IdentityBriefing
TopicsIdentity AttacksAI & Agent IdentityAuthenticationStandards & RegulationVendor MovesCommunity & Events
Topic

Identity Attacks

Campaigns, breaches and techniques aimed at credentials, enrolment and access. Analysis of how enterprise identity systems are actually attacked, for practitioners.

  1. identity attacks

    Microsoft fixes a CVSS 10.0 Entra ID flaw, and nobody has to do anything

    A maximum-severity deserialization bug that could have meant remote code execution, patched on the service side before customers ever saw an action item.

  2. identity attacks · authentication

    Attackers are going after the password reset, not the password

    A critical Keycloak flaw, a Kerberos attack called ResetNightmare and a wave of helpdesk social engineering all point at the same gap: recovery is weaker than the login it replaces.

  3. identity attacks

    A security company got socially engineered and published exactly what happened

    A ReliaQuest employee entered their password on a fake SSO page and approved the MFA push. What stopped the attacker was everything sitting behind the login.

  4. identity attacks

    Mirage2FA does not beat your MFA. It waits until you have used it.

    A phishing-as-a-service platform linked to more than 4,500 organisation domains is stealing Microsoft 365 sessions after authentication succeeds.

  5. identity attacks · authentication

    Three Black Hat papers broke passkey deployments. None of them broke passkeys.

    Pass-the-Passkey, Pass-Ta-Key and a Windows Hello abuse technique all reached privileged access without ever touching a private key.

  6. identity attacks · authentication

    Entra ID makes passkeys the default. Attackers went for enrolment first.

    Microsoft flips the default in September 2026. Okta has already documented a threat actor phoning users through a fake enrolment flow.

  7. identity attacks

    Microsoft maps three ShinyHunters paths into Salesforce

    Vishing into a malicious connected app, stolen vendor OAuth tokens, and misconfigured guest access. No Salesforce flaw required.

  8. identity attacks

    Attackers are spoofing OAuth client IDs to test stolen Entra credentials

    Hostile authentication made to look like traffic from a legitimate application, spread across fictional apps.

  9. identity attacks

    A new group called Helix is using vishing and MFA abuse to empty SharePoint

    Vishing, device-code phishing and MFA abuse, then it registers its own authenticator app. The second story this fortnight to start that way.

The fortnightly read for identity practitioners.

Original data from identity leaders, one proper deep dive, and the fortnight's news that actually matters. Free, every two weeks.

Read the latest issue →

You're subscribed. Read the latest issue →