🧰 Microsoft Entra ID

The items that name it 46

• AI, Scripts, Operator: Inside the ConnectWise Attack
  writeupas affected products2026-10-26It is written here as Microsoft Entra ID (sign-in logs, directory audit logs, service principals, OAuth applications).

  sign-in logs, directory audit logs, service principals, OAuth applications

• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooks
  writeupas tools2026-10-23It is written here as Microsoft Entra ID: revoking user access and sessions.
• China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
  articleas classification.technologies2026-10-23
• The Current Landscape of OAuth Attacks
  articleas classification.technologies2026-10-22
• Unboxing Phishing Kits: Huntress Examines 3 Real Kits
  articleas classification.technologies2026-10-22
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
  articleas affected products2026-10-22It is written here as Microsoft Entra ID (password spraying, sign-in probing).

  password spraying, sign-in probing

• M365 Token Spray and Replay Campaign Compromises Business Email Accounts
  writeupas affected products2026-10-22It is written here as Microsoft Entra ID (Entra-joined devices, Device Registration Service).

  Entra-joined devices, Device Registration Service

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeupas classification.technologies2026-10-21
• Microsoft Targets Rogue AI Agents With Dynamic Permissions, Risk Scoring
  articleas classification.technologies2026-10-20
• ConnectWise Suspends Cloud Services in Response to Cyberattack
  articleas classification.technologies2026-10-19
• Microsoft Threat Intelligence (@MsftSecIntel) on X
  advisoryas classification.technologies2026-10-17
• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
  writeupas classification.technologies2026-10-16
• [tl;dr sec] #350 - Reverse Engineer Anything, Tracking AI-integrated Malware, Test-driving Jev
  articleas affected products2026-10-15
• The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime
  articleas classification.technologies2026-10-14
• Python Hub (@PythonHub) on X
  toolas classification.technologies2026-10-02
• OAuth Token Theft Through Microsoft's Front Door | Huntress
  writeupas affected products2026-09-23It is written here as Microsoft Entra ID (Azure AD).

  Live tenant with MFA enabled and default security configuration used for end-to-end testing; token issuance and sign-in logs affected

• ThreatIntel-Aggregator
  repoas tools2026-09-17

  SSO authentication with per-user, role-based access (Entra mode)

• Architecting a secure landing zone in the AWS European Sovereign Cloud
  articleas classification.technologies2026-09-16
• Pass-the-Passkey Family of Attacks
  writeupas affected products2026-09-16

  Historically failed to enforce core WebAuthn anti-replay protections (challenge reuse, session binding, signature counters), letting captured assertions impersonate privileged cloud identities.

• Passkey-themed social engineering leads to identity and cloud compromise
  writeupas affected products2026-09-09It is written here as Microsoft Entra ID (Azure Active Directory).

  Identity platform targeted for authentication method/MFA persistence abuse, workload logged as AzureActiveDirectory.

• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  advisoryas affected products2026-09-08
• Managing identity source transition for AWS IAM Identity Center
  writeupas affected products2026-09-02It is written here as Microsoft Entra ID (Azure AD).

  Azure AD

• Inside Knight Office, a New M365 AiTM Phishing Kit
  writeupas affected products2026-09-02

  Threat actor enrolled an unauthorized host and completed a rogue, attacker-controlled device registration

• Next-Gen Phishing Tactics Users Aren’t Ready For | Huntress
  articleas affected products2026-08-28It is written here as Microsoft Entra ID (Azure AD).

  Primary target of ConsentFix OAuth consent phishing technique

• What Good Identity Hardening Looks Like
  articleas classification.technologies2026-08-25
• [tl;dr sec] #342 - Figma's Agentic Detection, Agent Identity, Uber's Agent-(E)DR
  articleas affected products2026-08-20
• How to Spot and Stop Rogue Device Joins
  writeupas affected products2026-08-18

  Device Registration Service (DRS) abused to register rogue devices using a victim's identity, bypassing Conditional Access policies requiring joined devices

• Orca Security: AI Agents Security
  articleas affected products2026-08-14

  Agent identity as a special service principal without its own credentials; a separate blueprint object holds credentials and acquires tokens; issues user tokens with split subject and actor fields; sponsor field records the accountable human

• UNC6671 Rebrands: Multi-Brand Vishing Extortion Targets Financial Services and Enterprise Cloud Environments
  articleas affected products2026-08-06
• Orca Security: AI Threat Detection
  articleas classification.technologies2026-07-30
• CosmosEscape: Taking Over Every Database in Azure Cosmos DB
  writeupas affected products2026-07-30

  Stores data in Cosmos DB, potentially accessible via the vulnerability

• How the LSHIY Password-Spraying Attack Abuses OAuth’s ROPC Grant
  articleas classification.technologies2026-07-22
• Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
  articleas classification.technologies2026-07-09
• Orca Security: ITDR for the Cloud
  articleas affected products2026-07-03
• XORCISM-AI/XORCISM
  repoas tools2026-07-01

  Identity provider connector pulling users, service principals, managed identities and devices via Microsoft Graph API

• No (Bad) CAP: Inside an Ongoing LSHIY Password Spray Attack
  writeupas classification.technologies2026-06-30
• We Need to Talk About Device Code Phishing
  articleas classification.technologies2026-06-22
• Secret Scanning Dev Workstations with bagel + Fleet
  writeupas classification.technologies2026-06-04
• How EvilTokens Turbocharges Old School Phishing with AI
  articleas classification.technologies2026-05-11
• OpenClaw, Rogue Agents, and Application Hygiene
  writeupas affected products2026-04-01It is written here as Microsoft Entra ID (Azure AD tenants).

  Directory service where OpenClaw/Moltbot service principals are registered and granted permissions such as Directory.ReadWrite.All.

• Threat Actors Abuse Railway.com PaaS as Microsoft 365 Token Attack Infrastructure
  writeupas affected products2026-03-23

  OAuth device authorization flow abused to obtain persistent access/refresh tokens; P1 required for Conditional Access Policy mitigation

• Deobfuscating Files for Flags: Huntress CTF 2025 Retro
  articleas classification.technologies2025-11-06
• Unpacking the AAD Broker LocalState Cache
  writeupas classification.technologies2025-09-30
• Using KQL to Detect Gaps in your Conditional Access Strategy
  writeupas classification.technologies2025-03-23
• 6 Months of Researching OAuth Application Attacks | Huntress
  writeupas classification.technologies2025-02-10
• Azure Batch Misused for Crypto Mining
  writeupas classification.technologies2024-03-15