Microsoft-Entra on CuraSec

TheHatman Claims Mass Credential Theft from Microsoft Entra Tenants

Wed, 19 Aug 2026 11:36:35 +0000

Engineer — Plan: Organizations running Microsoft Entra are directly in scope for this credential theft campaign; review MFA coverage and conditional access policies, audit Entra sign-in logs for anomalous authentication, and apply Unit 42’s hardening guidance this sprint.
SOC/IR — Act: An active claimed credential-theft campaign targeting Entra tenants creates an immediate hunt requirement — sweep Entra/M365 sign-in logs for impossible travel, anomalous service principal usage, and bulk authentication failures since mid-August when the campaign surfaced.
Leader — Act: If the organization uses Microsoft Entra, direct the security team this week to confirm whether anomalous authentication activity is present and request a status brief; prepare talking points for leadership in case credential exposure is confirmed.

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Plan: Device code flow phishing is a real and growing vector for M365/Azure tenants; audit Conditional Access policies to block or restrict device code flow for user accounts that don’t require it, and enforce compliant-device requirements where the flow must remain enabled.
SOC/IR — Plan: Build or tune detections on Entra ID sign-in logs for device code authorization events originating from unexpected locations or apps; also hunt for refresh token reuse anomalies that may indicate post-phishing lateral movement within M365.
Leader — Learn: A named actor targeting US M365 tenants via Microsoft’s own authentication UI is useful context for the risk register and customer security questionnaire responses, but no confirmed breaches or near-term regulatory deadlines make this a monitor-and-track item rather than an executive action.

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: At least two active threat actors are exploiting this Entra ID gap, but there’s no patch—the exposure is architectural. Audit your Entra OAuth app registrations and conditional access policies, and restrict which OAuth clients are permitted for interactive and non-interactive flows.
SOC/IR — Act: This technique deliberately suppresses successful sign-in events, creating a blind spot in standard Entra telemetry; shift detection to Entra audit logs for anomalous OAuth client IDs and non-standard token-request patterns, and run a retrospective hunt across the past 90 days of OAuth activity.
Leader — Plan: Credential-validation activity against your Entra tenant may be occurring without triggering existing alerts; ask your security team to assess current detection coverage for OAuth-based evasion and confirm whether identity monitoring logs are capturing the necessary audit events.