#microsoft

Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organizations including MSP clients, searching mail and downloading files. No Microsoft vulnerability is involved.

Microsoft investigated two intrusions that began with attackers posing as IT support on Teams and ended with Active Directory Certificate Services abuse. ESC1 yielded certificates for 11 privileged accounts, ESC8 one for a domain controller, and one account left out of automated containment carried the data out.

Arctic Wolf Labs said on October 26 it analyzed more than 400 incidents where attackers flooded an inbox with spam, then messaged the employee on Microsoft Teams as IT support and talked them into Quick Assist. Some reached code execution within 15 minutes.

Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and receive Microsoft Graph tokens for the signed-in work account. CVE-2026-80097 was fixed in 6.2606.4246.

Huntress reported on October 22 that one actor replayed tokens stolen by AiTM and device-code phishing into 79 organizations between July 14 and September 22, registering rogue Entra devices and swapping MFA methods within hours to survive password resets.

Microsoft said on October 21 that China-aligned Storm-0940 used the ARTEX agentic AI framework and stolen ConnectWise application identities to try signing in to more than 2,250 tenants, in some cases reaching privileged cloud access in under three hours.

Huntress found an attacker signing in as the ConnectWise Cloud Backup (formerly SkyKick) Entra app with a stolen app credential, pulling Microsoft Graph tokens in 162 tenants by October 16 and using a Cloud Management app to grant itself Global Administrator. ConnectWise has disabled seven app identities.

Proofpoint tracked a TeamFiltration campaign against 28 Microsoft 365 tenants in Chile. It sprayed more than 5,700 accounts and compromised seven, every one an unmanaged functional or service account on a default or unrotated password with no MFA.

From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signing in. Global Administrators and external users get until July 1. Keeping SMS means buying it from a telephony provider.