Trend Micro Research : Investigations

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA 2026-03-18 at 12:35 By Not every cloud breach starts with malware or a zero-day. In this incident, attackers discovered an exposed Spring Boot Actuator endpoint, harvested credentials from leaked configuration data, then used the OAuth2 Resource Owner Password Credentials (ROPC) flow to […]

From Misconfigured Spring Boot Actuator to SharePoint Exfiltration: How Stolen Credentials Bypass MFA Read More »

An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps

An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via ‘Cracked’ Apps 2025-09-04 at 22:22 By Trend™ Research analyzed a campaign distributing Atomic macOS Stealer (AMOS), a malware family targeting macOS users. Attackers disguise the malware as “cracked” versions of legitimate apps, luring users into installation. This article is an excerpt from Trend Micro