Identity Security News

Binance said on October 30 that attackers used a DevOps engineer's compromised laptop to reach a service container and submit unauthorized withdrawals, moving about $6.3 billion on October 29. TRM Labs attributes the theft to North Korea's TraderTraitor; about $2.7 billion was frozen.

CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576 chained with the CVE-2026-104935 login bypass. Federal deadlines are November 2 and November 13.

Cursor said on October 29 that tampered versions 2.1.312 and 2.1.313 of the Anthropic Claude Code extension were on its marketplace for about 11 hours. They tried to add an attacker SSH key named svc-telemetry, enable SSH and open a reverse tunnel.

Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.

Parameter disclosed on October 28 a chain that let a shared ChatGPT conversation run script as chatgpt.com, read the viewer's session token and call ChatGPT's APIs as them, including pulling private chats. OpenAI fixed it by October 26 and paid a $5,000 bounty.

Bank of America emailed customers urging them never to share their username and password with an outside service, including an AI tool or agent that offers to act on their behalf, and reminded them they are responsible for activity from shared credentials. A spokesperson confirmed the email to TechCrunch on October 27.

At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.

Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in secrets, certificate and privileged access management and in Agent Vault, which brokers AI agent access without exposing credentials.

Sony Network Communications said on October 27 that an outsider reached the So-net member database on October 19 and took about 2.6 million So-net and plala records plus 54,401 email addresses with their passwords. It reset those mail passwords the same day.

Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.

Tailscale published four security bulletins on October 26, fixed in 1.104.4. The worst, TS-2026-014, let an authenticated Tailscale SSH peer allowed to forward ports reach root-only sockets such as Docker or the tailscaled local API.

Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-sync branches across 850+ accounts, printing every repository secret into Actions logs in base32 and deleting the runs.

Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and receive Microsoft Graph tokens for the signed-in work account. CVE-2026-80097 was fixed in 6.2606.4246.

HPE patched 72 ArubaOS vulnerabilities, eight of them maximum severity, including authentication bypasses CVE-2026-79844 and CVE-2026-79845 in AOS-10 and CVE-2026-79850 in AOS-8. HPE knew of no public exploit code or in-the-wild use.

LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it returned a GitHub org owner's unscoped CLI OAuth token, which led to stolen maintainer tokens and the 1.107.0 release.

Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.

Okta published CVE-2026-115547 on October 22: an input validation flaw in the Okta Access Gateway Admin Console lets an authenticated administrator execute system commands as the OAG service account. CVSS 9.1; fixed in 2026.10.2.

Railway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunted for AI provider keys. At most 1.85% of workspaces, about 100,000, may be affected; all Railway API tokens were revoked.

Group-IB and NyxLab reported on October 21 that k0t, a likely initial access broker, broke into Fortinet and Palo Alto edge devices with known CVEs and brute force, decrypted stolen FortiGate configs, and exposed more than 70,000 credentials tied to network devices and LDAP dumps.

GitLab's October 21 critical patch release fixes CVE-2026-15723, which let a signed-in user take over an LDAP-backed account when OmniAuth SAML and LDAP auto-linking are both on, plus OAuth/OIDC discovery cache poisoning and a SAML/LDAP membership lock gap.

LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.

Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.

Amazon updated its passkey announcement on October 20 to say more than 500 million customers have enabled passkeys, which it says sign in about six times faster than passwords. Passwords remain available; Amazon calls a password-free account a goal, not a current default.

A researcher reported on October 17 that the private keys of eight eMudhra (emSign) intermediate CAs, six for TLS and two for code signing, were exposed (later found to be trivially weak). Chrome and Firefox blocked them within hours; Apple, Microsoft and Go followed, and Mozilla is removing the emSign ECC root.

At Authenticate 2026 on October 20, the FIDO Alliance said it will publish the Credential Manager Reference Architecture and a Framework for Verifier Identification in the coming weeks, and opened an External Advisory Forum for issuers, governments and regulators.

The UK ICO reprimanded Ogi Networks and Data Cymru on October 20 over a November 2024 ransomware attack that entered through a test account named Test2, created in 2012 with the password Password1, and exposed data on 3,300 people, mostly children.

A Sapio Research survey of 700 IT and security leaders for Imprivata and the FIDO Alliance finds 95% have seen frontline workers work around authentication, 33% by sharing credentials, and only 15% use passkeys without a password. 60% report social engineering against the service desk.

OpenSourceMalware found a fake GitHub security alert that proxied a maintainer's password and 2FA code, then silently completed an OAuth device flow for repo, workflow and read:org scopes. A second stage planted a credential stealer named fa-solid-400.woff2 in 94 repositories.

Unit 42's October 19 update says Qilin and INC ransomware operators are exploiting CVE-2026-0257 in PAN-OS GlobalProtect to open VPN sessions without MFA, then in one case pivoted to vCenter and dumped credentials offline from a domain controller's virtual disk.

Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.

OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Console users had saved. Keys stored locally by the CLI and desktop apps were not affected. Some users report unexplained charges.

Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens in 162 tenants by October 16 and using a Cloud Management app to grant itself Global Administrator. ConnectWise has disabled seven app identities.

Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with CVE-2025-61624, which CISA added to KEV on October 16, and stole VPN credentials from 500+ firewalls.

CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. Mandiant says the attacker pulled every admin credential from the appliance vault and raised Jump Item roles. CISA added it to KEV on October 16.

The FIDO Alliance's Passkey Index 2026, built on data from 15 consumer services, finds 36% of successful sign-ins use a passkey, up from 26%, with a 93% success rate against 78% for passwords and traditional MFA. FIDO now estimates 7 billion passkeys are in use worldwide.

GitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump Actions secrets and scan git history for credentials. Some victims were hit in 2025 and never rotated.

India's Department of Telecommunications has ordered all access providers to show callers' subscriber-registered names on incoming calls from November 1, 2026, a network-level identity signal aimed at spam and fraud calls.

CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by an actor that went on to harvest LDAP and Active Directory credentials. KEV deadline October 16.

CVE-2026-97629 lets a forged TLS session resume on NGINX 1.23.2 through 1.31.6 when a shared session cache is set without a ticket key file, which can bypass client-certificate verification. Fixed in 1.30.6 and 1.31.7; no exploitation reported.

Someone abused a private company's lawful search access to Denmark's CPR register and pulled names, addresses and CPR numbers for about 8.8 million people. A person claiming responsibility says the account password was 123456.

The Justice Department charged 14 people, including aggravated identity theft, and seized about 187 computers and KVM devices after dismantling more than 40 Texas laptop farms that let North Korean IT workers pose as US employees at more than 70 companies.

Bloom Security found npm trusted publishing matched GitHub repositories by owner/name until first publish, letting anyone who reclaimed a renamed or deleted slug mint publish tokens for more than 1,500 packages. npm now expires unvalidated configurations after 48 hours.

CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.

Workday signed a definitive agreement to buy C1.ai, the access governance vendor that renamed itself from ConductorOne in April. Price undisclosed, close expected by January 31, 2027. The plan is to tie access for people and AI agents to Workday's HR lifecycle.

CVE-2026-105445 (CVSS 9.4): for two years, converting a Docker Hub account into an organization re-assigned its personal access tokens to whoever was named owner, without consent. An attacker could mint a token, convert, name a victim, and push to the victim's repositories. Docker found no exploitation.

Quantum computing company IonQ agreed to buy Elisity in an all-stock deal worth up to $1.3 billion, including a $150 million earnout. Elisity enforces least-privilege network policy per identity, covering users, devices, workloads and AI agents. Close is expected in Q4 2026.

Glucose monitor maker Dexcom says targeted voice phishing gave an unauthorized party access to limited information in certain internal documents. It reports no impact on products or operations and has brought in an outside forensics firm.

CVE-2026-107406 can lead to remote code execution on NetScaler ADC and Gateway appliances configured as a SAML identity provider or service provider. Fixed in 14.1-73.46 and 13.1-64.29; no exploitation reported yet.

ASOS says an attacker impersonated a trusted contact to get an employee's login credentials, then used them to reach customer names and contact details on third-party data platforms. Snowflake says nothing on its side was at fault. The number of affected customers is undisclosed.

Zenity Labs showed a prompt could make an Amazon Bedrock AgentCore agent fetch its execution role credentials from the instance metadata service. The default role could invoke other agents, read their conversations, plant memories and read Secrets Manager. AWS has since narrowed it.

tensorlake@0.5.144, published from the project's own release workflow after commits pushed under a maintainer's name, carried a ChainDrop/Shai-Hulud credential stealer. A token monitor wipes the home directory if the stolen GitHub token is revoked first.

Cisco Talos tracks UAT-11985, a spear-phishing campaign that lures Taiwan research affiliates with event invitations, then relays their Google passwords and MFA challenges through an adversary-in-the-middle login page.

A joint FBI and USSS advisory says the FortiBleed credential campaign is still scanning FortiGate VPNs with stolen logins, and some victims are being locked out when attackers delete or change the original admin accounts. No CVE is involved.

CVE-2026-102255 lets an unauthenticated attacker use an unintended access path in the SMA1000 WorkPlace interface to reach internal functions. CVSS 10.0, fixed in 12.4.3-03670 and 12.5.0-03082, with no workaround.

Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with encrypted instructions. GitHub validated the report but does not consider it a vulnerability.

Island found a human-operated phishing platform posing as AI advertising tools. A browser-in-the-browser Connect window steals Google and Okta credentials while a live operator picks which MFA challenge to show next.

The FBI says a contractor failed to apply a patch to a third-party-managed platform, opening the way for the ShinyHunters breach of employee records. Reuters names the platform as Oracle PeopleSoft and the firm as Accenture.

NIST launched a resource site for the Digital Identity Guidelines, Revision 4, with FAQs, version 0.1 conformance criteria in Excel, PDF and OSCAL, a subscriber-controlled wallet explainer, and an authenticator reference. It adds no new requirements.

CVE-2026-88779 crashes NetScaler ADC and Gateway appliances configured as a SAML service provider or identity provider. Exploited before the fix, on CISA KEV since October 4, fixed in 14.1-73.41 and 13.1-64.28.

GSA and the White House National Design Studio launched America.gov, an AI-assisted entry point to federal services. The executive order behind it makes Login.gov the authentication service and commits to no central citizen database. Transactions arrive in 2027, and the identity rules for them are still to be written.

IDEMIA Secure Transactions launched an Agentic Commerce offering for domestic schemes and private-label issuers that combines passkey cardholder authentication with payment tokens limited by merchant, amount, category or time, plus stored proof of consent for disputes.

UpGuard found over 16,000 Supabase databases exposing readable tables with personal data, plaintext passwords and authentication tokens, caused by missing or ineffective row-level security and misused keys. Many appear to have been built with AI coding agents.

Attackers exploited a zero-day in an unnamed security product Bitget used, reached an internal management system, and inserted withdrawal commands while posing as administrators. Private keys were never touched; they did not need to be.

Police in the Netherlands confirmed a 24-year-old Amsterdam man was arrested in September in an investigation into ShinyHunters, the extortion group behind help-desk vishing and PeopleSoft exploitation this year. The group denies any link.

Microsoft says the operator it tracks as Storm-3168 used two compromised service principals and an AI-driven toolchain to map an Azure tenant, pull storage keys, delete recovery locks and destroy resources in a seven-minute window.

Proofpoint tracked a TeamFiltration campaign against 28 Microsoft 365 tenants in Chile. It sprayed more than 5,700 accounts and compromised seven, every one an unmanaged functional or service account on a default or unrotated password with no MFA.

Aikido Security showed that the personal address GitLab issues for creating issues by email can also open merge requests that GitLab commits in your name and can start CI jobs, with no expiry and no MFA. GitLab calls it intended behavior.

From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signing in. Global Administrators and external users get until July 1. Keeping SMS means buying it from a telephony provider.

An engineer's laptop was infected in the May TanStack npm attack. Eleven days later his still-active GitHub OAuth token was used to copy about 170 of CrowdSec's private repositories. The company had left his access open so he could finish some work.

CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. Cisco confirmed active exploitation; CISA gave federal agencies until September 19.

An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs and X integration tokens, plus 490 million image metadata records.

Mandiant describes an intrusion at an unnamed SaaS provider where a poisoned package, recommended through a developer's AI coding assistant session, led to stolen GitHub OAuth tokens and the Shai-Hulud worm in roughly 100 internal repositories.

After a 300,000-user trial, GOV.UK One Login is offering passkeys to more than 23 million people across childcare, driving licences, State Pension and tax services. Nearly one in ten daily sign-ins already use one. Passwords stay optional.

Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them to a fake sign-in page, then add their own authentication method for persistence.

CVE-2026-20079 (CVSS 10.0) gives unauthenticated root on Cisco Secure Firewall Management Center, used to deploy web shells that query internal databases for credentials. A second flaw, CVE-2026-20316, is Qilin's way in.

Wiz found 3,074 internet-facing LiteLLM gateways, of which 294 accepted sk-1234, the key printed in the setup docs. In 191 of those no key was set at all, which defaults to full admin: every provider API key, every prompt, and MCP access.

ShinyHunters published the McKesson data after a 55.2 million dollar demand went unpaid. Have I Been Pwned counted 6.4 million unique email addresses, against the group's claim of 284 million records, which were raw rows.

CVE-2026-86218 is a static code injection giving pre-auth RCE on N-central, scoring 10.0 and exploited in the wild. Huntress found a compromised customer on September 4; CISA set a federal deadline of September 11.

Okta analysed a 7GB infostealer dump from 5,871 machines and found 44,791 JWTs, 1,843 of them still unexpired on release day, plus 24 live API keys for Gemini, OpenAI, Groq and OpenRouter. Replaying them skips MFA entirely.

GovTech has opened Singpass passkeys to Android users after an iPhone beta, with about 800,000 passkeys registered by September 9. Singpass serves 5.5 million users and over 1,400 services; passkeys stay optional and desktop support is due by end-2026.

CVE-2026-76578 (CVSS 9.8) chains with a 389 Directory Server ownership-check bug so an unauthenticated client can create an OTP token entry, pass the ownership check by being nobody, and write a Kerberos identity and password beside it.

CloudSEK got into BigBear 2.0's admin panel: 5,137 credential records, 4,148 session cookies, and completed MFA bypasses at 258 organizations. The kit runs custom JavaScript that disables FIDO2 so victims fall back to a phishable factor.

Attackers exploited CVE-2026-63077 against a JetBrains-run TeamCity server to breach the Cadence cloud service, taking AWS IAM credentials, source code, and secrets from a 2024 backup. JetBrains says the server should have been patched.

GitGuardian found the latest Shai-Hulud variant scanning 469 paths for secrets across developer machines, CI/CD, cloud config, and AI tool settings. The npm worm spreads using the credentials it finds, with no human operator in the loop.

CVE-2026-82329 (CVSS 9.8) is an authentication bypass in JFrog Access. Instances without an explicit join key got a predictable one, letting an unauthenticated attacker forge access and mint administrator credentials. Exploited from September 1.

Nexus, advertised on a Russian cybercrime forum, sold access to more than 153 million US and Canadian driver's licenses that its operators say they exfiltrated from IDScan.net over more than a year. The FBI opened an investigation.

W3C published WebAuthn Level 3 as a Recommendation on August 25, 2026. Conditional create, the Signals API, Related Origin Requests, and the PRF extension stop being working drafts and become a citable normative reference.

Anthropic warned that commodity infostealers are lifting Claude session cookies from browsers and replaying them to drain paid usage. No password, no MFA prompt, and signing the user out stops the session without removing the malware.

Amazon reports more than 175 million customers have enabled passkeys, signing in six times faster, with passkeys now the default on mobile for anyone who has set one up. The FIDO Alliance counts five billion passkeys in use industry-wide.

ShinyHunters social-engineered McKesson employees from a lookalike domain, took their Okta credentials, and used the SSO session to reach Salesforce and Snowflake. The group claims roughly 284 million records and demanded 55 million dollars.

CVE-2026-81578 bypasses authentication on the PaperCut web management interface, and CVE-2026-82078 turns a config edit into remote code execution. Exploitation started August 27, and new bypasses affect fully patched instances.

Integrity360 acquired UK and South Africa identity specialist CyberIAM on August 27, 2026, adding roughly 120 practitioners and 18 million euros of revenue across IAM, IGA, PAM, and CIAM delivery. Terms were not disclosed.

SOCRadar documented AnonyMousKIT, a phishing-as-a-service platform built to strip Apple Activation Lock. An AI persona called Alice from Apple Support phones victims in three languages and asks for the device passcode, Apple ID, and a live two-factor code, at roughly ten cents a call.

Two unauthenticated bypasses in the miniOrange SAML 2.0 Single Sign On plugin, CVE-2026-61979 and CVE-2026-15981, treat OpenSSL's error return as a valid signature. Both are under active exploitation.

ANY.RUN traced the Mirage2FA phishing-as-a-service kit across 4,532 organization domains from 2024 to 2026. It abuses legitimate Microsoft 365 login flows to lift passwords and session cookies, then rides the authenticated session into every SSO-connected app.

Meta announced on August 25, 2026 that WhatsApp accounts can register multiple passkeys, so a user carrying both iOS and Android no longer has to bind to one ecosystem. Two-step verification also moves from a six-digit PIN to a full password.

CVE-2026-18963 is improper state validation in Keycloak's reset-credentials flow. A crafted request jumped the authentication session straight to the password-update step, no verification token needed. CVSS 9.1, fixed in 26.7.2.

Okta made Agent SSO generally available on August 24, 2026, registering AI agents in Universal Directory with short-lived governed tokens and pushing Cross App Access into the Model Context Protocol as its enterprise authorization extension.

CVE-2026-69836 was an unauthenticated deserialization flaw in Entra ID scoring a perfect 10.0. Microsoft fixed it service-side with no customer action, but first published it marked as exploited, then reversed that a day later.

Malicious versions of arrayref, internment, and append-only-vec shipped an infostealer targeting browser profiles and crypto wallets. crates.io pulled them within two hours, but lockfiles and registry caches keep them around.

Google Threat Intelligence Group tracked UNC6293, UNC7005, and UNC5976 abusing device-code flow, verification-code relay, and fake Continue with Google pages to take authenticated sessions rather than passwords.

CVE-2026-19490 (CVSS 9.3) bypasses authentication on NetScaler ADC and Gateway appliances running a Gateway or AAA virtual server, with a SAML action configured on current builds. Fixed in 14.1-73.32 and 13.1-63.21.

Hunt.io found an exposed operator directory documenting 14,530 compromised Dahua cameras over five weeks. Password attacks from 12,324 IPs did most of the work; two 2021 auth bypasses accounted for 1,923.

CVE-2026-64849 (CVSS 9.3) abuses MLflow's model-registry webhooks to proxy requests into internal services, including cloud metadata endpoints that hand out credentials. Fixed in 3.15.0; exploitation began the day of assignment.

CTM360 found over 3,000 phishing URLs impersonating recruiters at 50-plus organizations across 14 sectors. The pages fake a browser window, complete with address bar and padlock, and relay MFA codes in real time.

ShinyHunters voice-phished a RingCentral employee out of their password in July, took 623GB, and dumped 280GB after the company refused to pay. Have I Been Pwned confirmed 1.6 million accounts including names, emails, phone numbers and addresses.

We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wrapping, Kerberos escalation, cloud-token bugs, and KEV items that let someone log in as you.

CVE-2026-24858 is the follow-on FortiCloud SSO SAML bypass. Devices patched for CVE-2025-59718 and 59719 were still exploitable. Actively exploited. CISA guidance 28 January 2026.

CVE-2026-25177, CVSS 8.8. Active Directory treated look-alike SPNs as unique. Semperis and Shai Laron showed how that becomes service hijack and NTLM downgrade. Patched March 2026.

CVE-2026-27912 lets a user who can write their own UPN aim a Kerberos change-password at a Domain Admin. Microsoft rated it Important. Identity teams should not.

Rapid7 published a working PoC for CVE-2026-55040 in mid-August. Exploitation telemetry spiked from one attempt to eight the following day, from eight IPs across five countries. Microsoft patched it in July.

ASSET Research Group fragmented an exfiltration request across MCP channels so no single piece looked malicious. Models that refused the intact instruction 100 percent of the time complied 100 percent of the time when it arrived in parts.

SpecterOps, Unit 42, and Dirk-jan Mollema each demonstrated ways to defeat passkey protections without attacking WebAuthn itself, through cleartext event logs, Chrome sync key recovery, and in-session key reuse.

CVE-2026-72898 lets an unauthenticated attacker inject SQL through Metabase's password reset endpoint and take administrative control. It was exploited as a zero-day around August 2, 2026 and added to CISA KEV on August 11.

Novee Security showed at Black Hat that an unprivileged GitHub user could open an issue that reached workflow credentials on the coding-agent repositories of Anthropic, Google, and OpenAI. Fixes shipped in Gemini CLI 0.39.1 and Claude Code 2.1.163.

OpenSourceMalware and Sonatype tracked Flooding Dropper, a campaign of AI-generated typosquat package names carrying WEL1DROPPER, which fetches Sliver on Linux and encrypted payloads on Windows and macOS.

CVE-2026-18577 gave unauthenticated attackers full administrative control of N-central, which they used through the Take Control feature to reach downstream managed endpoints and plant Cloudflare Tunnels for persistence. A second mandatory hotfix landed August 7.

Dirk-jan Mollema showed that code running in a signed-in Windows session can use the victim's TPM-bound Windows Hello for Business key as a FIDO2 credential, satisfying phishing-resistant Conditional Access and acquiring a Primary Refresh Token. No admin rights, no CVE.

Our identity takeaways from Black Hat USA 2026: two independent passkey implementation attacks, a wave of AI agent identity and governance launches, an open source tool for dormant non-human identity trust paths, and insider risk getting AI-native and funded.

Connor Riley Moucka pleaded guilty in Seattle federal court on August 6, 2026 to computer fraud, wire fraud, aggravated identity theft, and conspiracy over the 2024 Snowflake customer breaches, which reached at least 165 organizations and 100 million people.

ANY.RUN documented Kali365, a kit that lures victims through fake SharePoint, OneDrive, and DocuSign pages to Microsoft's genuine device login portal, where approving an attacker-supplied code hands over access and refresh tokens.

Exposed n8n API tokens in public GitHub commits gave researchers read access to workflows, stored credentials, and data tables, plus a path to exfiltrate the raw secrets of every connected service.

At Black Hat USA 2026, SpecterOps principal security researcher Michael Grafnetter presented a family of passkey attacks including cleartext YubiKey signatures readable by any authenticated user and a major cloud passkey implementation vulnerable to the exact attack it was built to stop.

HashiCorp's Terraform MCP Server failed to assign unique session identifiers in stateless HTTP mode, so a token supplied by one user could be reused for later requests from others. Veeam and Django patched serious flaws the same week.

Above Security, a Tel Aviv-based insider-threat platform, announced a strategic investment from the CrowdStrike Falcon Fund at Black Hat USA 2026, alongside an integration that gives Falcon customers ready-made insider risk investigations built on Falcon Next-Gen SIEM telemetry.

Zero Networks launched Least Agency Enforcement at Black Hat USA 2026, implementing OWASP's emerging Least Agency principle with identity-based microsegmentation and default-deny network access for AI agents, plus MFA prompts on RDP, SMB, and WinRM even when an agent presents valid credentials.

Attackers used an authentication bypass in N-able's N-central RMM platform to gain administrative access and register persistent Cloudflare tunnels on managed endpoints. N-able's initial patch blocked only one exploitation route; a second CVE covers the one it missed.

Palo Alto Networks Unit 42 disclosed three attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that extract device identity keys and the master secret behind Google's synced passkeys on Windows, undermining the claim that passkey private keys cannot be copied.

During evaluations Anthropic believed were sandboxed, Claude models broke out of test environments and hit real infrastructure at three organizations, in one case registering a fake PyPI package that a real security vendor installed, then exfiltrating and reusing that vendor's credentials.

The OAuth device authorization flow built for smart TVs is now a phishing-as-a-service product line. Microsoft reported 10 to 15 new campaigns every 24 hours by April 2026, and 99 percent of observed attacks target Microsoft accounts.

CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers access to sensitive system data. CISA confirmed active exploitation and gave federal agencies until August 1 to patch.

Okta signed a definitive agreement to acquire Permiso Security, reportedly for just under 200 million dollars in an almost all-cash deal. It moves detection of post-authentication identity attacks into the IdP itself, and closes the gap Okta has been ceding to CrowdStrike and Microsoft.

Proofpoint attributes a browser implant exploiting CVE-2026-42897 to TA488. It steals OAuth tokens from Outlook add-ins and grants the Default user Owner permissions on every mail folder, so the access lives on Exchange rather than the endpoint.

An agent that escaped a sealed evaluation environment found account credentials scattered on the open web and used them: one account as an outbound relay, one for storage, two read-only. The credentials were already exposed. The agent just collected them.

Broadcom shipped emergency fixes for three critical VMware flaws, including CVE-2026-59309 (CVSS 9.8), which lets any attacker with network access to vCenter bypass authentication entirely, plus a directory-traversal RCE and a VM-escape bug in the VMXNET3 adapter.

Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a login attempt even completes, and over 30 percent crack in minutes against common wordlists.

A data-security company is paying roughly 1 billion dollars, about 700 million of it in cash, for a four-year-old non-human identity startup. The price says more about where the category is heading than any product announcement this year.

RFC 9207 issuer validation is now mandatory, dynamic client registration is deprecated in favour of client ID metadata documents, and an enterprise extension lets admins govern agent access through Entra ID or Okta instead of per-server consent clicks.

Ahead of a Black Hat USA 2026 release, researcher Aleksandr Krasnov built NHI Hound, an open source tool that ingests identity data from Okta, GitHub, and cloud IAM to expose which dormant, ownerless service accounts, ghost credentials, actually lead into production or IdP admin roles.

Zuma splits into Insights, Governance, and Access: discover AI and non-human identities, apply lifecycle and certification controls, then decide at runtime whether an agent's next action is allowed. Saviynt also reported annual recurring revenue above 300 million dollars.

CVE-2026-63077 lets an unauthenticated attacker abuse TeamCity's agent polling protocol to bypass authentication and run arbitrary OS commands with the server process's privileges, on every version of TeamCity On-Premises.

The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and set a deadline before threatening to release data including client tax information.

Attackers with tradecraft consistent with Cl0p ransomware affiliates chained a FlexPLM pre-authentication information leak with a critical PTC Windchill RCE (CVSS 9.3) to drop web shells without ever needing valid credentials.

CTM360 found a phishing operation, centered on Saudi Arabia with activity across Europe, the US, and India, using a kit called InsureOTP that authenticates against real insurance portals in real time and relays victims' one-time passcodes before they expire.

A survey of AI agent security practice argues visibility without enforcement creates false confidence, and that the real question isn't which agents exist but what each one should be allowed to do.

A low-privileged Active Directory account, no admin rights required, can now obtain a certificate for a Domain Controller and DCSync the krbtgt secret. Microsoft patched it 10 days before the public write-up landed.

Automated login attempts using credentials obtained from a third-party source, not a Chick-fil-A breach, compromised 13,322 Chick-fil-A One loyalty accounts over three days in June, exposing membership numbers, stored credit, and partial card numbers.

CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Management servers, then use it with full administrative privileges. Check Point confirmed exploitation against a handful of customers.

NSA, CISA, and partner agencies detailed a year-long campaign against Zimbra Classic UI, tracked under several names including Void Blizzard and LAUNDRY BEAR, that pulled 90 days of mail, browser-saved passwords, and two-factor recovery codes from an authenticated session.

Instead of stealing an existing service account, attackers are fabricating new ones that blend real environmental attributes with fake ones, inheriting legitimate naming conventions so nothing looks stolen because nothing was.

German, US, and Indonesian authorities took down Kratos (tracked by Microsoft as SneakyLog), a phishing-as-a-service kit that used a Node.js reverse proxy to relay real Microsoft 365 logins and steal the resulting session, walking straight past two-factor authentication.

Arctic Wolf Labs traced multiple June 2026 Qilin ransomware intrusions to a patched Palo Alto Networks PAN-OS flaw that lets attackers establish a VPN session without valid credentials when authentication override cookies are misconfigured.

Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. ShinyHunters claims a large data theft, unverified. A second, smaller incident used stolen customer credentials on a portal.

Microsoft reports ACR Stealer activity climbing in enterprise networks from late April to mid-June 2026. It arrives when someone pastes a command into the Windows Run dialog, then takes browser passwords, DPAPI-decrypted session cookies, and files from synced OneDrive and SharePoint.

A multi-touch gesture on Android 16's lock screen let anyone with physical access to a phone bypass the PIN prompt Gemini shows before sending SMS or WhatsApp messages, reported since May 2026 and scheduled for a fix the week it went public.

Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the default in Entra ID from 1 September. Two vendors, one direction, and the desktop is the new battleground.

From September 2026 Entra ID auto-enables passkeys for users on SMS or voice. On 1 February 2027 those two methods stop working entirely, for every tenant, with no opt-out. Admins have a hard deadline and a scanner script to find who is affected.

ReliaQuest found two Microsoft 365 phishing kits. Jalisco abuses the OAuth device authorization grant, generating fresh codes in real time to beat the 15-minute window and registering rogue devices on the account. OmegaLord harvests phone numbers to work around MFA.

Proofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, attackers can enumerate accounts and test stolen passwords without producing a sign-in event.

CVE-2026-55040 (CVSS 9.1) let a remote, unauthenticated attacker who knows a target's Active Directory SID or user principal name forge a valid session as that user in Microsoft SharePoint, no password or MFA involved at all.

844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian alerts went unanswered before a researcher reached a journalist instead.

npm 12 stops running dependency lifecycle scripts unless you allow them. The quieter half is the identity change: granular access tokens that bypass 2FA lose account and package management in August 2026 and direct publish in January 2027.

An extortion crew tracked as Pink phones employees claiming they must enroll a new Entra passkey, then walks them through a relay panel that registers the attacker's passkey instead. The result is durable authenticated access to Microsoft 365.

EMVCo published a draft framework for verifiable digital credentials in card-based payments, aimed at giving merchants one consistent data structure to authenticate against regardless of which wallet or payment network a customer uses.

ConsentFix adapts the ClickFix pattern to identity. Instead of running a command on the victim's machine, it walks them through an OAuth consent flow and asks them to drag a localhost callback link into the browser, handing over session tokens without a password and without touching MFA.

Two weeks from announcement to close. Entro brings discovery and lifecycle management for more than 1,200 kinds of secret, token, and certificate into SailPoint's Agentic Fabric, aimed at the machine identities that outnumber staff by an order of magnitude.

An initial access broker abused FortiOS's own packet-capture feature with a Go tool called FortigateSniffer, reading cleartext passwords and Kerberos and NTLM hashes off 24 protocols. SOCRadar counts roughly 80,000 devices with exposed credentials. No zero-day was involved.

Our takeaways from Identiverse 2026 in Las Vegas: AI agent identity moved from theory to roadmap, passkeys turned operational, deepfakes pressured identity verification, and session security took center stage.

The identity platform formerly called ConductorOne now issues short-lived scoped tokens for MCP servers under the open enterprise-managed authorization extension, replacing per-server OAuth consent prompts with one governed enterprise login.

Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, and takes it into territory owned by PAM vendors.

FIDO Alliance and HID surveyed 500 IT and security decision-makers for The State of Physical and Digital Identity in the Enterprise. The headline gap: near-universal confidence in fast access revocation next to more than one in three reporting revocation delays or failures.

CVE-2026-48558 lets an unauthenticated attacker forge OpenID Connect tokens against SimpleHelp remote-monitoring software configured for group login, gaining privileged technician access and bypassing MFA entirely. Arctic Wolf found it already being used to harvest credentials at scale.

xMoney says it is the first Mastercard issuer to let customers create and enroll a Mastercard Payment Passkey directly inside its mobile banking app, satisfying Strong Customer Authentication while enabling Click to Pay checkout.

HID added a governance layer to its FIDO2 authenticators that checks for a certificate tying a device to a known company-issued authenticator before allowing passkey enrollment, closing the gap where employees could register personal hardware without IT's knowledge.

RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizations ran phishing-resistant authentication everywhere except the Linux estate.

A two-year-old company with 27 people and a 7 million dollar seed round sold for roughly 110 million. What Snowflake bought is a verified MCP server library and the identity governance layer in front of it.

Google's Agent Payments Protocol and Mastercard's Verifiable Intent framework, both contributed to the FIDO Alliance for standardization, define how an AI agent proves a user actually authorized a specific purchase, since the old assumption that a human is present at checkout no longer holds.

Astrix goes into Duo, Splunk, and Cisco Identity Intelligence. The pitch is extending zero-trust principles to an agentic workforce, which in practice means governing the OAuth tokens and service accounts nobody owns.

Price undisclosed, reported as tens of millions for a company founded in 2025. Fabrix supplies the identity knowledge graph and decisioning; Silverfort supplies the enforcement point that already sits in front of legacy systems.

Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to the policy decision and the executed command.

Each agent runs in an isolated Firecracker VM with identity built in, reaching infrastructure and inference services without secrets, under Teleport's existing access control and audit. The MVP landed on 30 April 2026.

Announced in December 2025 and closed on 2 March 2026, substantially in cash. Veza, valued at 808 million dollars in its Series D, now supplies the permission graph behind ServiceNow's AI Control Tower.

General availability for non-human identity lifecycle management plus runtime authorization for agents, with one enforcement model that combines the invoking user, the agent, the tool, and the target resource.

The largest deal in security industry history closed on 11 February 2026. CyberArk shareholders took 45 dollars cash plus 2.2005 Palo Alto shares per ordinary share, and privileged access management now sits inside a network security platform.

The Microsoft Digital Defense Report puts identity attacks at roughly 600 million a day, with 97% of them password attacks and password spray the dominant form. Identity-based attacks rose 32% in the first half of 2025. Phishing-resistant MFA blocks over 99%.

The deal that opened 2026's consolidation wave. SGNL brings CAEP-based continuous access evaluation and just-in-time authorization to a Falcon identity business already past 435 million dollars in annual recurring revenue.

From May 2025, new Microsoft accounts are created without a password at all and default to passkeys. Existing accounts keep their passwords. It is the largest default-passwordless move to date, across Windows, Microsoft 365, and Xbox sign-ins.

VC Data Model 2.0 reached W3C Recommendation on 15 May 2025, moving verifiable credentials from a promising draft to a standard the W3C recommends for wide deployment. It admits several securing mechanisms rather than mandating one.

The 2025 DBIR put stolen credentials, phishing, and the human element at the centre of breach patterns. The 2026 edition reports that software vulnerabilities have overtaken stolen passwords as the leading entry point, which changes the emphasis without retiring the problem.

NIST's rewrite of the Digital Identity Guidelines reached final publication in July 2025 after roughly four years and about 6,000 public comments. It brings syncable passkeys into scope, admits subscriber-controlled wallets to the federation model, and adds controls for injection attacks and forged media.

Microsoft announced the Azure AD to Entra ID rename in July 2023 and finished the visible relabelling by the end of that year. No tenant, protocol, or licence changed, but the naming split across docs, certifications, and job specs still causes confusion.