The “Accidental” Breach: How a Misconfigured Endpoint Led to a Major SharePoint Data Leak

A Trend Micro investigation details a malware-less data exfiltration where exposed Spring Boot Actuator endpoints revealed a SharePoint service account and a spreadsheet with Azure AD client secrets enabled attackers to use the Resource Owner Password Credentials flow to obtain access tokens and download sensitive SharePoint documents; recommendations include restricting Actuator access, auditing plaintext secrets, and disabling ROPC.