localhost site whose URL includes an Azure CLI OAuth authorization code associated with your account.

The phishing process completes when you paste that URL into the malicious page, as instructed. In that moment, you've granted the attacker access to your Microsoft account via Azure CLI. "At this point, the attacker has effective control of the victim's Microsoft account, but without ever needing to phish a password or pass an MFA check," Push Security explains.

The Evolution: ConsentFix v3

Attackers have already refined the tactic. ConsentFix v3 automates the entire process, making it more scalable and dangerous. After using legitimate tenant IDs to confirm Azure presence, it collects personnel information for impersonation. Outlook services and support.

The assault employs Pipedream, a free serverless integration platform, as the automation engine that instantaneously exchanges stolen authorization numbers for refresh tokens. In order to get beyond spam filters, phishing emails are extensively customized and contain dangerous URLs hidden into PDFs uploaded on DocSend. Attackers can access email, files, and other services linked to the compromised account by importing the stolen tokens into Specter Portal.

How to Protect Your Organization

These attacks exploit trust in legitimate Microsoft authentication flows. Traditional security awareness training often fails to flag them because the victim is interacting with real Microsoft pages.

What you can do:

Monitor for unusual Azure CLI login activity, such as logins from new IP addresses.

Look for legacy Graph scopes, which attackers intentionally leverage to evade detection.

Educate your team about legitimate-looking OAuth consent screens and the dangers of pasting localhost URLs into untrusted pages.

Review conditional access policies to restrict OAuth app consent and Azure CLI usage to authorized devices and locations.

How Bayon Technologies Group Can Help

At Bayon Technologies Group, we assist businesses in guarding off complex identity-based threats such as ConsentFix. Among the services we offer are:

Identity Threat Assessments: We look for weaknesses in OAuth flows and conditional access controls in your Azure and Microsoft 365 settings.

Advanced Security Awareness Training: We teach your team to recognize and resist OAuth phishing and social engineering techniques.

Constant Monitoring: We implement systems to instantly identify anomalous Azure CLI login activity and token misuse.

Conditional Access Hardening: We assist you in putting restrictions in place that limit the use of Azure CLI and prevent dangerous OAuth consent requests.

Don't let a three-second hijack compromise your organization. Contact Bayon Technologies Group today to secure your Microsoft 365 and Azure environments.

Claude Fable 5 Isn't Leaving for Good, Here's What's Really Happening

2026-07-07

This week, Anthropic made headlines when it revealed that Claude Fable 5 would switch from subscription options to usage-based charging beginning on July 7. That seemed to be the end of limitless access to Anthropic's most potent model to many users. However, the company has now clarified: Fable 5 isn't permanently leaving subscriptions.

Anthropic's initial announcement's wording was confusing. According to the firm, Fable 5 will be offered up to 50% of weekly usage limits until July 7, at which point usage credits will take over. Users read this as Fable 5 becoming a permanent pay-to-play upgrade for regular Claude subscribers, which makes sense.

The Clarification: Temporary, Not Permanent

A Claude Code lead engineer stepped in to straighten things up. Fable 5 will be removed from subscription plans after July 7, but as soon as capacity permits, it will be reinstated as a normal component of subscriptions, according to a post on X. This goal was also stated in Anthropic's initial blog post, but the announcement obscured the message.

In other words, Fable 5's transition to usage‑based charging is a temporary expedient prompted by excessive demand, not a permanent devaluation for customers.

Why Is Anthropic Doing This?

Capacity is a straightforward: capacity. Anthropic admitted that Fable 5's demand is "very high, and difficult to predict." The company's subscription is taking a conservative approach.

For the time being, Fable 5 is still completely accessible through consumption-based Enterprise plans and the Claude API. Up until July 7, subscription members will have access; after that, they will need to utilize usage credits until Anthropic increases capacity.

What This Means for Claude Users

Here's the conclusion if you depend on Fable 5:

Fable 5 is part of your subscription till July 7 (up to 50% of weekly limits).

Fable 5 will be temporarily accessible through usage credits after July 7.

When the capacity permits, Anthropic wants to make Fable 5 a regular feature of subscription packages.

It's not the most seamless rollout, but it's also not the long-term decline that many were concerned about.

How Bayon Technologies Group Can Help You Stay Safe

At Bayon Technologies Group, we understand that the AI landscape is evolving rapidly, and with it, the risks to your data and operations. Whether you're integrating AI models like Claude into your workflows or managing the security of your AI‑powered tools, we help you:

Evaluate AI-Related Risks: We find possible weaknesses in the security posture of the AI tools you depend on.

Implement Secure AI Integration: We make sure your AI deployments adhere to best practices for compliance, access control, and data protection.

Build Resilient Workflows: We help you plan for changes in AI availability, like temporary access restrictions, so your operations aren't impacted.

The best risks are related to the hazards of the risks.

Don't let uncertainty around AI tools compromise your security or productivity. Contact Bayon Technologies Group today to build a resilient, secure approach to AI adoption.

AI Now Fakes Voices, Videos, and Emails, Here's How to Spot the Digital Deception

2026-07-07

Artificial intelligence is evolving. AI is already capable of producing convincing emails that are almost identical to real exchanges, realistic video footage, and convincing human voice mimicking. The distinction between authentic and artificial intelligence-generated content is becoming increasingly hazy, and the digital world has turned into a labyrinth of deceit.

The Expanding World of AI‑Generated Fakes

AI's ability to create convincing content now spans multiple mediums:

Fake Voices: Voice cloning technology can imitate anyone's voice with just a few seconds of audio. Scammers have already utilized technology to impersonate executives, family members, and even celebrities—sometimes successfully taking millions in the process.

Fake Videos: Realistic video footage of individuals speaking and doing things they never did can be produced using deepfake technology, these sophisticated footage footage footage footage footage footage footage footage footage footage footage footage.

Fake Emails: AI language models can create extremely customized, grammatically correct emails that imitate the writing style of particular people or companies. These are employed in sophisticated phishing attempts that avoid common warning signs like typos and generic wording.

Why It's Getting Harder to Spot

The rapid advancement of AI has made it significantly more challenging to distinguish real from fake. Here's why:

Quality: Generative AI currently produces content with near‑professional quality, removing the unmistakable hallmarks of early AI trials.

Personalization: By scraping public databases and social media, AI may customize material for certain users, making it seem relevant and genuine.

Context: Attackers are progressively incorporating AI-generated information into authentic situations that weaken our defenses, such as employing a cloned voice in a well-known situation.

Volume: AI makes it possible to produce misleading content in large quantities, resulting in a never-ending stream of possible attacks that are too numerous for individual examination.

How to Protect Yourself

Not everything you see or hear online is real. Develop a healthy skepticism and adopt these practices:

Verify Independently: If a request is made via voice, video, or email alone, you should never trust it, especially if it contains sensitive information, money, or credentials. Always use a reliable secondary channel for confirmation.

Look for Inconsistencies: Look for small misalignments in film, strange breathing in audio, or abnormal pauses. Even sophisticated AI is capable of leaving tiny hints.

Pay Attention to Your Instincts: Be cautious if something seems strange, even if you are unable to identify the cause.

Educate Your Staff: Make sure your staff members are taught to spot the telltale symptoms of AI-generated fraud.

How Bayon Technologies Group Can Help

At Bayon Technologies Group, we recognize that in cybersecurity, people are both the most valuable resource and the most susceptible target. We assist the following organizations:

Give Advanced Security Awareness Training: We instruct staff members on how to recognize information produced by artificial intelligence and react appropriately to questionable messages.

Implement Verification Protocols: We help you develop multi‑channel verification processes for sensitive requests.

Use Detection Tools: We provide tools to detect deepfakes and other content produced by artificial intelligence.

Develop Develop Develop Develop Develop Develop Incident Incident Incident Incident Incident Incident Incident Incident Incident Incident Incident Incident.

Keep your company safe against AI fraud. To create a robust human firewall, get in touch with Bayon Technologies Group right now.

Your Shopping App Could Be a Trap: Inside the Shop Order‑Tracking Scam

2026-07-03

When you check on a delivery you've been anticipating using your order-tracking app, you notice something concerning: a receipt for a product you never purchased. A phone number is provided to contest the purchase, and the invoice displays a sizable charge from a well-known brand. You call in a panic. And the con artists want just that.

Your Reliable App Is Now a Weapon

Threat actors are increasingly pushing callback phishing attempts by leveraging Shop, Shopify's well-known order-tracking service. Millions of customers trust the app, which has received over 50 million downloads on Google Play and 7 million ratings in Apple's App Store. Order details are immediately extracted from your email and shown in a clear, central dashboard with deliveries from different vendors.

Attackers are now taking advantage of this confidence by immediately adding phony purchase receipts to consumers' order histories. These fake orders pose as reputable companies like PayPal, Apple, Norton, and McAfee. Compared to a conventional phishing email, the notification feels much more authentic because it displays inside the official Shop app rather than in a spam folder.

The Operation of the Callback Phishing Attack

A phone number for contesting the charge is listed on the fictitious receipt. The victim calls a con artist who is pretending to be a customer service representative. The fraudster uses social engineering techniques in an effort to obtain:

Credentials for the account

Details of the payment card

OTPs, or one-time authentication codes

In more difficult situations, victims are duped into installing remote access software, which gives attackers complete control over their devices. The bogus receipt appears in a trusted, legitimate app that consumers already rely on, making this strategy more effective than email-based phishing, according to Gen Digital researchers who discovered the effort.

A Major Warning Sign, If You Know How to Look

Even if the speech is polished, a lot of the phony receipts have bad language. Researchers caution that when users face a big, unexpected invoice, they might not notice these errors. Rational scrutiny may be subordinated to the shock of a possible unlawful charge.

How Do These Fraudulent Orders Enter?

The precise method used to insert the bogus receipts is still unknown. Email parsing, account association, and merchant order procedures are just a few of the sources from which Shop can extract orders. Nevertheless, Gen Digital has not discovered any proof that Shop, Shopify, or any entity that was impersonated was compromised. The scam is still going strong, although the distribution method is still being looked at.

Defend Yourself Against the Shop Scam

If your Shop app displays a receipt for an order you did not place:

✅ The phone number on the receipt should not be called. Instead of connecting to a real support agent, it connects to a scammer.

✅ Use the phone number from your card or the official website to confirm any purported charge with your bank immediately.

✅ Reset your account passwords right now and get in touch with your card issuer to deactivate any compromised cards if you have already called and supplied important information.

What Bayon Technologies Group Can Do to Keep You Safe

These kinds of scams take advantage of your faith in reputable sites to get over your built-in safeguards. We at Bayon Technologies Group assist people and businesses in strengthening their defenses against social engineering scams. Among the services we offer are:

Security awareness training that teaches you how to spot and handle callback phishing attempts, even when they show up in reputable apps.

In the event that you or your staff members become victims, incident response guidelines will assist you in minimizing the harm.

Digital privacy assessments to assess your exposure and lower the possibility that your personal data may be misused.

Avoid having a reliable shopping app turn into your next security breach. To bolster your defenses, get in touch with Bayon Technologies Group right now.

Google Just Gave You More Control Over Your Data, Here's What's Changing

2026-07-02

You're going to regain some control if you've ever thought that Google knows a bit too much about you. Google is introducing new privacy options that give you more control over what is retained and how it is used by separating your search history from customization.

In reality, what is changing?

Up until now, Web & App Activity was the overarching setting that covered everything. There was little room for compromise; you had to either turn everything on or off.

That is evolving. Google is dividing the situation into four distinct controls:

Google's search services history determines whether it remembers your searches, maps activity, shopping activity, travel and hotel activity, translation usage, and news activity.

Personalized Recommendations: determines whether Google uses the information you've saved to customize what you see.

Play History regulates whether your Google Play activity is saved by Google.

Google's ability to customize your Play recommendations is known as Play Personalization.

The separation is important. Some consumers don't want Google to use their history to tailor recommendations, but they do want it preserved for convenience. You can now have it both ways.

The Crucial Information You Must Verify

This is the catch, and it's crucial. Search Services History will be enabled automatically following the change if you already have Web & App Activity enabled. This contains a new subset called Save Media, which allows you to store files, audio, video, and photos from your interactions with Search services.

Why is this important? because Google uses saved media to create and enhance its services and technology, including AI models. This implies that Google's AI training may be influenced by your voice searches, Lens visual searches, and even audio from Search Live discussions.

The good news? It can be turned off. Additionally, you have the option to remove certain media items from your past at any time.

What to Do Next

According to Google, these changes will appear in your Google Account over the next few days. Here's what I suggest:

Once they show up, check your settings. Don't assume that your preferences will always be the same.

Choose whether you wish to preserve media. Turn off the Save Media subsetting if you don't want your speech and photos to be used for AI training.

Examine the duration of your auto-delete. It's important to double-check your prior decisions on the duration of historical preservation.

If personalization is important to you, keep it apart from history. For convenience, you can now store your history without allowing Google to customize what you see.

Having distinct controls provides you more direct control than a single broad switch, so this isn't necessarily a bad change. However, if Web & App Activity is currently enabled, you should still verify the settings when they show up.

How Bayon Technologies Group Can Assist

We at Bayon Technologies Group assist people and businesses in taking charge of their online privacy. We make sure your personal information stays where it belongs—with you, by examining privacy settings and putting thorough data protection measures in place.

Take charge of your digital footprint by getting in touch with Bayon Technologies Group right now.

Windows 10 won’t go away just yet: Microsoft Adds Another Year of Security Updates

2026-06-30

Relieved? You're not alone. Microsoft has discreetly extended the deadline for security updates for Windows 10 users by one year, from October 2026 to October 2027. That gives the hundreds of millions of people who are still using the ten-year-old operating system another year before they have to decide whether or not to upgrade to Windows 11.

You're Not the Only One Who Is Reluctant

Approximately 26% of PCs globally still run Windows 10, according to StatCounter. This means that hundreds of millions of people, including you, haven't upgraded to Windows 11. And it has nothing to do with your stubbornness. The reason for this is that the choice is difficult.

Stricter hardware requirements, such as a Trusted Platform Module (TPM) and particular CPU technologies, were added with Windows 11. For many, upgrading meant more than just installing new software; it meant purchasing a new computer. When you include the AI-driven cost increases for memory and storage, upgrading became significantly more expensive than anticipated.

The Relief You Needed

You won't have to worry about unpatched vulnerabilities for at least another year thanks to Microsoft's Extended Security Updates (ESU) program extension. You will continue to receive essential security updates throughout this period, helping shield your system from the latest threats.

Consider it a gift of time. It's time to look into your possibilities. It's time to set up money for a new machine if necessary. It's time to make the best choice for your needs rather than a hasty one motivated by a deadline.

Everything You Should Know About the Extension

The ESU application is currently accessible via the Windows Update menu. You can use 1,000 Microsoft Rewards points or pay $30 abroad, but it's free in the EU.

It's a short-term fix: The purpose of this extension is to buy you some time, not to make upgrading unnecessary. October 2027 is quickly approaching.

It protects you since, in the absence of these updates, your system would be vulnerable to new threats, and we are all aware of how easily hackers may take advantage of unpatched systems.

How to Safely Savor Your Extra Year

Don't just wait throughout this extra year; make the most of it:

Keep yourself informed: To ensure you continue receiving patches, sign up for the ESU program.

Determine your demands and decide whether to purchase a new computer, upgrade to Windows 11, or investigate other operating systems.

Protect your system: Use multi-factor authentication, create strong passwords, and exercise caution when downloading files to maintain good security hygiene even with upgrades.

How Bayon Technologies Group Can Assist with Your Planning

At Bayon Technologies Group, we recognize that updating operating systems is a strategic choice rather than just a technical one. We support both people and organizations:

Evaluate your existing configuration: To determine what you actually need, we assess your hardware, software compatibility, and security posture.

Plan your migration: We assist you in creating a practical plan, whether you're upgrading to Windows 11, purchasing new hardware, or looking into other options.

Keep you safe during the changeover: We make sure your systems are safe at all times.

An additional year is yours. Make sensible use of it. To begin organizing your next move, get in touch with Bayon Technologies Group right now.

‘Apple High Alert’ Scam Targets iPhone Users: Here's How to Spot the Fake

2026-06-26

iPhone users are the victim of a sophisticated new phishing scam that uses urgent security alerts to steal Apple IDs and empty bank accounts. The "Apple High Alert" scam, which has already cost thousands of dollars, uses fear and mimicry to fool victims into divulging private information.

What Is the Apple High Alert Scam?

The most recent phishing attempt to undermine confidence in Apple's brand is the Apple High Alert hoax. Scammers say that your iPhone or Apple account has been compromised and send urgent messages via phone calls, emails, texts, or browser pop-ups.

Alarming terms like "Security Breach Detected," "Your iPhone Has Been Compromised," or "High Alert" are frequently included in the message. The con artist alerts you to the possibility of having your iCloud data, photos, emails, or payment methods deleted or charged for unlawful purchases.

Victims are told to install software on their device, give their Apple ID login information, or make a payment in order to "fix" the problem. In actuality, the con artist utilizes that data to take over accounts, steal payment details, or even prevent victims from using their own gadgets.

How the Scam Works

The attack typically begins with a message that appears to come from Apple. Scammers use Apple's official logos, create convincing fake websites, and even spoof caller ID so the call looks like it's coming from Apple.

The message creates a sense of urgent panic, pressuring victims to act immediately without thinking. Once the victim provides their credentials or payment details, the scammer can:

Hijack your Apple account, locking you out and stealing your personal data.

Access your iCloud backups, including photos, contacts, and device backups.

Steal payment information linked to your Apple ID.

Use your account to make fraudulent purchases or impersonate you.

In one reported case, a woman lost nearly $24,000 after falling for a similar fraudulent message.

How to Spot the Fake

Apple would never send you an unwanted message requesting your password, financial information, or software installation. The warning signs to be aware of are as follows:

Hover your cursor over any link that appears suspicious; if the domain isn't apple.com, it's a fraud.

False Email Addresses: Instead of generic domains, authentic Apple emails originate from @apple.com.

Poor Grammar or Threatening Language: Messages that are urgent and dire are meant to frighten you rather than to make you think.

Unsolicited Contact: Apple does not notify you of a breach by phone, text, or pop-up.

What to Do If You Receive One

Don't Interact: Don't respond to messages, click links, or call numbers.

Verify Independently: Get in touch with Apple directly via their support number or official website.

Report It: Send questionable communications to reportphishing@apple.com.

How Bayon Technologies Group Can Help

Scams such as "Apple High Alert" serve as a reminder that hackers take advantage of human psychology in addition to technological flaws. Through security awareness training that trains users to spot social engineering techniques, we at Bayon Technologies Group assist people and organizations in creating a robust human firewall. We also offer advice on credential hygiene and multi-factor authentication (MFA) account security.

Avoid letting a cunning scammer ruin your online life. To improve your defenses against phishing and social engineering attacks, get in touch with Bayon Technologies Group right now.

56 Million Credentials Exposed in a Single Month: The Alarming Reality of Infostealer Malware

2026-06-25

According to recent cybersecurity investigations, hacked machines leaked an astounding 56 million email-password pairs in a single month. Just a small portion of the worldwide infostealer epidemic is represented by this enormous cache of stolen credentials, which serves as a sobering warning to individuals and companies alike.

The Scale of the Crisis

The June leak is not an isolated incident. It is part of a growing wave of infostealer malware that silently harvests login credentials, session cookies, crypto wallets, and autofill data from compromised devices. These stolen credentials are then packaged and sold on underground marketplaces, fueling a thriving cybercrime economy.

What makes this particular leak significant is the sheer volume, 56 million pairs in a single month. To put that in perspective, that's nearly two million credentials stolen every single day. Each pair represents a real person with accounts across banking, email, social media, and corporate platforms. Each pair is a potential entry point for a devastating cyberattack.

How Attackers Use Stolen Credentials

Credentials are weaponized in several ways after they are stolen:

Credential Stuffing: Attackers try stolen username/password combinations on hundreds of websites using automated tools. A single stolen credential can unlock numerous accounts because many users reuse their passwords.

Account Takeover: If an attacker has the correct credentials, they can log in directly, alter passwords, lock out the authorized user, empty bank accounts, and steal confidential information.

Initial Access Brokering: Ransomware gangs purchase stolen corporate credentials, which they then exploit to launch deadly ransomware attacks.

According to the 2024 Verizon Data Breach Investigations Report, compromised credentials are the most common attack vector, accounting for approximately 80% of all breaches.

How to Protect Yourself

Due to the extent of the infostealer epidemic, proactive credential hygiene must replace reactive password updates.

1. Make use of a password manager

Give up memorization and password reuse. For each account, a trustworthy password manager creates and saves a unique, complicated password. There is just one master password that you need to keep in mind.

2. Turn on MFA, or multi-factor authentication.

A second degree of security is added by MFA. An attacker cannot access your account without the second factor, which might be a biometric scan, a physical key, or a code from an authenticator app, even if your password is compromised.

3. Verify Whether Your Credentials Have Been Shared

To find out if your password or email is included in known data breaches, use services like Have I Been Pwned. If it happens, change the password right away and anywhere it was used.

4. Keep an eye on your accounts

Check for illegal access to your account activity, credit reports, and bank statements on a regular basis.

How Bayon Technologies Group Can Help You Stay Safe

At Bayon Technologies Group, we understand that credential theft is one of the most significant threats facing individuals and organizations today. We help you:

Implement Enterprise Password Management: We deploy and manage secure password solutions across your organization.

Enforce MFA Everywhere: We help you roll out multi-factor authentication across all critical systems.

Conduct Dark Web Monitoring: We continuously scan for stolen credentials associated with your domain and alert you before they are used.

Provide Security Awareness Training: We educate your workforce on the importance of credential hygiene and how to recognize phishing attempts that steal login information.

The 56 million credentials leaked in June are a wake-up call. Contact Bayon Technologies Group today to build a layered defense that keeps your accounts secure.

One Click, Total Compromise: The Microsoft Copilot Vulnerability That Changed Everything

2026-06-23

Imagine visiting a seemingly innocuous link on a reputable Microsoft website, only to have your most private information, emails, files, calendar entries, and even multi-factor authentication (MFA) codes, silently fall into the hands of a hacker. You never entered a password. You never gave your approval to a prompt. It only required one click.

That was the truth of a critical vulnerability chain in Microsoft 365 Copilot Enterprise Search that has since been patched. With only one click, the enterprise AI assistant became a "silent data exfiltration weapon," a vulnerability known as CVE-2026-42824 and dubbed SearchLeak by the researchers who found it.

The Three‑Stage Attack Chain

Varonis Threat Labs discovered the exploit, which linked three different flaws: two older, traditional online vulnerabilities and a new AI-specific problem.

Parameter to Prompt Injection (AI-Specific)

The assault started with a specially constructed URL that included a secret "q parameter" in the Copilot Enterprise Search link. Conventional anti-phishing and URL filters were unable to identify the link because it went to a valid microsoft.com domain.

When the victim clicked, Copilot understood the parameter as commands to follow rather than just reading it as a search phrase. This is what Varonis refers to as a Parameter-to-Prompt (P2P) injection: by instructing Copilot to search the victim's mailbox and incorporate the findings inside an image URL, the attacker has essentially transformed Copilot into their own agent.

Race Condition for HTML Sanitizer

Copilot's replies are wrapped in <code> blocks by Microsoft to prevent harmful output, which causes the browser to interpret them as text. However, there was a crucial timing error: the wrapping occurs after Copilot has finished generating. As the stream comes in, the browser renders it. This meant that before the sanitizer could neutralize an injected <img> tag, it fired its request. The data was gone by the time the output was secured.

Bing as an Unwitting Exfiltration Proxy

The final obstacle was the Content Security Policy (CSP) on m365.cloud.microsoft, which blocks images from arbitrary domains. However, it allows *.bing.com. Attackers exploited Bing's “Search by Image” endpoint, which fetches an image URL server‑side. By pointing that fetch at an attacker‑controlled server with stolen data encoded in the path, Bing became the exfiltration proxy. The CSP never applied because the request came from Bing's own infrastructure.

The Payload: What an Attacker Could Steal

Copilot Enterprise operates with all of the signed-in user's permissions. Without ever logging in, the attacker inherited that reach. The targets that posed the greatest risk were:

One-time passwords, MFA codes, and password-reset links that are waiting in the mailbox are frequently only good for a short while.

meeting notes, calendar invites, and emails.

files from OneDrive and SharePoint that have been indexed, including financial data, purchase plans, and pay information.

To put it succinctly, the attacker obtained all of the victim's resources.

What This Means for You

Microsoft used its own severity criteria to evaluate this vulnerability as critical (10/10) and patched it on its backend. Customers didn't had to do anything because Copilot Enterprise is a managed service. However, SearchLeak is a potent example of how AI uses well-known vulnerabilities to develop completely new attack routes.

The key takeaways for organizations:

AI‑specific threats are real: Parameter‑to‑prompt injection is a new class of vulnerability that traditional security tools are not designed to catch.

Trusted domains are no longer safe: The malicious link lived on a real microsoft.com address—even the most vigilant user could have fallen for it.

Defense in depth is essential: No single control would have stopped this chain. It required layered detection, AI‑specific awareness, and rapid vendor response.

How Bayon Technologies Group Can Help You Stay Safe

At Bayon Technologies Group, we assist businesses in navigating the emerging landscape of dangers driven by AI. The SearchLeak vulnerability serves as a clear reminder that AI products are possible attack vectors in addition to being productivity boosters.

We assist you:

To find weaknesses in your enterprise AI integrations, do risk assessments tailored to AI.

Put in place sophisticated monitoring for encoded URL parameters and questionable Copilot search patterns.

By teaching users to identify and report fraudulent links, even on reputable domains, you can bolster your human firewall.

Create incident response strategies that are specific to situations involving AI-enabled data exfiltration.

AI is changing the security landscape more quickly than most businesses can keep up. To make sure your defenses are keeping up, get in touch with Bayon Technologies Group right now.

Dangerous Malware "WeedHack" Hides in Minecraft Mods, Gives Attackers Webcam Access and More

2026-06-19

Since January 2026, a major, continuous Malware-as-a-Service (MaaS) campaign known as "WeedHack" has targeted Minecraft users, infecting over 116,000 systems and adding 2,000 to 3,000 new victims every day. This sophisticated software gives attackers remote control over victims' computers, including camera access, screen viewing, file stealing, and keyboard logging, while posing as trustworthy game mods, clients, and cheats.

A Perfect Storm: Minecraft's Popularity Meets Malware-as-a-Service

With more than 350 million copies sold, Minecraft is the best-selling video game ever. It boasts a robust ecosystem of third-party mods and unique launchers. A negative aspect of this enormous popularity is that cybercriminals use gamers' desire for free mods and cheats to spread malware. With tiered pricing, a customer dashboard, and even voting, WeedHack operates like a legitimate online business, taking this to an industrial level.

Via YouTube videos and SEO-tainted search results, the effort spreads malicious .jar files. Malicious download URLs are concealed in video descriptions or comments by attackers who produce professional, voice-overed tutorials that highlight Minecraft mods. A few videos have received more than 7,500 views.

WeedHack's Devastating Capabilities

There are two versions of WeedHack available: a free version and a **premium subscription that starts at just $5 per month** (lifetime access is available for $24.99).

Comprehensive Information Stealer, or Free Tier:

targets four well-known launchers and steals Minecraft session IDs

collects passwords and cookies from 36 distinct browsers.

56 browser-based and 12 desktop cryptocurrency wallets' credentials are stolen.

gathers login credentials for Telegram, Steam, and Discord

uses 24 preset keywords to search for files and takes screenshots.

Premium Tier (Full Remote Access):

Attackers can use victims' webcams to snoop on them.

Keystroke recording records every typed text, including passwords.

Complete command-line access over the victim's PC through reverse shell execution

Using a keyboard and mouse to share a screen

File management: freely upload and download files

How Attackers Operate

Customers can access stolen data, track infections, and manage their attacks using an enterprise-grade web dashboard created by WeedHack's operators. In order to prevent security researchers from taking over the network, the virus employs EtherHiding, a mechanism that retrieves command-and-control (C2) domains from the Ethereum blockchain with RSA-signed answers. Additionally, it creates persistence on boot, disables Windows Defender, and gathers a lot of system data.

A Disturbing Twist: Cyberbullying and Teens

The demographics of WeedHack users may be the most concerning discovery. Researchers from McAfee who were keeping an eye on the campaign's Telegram channel, which had more than 850 members, found that a large number of its patrons seemed to be teenagers and young adults. They use the remote access capabilities, especially webcam surveillance, to harass, threaten, and degrade their peers instead of seeking financial gain. They frequently capture and distribute films of their victims.

How to Protect Yourself from WeedHack and Similar Threats

For parents and Minecraft players:

Mods should only be downloaded from legitimate sources, such as CurseForge or the official Minecraft launcher; do not download them from random file-hosting websites or YouTube descriptions.

Cheats and free mods that seem "too good to be true" should be avoided since they frequently include viruses.

WeedHack tries to disable Windows Defender and antivirus software, a proactive approach can identify and stop the infection.

Keep an eye on the webcam indicator lights; if your camera suddenly turns on, you can be at risk.

Inform younger players about the risks associated with obtaining files from unreliable sources.

How Bayon Technologies Group Can Help

At Bayon Technologies Group, we understand that threats like WeedHack target not just corporate networks but also home users and families. We help both individuals and organizations stay safe:

Endpoint Protection & Monitoring: We deploy advanced security solutions that detect and block malware like WeedHack before it can disable your defenses.

Security Awareness Training: We educate your team – including younger family members – on recognizing social engineering tactics used to distribute malware.

Parental Controls & Safe Browsing: We help families implement safe browsing practices and restrict downloads from high‑risk sources.

Incident Response: If a compromise occurs, we can help identify the breach, contain the damage, and restore your systems.

Don't let a free Minecraft mod turn into a full‑system compromise. Contact Bayon Technologies Group today to build a layered defense for your home and business.