Loading story…
Threat reporting says the ExfilSquad group has been targeting misconfigured Microsoft Power Pages portals to access data exposed through the platform’s built-in Web API. Power Pages uses the /_api route to perform create, read, update, and delete operations against Microsoft Dataverse tables, and Microsoft documents that access is governed by per-table enablement, field-level controls, table permissions, column permissions, web roles, and CSRF protections. If those controls are improperly configured, portal data can become accessible in ways administrators did not intend.
Microsoft’s documentation shows that the API is designed for portal user experiences and requires explicit configuration for each table and field, including use of the correct EntitySetName in requests. The guidance also notes that unsupported tables are blocked and that missing mandatory field settings can produce the error "No fields defined for this entity", underscoring how heavily security depends on correct setup. The reported activity highlights a familiar cloud risk: attackers are abusing exposed functionality rather than a newly disclosed software flaw, making Power Pages permission reviews and API exposure checks a priority for defenders.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ExfilSquad**, a newly identified data extortion group, has leaked **382.64 GB** of uncompressed data containing roughly **27 million records** from **13 organizations** after claiming a total of 15 victims. The group surfaced on the dark web in late July and initially posted victim names without proof before releasing sample datasets and later full archives. Reported victims include **Microsoft**, **Allstate**, **Frontier Airlines**, the **City of Houston**, the **City of Atlanta**, and multiple education and public-sector entities. Threat intelligence from Fortra indicates the activity was most likely enabled by **misconfigured Microsoft Power Pages** portals that exposed **Microsoft Dataverse** data through the `/_api/` interface, rather than a flaw in Dynamics 365 itself. Researchers identified more than **10,000** potentially exposed Power Pages instances, and said the **Power Pwn** tool was likely used to automate discovery. The group reportedly used infrastructure including IP address `209.99.188.199`, the anonymous file-sharing domain `u.pone.rs`, and a consistent archive naming pattern of `[victim]_exfilsquad.7z` for leaked data.
Aug 18, 2026
Security researchers disclosed **"BillGate"**, a set of exposure scenarios in **Microsoft Dataverse** and **Microsoft Power Pages** that can leave sensitive tenant and customer data accessible through default or overly permissive configurations. In Dataverse default environments, researchers found that **guest B2B accounts** in a tenant could query the standard Web API and read the `systemusers` table because those environments cannot be restricted with a security group, exposing **Entra ID user details** to external guest users. The research also found that **Power Pages** sites can expose entire Dataverse tables over HTTPS when table permissions grant global read access to **Anonymous Users** or **Authenticated Users** and the **Web API** or **OData feed** is enabled. Researchers said some portals still allowed access to the Entra login endpoint even when the sign-in button was hidden, enabling guest users to authenticate and retrieve records as authenticated users. Reported impact includes bulk disclosure of **customer PII**, documents, support tickets, portal account identities, and in some cases **portal password hashes**.
Aug 18, 2026Microsoft published security advisories for several remote code execution vulnerabilities affecting **SharePoint**, **Microsoft Edge (Chromium-based)**, **Azure Orbital Spatio**, **Azure Virtual Network Gateway**, and **Microsoft Power Pages**, including `CVE-2026-45659`, `CVE-2026-45495`, `CVE-2026-40412`, `CVE-2026-40411`, and `CVE-2026-23652`. The most detailed disclosures focused on SharePoint Server, where Microsoft described `CVE-2026-35439` and `CVE-2026-40357` as **deserialization of untrusted data** flaws that could let authenticated attackers execute arbitrary code over the network on vulnerable servers. Microsoft rated both SharePoint issues **Important** with **CVSS 8.8** and said exploitation requires valid access, with `CVE-2026-35439` requiring at least **Site Owner** privileges and `CVE-2026-40357` requiring **Site Member** permissions. The company said neither flaw had been publicly disclosed or exploited in the wild at publication and assessed exploitation as less likely, while providing fixes that also apply to both **SharePoint Server 2016** and **SharePoint Enterprise Server 2016**. Microsoft also disclosed `CVE-2026-40362`, an **Excel** heap-based buffer overflow that can lead to remote code execution if a user opens a malicious Office file; Microsoft said the Preview Pane is not an attack vector and that a patch is available.
Jul 23, 2026