Phishing-resistant authentication was supposed to end credential theft. This week, Microsoft disclosed a campaign that proves the enrollment process itself is the new target - and that post-authentication behavioral monitoring is the control most organizations still have not deployed. Meanwhile, workload identity trust in Kubernetes took a hit, and a Cisco management plane flaw is under active exploitation by ransomware operators.

In the News

Passkey-Themed Social Engineering Compromises Entra ID with MFA Persistence

Microsoft’s security team disclosed an active campaign running since May 2026 that weaponizes the passkey enrollment experience itself. Attackers send phishing emails that direct victims to convincing passkey registration pages. When users interact with the fake enrollment flow, attackers capture session tokens and immediately register their own authentication methods - passkeys, FIDO2 keys, or authenticator apps - on the compromised account.

The kill chain is precise and repeatable: identity compromise through social engineering of the enrollment flow, MFA persistence through registering attacker-controlled auth methods, reconnaissance through Microsoft Graph API calls, and data exfiltration from SharePoint, OneDrive, and Exchange. The attackers do not need to bypass MFA at the login stage - they hijack the enrollment stage instead.

This finding changes the passkey conversation. Phishing-resistant authentication is still the right primary control, but it is incomplete without identity threat detection and response (ITDR) monitoring for anomalous authentication method registration events. Conditional access policies should restrict where and how new passkeys or authenticator apps can be registered - ideally limited to managed, compliant devices through device-bound registration flows.

What defenders should do: Monitor Entra ID audit logs for StrongAuthenticationPhoneAppDetail and StrongAuthenticationMethod registration events from unusual locations or devices. Enforce conditional access policies requiring compliant/managed devices for authentication method registration. Deploy ITDR that baselines and alerts on authentication method changes per user. MITRE ATT&CK: T1556.006 – Modify Authentication Process: Multi-Factor Authentication.

Russia-Linked Spies Used Claude in Espionage Operations Against 20+ Governments

Anthropic disclosed that it detected and disrupted Russia-linked espionage actors using Claude to assist hacking operations targeting diplomatic and defense entities across more than 20 governments. The actors used Claude for operational tasks within their intrusion workflow - making this the fourth publicly confirmed case of AI tools being used in real cyber operations and the first involving state-sponsored actors weaponizing a commercial AI agent.

The incident fits a pattern that has accelerated through 2026: AI tools are no longer theoretical risks or productivity aids alone. They are becoming components of the attack surface and of adversary tradecraft. Session tokens, API keys, and OAuth grants that connect AI tools to organizational data are the identity artifacts attackers target.

What defenders should do: Inventory all AI tool integrations, their OAuth grants, and the scope of data they can access. Implement session token lifecycle controls - short-lived tokens, device-bound sessions, and revocation on anomalous behavior. Monitor for unusual AI tool usage patterns that deviate from baseline. MITRE ATT&CK: T1550.001 – Use Alternate Authentication Material: Application Access Token.

SPIFFE/SPIRE Identity Spoofing Enables Lateral Movement After K8s Node Compromise

Palo Alto Unit 42 published research demonstrating that root access on a compromised Kubernetes node allows attackers to spoof SPIFFE workload identities by abusing SPIRE metadata. SPIFFE (Secure Production Identity Framework for Everyone) is the dominant standard for zero-trust workload identity in service mesh environments. SPIRE is its reference implementation.

The attack path: once an attacker achieves root on a K8s node, they can access the SPIRE agent’s Unix domain socket, request SVIDs (SPIFFE Verifiable Identity Documents) for any workload scheduled on that node, and impersonate co-located services. This is a post-exploitation non-human identity abuse pattern - the node compromise is the prerequisite, and SPIFFE/SPIRE’s trust-the-node attestation model is the enabler.

The implication for identity practitioners is significant. SPIFFE/SPIRE identity attestation without runtime node integrity verification creates a lateral movement path that bypasses service mesh mutual TLS entirely. Microsegmentation that does not rely solely on SPIFFE identity assertions is the compensating control.

What defenders should do: Deploy runtime node integrity attestation alongside SPIFFE/SPIRE - do not rely on node attestation alone. Enforce microsegmentation policies that validate workload identity independently of SPIRE-issued SVIDs. Monitor for anomalous SVID issuance patterns per node. MITRE ATT&CK: T1550.001 – Use Alternate Authentication Material: Application Access Token.

Cisco FMC Auth Bypass Under Active Exploitation by Ransomware and State Actors

Cisco Talos disclosed that CVE-2026-20079 (CVSS 10), an authentication bypass in Cisco Secure Firewall Management Center (FMC), is under active exploitation by three separate threat clusters - including Qilin ransomware operators and state-sponsored attackers. The attackers chain CVE-2026-20079 with CVE-2026-20316 (CVSS 5.3) to elevate privileges, harvest credentials, and deploy ransomware.

FMC is the management plane for Cisco’s entire NGFW fleet. Compromise of FMC gives attackers visibility into firewall rules, VPN configurations, and credential stores - it is the crown jewel of the network security stack. A hotfix is available and should be applied immediately. In the interim, restrict FMC management interface access to hardened jump hosts via network access control.

What defenders should do: Apply the Cisco FMC hotfix for CVE-2026-20079 and CVE-2026-20316 immediately. Restrict management plane access to authorized admin workstations via ACLs or network access control. Audit FMC admin accounts for anomalous authentication events. Review Talos threat intelligence for published IOCs.

Defender Action Items

  • Passkey enrollment governance: Enforce conditional access policies in Entra ID (or equivalent IdP) requiring managed/compliant devices for any authentication method registration. Alert on StrongAuthenticationMethod changes from unusual locations.
  • AI identity inventory: Catalog all AI tool integrations, their OAuth scopes, and token lifetimes. Implement short-lived, device-bound session tokens for AI tools. Revoke tokens on behavioral anomalies.
  • SPIFFE/SPIRE hardening: Supplement node attestation with runtime integrity checks. Enforce microsegmentation policies independent of SPIRE-issued identity documents. Monitor SVID issuance rates per node.
  • Cisco FMC patching: Apply the hotfix for CVE-2026-20079 and CVE-2026-20316 immediately. Restrict management interface access. Audit admin authentication logs against Talos IOCs.
  • LiteLLM/AI gateway audit: If running LiteLLM or similar AI gateways, verify that default API keys (sk-1234) have been rotated. Remove internet exposure from AI gateway management interfaces.

Detection Queries

Detect anomalous authentication method registration in Entra ID - the behavioral signal Microsoft described in the passkey social engineering campaign. This KQL query surfaces new MFA method registrations from atypical locations or devices.

AuditLogs
| where OperationName in ("User registered security info", "User registered all required security info")
| extend TargetUser = tostring(TargetResources[0].userPrincipalName)
| extend Location = tostring(LocationDetails.city)
| extend DeviceCompliant = tostring(DeviceDetail.isCompliant)
| where DeviceCompliant != "true"
| summarize RegistrationCount = count(), Locations = make_set(Location) by TargetUser, bin(TimeGenerated, 1h)
| where RegistrationCount >= 1
| order by TimeGenerated desc

This query flags any security info registration event from a non-compliant device. Expect low false positive rates in environments that enforce device compliance for auth method registration - any hit outside that policy is worth investigating. Tune by adding known admin locations or service accounts to an exclusion list.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.