Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Insufficient
- Confidence65
Microsoft has tracked passkey- and SSO-themed help desk impersonation since May 2026, with the calls steering employees into adversary-in-the-middle proxies and device-code grants that hand over live Microsoft 365 sessions.
Perspective Coverage
6 publishers
- Builder
- Builder 28%
- Operator
- Operator 62%
- Investor
- Investor 10%
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence60
Microsoft's Digital Crimes Unit and its partners pulled down the EvilTokens phishing service about seven months after it launched, and British police arrested its two suspected operators. The authentication technique it sold survives on other platforms.
Perspective Coverage
8 publishers
- Builder
- Builder 25%
- Operator
- Operator 60%
- Investor
- Investor 15%
Reality
- Evidence66
- Adoption58
- Hype gap+18
- Incentives62
- Confidence64
Proofpoint tracked three waves of TeamFiltration password spraying against Microsoft 365 tenants in Chile between July 21 and August 16. The seven accounts that opened were all functional identities carrying provisioned passwords with no MFA.
Reality
- Evidence50
- Adoption60
- Hype gap+10
- Incentives65
- Confidence55
Microsoft says the phishing-as-a-service platform reached more than 12,000 inboxes at over 10,000 organizations in seven months by abusing a legitimate OAuth flow, and its Digital Crimes Unit has now disrupted the infrastructure behind the service.
Reality
- Evidence58
- Adoption62
- Hype gap+20
- Incentives76
- Confidence57
CSO Online's teardown of a Webworm implant found an upgrade command that replaces all five credential strings in a single task. The revocation step at the top of most identity runbooks costs the operator one poll cycle.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+15
- Incentives22
- Confidence56
The Java gateway now requests Calendars.ReadWrite.Shared, drops davmail.caldavImpersonate, turns folder delta sync on by default and makes anyone moving from EWS to Graph sign in again. In tenants that vet app permissions, consent comes before rollout.
Reality
- Evidence58
- Adoption15
- Hype gap+8
- Incentives30
- Confidence60
eSentire says a phishing kit called GhostCode used Microsoft's device-code flow to register three devices within 77 seconds of a victim completing MFA, and one of them stayed enrolled in Intune until it was explicitly removed.
Reality
- Evidence58
- Adoption30
- Hype gap+12
- Incentives60
- Confidence55
Microsoft has tracked intrusions since May in which callers posing as IT told employees a passkey update was due, then steered them to a phishing page or a device-code prompt. The enrollment step is where the chain starts.
Reality
- Evidence55
- Adoption35
- Hype gap−5
- Incentives60
- Confidence58
Microsoft's researchers describe a device code phishing campaign that minted fresh codes the moment a target clicked, defeating the expiry that used to hold these attacks down. The flow it abuses is only needed by hardware that cannot show a login page.
Reality
- Evidence55
- Adoption45
- Hype gap+20
- Incentives65
- Confidence60
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives55
- Confidence55
RuntimeWire's comparison of two shipped Claude for Windows builds found CAE markers, a local authentication broker and sovereign-cloud handling, while Microsoft's published certification record for Claude still answers No on CAE.
Reality
- Evidence62
- Adoption22
- Hype gap+20
- Incentives52
- Confidence58
Microsoft has tracked this since May 2026. First contact lands on an unmanaged personal phone, and the attacker's own authenticator outlives the stolen session, so tenant telemetry only starts after the account is already lost.
Reality
- Evidence55
- Adoption45
- Hype gap−10
- Incentives65
- Confidence58
Since May, intruders posing as IT have walked employees through a passkey update on their personal phones, then registered their own authentication method and pulled mail and files through Graph, SharePoint and Exchange APIs.
Reality
- Evidence62
- Adoption32
- Hype gap+12
- Incentives65
- Confidence58
RelayPublisher publishes YAML manifests as Intune line-of-business apps straight from CI, which relocates the right to write apps in your tenant from a human's time-boxed elevation to a pipeline credential that holds it permanently.
Reality
- Evidence34
- Adoption8
- Hype gap+18
- Incentives66
- Confidence41
A single Stormcast episode carries a Keycloak 26.7.2 password-reset fix, a reported N-able password manager leak, and a published LLM safeguard bypass. Most of it sits in the identity and secrets tier.
Publishers:isc.sans.edu
Reality
- Evidence52
- Adoption
- Insufficient
- Hype gap+14
- Incentives34
- Confidence55
A custom directory role scoped to one app consent policy lets a delegate approve tenant-wide consent only inside a named envelope. The queue does not vanish; it becomes policy maintenance.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+14
- Incentives
- Insufficient
- Confidence58
Google says the BlackFile crew has targeted dozens of organisations by phoning staff and posing as internal IT. No vendor bug is involved, which puts the remedy on IT leadership.
Reality
- Evidence70
- Adoption42
- Hype gap+8
- Incentives62
- Confidence58
A Foundry governance walkthrough splits agent permissions into on-behalf-of reads, unattended agent identity, and human approval. Collapsing them into one credential is a publish-time failure.
Reality
- Evidence42
- Adoption
- Insufficient
- Hype gap+8
- Incentives30
- Confidence40