Loading story…
Threat researchers and U.S. government defenders warned that attackers who steal an identity provider's token-signing private key can forge SAML 2.0 assertions and authenticate as arbitrary users to cloud services that trust the compromised provider. The technique, known as Golden SAML, lets intruders bypass normal controls including MFA in some scenarios and obtain access to environments such as AWS, Azure, Microsoft 365, and vSphere. CyberArk showed the method can be used against AD FS federations, including exchanging forged assertions through AWS STS AssumeRoleWithSAML to obtain temporary AWS credentials, while noting the abuse stems from compromised trust infrastructure rather than a flaw in SAML itself.
Mandiant and CISA later tied Golden SAML to broader post-compromise cloud intrusion activity, including operations by UNC2452, and said attackers often pivot from on-premises compromise into cloud tenants by stealing AD FS signing certificates, altering federated domains, abusing privileged Azure AD roles, or adding rogue credentials to applications and service principals. Defenders were urged to treat on-premises and cloud investigations as linked, rotate signing certificates and other secrets, revoke refresh tokens, remove cloud persistence, and harden monitoring around AD FS, federation settings, privileged accounts, and application permissions. Detection remains challenging because forged assertions can closely resemble legitimate federated logins; Splunk noted one analytic for suspicious AWS AssumeRoleWithSAML activity was ultimately removed because it no longer reliably identified the intended abuse.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research removed the detection "AWS SAML Access by Provider User and Principal" from its library in version 5.4.0, stating it no longer effectively identified the intended malicious activity. The analytic had been aimed at spotting suspicious AssumeRoleWithSAML activity relevant to Golden SAML-style abuse in AWS federated environments.
CISA issued alert AA21-008A on detecting post-compromise threat activity in Microsoft cloud environments. The alert reflects official U.S. government guidance related to techniques such as Golden SAML and other cloud persistence and privilege-abuse methods.
At Black Hat USA 2021, Mandiant presented research on Microsoft 365 intrusions observed in the wild, detailing techniques for stealth, persistence, and large-scale data theft. The presentation disclosed abuse of mailbox audit bypass, license downgrades to disable MailItemsAccessed logging, mailbox folder permissions, and Azure AD application or service principal hijacking for remote tenant access.
FireEye disclosed in December 2020 a widespread campaign it attributed to UNC2452. Later reporting tied some of these intrusions to post-compromise movement from on-premises environments into victims' Microsoft 365 tenants.
In the same disclosure, CyberArk released "shimit," a tool that automates generating and signing forged SAML responses and, in an AWS and AD FS scenario, exchanges them with AWS STS to obtain temporary credentials. The publication also documented operational details and defensive recommendations around AD FS signing-key protection.
CyberArk Labs publicly described an attack it named "Golden SAML," in which attackers with an identity provider's token-signing private key can forge SAML assertions to access trusted cloud services as arbitrary users. The post emphasized this was an abuse of compromised signing keys rather than a flaw in SAML, AWS, or AD FS.
Mandiant reported that in some UNC2452 intrusions, attackers stole AD FS token-signing material and forged SAML tokens to access Microsoft 365 without users' passwords or MFA. The white paper also described additional cloud attack paths including federated-domain modification, abuse of privileged Azure AD roles, and hijacking of Azure AD applications or service principals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourcecisa.gov
Open sourcecyberark.com
Open sourcefireeye.com
Open sourcei.blackhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated phishing campaign has been identified targeting organizations that use Microsoft 365 and Okta for single sign-on (SSO). Attackers employ adversary-in-the-middle (AiTM) techniques to hijack legitimate SSO authentication flows, bypassing multi-factor authentication (MFA) methods that are not phishing-resistant. The campaign uses lookalike domains to impersonate Okta login pages and proxies authentication requests, capturing credentials and session tokens. Hundreds of users across dozens of organizations have been targeted, with phishing emails and malicious URLs designed to closely mimic legitimate login experiences, making detection challenging. Broader trends in SaaS security highlight the increasing abuse of OAuth tokens and session cookies, enabling persistent, non-interactive access to cloud services even after password resets or MFA changes. Attackers leverage browser extensions and session exfiltration to maintain access, and AI-driven lures accelerate the speed and scale of these attacks. The combination of AiTM phishing, token replay, and browser-based persistence underscores the evolving threat landscape for organizations relying on cloud identity providers like Okta and Microsoft 365.
Jun 29, 2026
Kaspersky reported a rise in phishing campaigns that abuse Amazon Simple Email Service (**SES**) to deliver convincing messages through trusted cloud infrastructure. The activity is believed to be fueled by exposed AWS Identity and Access Management (**IAM**) access keys discovered in public GitHub repositories, `.env` files, Docker images, backups, and public S3 buckets. After validating stolen credentials—reportedly with automated secret-scanning and access-checking workflows—attackers use SES to send bulk phishing emails that can pass **SPF**, **DKIM**, and **DMARC**, reducing the effectiveness of reputation-based filtering. Observed campaigns included fake **DocuSign** notifications that redirected targets to AWS-hosted credential-harvesting pages, as well as more advanced business email compromise attempts using fabricated email threads and fake invoices. Researchers urged organizations to enforce least-privilege IAM permissions, enable MFA, rotate keys regularly, apply IP-based access restrictions, and strengthen encryption controls around secrets. Amazon said it provides guidance for exposed credentials, responds to abuse reports, and directs suspected misuse of AWS resources to **AWS Trust & Safety**.
Jun 29, 2026
Researchers reported a new wave of **SAML authentication bypass** flaws affecting multiple libraries and products, including **Authentik**, **PHP litesaml/lightsaml**, **OneUptime**, **java-saml-client**, and earlier-disclosed Ruby and PHP SAML ecosystems. The findings describe parser-level inconsistencies, XML signature wrapping, namespace confusion, attribute pollution, and a **"Void Canonicalization"** technique that can desynchronize XML signature verification from assertion parsing, allowing attackers to present a well-formed SAML document that still bypasses validation. In the most prominent case, **CVE-2026-57580** in Authentik allowed abuse of XML comments in a `NameID` value under certain non-default account-matching modes, potentially linking an attacker-controlled identity to a victim account and enabling account takeover. The disclosures show both practical exploitation and vendor response. PortSwigger demonstrated real-world impact against **GitLab EE 17.8.4** and said fixes were issued for **xmlseclibs 3.1.4** and Ruby-SAML advisories tied to **CVE-2025-66567** and **CVE-2025-66568**. Separate reporting said **JFrog** directly credited Ben Morris working with **Claude** and Anthropic Research across four authentication-related flaws, including a SAML signature-verification issue, while Authentik patched its bug in versions **2026.2.6** and **2026.5.5**. The broader research also identified signature-validation bypasses in authentication requests, attribute queries, and logout flows, along with denial-of-service risks from malicious XML inputs.
Aug 20, 2026