Topic
Field covering security of cloud-hosted identity and access management services, such as Microsoft Entra ID, a shared, vendor-operated trust layer.
Microsoft says kits backed by YAM Store's illicit Microsoft and Google environments supported over one billion phishing emails and SMS messages since January. Storm-3119 obtains tenants by compromise or by creating fraudulent organizations.
Reality
Microsoft says Storm-3168 used a compromised service principal to delete Azure storage accounts, a Key Vault and an App Service plan in about seven minutes. The deletions ran on roles it already held, so role scope and locks had to exist before the credentials leaked.
Reality
Consent phishing, the most common OAuth entry point according to SC World, leaves a victim tenant three audit events and no app registration record. Registration monitoring misses it, so the hunt moves to consent and delegated-grant operations in the defender's own logs.
Reality
A seller using the name TheHatman is offering employee directory exports from nine named enterprises. Hudson Rock ties the theft to infostealer credentials, not a compromise of the provider.
Perspective Coverage
5 publishersReality
Two months of AWS audit logs from 125 environments went through UMAP and HDBSCAN to group more than 40,000 identities by what they actually did, and the classification rules that fell out run in plain SQL.
Reality
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
CVE-2026-69836 scored 10.0 and allowed unauthenticated remote code execution against Microsoft's identity service, and because the fix landed server-side, no customer ever had a version to check or a window to schedule.
Reality
Microsoft says CVE-2026-69836 is fully mitigated and needs no customer action. It has not said who exploited it, when it started, or how many tenants were touched.
Reality