tag: Cloud-Identity · 3 items
- Engineer — Plan: Device code phishing abuses the OAuth device authorization grant, which many cloud tenants leave unrestricted by default; audit Conditional Access policies in Entra ID to block or scope device code flow to legitimate managed devices only.
- SOC/IR — Act: Active named campaign targeting U.S. organizations via device code auth abuse — hunt for anomalous device code authentication events in Entra ID/M365 sign-in logs (filter on ‘DeviceCode’ grant type) and flag suspicious OAuth token issuances since at least early October 2026.
- Leader — Learn: This campaign highlights that modern account takeover can succeed through legitimate auth flows rather than credential theft, making it harder to detect via traditional controls; useful framing for risk conversations but no immediate leadership action required absent a confirmed breach at a dependent vendor.
- Engineer — Plan: TeamFiltration targets M365 tenants using default/weak credentials; audit your tenant for accounts lacking MFA and enforce Conditional Access policies requiring phishing-resistant auth before this campaign broadens its target geography.
- SOC/IR — Act: Active M365 credential-spray campaign is live and compromising accounts; hunt for TeamFiltration enumeration patterns in Azure AD sign-in logs and flag clusters of authentication attempts originating from AWS EC2 CIDR ranges with mixed failure/success ratios.
- Leader — Learn: Seven-account compromise across 28 tenants is low scale and currently regional (Chilean retail/finance), but the default-password attack path is a useful data point for board-level conversations about basic credential hygiene and MFA adoption metrics.
- Engineer — Learn: Demonstrates that passkey-themed social engineering can bypass MFA assumptions — worth factoring into how passkey enrollment flows and conditional access policies are hardened, but no CVE or patch action follows from this disclosure.
- SOC/IR — Plan: The active campaign pattern — CEO-impersonation lures leading to passkey/cloud credential harvesting — is worth building detections around: hunt for anomalous passkey registration events in Entra ID and tune email-gateway rules for third-party-relayed CEO impersonation at volume.
- Leader — Learn: Useful context that passkey adoption does not eliminate cloud account takeover risk; informs future board or customer messaging about layered identity controls, but no vendor breach or regulatory trigger here.