IA – Trackr.Live

§ Category

A Phished OTP Can Buy the Attacker a Passkey in Your Tenant, and the Registration Audit Trail Is Your Most Direct Signal

O-UNC-066 appears built to walk a victim through a fake passkey enrollment while the operator registers an attacker-controlled passkey in the real Entra tenant. It survives the password reset, and the most direct durable evidence is the authentication-method registration audit trail — written from a session your controls let through because the registration action was protected only by relayable MFA.

The BadSuccessor Patch Killed the One-Sided Link. Mutual Pairing Still Leaks the Target’s Kerberos Keys

Microsoft’s August 2025 fix for BadSuccessor (CVE-2025-53779) works — but an attacker who controls a dMSA and can write a target’s migration-link attributes can forge the mutual pairing the KDC now demands and pull that account’s Kerberos key material out of the dMSA key package. The detection has to move from watching one attribute to watching the pairing on the target object.

Cyber Tools

The IKEv1 Bypass Is Client-Controlled. Check Point Logs the Login, Not the Vendor ID That Forged It

CVE-2026-50751 lets an unauthenticated client flip a Check Point gateway’s certificate-verification flag using a crafted IKEv1 vendor ID payload. The catch for defenders: the forged payload isn’t in your normal VPN security logs. The only artifact is a VPN session that came up when it shouldn’t have.

Your Device Code Flow Alert Fires on Every az login. The Signal Is the Broker Token, Not the Prompt

Device code phishing doesn’t defeat MFA — it redirects a legitimately MFA-completed sign-in — and the naive detection drowns in legitimate CLI traffic. The durable signal is the Authentication Broker redemption and the device registration that follows, and the real fix is a Conditional Access authentication-flows block.

Strong Certificate Mapping Only Helps If the CA Owns the SID. ESC16 Takes It Away

Microsoft’s strong certificate mapping enforcement finally landed, and where it’s genuinely in force it does close the naive implicit-mapping hole that made ADCS escalation trivial — a certificate with only a weak name is denied. ESC16 strips the CA-issued SID so the mapping decision falls to whatever’s left: on a compatibility-mode DC that’s weak SAN mapping, and even on a fully-enforced DC it’s an attacker-supplied SID-in-SAN URI the KDC treats as strong. The audit events you’d hunt it with are off by default.

The DPRK Worker’s KVM Is Plugged Into Your Laptop, Not the Internet. Hunt the Sign-In Log Instead

North Korean IT workers don’t breach you — they get hired. The device fingerprint everyone reaches for is spoofable and behind home NAT. The detection that survives contact with production lives in your identity provider’s sign-in logs.

Cyber Tools

RC4 Is About to Go Extinct in Kerberos. So Is Your Kerberoasting Detection

Microsoft’s three-phase RC4 disablement for Kerberos closes a real attack surface and quietly breaks the most common Kerberoasting detection rule in the process. The signal you keyed on is about to disappear, and the attack isn’t going with it.

Token Protection Binds the PRT, Not the Browser Session AiTM Actually Steals

Conditional Access Token Protection is the control everyone cites as the answer to adversary-in-the-middle phishing. It binds the PRT for native apps on Windows and skips browsers entirely — which is exactly where the stolen cookie lands. Detection, not the control, is still your line.

FortiBleed Has No Single Patch — It’s Credential Debt, Not a CVE. Your Edge Is an Identity Perimeter Now

FortiBleed isn’t a Fortinet vulnerability — it’s years of leaked configs, infostealer logs, and legacy password hashing compounding into tens of thousands of working FortiGate logins. There’s nothing to patch. Here’s what that changes for detection and response.

Service Principal Credential Adds Are the Entra Persistence Move Conditional Access Won’t See

An attacker with app-management rights doesn’t need another password. They add their own secret to a trusted service principal and authenticate as the app, outside MFA and outside Conditional Access. Here is what the audit event looks like, what the first round of tuning has to fix, and where the cleanest preventive control hides behind a SKU you probably didn’t buy.