October 2026 Threat Report Covers EvilTokens Disruption, Exploited Flaws and M365 Spraying

Oct 30, 2026 · Original article ↗

Summary

Hornetsecurity’s October report reviews the EvilTokens disruption, active exploitation of SharePoint and Atlassian flaws, and a Proofpoint-tracked M365 password-spraying campaign, with guidance on service accounts, device-code phishing and patching.

Key points

Proofpoint tracked 32,825 authentication events across 5,714 M365 accounts and 28 tenants; seven functional accounts were compromised, all in one organization, and none had MFA enforced.
Proofpoint says sign-in records alone do not establish that data was taken. In one account it examined, an attempted corporate VPN login was blocked by MFA or Conditional Access.
Microsoft said its court-authorized disruption of EvilTokens seized 50 websites and disabled more than 150 supporting domains. Microsoft attributed more than 12,000 inboxes across over 10,000 organizations to the service, which used device-code phishing and AI-assisted mailbox triage.
Microsoft reclassified SharePoint CVE-2026-65660 from spoofing (CVSS 6.5) to remote code execution (CVSS 8.8). Exploitation was reported from September 24, and Microsoft confirmed exploitation as CISA added it to KEV on September 25.
Previdian reported honeypot attempts against Atlassian CVE-2026-21589 within two hours of public exploit code; its later count was 190 attempts from 32 addresses. The unauthenticated flaw enables file reads, and Atlassian provided WAF and proxy guidance.
The report recommends assigning owners to non-human accounts, rotating their credentials, restricting device-code sign-ins through Conditional Access, and patching and investigating affected SharePoint servers.

Article Details

Event Type: A monthly security report covering the disruption of the EvilTokens phishing service, reported exploitation of SharePoint and Atlassian vulnerabilities, and a Microsoft 365 password-spraying campaign.
Impact: Microsoft and partners seized 50 websites and disabled more than 150 domains associated with EvilTokens. Microsoft reported that the service had reached more than 12,000 inboxes at over 10,000 organizations; SpyCloud separately reported recapturing phished data covering 8,708 accounts across 6,585 corporate domains. Proofpoint reported seven compromised accounts in a password-spraying campaign affecting 5,714 accounts across 28 tenants. Reported exploitation of CVE-2026-65660 and honeypot activity targeting CVE-2026-21589 exposed organizations to remote code execution and unauthenticated file reading, respectively.

Indicators of compromise

Type	Indicator	Context
IPV4	`146[.]70[.]187[.]234`	Previdian reported this address as a source of honeypot attempts targeting Atlassian's CVE-2026-21589.
IPV4	`159[.]26[.]119[.]225`	Previdian reported this address as a source of honeypot attempts targeting Atlassian's CVE-2026-21589.
IPV4	`38[.]60[.]157[.]86`	Previdian reported this address as a source of honeypot attempts targeting Atlassian's CVE-2026-21589.