This Week in Identity

A LiteLLM admin key deleted in May but never revoked led to a poisoned release in October, Storm-0940 turned consented ConnectWise app identities on 2,250 Microsoft 365 tenants, Gheist dumped GitHub secrets through Actions logs, and Arctic Wolf counted 400-plus fake help desk chats on Teams.

A BeyondTrust Remote Support zero-day handed a China-nexus group the whole credential vault, Ivanti Connect Secure attackers went straight for Active Directory, a FortiOS implant decides which VPN sessions get checked, and FIDO's Passkey Index puts passkeys at 36% of sign-ins.

Shai-Hulud reaches an AI sandbox SDK with a wiper that fires when you revoke the stolen token, npm trusted publishing trusted reclaimable repository names, Denmark's national register was emptied through one company's search account, and Workday moves to buy C1.ai.

An exploited NetScaler SAML flaw sends September's patchers back for a second upgrade, the FBI ties its ShinyHunters breach to a contractor's missed patch, fake AI ad portals relay MFA codes live, and NIST publishes machine-readable conformance criteria for SP 800-63-4.

America.gov launches with Login.gov named as its sign-in, a spraying campaign against 5,700 accounts gets in only through service accounts on default passwords, and GitLab's issue email address turns out to be a token that commits code as you.

Microsoft sets the date SMS codes stop in Entra ID and gives global admins the longest runway, CrowdSec loses 170 repositories through a leaver account kept open on purpose, and a Cisco ISE CVSS 10 is exploited before the patch.

The UK offers passkeys to 23 million people, attackers start phoning employees about their passkeys, and Okta finds 1,843 live session tokens in one infostealer dump. Plus a fourth N-central hotfix and Qilin landing through Cisco FMC.

A phishing kit starts disabling WebAuthn in the browser to force a downgrade, JetBrains is breached through an unpatched copy of its own TeamCity, and a FreeIPA chain lets an anonymous client write itself a Kerberos identity.

WebAuthn Level 3 becomes a W3C Recommendation, infostealers start draining Claude subscriptions with stolen cookies, and a service sells 153 million driver's licences taken from an identity verification vendor.

A CVSS 10.0 Entra ID flaw that Microsoft first marked exploited and then unmarked, a Keycloak reset that skips the email token entirely, and Mirage2FA reaching 4,500 organizations by stealing sessions instead of breaking MFA.

Active Directory had a bad week: KerberLoss twins an SPN with invisible Unicode and ResetNightmare resets a Domain Admin from a low-privilege account. Plus a SharePoint PoC that turned into exploitation in 48 hours.

Black Hat week. Three passkey attacks that leave the cryptography alone, two CVSS 10.0 flaws, a GitHub issue reaching CI secrets, and GhostSplice driving coding agents to exfiltrate by splitting the instruction.

Two AI agents used stolen credentials this week, one of them Anthropic's own during a botched security test. Plus OWAReaper surviving credential rotation, Okta buying Permiso, and device code phishing at 25 kits.

The busiest week of the summer: a phishing-as-a-service takedown with 1,800 customers, four authentication bypasses, Certighost forging Domain Controller certificates, and Cyera buying Oasis for a billion dollars.

Google puts FIDO2 keys into Windows login days after Entra makes passkeys default, ransomware affiliates adopt a patched PAN-OS bypass as a front door, and a two-finger gesture sent SMS from a locked Android phone.

Microsoft makes passkeys the Entra default and retires SMS in 2027, and in the same week attackers phish the passkey enrollment flow. Plus a SharePoint JWT bypass and six months of AWS GovCloud keys in a public repo.

OAuth consent phishing gets a name and a kit, SailPoint closes its Entro deal, and EMVCo drafts one credential standard so merchants stop building per-wallet integrations.

Digital identity goes national: the EU's wallet deadline closes in, India's data-protection rules set their clock, and we publish a directory of 86 national eID schemes across 51 countries.

World Passkey Day puts a number on adoption: an estimated 5 billion passkeys in active use. Plus RSA brings passwordless to Linux, and a FIDO and HID study finds enterprise confidence outruns operational reality.