🎯 ARToken PhaaS, 🐛 LLM-Fuzzed Zero-Days, 🤖 Ollama/LiteLLM Vulns, 📧 KDDI Breach, 🎭 Poisoned Tenant Attack

ARToken is the day's defining story. Cisco Talos documented the phishing-as-a-service platform during incident response and found a management panel with more than 80 API endpoints tied to the EvilTokens ecosystem. It steals Microsoft 365 tokens, sustains access with Primary Refresh Tokens, and automates the business email compromise loop, including mailbox keyword monitoring and AI-assisted scoring of victims by financial exposure. ARToken phishing platform

The technique is what makes it dangerous: device code authentication phishing routes victims through Microsoft's own login page and mints tokens directly to the attacker, bypassing MFA. Push Security measured a 37-fold surge in device code phishing over the past year, with at least 11 kits now offering the technique. This is a consent-flow gap, not a credential failure, so conditional access coverage of non-interactive authentication is the control that matters.

The AI supply chain produced two disclosure dumps. One researcher published LLM-fuzzed proof-of-concept exploits against dozens of projects including FFmpeg, Gitea, Ghidra, and OpenVPN, nine with CVE identifiers, and Huntr disclosures covered five more flaws in Ollama and LiteLLM, including a pass-the-hash authentication bypass in LiteLLM. Parser and trust-boundary bugs are the recurring theme. LLM-fuzzed disclosures

Watchlist: conditional access coverage for device code and consent flows, plus patch monitoring for the affected open source projects.