Unified SaaS Application Security, Detection, and Response | Qualys
Summary: Qualys describes its SSPM product, built on its FedRAMP-authorized Cloud Platform, as a single console for continuous visibility, data access control, and security configuration hygiene across Microsoft Office 365, Zoom, Salesforce, and Google Workspace, with Slack and Okta support coming soon. The post cites a Business Email Compromise case in which fifteen Office 365 accounts were used to register 150 domains through GoDaddy's Wild West Domains using a homograph technique, and the SolarWinds Orion compromise (Dark Halo, tracked by FireEye as UNC2452) in which attackers escalated to privileged accounts managed by Azure Active Directory and exfiltrated data via Office 365 misconfigurations such as MFA disablement.
What you should know: Fifteen compromised Office 365 accounts were enough to register 150 lookalike domains and redirect a wire transfer, and the SolarWinds attackers reached privileged Azure Active Directory accounts through Office 365 misconfigurations like disabled MFA - both are configuration and identity gaps inside SaaS apps that host-based security programs do not cover.
Read the original at Qualys Blog ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026