Loading story…
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the usernamemixed endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct AADSTS error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access.
The activity aligns with ATT&CK techniques for Password Spraying and abuse of Valid Accounts, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust usernamemixed endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Varonis published research describing how Microsoft Entra ID's legacy WS-Trust autologon endpoint can be used for password spraying that bypasses expected Smart Lockout behavior, omits failed attempts from standard sign-in logs, and reveals valid passwords through distinct AADSTS responses. The article also recommends disabling the usernamemixed endpoint, blocking legacy authentication, and monitoring the Unified Audit Log.
Splunk removed the detection 'Multiple Okta Users With Invalid Credentials From The Same IP' from its Threat Research content library in version 5.2.0. The company said it was replaced with 'Okta Multiple Users Failing To Authenticate From Ip' because detections were updated for new search logic and field names.
The Varonis article cites Secureworks Counter Threat Unit research documenting that failed authentications against the autologon flow were not visible in standard Entra ID sign-in logs. It notes Microsoft classified this behavior as 'by design.'
MITRE published the ATT&CK entry for Valid Accounts: Default Accounts, describing how adversaries abuse default accounts for initial access, persistence, privilege escalation, and defense evasion. The entry includes examples such as built-in OS accounts, factory-set credentials, and ESXi's vpxuser account.
The Varonis article cites prior research by Dr. Nestori Syynimaa documenting user enumeration against Microsoft Seamless SSO. This is referenced as earlier public research relevant to the WS-Trust autologon issue.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
varonis.com
Open sourceresearch.splunk.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that attackers are increasingly abusing **OAuth client ID spoofing** against Microsoft Entra ID to enumerate accounts and validate credentials without registering a legitimate OAuth application. The activity relies on Resource Owner Password Credentials (ROPC) authentication requests that use spoofed or random `client_id` values, allowing attackers to distinguish invalid usernames, valid usernames with incorrect passwords, and in some cases valid username-password pairs based on Microsoft Entra `AADSTS` error responses. Proofpoint said it observed at least two large-scale campaigns, **UNK_pyreq2323** and **UNK_OutFlareAZ**, using different infrastructure, user agents, and client ID generation patterns, indicating the technique is being adopted by multiple threat actors. Microsoft’s published Entra error code behavior helps explain how responses such as `AADSTS700016` can leak authentication state, and defenders were urged to review Entra sign-in logs for blank or missing application names or IDs and to treat some apparent failed logins as possible signs of successful credential validation by an attacker.
Aug 11, 2026
SpecterOps disclosed a **"Pass-the-Passkey"** attack family that can undermine passkey-based authentication in **Windows 11** and **Microsoft Entra ID** without extracting private keys from hardware tokens or trusted enclaves. The most serious chain used Windows 11 event logging that recorded full WebAuthn assertion responses and paired it with Entra ID replay-validation weaknesses, allowing attackers to replay harvested assertions and gain access to privileged cloud accounts while still meeting phishing-resistant MFA checks. Microsoft addressed the Windows logging exposure as **`CVE-2026-34348`**, truncating logged signature fields to six bytes. The research also described local attack paths that abuse legitimate WebAuthn APIs for prompt flooding, application identity spoofing, remote desktop pass-through, and Credential UI spoofing, enabling local passkey phishing and user-fatigue scenarios. Researchers released open-source tooling to help defenders test for assertion injection, event-log mining, and WebAuthn API hooking, and recommended patching Windows 11, enforcing server-side anti-replay protections, monitoring WebAuthn API activity, and requiring hardware-backed attestation for high-privilege Entra ID accounts.
Aug 10, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft Entra ID by abusing legitimate OAuth 2.0 authorization flows. Attackers craft malicious login URLs and use social engineering tactics—such as fake CAPTCHAs or error messages—to trick users into providing OAuth authorization codes. These codes are then exchanged for access and refresh tokens, granting attackers programmatic access to Microsoft accounts and cloud resources, all without stealing credentials or triggering multi-factor authentication (MFA) prompts. The attack is an evolution of previous consent phishing and ClickFix-style methods, with recent variants making the process even easier for victims through drag-and-drop functionality. ConsentFix is particularly dangerous because it bypasses Conditional Access policies and device compliance requirements, undermining otherwise robust security frameworks. Detection and response require visibility into identity, SaaS, and cloud activity, as traditional prevention mechanisms are ineffective. Security teams are advised to monitor Azure sign-in logs for unusual authentication events and to educate users about the risks of interacting with suspicious login flows or error messages that request manual actions like copying and pasting URLs. The attack highlights the ongoing evolution of phishing tactics targeting cloud authentication systems and the need for advanced monitoring and user awareness.
Jun 29, 2026