Top all-time · #7827
Eye Research
Company blog · research.eye.securitysecurity
Eye Research is the company blog at research.eye.security, writing about security. Since 2025, 9 different Hacker News readers have linked it 13 times, most often “ToolShell Mass Exploitation (CVE-2025-53770)”. It is still writing: the last post was on 2026-10-29, and you can follow it by feed.
Too few sampled comments (2) to say how often HN recommends it.?
Why HN links it
HN readers link Eye Research for security write-ups, including its ToolShell SharePoint mass exploitation analysis and its Entra ID research on obtaining global admin. Comments cite these posts as references.
Summarised by Claude from a sample of 2 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Cyber incidents, malware, threat intel and vulnerabilities.
Most-linked posts?
- ToolShell Mass Exploitation (CVE-2025-53770)3 people · 3 mentions · first linked 2025-07-20
- Abusing Entra OAuth for fun and access to internal Microsoft applications3 people · 3 mentions · first linked 2025-08-08
- How we rooted Copilot2 people · 2 mentions · first linked 2025-07-25
What Hacker News says?
https://archive.is/LVrQQ Related: ToolShell Mass Exploitation (CVE-2025-53770) - https://research.eye.security/sharepoint-under-siege/ | https://news.ycombinator.com/item?id=44629133
Comment linking /sharepoint-under-siege/
on “Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say”Submitted Abusing Entra OAuth for fun and access to internal Microsoft applications as a story · 356 points
HN discussionYou could get into Microsoft's tenant with any Entra account. That's because Microsoft's own fucking developers don't even understand how Entra authentication/authorization works, and that in some/most scenarios you'll need to check if a account is actually authorized to enter a protected resource post-login (which you need to do within the Oauth login flow in the resource being accessed, nobody will do it for you).…
Comment linking /consent-and-compromise/
on “One Token to rule them all – Obtaining Global Admin in every Entra ID tenant”Submitted How we rooted Copilot as a story · 350 points
HN discussionSubmitted ToolShell Mass Exploitation (CVE-2025-53770) as a story · 9 points
HN discussionSubmitted Device Code Phishing Forensics: What We Learned Investigating BEC in the Wild as a story · 2 points
HN discussionSubmitted Consent and Compromise as a story · 2 points
HN discussionSubmitted ToolShell Mass Exploitation (CVE-2025-53770) as a story · 2 points
HN discussionSubmitted Cooldown or compromise: the three-day rule for NPM and PyPI as a story · 1 points
HN discussionSubmitted How AI is powering business email compromise at scale as a story · 1 points
HN discussionSubmitted Log Poisoning in OpenClaw as a story · 1 points
HN discussionSubmitted When Updates Backfire: RCE in Windows Update Health Tools as a story · 1 points
HN discussionSubmitted How We Rooted Copilot as a story · 1 points
HN discussion
