Guardian Digital, Inc. @gdlinux

Instagram is notifying users whose accounts were targeted after attackers manipulated an AI support chatbot into changing account recovery details. The interesting part is the workflow, not the platform. In Microsoft 365, recovery and identity-change processes often become a higher-risk path than the initial login itself. Many organizations discover identity control weaknesses only after reviewing Entra ID audit activity. Recovery workflows deserve the same scrutiny as authentication flows. techcrunch.com/2026/06/03/ins… #microsoft365 #Cybersec #InfoSec

Email retention is often treated as a storage problem when it’s really a data governance issue. Large Microsoft 365 tenants frequently accumulate years of business communications that no longer serve an operational purpose. Administrators usually encounter this during mailbox migrations or compliance reviews. guardiandigital.com/resources/faq/… #microsoft365 #InfoSec #CyberThreats

Attackers increasingly abuse legitimate Microsoft 365 services to make phishing emails appear trustworthy. This reduces the signals users and filters typically rely on. The activity often blends into normal collaboration and notification traffic. Many organizations first spot it during mailbox or sign-in investigations. Tenant trust can become part of the attack path. guardiandigital.com/resources/must… #microsoft365 #CyberDefense #InfoSec

@namd1nh @namd1nh Great point on the loss of human friction in support flows. Do you think future AI agents can reliably detect and escalate suspicious requests, or is human review still essential for high-risk account actions?

@Malwarehunterr @Malwarehunterr Thanks for sharing the details, especially the hash and IOCs. Do you know if DocuSign has made any official statement or updated guidance to address this specific attack method?

@lopp @lopp Great point about fake Trezor Suite links. With attackers getting smarter, do you think extra verification steps or browser extensions could help users spot these phishing attempts more easily?

@voided @voided Great breakdown, using search ads to mimic legit wallet sites is sneaky and highlights social engineering risks. Do you think platforms like Google should take more responsibility for screening crypto-related ads?

@The_Cyber_News Leaving "setIsDebugMode(true)" in production is a major oversight. Curious, how long was this flag active before discovery? This highlights the need for more thorough release pipeline checks.

Public disclosure debates usually focus on the vulnerability itself. The operational issue is what happens before remediation reaches production. In Microsoft 365 environments, attackers routinely look for existing sessions, OAuth grants, and trusted device access. Many tenants still carry legacy authentication dependencies. Track what is actually being used. csoonline.com/article/417886… #microsoft365 #Cybersec #CyberDefense

Attackers involved in email thread hijacking rarely send mass phishing immediately after compromise. They often spend time reading conversations and identifying operational workflows first. In Microsoft 365 environments, this commonly appears as low-volume mailbox activity that blends into normal usage. Security teams frequently find the compromise during retrospective Entra investigations. OAuth consent activity is worth monitoring closely. guardiandigital.com/resources/blog… #microsoft365 #CyberDefense #Cybersec

@Vamzzz93 @Vamzzz93 It's frustrating that reporting doesn’t help, as you mentioned. Do you think Meta’s approach is more reactive than proactive when it comes to these security threats?

Multiple disclosed vulnerabilities were reportedly observed under active exploitation after publication. That increases pressure on monitoring long before patch cycles catch up. For Microsoft 365 teams, compromised endpoints often become a path to cloud identity abuse and lateral access. Conditional Access exclusions remain a common blind spot. Review exception policies regularly. csoonline.com/article/417886… #microsoft365 #CyberThreats #TechSecurity

Every retained email becomes another record that may need to be searched, preserved, or produced later. In Microsoft 365 environments, retention decisions directly affect eDiscovery scope, compliance workloads, and incident response timelines. Many organizations inherit retention settings that nobody has reviewed in years. guardiandigital.com/resources/faq/… #microsoft365 #Cybersec #TechSecurity

Roughly 20% of phishing emails were marked clean by Microsoft 365 EOP and delivered to inboxes. That matters because attackers only need one message to reach a user. In many M365 environments, phishing campaigns are built around trusted infrastructure and legitimate-looking workflows. Most admins discover these messages after a user reports them. Review messages that bypass filtering, not just blocked ones. guardiandigital.com/resources/must… #microsoft365 #Cybersec #InfoSec

Many thread hijacking attacks succeed because the malicious email inherits the context of an existing trusted conversation. Users see familiar subjects, participants, and reply history. Operationally, this often follows account compromise through password reuse or token theft in Microsoft 365 tenants. Organizations usually discover the issue only after tracing unusual sign-in behavior across locations. Conditional access exclusions deserve closer review. guardiandigital.com/resources/blog… #microsoft365 #InfoSec #CyberAttack

@ai_for_success @ai_for_success You’re right, letting a chatbot handle email changes without strong verification is risky. Should multi-factor checks be mandatory for all sensitive actions handled by AI agents?

@benryanwriter @benryanwriter Yes, phishing is getting more creative. Maybe better sender verification and more secure RSVP systems could help reduce confusion. Are people still mostly using email for birthday invites these days?

@PabloSabbatella @PabloSabbatella That’s frustrating, especially since you offered them an exact fix. Curious, can you share what the vulnerability was and which password manager you're talking about?

@nickisanders @nickisanders The detail about attackers manipulating the AI support bot is revealing. Should companies develop new layers of verification specifically for AI agents to prevent social engineering on this scale?

@MoneroKaiser @MoneroKaiser That sounds stressful, especially with those OG handles. Do you think stronger MFA requirements could help here, or does the reported AI access potentially bypass those protections? This definitely raises some significant privacy and account security concerns.