Entra ID

2026-07-0110 minHuntresshigh

Huntress demonstrated that a standard Microsoft 365 user with no admin privileges can be escalated to Global Administrator in under six minutes by exploiting common identity misconfigurations — specifically, an over-privileged service account owning an enterprise application, lack of MFA enforcement, and standard users being permitted to access the Azure portal. Analysis of 12,000+ M365 tenants revealed that over 60% were missing at least half of recommended security controls, with MFA gaps, over-privileged accounts, and admin restriction failures being the most prevalent issues. The article argues that continuous, automated identity posture management is essential because configuration drift creates exploitable windows far shorter than the 24-hour scan cycles of traditional tools.

2026-06-195 minElastic Security Labsmedium

Microsoft has introduced customer-accessible logging for the legacy Azure AD Graph API (graph.windows.net), closing a significant visibility gap historically abused by adversary enumeration tools like ROADrecon and AADInternals. Defenders can now ingest AzureADGraphActivityLogs into their SIEM to detect bulk directory reconnaissance, suspicious user agents, and internal API misuse.

2026-05-266 minElastic Security Labscritical

Tycoon 2FA is a prolific Phishing-as-a-Service (PhaaS) platform utilizing Adversary-in-the-Middle (AiTM) techniques to bypass MFA and steal session tokens across Microsoft 365 and Google Workspace. The kit employs sophisticated evasion tactics, automated post-compromise reconnaissance, and establishes durable persistence mechanisms, such as Device-PRT in Entra ID, which survive standard session revocation procedures.

2026-05-225 minPalo Alto Networkshigh

ROADtools is an open-source Python framework designed for Entra ID exploration that has been co-opted by nation-state threat actors like APT29 and APT33. Attackers leverage its modules to conduct extensive directory reconnaissance, register rogue devices for persistence, and manipulate OAuth tokens to bypass interactive authentication controls such as MFA. Detection relies on identifying anomalous Microsoft Graph API queries, unusual user-agent strings, and default device registration artifacts.

2026-05-134 minVaroniscritical

Varonis Threat Labs identified a Remote Code Execution (RCE) vulnerability in Azure Cosmos for PostgreSQL caused by improper input validation of the loglineprefix parameter within the Azure management API. By utilizing form feed and newline characters, attackers could bypass single-quote restrictions to inject arbitrary PostgreSQL configurations, such as archive_command, ultimately leading to arbitrary OS command execution on the underlying managed database node.

2026-05-135 minVaronismedium

A nuance in the Entra ID Resource Owner Password Credentials (ROPC) protocol allows attackers with compromised credentials to authenticate against a permissive external tenant, generating a 'Sign-in: Success' log in the victim's home tenant. While this cross-tenant authentication does not grant access to the victim's data, it effectively poisons UEBA models and floods the SOC with false positive alerts, creating significant operational disruption and compromising log integrity.

2026-05-134 minHuntresshigh

Huntress details the operational benefits of unifying EDR and ITDR to combat infostealers and rapid credential abuse. A highlighted incident demonstrates a ClickFix social engineering attack leveraging WebDAV and rundll32.exe to execute a remote payload, which was mitigated by automatically isolating the host and revoking associated Microsoft 365 identity sessions.

2026-05-135 minHuntresshigh

The rapid adoption of AI agents like OpenClaw has introduced a new identity threat surface in Microsoft cloud environments. These applications are often granted sweeping tenant-wide permissions, effectively acting as highly privileged service principals that bypass traditional endpoint defenses and could allow attackers to inherit administrative control if the agent is compromised.