This Week in Identity, Issue 6

Issue 6 of This Week in Identity. Sixteen stories worth writing up, which is not normal. Here is what mattered.

In brief

Kratos, a phishing-as-a-service platform with 200 servers and 1,800 paying customers, was dismantled. It walked past MFA on every run, because it stole the session rather than the password.
Four separate authentication bypasses shipped in one week: Check Point SmartConsole, TeamCity, PTC Windchill, and AD CS via Certighost.
Cyera agreed to buy Oasis Security for about a billion dollars, the largest non-human identity deal yet.

The big story

Kratos phishing-as-a-service was taken down: 200 servers, 1,800 customers, MFA defeated every time. The scale is the story. Session-stealing phishing is no longer a capability an attacker builds, it is a subscription an attacker rents, and 1,800 customers is a market.

Why it matters: attacker-in-the-middle proxies do not break MFA, they make it irrelevant. The victim completes a genuine login, the genuine factor is satisfied, and the proxy keeps the resulting session cookie. Every control that evaluates the authentication event has already passed by the time the theft happens. Two things actually help: phishing-resistant credentials bound to the real origin, which will not produce an assertion for a proxy, and token binding so a stolen cookie is useless off the device that earned it. Source: Kratos takedown.

Patch this week

Check Point SmartConsole: unauthenticated attackers receive full administrator tokens. Post.
TeamCity: every on-premises server is vulnerable to a bypass in the agent polling protocol. Post.
PTC Windchill: Cl0p-linked affiliates chain an unauthenticated RCE with no login step at all. Post.
AD CS (Certighost): any domain user can forge a Domain Controller certificate. This is the ESC template abuse family, and it needs no CVE to work. Post.

The pattern

Four bypasses in one week, and none of them required a credential. That is the defining property of the class: an authentication bypass converts "attacker must obtain a secret" into "attacker must reach the port." Internet exposure becomes the entire control surface, which is why the 24,650 exposed management interfaces leaking password hashes before login is the same story as the other four.

What else happened

A Zimbra XSS zero-day let a Russian espionage group read mailboxes and steal 2FA codes for months. Post.
Chick-fil-A's second credential stuffing breach in three years hit 13,322 loyalty accounts. Credential stuffing is a reused-password problem, and a repeat says the control did not change after the first one. Post.
Insurance phishing kits now relay OTPs live rather than harvesting passwords. OTP relay is standard kit now. Post.
ShinyHunters claimed an Ernst & Young breach starting with a third party's stolen credentials. Post.
The MCP spec shipped enterprise-managed authorization and hardened its OAuth profile, which matters as agents accumulate credentials. Post.
NHI Hound, a new open-source tool, maps the trust paths dormant service accounts leave into your identity provider. Post.
Cyera agreed to buy Oasis Security for roughly a billion dollars, and Saviynt launched Zuma as ARR passed 300 million. Both on the M&A hub.

New from Start with Identity

The /compare section expanded to 69 comparisons across 18 categories, grouped by pillar rather than alphabetically, with FAQ structured data. Start at /compare/.
The identity M&A hub launched at /acquisitions/, cross-checked against every vendor profile so ownership claims cannot drift.
The news pipeline was rebuilt: a candidate queue with invariant checks, tested scoring helpers, and a quality gate in CI that blocks thin posts.

From the community

Sixteen stories in a week is why the digest exists. If we missed something, the contact form reaches an editor.

That's Issue 6. Subscribe for the next one.