A CVSS 10.0 in the identity control plane. Three Russian APT clusters weaponizing the OAuth consent screen. Phishing payloads delivered through Slack DMs instead of email. Today’s brief is a case study in how the identity layer has become the primary attack surface — and why controls built for the perimeter do not translate.

In the News

Microsoft Patches CVSS 10.0 Entra ID RCE Exploited in the Wild

Microsoft disclosed and patched CVE-2026-69836, a maximum-severity remote code execution vulnerability in Entra ID — the cloud-based identity platform that anchors authentication and authorization for millions of Microsoft 365 tenants. The flaw was exploited in the wild before the cloud-side fix was deployed.

Microsoft states no customer action is required because the patch was applied server-side. That framing is accurate for remediation but incomplete for incident response. Any RCE in the identity control plane puts token-signing infrastructure, conditional access policies, and directory replication in scope. Organizations that rely on Entra ID as their primary IdP should review sign-in and audit logs for anomalous token issuance, unexpected application registrations, and privilege escalation events during the exploitation window.

The broader lesson: when your identity provider is the zero-day target, “no customer action required” means the vendor patched the infrastructure — it does not mean no attacker exploited it before the fix landed. ITDR capabilities that monitor identity-layer behavior independently of the IdP are the detection layer that closes this gap.

What defenders should do: Review Entra ID sign-in logs and unified audit logs for anomalous activity during the exploitation window. Audit service principal and application registrations created in the past 30 days. Confirm phishing-resistant MFA enforcement across all privileged accounts.

Source: BleepingComputer

Russian APTs Abuse Google OAuth and WhatsApp Device Linking for Persistent Access

Three Russian-aligned threat clusters — tracked as UNC6293, UNC7005, and UNC5976 — are using legitimate OAuth consent flows and WhatsApp device-linking features to maintain persistent access to high-value targets in defense, academia, and government across the EU and US. The tradecraft is notable for what it avoids: no credential theft, no malware delivery, no malicious attachments.

Instead, victims are social-engineered into completing real Google Sign-In authorization flows, granting attackers long-lived OAuth tokens with mail-read and drive-access scopes. WhatsApp device linking provides a parallel persistent channel. Because the authorization happens through legitimate identity provider screens, email gateway detection does not trigger — the phishing payload is the consent screen itself.

The defensive gap is OAuth app governance. Organizations that cannot enumerate which third-party applications have consent grants to user accounts in their tenant cannot detect this attack class. Consent-grant monitoring, automated revocation policies for high-risk scopes, and ZTNA enforcement that restricts OAuth redirect domains are the primary controls.

What defenders should do: Audit OAuth consent grants across Google Workspace and Microsoft 365 tenants. Implement policies that require admin approval for high-privilege scopes (mail.read, drive.readonly). Monitor for OAuth token use from unexpected geolocations.

Source: The Hacker News

Identity Phishing Moves Inside Slack, Teams, and ServiceNow

Palo Alto’s Unit 42 published research documenting a shift in identity phishing tactics: attackers are delivering credential-harvesting links directly through collaboration platforms — Slack DMs, Microsoft Teams messages, and ServiceNow tickets — bypassing email security infrastructure entirely.

The attack surface is the implicit trust users place in internal communication channels. A credential-harvesting link in a Slack DM from what appears to be an internal account does not trigger the same suspicion as an external email. Most organizations have invested heavily in email security (secure email gateways, DMARC, link rewriting) but have zero equivalent detection for URLs delivered through collaboration tools.

This is a measurable gap. If your organization cannot inspect URLs inside Slack, Teams, or ServiceNow for credential-harvesting indicators, phishing has a clean path that avoids every email-focused control.

What defenders should do: Deploy CASB or SSE with inline inspection of collaboration-platform traffic. Implement ITDR that detects credential use anomalies regardless of the phishing delivery channel. Educate users that internal channels are not inherently trustworthy.

Source: Unit 42

Today’s Deep Dive — ChainDrop and the Collapse of Secret-Exposure-to-Abuse Time

GitGuardian detailed ChainDrop, an npm worm that represents a qualitative shift in non-human identity (NHI) theft. The worm embeds malicious hooks into AI coding assistants — specifically Claude Code and VS Code extensions — that trigger on every git checkout operation. On execution, the hooks harvest API keys, OAuth tokens, SSH keys, and cloud credentials from the developer’s environment and exfiltrate them to attacker-controlled infrastructure.

The critical metric is time. Traditional secrets-in-code exposure follows a pattern: a secret is committed, a scanning tool detects it (minutes to hours later), and a response team rotates it (hours to days later). ChainDrop collapses this to near-zero. The credential is stolen at build time, and AI agent hooks enable automated abuse before any human-driven response can execute. This is MITRE ATT&CK T1528 (Steal Application Access Token) and T1059.006 (Command and Scripting Interpreter: Python) executed at machine speed.

The arrayref Rust crate compromise reported this week follows the same pattern: a maintainer account was compromised, a malicious build was pushed to a crate with 245 million monthly downloads, and the infostealer payload targeted developer SSH keys and cloud tokens. Two separate supply-chain attacks in the same week, both targeting NHI credentials in developer toolchains.

The defensive response requires secrets scanning that operates at commit time (pre-push hooks), runtime credential monitoring in CI/CD pipelines, and NHI lifecycle management that enforces automatic rotation and least-privilege scoping for every service account, API key, and OAuth token in the development environment. A secret that cannot be abused because it expired 60 seconds after issuance is a secret that ChainDrop cannot weaponize.

Source: GitGuardian | BleepingComputer

Defender Action Items

  • Entra ID (CVE-2026-69836): Review sign-in and unified audit logs for anomalous token issuance, unexpected app registrations, and privilege escalation events during the exploitation window. Audit all service principals created in the last 30 days.
  • OAuth consent grants: Enumerate all third-party OAuth applications with consent grants in Google Workspace and Microsoft 365. Revoke grants with high-privilege scopes (mail.read, drive.readonly, files.readwrite) that were not explicitly approved by IT.
  • Collaboration platform phishing: Verify whether your SSE or CASB solution inspects URLs inside Slack, Teams, and ServiceNow. If not, this is an unmonitored phishing channel.
  • NHI credential rotation: Audit API keys, OAuth tokens, and service account credentials in CI/CD pipelines for age and scope. Implement automatic rotation with a maximum lifetime of 24 hours for high-privilege NHI credentials.
  • GitLab (CVE-2026-19478): Patch GitLab CE/EE immediately — unauthenticated code injection is actively exploited and leads directly to CI/CD secrets harvest.

Detection Queries

Detect anomalous OAuth consent grants in Microsoft 365 — a key indicator for the Russian APT OAuth abuse campaign documented this week:

1index=o365 sourcetype="o365:management:activity" Operation="Consent to application"
2| eval risk_scope=if(match(ModifiedProperties{}.NewValue, "(Mail\.Read|Files\.ReadWrite|Directory\.Read)"), "HIGH", "LOW")
3| where risk_scope="HIGH"
4| stats count by UserId, AppId, ResultStatus, ClientIP
5| where count > 0
6| sort -count

This query surfaces consent-grant events for high-privilege OAuth scopes in Microsoft 365 audit logs. False positive rate is low in environments that require admin approval for app consent — any hit in a restricted tenant is worth investigating. In permissive tenants, filter by AppId against your approved application inventory.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) — Human, machine, and AI identity security — NHI, ITDR, and the IAM market.