Loading story…
An authorized assessment of an unnamed supply-chain yard management system uncovered a critical application-level authentication bypass in its custom signed-session-cookie design. The platform used publicly exposed user database identifiers (CUIDs) as identity-bearing cookie values and signed them with a predictable hard-coded HMAC secret reportedly matching the cookie name. An unauthenticated attacker could therefore forge valid sessions for arbitrary users, bypassing passwords, MFA, and Microsoft Entra ID SSO token validation; the weakness did not compromise Entra ID itself.
Researchers impersonated 95 of 241 tested employee accounts, including privileged administrators, and used a forged administrator session to execute persistent state-changing actions in a staging environment. The vulnerable session mechanism was accepted by both API and administrative single-page-application hosts, and an authenticated-user endpoint reportedly exposed an Entra refresh token. Recommended actions are to immediately rotate the signing secret, invalidate all active sessions, replace client-held identity claims with random server-side session IDs, use distinct high-entropy secrets per environment, and review logs for anomalous session use, impersonation, token exposure, and administrative activity.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
An authorized assessment of an unnamed supply-chain yard management system found that a predictable hard-coded HMAC secret and client-held user CUIDs allowed unauthenticated forging of signed session cookies. Researchers impersonated 95 of 241 tested employee accounts, including administrators, and used a forged administrator session to perform a persistent state-changing API action in a staging environment; no production systems were tested.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceresecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Varonis Threat Labs disclosed **TrustSink**, a post-compromise Microsoft Entra persistence and credential-phishing technique that abuses External Authentication Methods (EAMs). An attacker with **Global Administrator** or **Authentication Policy Administrator** privileges can register a malicious OIDC authentication provider and associated Entra application, present victims with a convincing Microsoft password prompt during a legitimate MFA flow, and capture plaintext credentials while returning a valid signed success response to Entra. Victims can complete MFA and access the intended application normally, concealing the theft. The rogue provider can remain active after a password reset and capture replacement passwords at the next sign-in, so password resets alone do not remediate an intrusion. Organizations should monitor Authentication Methods Policy changes; newly created applications, service principals, and consent grants; unfamiliar EAM issuer URLs and redirect URIs; and hardware-key claims without a corresponding legitimate enrollment. Incident responders should remove the malicious external authentication method and all related Entra artifacts before resetting affected users' credentials.
Sep 28, 2026
Researchers reported that Microsoft Entra ID’s legacy WS-Trust autologon endpoint for Seamless SSO can be abused to conduct password-spraying attacks with reduced defensive visibility. Testing found the `usernamemixed` endpoint remained reachable for older Office 2013-era clients, did not appear to trigger expected Smart Lockout protections, and omitted failed attempts from standard Entra ID sign-in logs. The endpoint also returned distinct `AADSTS` error codes that let attackers distinguish invalid passwords from valid credentials that were later blocked by MFA or Conditional Access, enabling efficient credential validation without full account access. The activity aligns with ATT&CK techniques for **Password Spraying** and abuse of **Valid Accounts**, including default or legacy authentication paths that permit legitimate-looking logons once credentials are known. Defenders were advised to disable the WS-Trust `usernamemixed` endpoint, block legacy authentication through Conditional Access, monitor the Unified Audit Log for autologon requests, and use detections for repeated failed logons from a single IP across multiple users—similar to Okta analytics that flag more than five invalid authentication attempts from one source as suspicious spraying behavior.
Aug 12, 2026
A new phishing technique called **ConsentFix** has emerged, targeting Microsoft Entra ID by abusing legitimate OAuth 2.0 authorization flows. Attackers craft malicious login URLs and use social engineering tactics—such as fake CAPTCHAs or error messages—to trick users into providing OAuth authorization codes. These codes are then exchanged for access and refresh tokens, granting attackers programmatic access to Microsoft accounts and cloud resources, all without stealing credentials or triggering multi-factor authentication (MFA) prompts. The attack is an evolution of previous consent phishing and ClickFix-style methods, with recent variants making the process even easier for victims through drag-and-drop functionality. ConsentFix is particularly dangerous because it bypasses Conditional Access policies and device compliance requirements, undermining otherwise robust security frameworks. Detection and response require visibility into identity, SaaS, and cloud activity, as traditional prevention mechanisms are ineffective. Security teams are advised to monitor Azure sign-in logs for unusual authentication events and to educate users about the risks of interacting with suspicious login flows or error messages that request manual actions like copying and pasting URLs. The attack highlights the ongoing evolution of phishing tactics targeting cloud authentication systems and the need for advanced monitoring and user awareness.
Jun 29, 2026