Cyberdudebivash

        UNC6040: The Vishing-to-OAuth Attack Chain - A Threat Analysis Report By CyberDudeBivash     By CyberDudeBivash • October 02, 2025, 10:35 AM IST • APT Threat Intelligence Report   Multi-Factor Authentication (MFA) is the bedrock of modern identity security, but threat actors are evolving. We are tracking an emerging threat actor, designated **UNC6040**, that is successfully bypassing MFA protections through a sophisticated attack chain that combines old-school social engineering with modern cloud application abuse. This **"Vishing-to-OAuth"** campaign targets corporate users of Microsoft 365. Instead of trying to steal passwords, the attacker's goal is to trick the victim into granting persistent, privileged access to a malicious OAuth application. This technique grants the attacker access to the victim's email and files, completely bypassing the need for passwords or future MFA prompts. This is a deep-dive analysis of the TTPs used by ...