The fortnightly read for identity practitioners.
Clear breakdowns of the standards, tools and threats shaping the industry.
Views and interviews from identity practitioners doing the work.
What vendors are launching, what is changing and what is actually worth paying attention to.
THIS NEWSLETTER IS POWERED BY CLUTCH
This fortnight’s biggest Identity story started with a compromised credential belonging to ConnectWise Cloud Backup and got quite a bit worse as more information came out.
ConnectWise Cloud Backup, formerly SkyKick, is used by MSPs to back up Microsoft 365 environments. To do that, the application normally has fairly broad access to things like mailboxes, OneDrive, SharePoint, Teams and directory data across every tenant where it is installed.
Huntress says one of those application credentials was compromised and then used to get Microsoft Graph tokens across 173 partner and customer tenants.
The part that stood out to me was how little the attacker needed to do after that. They did not need to compromise 173 different users, get through MFA 173 times or find a separate vulnerability inside every company. They had one vendor credential for an application all of those customers had already trusted.
There was also no normal user sign-in for somebody to notice. The activity moved through tenants only a few seconds apart and in sorted order, which suggests the attacker was working through a prepared list automatically.
It did not necessarily end with the original application either. In at least one partner tenant, Huntress found another ConnectWise application assigning itself Global Administrator and adding credentials to two other trusted applications.
That made responding quite a bit more difficult. Disabling the original application may stop it getting new tokens, but it does not remove credentials already added somewhere else, and existing tokens can keep working until they expire.
Microsoft then published its own investigation and attributed the campaign to Storm-0940, which it describes as a China-state aligned actor. It says the group used an open-source agentic AI penetration testing framework called ARTEX to speed the campaign up.
Following the ConnectWise compromise, the actor attempted to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts a minute.
The AI part is obviously interesting, especially after the agent-driven attacks we covered last issue, but it is not really the main story for me. It made the campaign faster, while the compromised vendor credential and the access already sitting behind it made the attack possible.
So the thing I would be checking this week is how many third-party applications currently have broad consent inside your Microsoft 365 tenant. Do you know what each one can access and who would be responsible for disabling it if the vendor was breached? More importantly, if you disabled the original application, are you sure you would have removed every other path the attacker had created?
Off the back of this, Microsoft is recommending that organisations review service principal sign-ins, unexpected application credential changes, privileged role assignments and Microsoft Graph activity going back to at least 15 October.
ConnectWise has reset accounts and credentials and started restoring its services. It says there is currently no indication that the backup archives themselves were compromised, although customers still need to check what happened inside their own Microsoft 365 tenants.
Join one of Australia’s biggest Identity events with speakers from brands such as Rio Tinto, Telstra, Unisuper, Commonwealth Bank, Great Southern Bank, Melbourne Airport and so many more.
Registration is complimentary for Identity Briefing subscribers using the link below.
After spending the last few issues looking at Passkey attacks, poor implementations and recovery problems, FIDO has published some numbers showing how quickly adoption is still moving.
It estimates there are now seven billion Passkeys in use around the world. Its new Passkey Index, based on data from 15 major consumer services, also found that 36% of successful sign-ins now use a Passkey.
That is up from 26% in last year’s Index, although FIDO says the companies taking part were not exactly the same. Even with that caveat, more than one in three successful sign-ins using a Passkey is a pretty big shift.
The number I found more useful though was the gap between somebody having a Passkey and actually using it.
Around 38% of active accounts covered by the research had a Passkey enrolled, while 36% of successful sign-ins used one. Last year that gap was eight percentage points. This year it is only two.
People who create a Passkey are now much more likely to actually use it, although eight of the ten companies that supplied both figures still had more Passkeys enrolled than used.
A lot of that probably comes down to what the login page puts in front of people. If the password or OTP box is still the first and easiest option, plenty of users are going to keep choosing it even when a Passkey is already sitting on the account.
Passkey sign-ins also succeeded 93% of the time, compared with 78% for passwords and traditional MFA. They were 2.8 times faster as well, and all eight companies that measured phishing reported fewer successful attacks after deploying them.
Amazon also announced that more than 500 million customers have now enabled Passkeys on their accounts. Amazon says signing in with one is six times faster than using a password.
We have spent quite a lot of time looking at what can still go wrong around Passkeys, including enrolment attacks, bad implementations, compromised devices and poor recovery. Those problems do not appear to be slowing adoption down very much.
The 36% figure is probably the headline number, but the gap between enrolment and use is the one I would keep watching. If it keeps shrinking, people are not just creating Passkeys. They are actually choosing to use them.
Unit 42 says the Qilin and INC ransomware groups are exploiting CVE-2026-0257, an authentication bypass affecting PAN-OS GlobalProtect. The attackers can establish a VPN session without going through the normal MFA process and then move further into the network.
In one incident, they reached vCenter, disabled security controls on the ESXi hosts and dumped credentials from a domain controller’s virtual disk. They did not beat MFA in the normal sense. They found a way into the environment that avoided it completely.
Workday is acquiring C1.ai, formerly ConductorOne, to add access governance for employees and AI Agents. It makes a fair bit of sense when Workday already knows when somebody joins, changes jobs or leaves.
IonQ buying Elisity for up to $1.3 billion is more surprising. IonQ is best known for quantum computing, while Elisity provides Identity-based Zero Trust across users, devices, workloads and AI Agents. Very different companies, but both announced Identity deals in the same fortnight.
The GhostAction campaign reportedly compromised around 1,900 GitHub accounts and affected more than 30,000 repositories by abusing the device authorisation process. Somebody could complete what looked like a normal login while actually giving the attacker access to their GitHub account.
LiteLLM had a separate supply chain compromise this fortnight, with a malicious version used to distribute a credential stealer and backdoor through PyPI packages and Docker images. Different attacks, but both came back to somebody getting control of a developer account or the process used to publish software.
The US Department of Justice announced charges and searches connected to North Korean remote IT worker schemes affecting more than 70 American companies. Authorities searched more than 40 known or suspected laptop farms and seized around 187 devices.
The alleged workers used stolen or fabricated identities to get remote jobs, while facilitators inside the US received company laptops and made them appear local. It is an extreme example, but a company can follow its normal provisioning steps and still give credentials and devices to the wrong person.
The OpenID Foundation’s Australian Digital Trust Community Group has responded to the Federal Government’s latest privacy reform consultation. It raises questions around business-specific identifiers, biometric checks that stay on somebody’s device and credentials that only share one piece of information.
It also asks who is responsible when a Digital Identity transaction involves several organisations. This is the fourth Australian policy submission we have seen from the OpenID Foundation since August, and the questions are becoming much more specific.
Identity at the Center released episode #453 with Eve Maler on treating Identity like a product, including how companies might control access from AI Agents they do not own.
Episode #455 with Mike Small from KuppingerCole looks at CNAPP and the cloud Identity problem, with a lot of it coming back to permissions, credentials and service identities.
SailPoint Navigate comes to Sydney on 4–5 November 2026, with speakers joining from Rio Tinto, Telstra, UniSuper, Commonwealth Bank, Great Southern Bank, Melbourne Airport and plenty more.
It is one of the bigger Identity events in Australia, and registration is complimentary for Identity Briefing subscribers using the link below.
The Gartner Identity & Access Management Summit takes place from 7–9 December in Las Vegas.
Our full Identity World 2027 calendar is also live across Sydney, Melbourne, New York, London and San Francisco. The events cover IAM, PAM, Digital Identity, machine Identity and AI Agents, with most sessions led by practitioners sharing what they are actually doing.
One thing I keep seeing come up is Windows Hello taking priority over a synced Passkey when somebody signs in to Microsoft 365. Is that what you expected to happen, and is it actually what you want?
If you are dealing with this now, I would be interested to hear how you are approaching it.
Get in touch at danny@clutchgroup.co.
Identity Briefing is published fortnightly by Clutch Group, which runs the Identity Leaders Network, Identity Briefing and the Identity World events series.
Know someone who should be reading it? Forward this on.
The Identity Leaders Network is a free, global and vendor-neutral identity community.
The group comes together for virtual roundtable discussions, peer-matching meetings, dinners and through the community WhatsApp channel.
The fortnightly read for identity practitioners.
Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.
You're subscribed. Read the latest issue →