Oauth on CuraSec

Greatness PhaaS Adds Device Code Phishing to Bypass MFA

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Plan: Device code flow abuse bypasses MFA by design; audit your identity provider (Entra ID, Okta) and restrict or disable the OAuth Device Authorization Grant for users/apps that don’t require it — block or conditional-policy-gate this flow this quarter.
SOC/IR — Plan: No IOCs provided, but Greatness PhaaS commoditizing device code phishing signals growing campaign volume; build detections in Entra/Okta logs for unexpected device code authorization requests, particularly outside normal device-enrollment windows.
Leader — Learn: MFA bypass techniques are now packaged in commercial crimeware toolkits, eroding the assurance value of standard MFA — useful context for risk register updates and for evaluating phishing-resistant auth (FIDO2/passkeys) as a strategic control.

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: At least two active threat actors are exploiting this Entra ID gap, but there’s no patch—the exposure is architectural. Audit your Entra OAuth app registrations and conditional access policies, and restrict which OAuth clients are permitted for interactive and non-interactive flows.
SOC/IR — Act: This technique deliberately suppresses successful sign-in events, creating a blind spot in standard Entra telemetry; shift detection to Entra audit logs for anomalous OAuth client IDs and non-standard token-request patterns, and run a retrospective hunt across the past 90 days of OAuth activity.
Leader — Plan: Credential-validation activity against your Entra tenant may be occurring without triggering existing alerts; ask your security team to assess current detection coverage for OAuth-based evasion and confirm whether identity monitoring logs are capturing the necessary audit events.

Wed, 15 Jul 2026 12:11:39 +0000

Engineer — Plan: RabbitMQ is widely deployed as enterprise messaging infrastructure; these access control flaws — OAuth client secret leakage and cross-tenant queue metadata exposure — represent real risk for teams running it in multi-tenant or OAuth-integrated configurations. No active exploitation or PoC reported, but identify affected versions and schedule patching once a fix is available.
SOC/IR — Learn: No IOCs, no reported exploitation, and no actionable detection surface in this disclosure; file for context in case RabbitMQ compromise indicators surface later, but no hunt or detection work is warranted now.
Leader — Skip