Synthesized by Clarity (Claude) from 40 sources · May contain errors — spot one? [email protected] · Methodology →
Entra ID OAuth Client-ID Spoofing Sprays Hide in AADSTS Noise
- Sources
- 40
- Words
- 863
- Read
- 4min
Topics AI Regulation Agentic AI AI Capital
◆ The signal
ShinyHunters ran a parallel campaign for a year, living in Salesforce CRM through OAuth consent abuse. Zero CVEs in either operation. The Entra spray surfaces only as AADSTS700016 errors and blank-application-ID sign-ins in default logs. ROPC remains enabled by default in most tenants, which is where the spray finds its opening.
◆ INTELLIGENCE MAP
Intelligence map
01 The Identity Layer Is the Breach
monitorTwo parallel campaigns bypass MFA with zero software flaws. ShinyHunters vished employees into approving a malicious connected app impersonating Salesforce Data Loader, inheriting permissions for a year. Another actor spoofs Microsoft OAuth client IDs and abuses ROPC to validate stolen credentials across thousands of Entra tenants, invisible to default sign-in logs.
- Dwell time
- Log footprint
- Threat groups
02 Patch-Now Infrastructure Sitting In Your Stack
monitorTrust-before-verification bugs likely in your stack: RabbitMQ 3.13.0+ leaks its OAuth client secret via unauthenticated /api/auth for full broker takeover; six U-Boot flaws (BRLY-2026-037 to 042, two RCE) trace to 2013 across 50+ releases; a Debian MariaDB regression silently exposes port 3306; CISA added a Cisco IOS CSRF to the KEV catalog.
- RabbitMQ affected
- U-Boot releases
- U-Boot root code
- 02Cisco IOS CSRF (KEV)Federal deadline
- 03U-Boot FIT parsing RCE50+ releases
03 Live Supply-Chain Fires
monitorThe @asyncapi npm namespace was hijacked — poisoned versions drop a Miasma loader from IPFS, persisting as sync.js with C2 at 85.137.53.71. A jscrambler compromise landed over the weekend (Socket flagged it in 6 minutes). npm 12 GA disables lifecycle scripts by default, and xAI's Grok Build CLI was caught uploading whole repos to a GCS bucket.
- npm bad versions
- Socket detection
- ModHeader installs
04 Agentic AI Crosses The Mass-Adoption Line
backgroundCodex hit 6M users adding ~1M/day and became JetBrains' default; Computer Use shipped across OpenAI, Anthropic and Meta. Skills.md files, MCP connectors and loop-engineering agents now run shell-capable, credentialed automation your SOC never scoped. Microsoft's own study shows AI agents lift merged PRs ~24%, flooding pre-AI-sized review gates.
- Codex users
- Daily growth
- Merged-PR lift
05 Compliance And Federal Coordination Shifts
backgroundThe Pentagon froze CMMC Phase 2 weeks before its Nov 10 effective date and stood up a 60-day reform task force that hasn't ruled out cancellation — enforcement reverts to NIST 800-171 Rev 2 self-attestation. The White House also launched Gold Eagle, a public-private cyber vulnerability clearinghouse from the June 2026 AI cybersecurity EO.
- SMB cost/yr
- Assessors
- Companies
- Certified assessors100
- Companies needing assessment100,000
◆ DEEP DIVES
Deep dives
01 Your OAuth Consent Grants Are the New Authentication Bypass
act nowLogin-centric detection is blind here by design. Both campaigns operate after a valid token is issued, inside sessions telemetry treats as legitimate.
ShinyHunters ran mid-2025 through mid-2026 against retail, education and manufacturing. Operators posed as IT support and vished employees into approving an attacker-controlled connected app impersonating Salesforce Data Loader. The app inherited user permissions and ran high-volume API exports. No re-authentication. No MFA prompt. Microsoft documents three distinct attack paths. None is a Salesforce platform flaw.
The parallel Entra ID campaign hits Azure tenants now. Attackers spoof legitimate Microsoft OAuth client IDs and POST credentials to the token endpoint via the Resource Owner Password Credentials (ROPC) flow. That validates stolen credentials at scale and skips interactive sign-in logging. The only footprint in default logs is sign-ins with blank application IDs and AADSTS700016 errors. The AADSTS error family also leaks whether username, password, and conditional access each pass. That is a free credential-triage oracle.
None of the three top campaigns this cycle required a CVE. Login-event detection misses all of them.
This ties to the WorkOS Pipes and 'Login with ChatGPT' items. OAuth consent and token brokering are becoming the primary bypass class. Consent-grant monitoring is absent by default in most tenants.
Action items
- Hunt Entra ID sign-in logs today for blank application IDs and AADSTS700016 errors, and disable the ROPC flow tenant-wide wherever not explicitly required
- Inventory all Salesforce and M365 connected apps this sprint, revoke unused or over-permissioned OAuth grants, and flag any app impersonating Data Loader
- Enable consent-grant and OAuth client-ID anomaly monitoring in your IdP and enforce conditional access to blunt validated-credential reuse
02 Four Bugs That Won't Wait for Your CVE Feed
act nowCommon thread: trust granted before verification. Signature-feed scanners underweight all three because of it. Two carry no CVE yet.
RabbitMQ 3.13.0+ is the sharpest. An unauthenticated
/api/authendpoint hands out the broker's OAuth client secret. That is full admin takeover. A second flaw lets any zero-permission authenticated user declare queues across a shared vhost. Brokers sit at the trust center of event-driven architectures. Own one and you pivot into everything downstream. Patching does not undo the exposure. Leaked secrets stay valid until rotated.Issue Affected Precondition Status RabbitMQ OAuth secret leak 3.13.0+ Network reach to /api/auth Restrict endpoint + rotate secrets now U-Boot FIT parsing RCE v2013.07+, 50+ releases Malicious FIT image pre-sig-check No CVEs yet; vendor firmware lag MariaDB port exposure 10.11.18-0+deb12u1 Reach to 3306 after update Firewall + verify socket bind Cisco IOS CSRF IOS Arbitrary command execution In KEV — federal deadline The U-Boot RCE lives in
fdt_get_name/libfdt, code shared with the Linux kernel and barebox. Exposure runs past bootloaders. No auto-patch feed catches it until CVE assignment. The MariaDB regression is the quiet one: a systemd socket-activation default silently re-binds 3306 to all interfaces on update. The Cisco IOS CSRF already carries a CISA-mandated remediation clock.Action items
- Inventory RabbitMQ versions now, network-restrict /api/auth while awaiting a fixed release, and rotate all OAuth client secrets tied to affected brokers
- Remediate the Cisco IOS CSRF within CISA KEV timelines and add detection for newly exposed 0.0.0.0:3306 listeners across Debian 12 hosts
- Query firmware/CMDB inventory for U-Boot-based IoT/OT/appliance devices, prioritize internet-facing units, and track vendor timelines on BRLY-2026-037 to 042
03 Poisoned Packages and a Coding CLI That Ships Your Repo
monitorTwo of today's supply-chain hits are confirmed compromises with live IOCs. Not posture warnings.
The @asyncapi npm namespace was hijacked. Three poisoned versions: generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1. On import each drops a loader that pulls an encrypted Miasma second stage from IPFS, persisting as
sync.jswith shell exec, credential theft, and C2 at 85.137.53.71. IPFS staging is censorship-resistant. The loader fires during normal dev/CI import, before the secret scanner runs. Timing is the point. A jscrambler package was also compromised over the weekend. Socket flagged it in six minutes. Batch scanners do not run on that clock.Structural note. npm 12 went GA with lifecycle scripts disabled by default, which closes the most-abused postinstall path. Legitimate packages break under that setting. The predictable response is a global re-enable, and a global re-enable returns the surface to where it was.
xAI's Grok Build CLI was caught uploading entire repositories to an xAI-controlled Google Cloud Storage bucket, full commit history included, regardless of what the agent read. Full history is where deleted secrets stay. There is no DPA and no contractual no-train assurance. Any repo it touched is confirmed disclosure to an uncontracted processor. Treat it that way.
Action items
- Grep SBOMs and lockfiles now for @asyncapi poisoned versions and jscrambler (including transitive), block egress to 85.137.53.71, and rotate npm/GitHub/cloud/SSH/CI secrets where sync.js is found
- Hunt dev endpoints and CI runners for Grok Build CLI, and for any repo it touched, scan full commit history and rotate every embedded credential
- Stage npm 12 via 11.18.0 first in an isolated CI branch and fix breakage per-package — never globally re-enable lifecycle scripts
04 CMMC Phase 2 Froze — Your Supply-Chain Assurance Just Dropped
backgroundDOD suspended CMMC Phase 2. Liability moves to self-attestation, whatever the review decides.
The suspension landed weeks before the Nov 10 effective date. A 60-day reform task force is now running, and it has not ruled out killing the program. The driver was cost: a projected $7B+ annual cost to small businesses against ~100 assessors for 100,000+ companies. Do the math on that ratio. Enforcement reverts to NIST SP 800-171 Rev 2 self-assessment plus select government-led evaluations. The framework name changes; the controls in CMMC Phase 2 do not.
Dimension CMMC Phase 2 (frozen) NIST 800-171 (fallback) Verification Third-party certified Self-attestation Assurance High (independent) Lower (declared) Primary liability Bid ineligibility False Claims Act exposure The controls survive. Independent verification does not. That is a measurable drop in supply-chain assurance, and it shifts liability onto self-attestation accuracy. A false attestation carries False Claims Act exposure. Programs are freezing external assessor spend and holding readiness investment. Separately, the White House launched Gold Eagle, a federal-plus-industry vulnerability clearinghouse. It is unclear whether Gold Eagle functions as an intel-sharing asset or creates new disclosure and reporting obligations by sector. That answer will arrive before or during an audit.
Action items
- Freeze new third-party CMMC assessment spend this quarter while maintaining 800-171 Rev 2 control readiness and self-attestation-grade SSP/POA&M documentation
- Assign GRC to scope Gold Eagle participation and any new disclosure obligations, and model three CMMC outcomes: reinstatement, tiered reform, or cancellation
◆ QUICK HITS
Quick hits
CrashStealer abuses Apple notarization: a signed 'Werkbit Setup' installer clears Gatekeeper, fakes a Keychain prompt, and exfiltrates creds plus 80+ crypto-wallet extensions via AES-256-GCM.
Attackers register a rogue AMSI provider via regsvr32 for reboot-surviving, EDR-trusted code execution (MITRE T1546/T1112) — a persistence blind spot most fleets never baseline.
Ghostcommit hides prompt injection in images committed to Git repos, instructing AI agents to exfiltrate .env byte-by-byte; Cursor and Antigravity obeyed — only Opus in Claude Code flagged it.
CVE-2026-33697 (CVSS 7.5): TU Dresden's formal verification found all seven attested-TLS binding mechanisms in WhatsApp Private Processing relay-attack vulnerable — missed by Trail of Bits' manual audit.
CISA contractor Nightwing left AWS GovCloud admin keys and plaintext passwords in a public GitHub repo for ~6 months; nine automated alerts were ignored until a journalist intervened.
Update: Turla / FSB Center 16 drew coordinated EU/UK sanctions after 16 years undetected across 8+ nations — including the Dec 2025 Poland grid attack that left 500,000 without heat.
Accounts netted $8.2M gaming Polymarket's single-source Binance/Chainlink oracle — a data-integrity warning (T1565) for any system trusting one external feed for automated decisions.
◆ Bottom line
The take.
This week's throughline is trust you granted, not code you failed to patch: consent grants, notarized installers, package registries, and AI-tool defaults are all being turned against you — so before touching the CVE queue, enumerate and revoke every standing OAuth grant, non-human identity, and unsanctioned tool that can act in your name.
Frequently asked
- How do I detect the Entra ID OAuth spraying campaign in default logs?
- Hunt sign-in logs for entries with blank application IDs and AADSTS700016 errors. These are the only footprints the ROPC-based token endpoint spray leaves, because it bypasses interactive sign-in logging entirely. The AADSTS error family also reveals which of username, password, or conditional access checks passed, giving attackers a credential-triage oracle you can pivot on defensively.
- Why isn't disabling ROPC enough to stop OAuth-based tenant compromise?
- ROPC disablement closes the credential-spray vector, but the ShinyHunters pattern uses a different path: social-engineered consent grants to attacker-controlled connected apps impersonating tools like Salesforce Data Loader. Those inherit user permissions and run API exports without re-authentication or MFA. You also need connected-app inventory, consent-grant monitoring, and conditional access to cover both paths.
- What makes the RabbitMQ flaw more urgent than the CVSS score suggests?
- An unauthenticated /api/auth endpoint on RabbitMQ 3.13.0+ leaks the broker's OAuth client secret, and brokers sit at the trust center of event-driven architectures — one compromise pivots downstream across every consumer. Patching does not undo exposure: leaked secrets remain valid until rotated, so remediation requires both an upgrade and full secret rotation.
- Which supply-chain compromises need action today versus monitoring?
- Three are confirmed live: the @asyncapi npm namespace hijack (generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1) dropping Miasma via IPFS with C2 at 85.137.53.71, the jscrambler package compromise, and xAI's Grok Build CLI exfiltrating full repository histories to an uncontracted GCS bucket. Grep SBOMs, block the C2, rotate secrets, and treat any Grok-touched repo as disclosed.
- What changes for defense contractors now that CMMC Phase 2 is suspended?
- Verification drops from third-party certified to self-attestation against NIST SP 800-171 Rev 2, but the underlying controls are unchanged. Primary liability shifts from bid ineligibility to False Claims Act exposure on inaccurate attestations. Freeze new assessor spend, maintain control readiness and SSP/POA&M documentation to self-attestation grade, and model reinstatement, reform, and cancellation outcomes.
◆ Same day, different angle
Read this day as…
◆ Recent in security
Keep reading.
- SonicWall SMA1000 CVSS 10 Zero-Day Under Active Exploitation
- FSB Center 16 Exploits 18-Year-Old Cisco Flaw in Critical Infra
- Dormant GitHub Account Ships One-Click LoadMaster RCE Kit
- Progress Orders ShareFile Shutdown as MOVEit Pattern Returns
- Pre-Auth libssh2 RCE Exposes curl, Git, and PHP Runtimes
Spot an error? [email protected]