A zero-day on an OAuth authorization server. An AI-powered phishing service that stole 12,000 Microsoft tokens. A rogue MFA provider that intercepts passwords during legitimate logins. And the first fully autonomous AI command-and-control malware. Today’s identity threat landscape covers every lane - from infrastructure vulnerabilities to AI-augmented attacks to the trust model of authentication itself.

In the News

F5 BIG-IP APM Zero-Day Gives Attackers RCE on OAuth Servers

CVE-2026-94127 is a CVSS 9.8 zero-day in F5 BIG-IP Access Policy Manager that allows unauthenticated remote code execution on systems configured as OAuth authorization servers. The vulnerability is being exploited in the wild. F5 released emergency hotfixes on September 22.

The identity implications are severe. BIG-IP APM is not a peripheral network device in this configuration - it is the system that issues OAuth tokens for SSO, OIDC, and federated authentication flows. Unauthenticated RCE on the token issuer means an attacker can compromise the entire trust chain: forge tokens, intercept credentials, or pivot to any application relying on that OAuth server for authentication decisions.

Any organization using BIG-IP APM as an OAuth authorization server should treat this as a P1 patch. If immediate patching is not possible, take the OAuth configuration offline and redirect authentication to a secondary provider. Monitor for anomalous token issuance patterns - tokens issued outside normal hours, from unexpected source IPs, or with unusual scope grants are high-fidelity indicators of compromise.

What defenders should do: Apply F5 emergency hotfixes immediately. Audit all OAuth tokens issued by affected APM instances in the last 30 days. Implement ITDR monitoring for token-issuance anomalies on identity infrastructure, not just endpoints.

Microsoft Disrupts EvilTokens - AI-Powered Device-Code Phishing Hit 12,000 Accounts

Microsoft’s Digital Crimes Unit took down EvilTokens on September 22, dismantling a phishing-as-a-service platform that automated device-code OAuth flows to steal Microsoft tokens at scale. The operation compromised over 12,000 Microsoft accounts across approximately 10,000 organizations. Two individuals were arrested in the United Kingdom.

Device-code phishing is particularly effective because the user completes a legitimate authentication - including MFA - on the attacker’s behalf. The attacker initiates a device-code flow, sends the code to the victim via a crafted lure, and the victim authenticates normally. The resulting token goes to the attacker. Traditional MFA (push notifications, TOTP, SMS) does nothing to prevent this because the authentication is genuine. EvilTokens added AI to the equation: automated lure generation, inbox analysis to identify high-value targets, and prioritization of accounts with access to sensitive resources.

The takeaway is not that device-code flows should be disabled (they have legitimate uses for headless devices). The takeaway is that phishing-resistant passwordless authentication - FIDO2 - is the only authentication method that structurally prevents this class of attack, because the cryptographic assertion is bound to the origin and device. Push-based MFA is not sufficient.

What defenders should do: Implement phishing-resistant passwordless authentication (FIDO2) for all accounts. Apply conditional access policies that restrict device-code flows to managed devices or block them entirely where not needed. Monitor for unusual device-code flow requests in identity logs (MITRE ATT&CK: T1078.004 - Cloud Accounts).

Rogue External MFA Providers Can Harvest Passwords During Microsoft Logins

Researchers disclosed an attack vector where a threat actor with compromised administrator privileges can register a malicious external MFA provider in Microsoft Entra. Once registered, the rogue provider intercepts user passwords during legitimate authentication flows - every user who logs in has their credentials exposed to the attacker-controlled service.

This is an identity supply-chain attack that uses the trust relationship between Entra and external authentication methods as a persistence mechanism. The attack requires prior admin compromise, which limits initial access. But as a persistence technique, it is potent: the rogue provider sits silently in the authentication pipeline, harvesting credentials at scale without triggering traditional credential-theft detections.

There is no patch. Microsoft can detect anomalous provider registrations, but the defensive burden falls on organizations to monitor for unexpected changes to their authentication method configurations. This is an ITDR gap - most identity-threat-detection tooling focuses on user behavior anomalies, not on configuration changes to the identity provider itself.

What defenders should do: Monitor Entra audit logs for new external MFA provider registrations and authentication method changes. Restrict who can modify authentication methods using Privileged Identity Management with just-in-time approval. Implement ITDR that covers identity-provider configuration drift.

Talos Unveils CLOSEDQUORUM - First Fully Autonomous AI C2 Malware

Cisco Talos disclosed CLOSEDQUORUM, a Windows malware that uses four AI models - Gemini, DeepSeek, Qwen, and Mistral - to autonomously decide post-compromise actions without human operator involvement. This is the first reported fully autonomous AI command-and-control implant. The developer has been linked to carding forums active since 2025, though CLOSEDQUORUM has not yet been confirmed in active campaigns.

The identity implications are forward-looking but real. When malware uses AI agents to make lateral-movement and exfiltration decisions autonomously, the “threat actor” is effectively a non-human identity - an AI agent operating with the compromised user’s credentials and permissions. Traditional IOC-based detection fails because the AI generates novel behavior patterns dynamically. Behavioral identity analytics - profiling what an identity does against an established baseline - becomes the primary detection method.

What defenders should do: This is not a patch-now situation, but it is a strategic planning signal. Invest in behavioral identity analytics and ITDR that can detect deviations from established identity baselines regardless of whether the deviation matches a known attack pattern.

Defender Action Items

  • Apply F5 BIG-IP APM hotfix for CVE-2026-94127 immediately - all OAuth authorization server configurations are vulnerable to unauthenticated RCE
  • Apply Check Point Security Management Server patch for CVE-2026-93616 - exploited since July 23
  • Patch on-prem VeloCloud Orchestrator for CVE-2026-93952 (CVSS 10.0) - unauthenticated privilege escalation on certificate-based Edge auth configurations
  • Upgrade Bifrost AI Gateway to v2.1.0 for CVE-2026-90898 if deployed
  • Implement phishing-resistant passwordless authentication (FIDO2) - device-code phishing bypasses all traditional MFA methods
  • Restrict device-code OAuth flows via conditional access policies to managed devices only
  • Monitor Entra audit logs for new external MFA provider registrations and authentication method modifications
  • Audit GitHub App private keys for rotation - GitGuardian found 10% of leaked keys still valid, some with org-admin privileges

Detection Queries

Detect anomalous device-code OAuth flow requests in Microsoft Entra sign-in logs - high volume of device-code authentications from a single IP or targeting multiple accounts is a strong indicator of device-code phishing campaigns like EvilTokens.

index=azure sourcetype="azure:aad:signin" properties.authenticationProtocol="deviceCode"
| stats count dc(properties.userPrincipalName) as unique_users values(properties.userPrincipalName) as users by properties.ipAddress
| where count > 10 OR unique_users > 3
| sort -count

Monitor for new external authentication method registrations in Entra - rogue MFA provider registrations appear as admin-initiated changes to authentication methods.

AuditLogs
| where OperationName has_any ("Add authentication method", "Register external authentication provider", "Update authentication method")
| where InitiatedBy.user.userPrincipalName != ""
| project TimeGenerated, OperationName, InitiatedBy.user.userPrincipalName, TargetResources
| sort by TimeGenerated desc

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.