Certighost Exploit Enables Low-Privileged AD Users to Impersonate Domain Controllers
On July 24, 2026, researchers H0j3n and Aniq Fakhrul published a working exploit for a Microsoft Active Directory Certificate Services (AD CS)…
Tag: Identity Security
Synthetic Identity Fraud Targets Machine Identities: A Growing NHI Threat
Most organizations focus on protecting Non-Human Identities (NHIs) from theft, but a more insidious threat is emerging: fabricated machine identities. Unlike stolen…
Two Scattered Spider Hackers Sentenced to 5.5 Years for £29 Million TfL Hack
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on July…
OAuth Client ID Spoofing Exploits Blind Spot in Microsoft Entra ID to Validate Stolen Credentials
Proofpoint has uncovered a novel evasion technique called OAuth client ID spoofing, exploited by at least two threat actors to validate stolen…
Fake Microsoft Entra Passkey Enrollment Used in Voice Phishing Attacks Targeting M365 Users
A sophisticated threat actor tracked as O-UNC-066 by Okta is targeting organizations across multiple sectors with a voice-based phishing (vishing) scheme that…
GitHub ‘Verified’ Commits Can Be Rewritten Into New Hashes Without Breaking Signatures
New research from Carnegie Mellon University PhD student Jacob Ginesin, also a cryptographic auditor at Cure53, reveals that GitHub's 'Verified' commit badge…
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A sophisticated device code phishing campaign targeting Microsoft 365 accounts has been observed between late June and early July 2026, leveraging collaboration-themed…
Over-Permissioned Entra ID Apps Allowed Email Reading
The red team abused Entra ID applications with elevated permissions to read the security team's email, demonstrating the risk of over-permissioned applications…
Orchid Security: Identity Observability for Compliance
Orchid Security is an identity security platform that discovers identities directly from applications and infrastructure, surfaces identity dark matter, and maps identity…
Automated Pentest Gaps: What Your Report Misses and How to Fix It
Automated penetration testing is a staple of security validation, but a clean report may create a false sense of security. This article,…