Loading story…
Security researchers disclosed "BillGate", a set of exposure scenarios in Microsoft Dataverse and Microsoft Power Pages that can leave sensitive tenant and customer data accessible through default or overly permissive configurations. In Dataverse default environments, researchers found that guest B2B accounts in a tenant could query the standard Web API and read the systemusers table because those environments cannot be restricted with a security group, exposing Entra ID user details to external guest users.
The research also found that Power Pages sites can expose entire Dataverse tables over HTTPS when table permissions grant global read access to Anonymous Users or Authenticated Users and the Web API or OData feed is enabled. Researchers said some portals still allowed access to the Entra login endpoint even when the sign-in button was hidden, enabling guest users to authenticate and retrieve records as authenticated users. Reported impact includes bulk disclosure of customer PII, documents, support tickets, portal account identities, and in some cases portal password hashes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
On August 14, 2026, Starknex published security research describing two related exposure scenarios in Microsoft Dataverse and Microsoft Power Pages. The research said guest B2B users could read Dataverse systemusers data in default environments and that misconfigured Power Pages permissions plus Web API or OData exposure could allow bulk retrieval of Dataverse tables, including sensitive records.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat reporting says the **ExfilSquad** group has been targeting misconfigured **Microsoft Power Pages** portals to access data exposed through the platform’s built-in Web API. Power Pages uses the `/_api` route to perform create, read, update, and delete operations against **Microsoft Dataverse** tables, and Microsoft documents that access is governed by per-table enablement, field-level controls, table permissions, column permissions, web roles, and CSRF protections. If those controls are improperly configured, portal data can become accessible in ways administrators did not intend. Microsoft’s documentation shows that the API is designed for portal user experiences and requires explicit configuration for each table and field, including use of the correct `EntitySetName` in requests. The guidance also notes that unsupported tables are blocked and that missing mandatory field settings can produce the error **"No fields defined for this entity"**, underscoring how heavily security depends on correct setup. The reported activity highlights a familiar cloud risk: attackers are abusing exposed functionality rather than a newly disclosed software flaw, making Power Pages permission reviews and API exposure checks a priority for defenders.
Aug 3, 2026
**ExfilSquad**, a newly identified data extortion group, has leaked **382.64 GB** of uncompressed data containing roughly **27 million records** from **13 organizations** after claiming a total of 15 victims. The group surfaced on the dark web in late July and initially posted victim names without proof before releasing sample datasets and later full archives. Reported victims include **Microsoft**, **Allstate**, **Frontier Airlines**, the **City of Houston**, the **City of Atlanta**, and multiple education and public-sector entities. Threat intelligence from Fortra indicates the activity was most likely enabled by **misconfigured Microsoft Power Pages** portals that exposed **Microsoft Dataverse** data through the `/_api/` interface, rather than a flaw in Dynamics 365 itself. Researchers identified more than **10,000** potentially exposed Power Pages instances, and said the **Power Pwn** tool was likely used to automate discovery. The group reportedly used infrastructure including IP address `209.99.188.199`, the anonymous file-sharing domain `u.pone.rs`, and a consistent archive naming pattern of `[victim]_exfilsquad.7z` for leaked data.
Aug 18, 2026
Microsoft published multiple security advisories covering **information disclosure** issues across Azure services, Windows components, and Power Automate Desktop. The disclosures include `CVE-2026-23661`, `CVE-2026-23662`, and `CVE-2026-23664` affecting **Azure IoT Explorer**; `CVE-2026-21524` affecting **Azure Data Explorer**; `CVE-2026-25186` affecting **Windows Accessibility Infrastructure (`ATBroker.exe`)**; and an earlier advisory, `CVE-2023-35625`, affecting **Azure Machine Learning Compute Instance for SDK Users**. Microsoft also listed `CVE-2026-26121` as a **spoofing** vulnerability in Azure IoT Explorer, indicating that the Azure IoT Explorer issues extend beyond data exposure alone. The most detailed advisory, **`CVE-2026-40374`**, describes an **Important** information disclosure flaw in **Microsoft Power Automate Desktop** with a **CVSS 3.1 score of 6.5**. Microsoft said a logging issue could cause values stored in variables marked as **Sensitive** to appear in execution logs uploaded to the Power Automate portal, where they may be visible to users with **Owner, Co-Owner, or Runner** permissions for the affected desktop flow. The company assessed exploitation as **less likely**, said the issue was **not publicly disclosed or exploited** at publication, and stated that an official fix is available.
Jun 29, 2026