ExfilSquad Targets Microsoft Power Pages with Data Theft Campaign

A recent data theft campaign by ExfilSquad has targeted organizations using Microsoft Power Pages. The attackers are taking advantage of misconfigured security settings, which give anonymous users too much access to Microsoft Dataverse records.

According to VenariX, a cybersecurity company, the group is searching the internet for Power Pages sites with incorrect permissions and stealing data without exploiting software flaws or login credentials.

The stolen information includes names, email addresses, phone numbers, customer records, and other personal or business information stored on the sites.