Loading story…
Researchers detailed how Microsoft nested app authentication (NAA), also called BroCI, can let an attacker who already holds a valid refresh token from a broker-capable Microsoft application exchange it for tokens to other apps and resources. The technique was shown against Azure and Entra ID workflows to retrieve Conditional Access Policy data, activate Privileged Identity Management roles, access Azure Key Vault secrets, and enumerate Intune devices by brokering requests through administrator portals. The write-up emphasized that MFA claims present in the original broker token can persist into downstream requests, potentially satisfying Conditional Access checks, and clarified that the method relies on refresh tokens, not access tokens.
A separate offensive analysis showed that VS Code Dev Tunnels can be abused for remote access by using authenticated GitHub or Azure/Entra ID tokens to enumerate tunnels, obtain connect-scoped JWTs, establish WebSocket relay sessions, and invoke MsgPack-based RPC methods for command execution and file operations on tunnel hosts. The author said credentials stored by VS Code can still be recovered by same-user processes despite Electron safeStorage, and released a Rust proof-of-concept called Ouroboros to interact with existing tunnels. Together, the research highlights how token theft, device-code phishing, and Microsoft token pivoting techniques such as FOCI/BroCI can extend access across cloud administration surfaces and developer remote-access infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
XPN InfoSec published an analysis of Microsoft Visual Studio Code Dev Tunnels, explaining how authenticated GitHub or Azure/Entra ID tokens can be used to enumerate tunnels, obtain connect-scoped JWTs, establish relay connections, and invoke RPC methods enabling remote command execution and file operations. The post also introduced a Rust proof-of-concept tool called Ouroboros and discussed persistence, lateral movement, and initial access implications.
SpecterOps published research on Microsoft nested app authentication (also called BroCI), describing how refresh tokens from broker-capable Microsoft applications can be exchanged for tokens to other applications and resources. The post detailed offensive use cases in Azure and Entra ID and clarified that the method uses refresh tokens only, not access tokens.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed two separate Microsoft Entra Conditional Access bypasses that could let attackers obtain **Microsoft Graph** access without the intended controls, including MFA in some cases. NetSPI reported that **Nested App Authentication (NAA)**, also called **BroCI**, allowed certain brokered application flows to exchange an Azure Portal refresh token for Graph access tokens without Conditional Access enforcement. The issue affected specific clients, including `ADIbizaUX` and two Microsoft Intune portal extension clients, and was primarily useful as a persistence mechanism after an attacker had already stolen an Azure Portal refresh token through methods such as phishing or adversary-in-the-middle collection. Microsoft classified that issue as medium severity and deployed a fix; post-patch testing returned `AADSTS53003` access-blocked errors for the previously successful exchanges. A separate disclosure showed that Entra policies configured for **all resources** but with at least one excluded resource could also be bypassed to obtain Graph tokens without the expected Conditional Access checks. The researcher said the gap was broader than Microsoft had publicly documented and warned that some Microsoft first-party applications appeared able to reach Entra ID data through Graph beyond the scopes visible in issued tokens, enabling tenant enumeration and potentially modification where user privileges allowed it. Microsoft later acknowledged the problem and began rolling out **baseline scope enforcement** changes, with enforcement starting June 15 and an early opt-in option available through the Entra Admin Center; according to the researcher, enabling that enforcement closes the Graph token bypass and restores proper Conditional Access evaluation.
Jul 12, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026
Researchers documented multiple ways attackers can hide command-and-control and data theft inside legitimate Microsoft Azure services, highlighting how trusted cloud traffic can mask malicious activity. One proof-of-concept showed Azure DevOps REST APIs being used without exploiting any software flaw: Windows malware authenticated with a Personal Access Token, queried `dev.azure.com`, created work items, and stored host data in task fields over HTTPS. The technique requires no attacker-owned infrastructure, blends into normal enterprise traffic, and can leave exfiltrated data preserved in Azure DevOps records until removed; the sample also reportedly avoided detection in sandbox testing. A separate investigation tied the same cloud-abuse theme to real-world banking malware in Brazil, where a phishing campaign delivered the **AllaSenha** trojan through invoice-themed lures, malicious `.lnk` files, PowerShell and Python stages, and an in-memory Delphi loader. The malware used a DGA to reach Azure-hosted endpoints under `*.brazilsouth.cloudapp.azure[.]com` over raw TCP, then deployed a final payload that stole Brazilian banking credentials and 2FA material, including tokens and QR codes, while using operator-driven overlays to hijack authentication flows. The reporting underscores that Azure infrastructure is being used both experimentally and operationally as a stealthy channel for malware staging, C2, and exfiltration.
Aug 14, 2026