Security daily

Synthesized by Clarity (Claude) from 34 sources · May contain errors — spot one? [email protected] · Methodology →

Golden SAML Variant Forges Entra Global Admin, Skips LSASS

Sources
34
Words
919
Read
5min

Topics AI Regulation Agentic AI AI Capital

◆ The signal

Mandiant documented a Golden SAML variant. It pulls active signing keys from the DPAPI_SYSTEM LSA secret and mints valid Global Admin assertions that Entra ID accepts, without ever touching the live ADFS process. LSASS-focused EDR sees nothing, which is the same blind spot the original Golden SAML tradecraft exploited years ago. Any surviving ADFS host is Tier 0. Alert on Event ID 385 now.

◆ INTELLIGENCE MAP

Intelligence map

  1. 01

    Federated Identity Forgery Bypasses Your EDR

    monitor

    Mandiant's new Golden SAML variant lets a SYSTEM-level attacker on any ADFS host pull active signing keys from the DPAPI_SYSTEM LSA secret and forge Global Administrator assertions Entra ID trusts — without touching LSASS or the live ADFS process. Every LSASS-handle-access detection is blind to it.

    0
    LSASS touches to forge admin
    1
    source
    • Prerequisite
    • Outcome
    • Detection anchor
  2. 02

    AI Coding Agents Are Now a Primary Attack Surface

    monitor

    Four+ attack classes hit Claude Code, Cursor, Codex, Amazon Q, Windsurf and Augment in one cycle: GhostApproval symlink escape (6 assistants), a 0DIN prompt injection with payload in a swappable DNS TXT record, GitLost repo exfiltration, and HalluSquatting. Sophos found legitimate agents trip the same EDR rules as intruders.

    [remove — no sourced figure]
    of AI commits ship unreviewed
    9
    sources
    • Assistants hit by GhostApproval
    • AI incident rate (DigiCert)
    • Unreviewed commits Feb→Mar
    1. Feb 202610%
    2. Mar 202640%+300%
  3. 03

    KEV Exploits on Your Web Tier + Perimeter RCE

    act now

    Adobe ColdFusion (CVE-2026-48282, CVSS 10.0) and Joomla Page Builder CK (CVE-2026-56290) entered CISA KEV July 7 and are exploited now. Pre-auth RCE sits in BeyondTrust (CVE-2026-40139, 9.8) and Citrix NetScaler (CVE-2026-8452/8655, 9.8); Gitea impersonation (CVE-2026-20896) is exploited; Containerd and the AI/ML tooling stack are riddled with 9.8–10.0 RCE.

    10.0
    CVSS on live ColdFusion exploit
    3
    sources
    • KEV entries (Jul 7)
    • Gitea servers exposed
    • IBM Langflow CVEs
    1. 01ColdFusion CVE-2026-4828210
    2. 02Crawl4AI CVE-2026-5757210
  4. 04

    Your EU→US Data Pipeline Just Got a Legal Expiry Date

    background

    The June 2026 SCOTUS ruling letting the President fire an FTC commissioner without cause gives Schrems his constitutional hook for round three against the EU-US Data Privacy Framework, whose adequacy decision names the FTC as an 'independent authority.' Safe Harbor fell 2015, Privacy Shield 2020 — 3,600+ firms' flows hang on the third.

    3,600+
    firms relying on the framework
    2
    sources
    • Frameworks Schrems has killed
    • CIRCIA final rules
    • ECB AI-defense deadline
    1. 2015Safe Harbor struck down
    2. 2020Privacy Shield struck down
    3. 2026DPF challenged via FTC ruling
  5. 05

    Synthetic Media + Vendor Data-Handling Erode Trust Controls

    background

    Meta's Muse Image (default-on, @-mention any public Instagram account) and OpenAI's full-duplex GPT-Live voice strip the latency and skill barriers behind executive-impersonation BEC. Veriff reports AI-enabled fraud up 300% YoY. Separately, HubSpot silently pooled customer CRM records cross-tenant — a live vendor-risk case even after its reversal.

    300%
    AI-enabled fraud growth YoY
    8
    sources
    • Muse distribution
    • Voice mode
    • Breached orgs told to stay quiet

◆ DEEP DIVES

Deep dives

  1. 01

    Golden SAML, Second Generation: The Identity Forgery Your EDR Can't See

    monitor

    This variant matters not because it forges a Global Admin — classic Golden SAML did that — but because of where it reads the keys. Prior tradecraft required extracting signing material from the live ADFS configuration or scraping process memory, both of wh

    Action items

    • Classify every remaining ADFS host as Tier 0 this week: enable SACL auditing on MachineKeys/Protect\S-1-5-18, wire Event ID 385 into your SIEM, and migrate signing keys to an HSM.
    • Add ADFS retirement to this quarter's identity roadmap, moving surviving federations to native Entra ID.
  2. 02

    Your Developers' AI Agents Are the New RCE Path Into the Build Chain

    monitor

    Four independent research teams disclosed distinct attack classes against the same tools in one week. That convergence is the signal. This is a design-class problem, not a vendor bug you can switch away from. Map each disclosure to the layer it breaks.

    TechniqueBreaksScopePatchable?
    GhostApproval (Wiz)The approval/consent model — agent asks to edit one file, symlinks grant broad machine access6 assistants (Claude Code, Cursor, Amazon Q, Antigravity, Windsurf, Augment)Yes — vendor patch + symlink hardening
    0DIN prompt injectionStatic analysis — payload is a base64 reverse shell in a swappable DNS TXT record, not the repoAny agent pointed at an untrusted repoNo — usage/sandboxing control
    HalluSquattingThe supply chain — attackers pre-register package names LLMs hallucinateAll LLM assistantsNo — intercept at install
    Sophos EDR findingYour detection pipeline — legit agents fire the same rules as intrudersEndpoint telemetryNo — detection re-engineering

    The 0DIN chain is the one to watch. Components: a README, a Python package that raises a RuntimeError, and a setup script piping a dig query into bash. The repo carries zero malicious code. The payload rotates server-side with no new commit. Code review and SAST see nothing, because there is nothing in the tree to see.

    The human gate is going. Unreviewed AI commits went from 10% to 40% in a single month. DigiCert found 78% of enterprises have hit AI-related incidents, mostly misconfigured agents, not bad code. The Claude Code geo-fingerprinting episode fits the same pattern: surfaced by a Reddit reverse-engineer, flagged by China's MIIT. It confirms the behavior — these clients do undisclosed local inspection with unaudited network egress. One incident is a bug. Four in a week is a category.

    Action items

    • Egress-filter DNS TXT lookups and block agent-initiated shell/network calls from dev workstations and CI runners this sprint; sandbox agents in non-privileged containers and disable symlink following.
    • Force-update the six GhostApproval-affected assistants, pin Claude Code to 2.1.198+ per CNVD guidance, and enforce dependency allow-listing against HalluSquatting.
    • Re-tune EDR to baseline legitimate agent behavior separately (tag agent processes, allowlist), then red-team validate intruder detection survives the tuning.
  3. 03

    Two Live KEV Exploits and Pre-Auth RCE Sitting on Your Perimeter

    act now

    Two items separate signal from the dozens of 9.x CVEs this cycle. Adobe ColdFusion CVE-2026-48282 (CVSS 10.0) and Joomla Page Builder CK CVE-2026-56290 both entered CISA KEV on July 7. KEV listing means working exploits and active scanning, so these are incidents-in-waiting rather than triage. Anything internet-facing and unpatched by tonight stays exposed until it is isolated.

    The secondary cluster hits the appliances that broker access to everything behind them, which is where the real damage lives. BeyondTrust Remote Support carries CVE-2026-40139 at 9.8, plus 40138 and a priv-esc, 40141, at 9.9. Citrix NetScaler ADC/Gateway carries CVE-2026-8452 and 8655, both 9.8 memory overflow. All of it is pre-auth. A compromised PAM or gateway is a compromised environment, and until the credentials those appliances broker are rotated, a patch alone leaves the trust chain intact. Separately, Gitea CVE-2026-20896 is exploited in the wild to impersonate any user, with 6,200-plus servers still exposed despite a fix out since end of June, which makes the auth logs worth a retro-hunt.

    The under-monitored surface

    The pattern worth watching is the AI/ML tooling ecosystem, which ships fast and secures slow. This is the same fast-adoption dynamic that made early container deployments a mess, and it is playing out again. Crawl4AI CVE-2026-57572 is a 10.0 command exec. LLaMA-Factory CVE-2026-58116 is 9.8 RCE via a malicious model path. txtai CVE-2026-58449 is 9.8 via /reindex. NVIDIA AIStore is 9.8 auth bypass. IBM Langflow carries seven CVEs up to 10.0. These live inside privileged data-science environments most SOCs do not monitor. Containerd adds container-escape potential through CVE-2026-50195 at 9.9 and 53492 at 9.6; the fixed builds are 2.3.2, 2.2.5, and 2.1.9.

    The trap this cycle is that incomplete fixes are being bypassed. HPLIP CVE-2026-14544 and Pivotal CRM CVE-2026-51947 each reopen a prior hole. We have seen vendors close a bug and leave the door ajar before, so "patched" is a label to validate, not to trust.

    Action items

    • Patch or isolate every internet-facing ColdFusion (CVE-2026-48282) and Joomla Page Builder CK (CVE-2026-56290) tonight; if patching can't be immediate, pull behind auth or take offline.
    • Patch BeyondTrust and Citrix NetScaler this week, review appliance logs for pre-auth anomalies, and rotate all credentials those appliances broker.
    • Inventory AI/ML tooling (Crawl4AI, LLaMA-Factory, txtai, Langflow, AIStore) across dev and prod, patch to fixed versions, remove internet exposure, and stand up SOC detection on ML hosts.
  4. 04

    The Legal Clock on Moving EU Data Stateside Just Started Ticking

    background

    The chain is direct. The European Commission's adequacy decision for the EU-US Data Privacy Framework names the FTC as one of the "independent authorities" underpinning SIGINT-redress oversight. The EU Charter requires exactly that. The June 2026 SCOTUS ruling holds that the President can fire an FTC commissioner without cause. It struck down the statute limiting removal to "inefficiency, neglect, or malfeasance." That hands Max Schrems a clean argument that no genuinely independent authority exists.

    Schrems is 2-for-2. Safe Harbor fell in 2015. Privacy Shield fell in 2020. One legal expert calls the current argument "a stretch." A man who has killed two frameworks earns a contingency plan. The 3,600+ firms certified under the DPF hold the concentrated exposure.

    Readiness costs less than a fire-drill during an invalidation. EU personal data most commonly lands in M365, Salesforce, and AWS/GCP US regions, and those US-region processing paths carry the worst downside. Other deadlines run alongside. The ECB has given EU banks four months to produce AI-cyberattack defense plans. CIRCIA's final breach-reporting rules are expected in September. The transfer question is the one with the hardest downside, so it leads.

    Action items

    • Commission a fresh Transfer Impact Assessment and pre-stage Standard Contractual Clauses / EU data-residency fallbacks for all US-hosted processing of EU personal data this quarter.
    • Set a defined go/no-go trigger tied to the CJEU/noyb docket so the SCC fallback activates on a decision, not a scramble.

◆ QUICK HITS

Quick hits

  • Ubiquiti bulletin 066 discloses 7+ critical CVEs across the UniFi line, including Connect/Access/OS command injection at CVSS 10.0 (CVE-2026-50746) and Talk SQLi (CVE-2026-50747).

  • Accenture confirmed a 35GB Azure DevOps repo breach exposing Azure keys, tokens, and source code — by the same actor who stole and sold its data in 2024, indicating failed remediation or persistent access.

  • A password-spray campaign hit 80,000 M365 accounts across ~3,000 tenants (education-focused) alongside Forg365, a new AitM Phishing-as-a-Service kit with session persistence and AI-generated lures that defeats basic MFA.

  • HubSpot silently pooled customer CRM records into a shared cross-tenant enrichment dataset — its five 'enrichment controls' governed only inbound refresh, not outbound flow — then reversed only after backlash.

  • Update: the decade-old kernel escapes (GhostLock rtmutex UAF, fixed only in kernel 7.1/backports; and the KVM 'Januscape' guest-to-host escape behind Google's $250K bounty) now have public fixes — the patch-development clock is running against multi-tenant hosts.

  • Bitdefender's 2026 data shows 55.2% of breached organizations were pressured to stay silent — a disclosure-integrity risk worth pre-wiring authority for before an incident forces it under duress.

  • Update: the US-Iran ceasefire collapsed (80+ US airstrikes, Strait of Hormuz closure) — every prior kinetic escalation has drawn Iranian state-sponsored cyber retaliation (APT33/APT34/CyberAv3ngers) against US energy and finance within days.

◆ Bottom line

The take.

Stop treating identity federation, developer tooling, and cross-border data contracts as settled infrastructure. This week's highest-leverage move: re-draw your trust boundaries and ask which non-human, federated, and vendor-held identities can silently mint privilege or move data outside anything your controls actually watch.

— Promit, reading as Security ·

Frequently asked

Why does this ADFS attack bypass EDR that would normally catch Golden SAML?
The variant reads active signing keys from the DPAPI_SYSTEM LSA secret on disk rather than extracting them from the live ADFS process or LSASS memory. EDR tooling built around LSASS access patterns and process memory scraping never sees the read, so detection has to shift to filesystem/registry auditing on the key-store paths.
What concrete detections should be in place on surviving ADFS hosts right now?
Enable SACL auditing on MachineKeys and the Protect\S-1-5-18 DPAPI paths, forward Event ID 385 into the SIEM, and alert on any non-ADFS-service process touching those key stores. Treat every ADFS host as Tier 0, and plan HSM migration for the signing keys so the on-disk primitive goes away entirely.
If an attacker has already minted a forged Global Admin assertion, what does response look like?
Assume the token signing key is compromised: rotate ADFS signing certificates, revoke and reissue, and force reauthentication for privileged Entra ID roles. Hunt Entra sign-in logs for SAML assertions with anomalous issuer, IP, or authentication context, and audit recent Global Admin actions and consent grants for persistence.
Is there a way to eliminate this attack class rather than just detect it?
Retire ADFS and move federations to native Entra ID authentication, which removes the on-prem signing-key store the technique depends on. Where ADFS must remain short-term, migrating signing keys to an HSM prevents the DPAPI-based extraction path even if the host is compromised.

◆ Same day, different angle

Read this day as…

  1. 10 shared

    TeamPCP's supply chain campaign has cascaded from the previously-reported Trivy compromise into the Python AI ecosystem: LiteLLM versions 1.82.7 and 1.82.8 on PyPI were trojanized via a stolen publishing token, using a novel .pth file injection that exfiltrates every credential on the host — SSH keys, cloud IAM, K8s configs, CI/CD secrets — the moment any Python process starts, without the package ever being imported.

    TeamPCP's supply chain campaign has cascaded from Trivy into the Python AI ecosystem — LiteLLM's trojanized PyPI packages use a .pth injecti…

  2. 8 shared

    Two groups are spraying your Entra ID tenants invisibly via OAuth client-ID spoofing.

    This week's throughline is trust you granted, not code you failed to patch: consent grants, notarized installers, package registries, and AI…

  3. 8 shared

    SharePoint CVE-2026-45659 just hit CISA KEV with confirmed active exploitation

    Two confirmed RCE paths are open right now — SharePoint (KEV-listed, actively exploited) and Cursor (9.8 zero-click, every version before 3.…

◆ Recent in security

Keep reading.

Spot an error? [email protected]