Netcrook
#identity security
When a Browser Becomes the Break-In Tool
A token-theft workflow tied to Umbrij shows how ordinary browser developer features can be turned into quiet access to corporate Gmail and other Google services.
When Secrets Outnumber People, Identity Becomes the Real Attack Surface
Non-human identities like service accounts, tokens, and secrets are often dozens of times more numerous than users, and that imbalance makes credential lifecycle management a core security problem.
When Agents Start Buying Software, the Real Battleground Becomes Identity, Not Interface
Gartner’s forecast of US$234 billion in exposed SaaS spend is less about a software collapse than a shift in control, where permissions, contracts, and machine memory matter more than dashboards.
When the Consent Screen Becomes the Crime Scene
ConsentFix and ClickFix show how a fake prompt and an OAuth flow can turn Microsoft 365 identity controls into a fast-moving token theft problem.
When Microsoft Sign-In Becomes the Trap: ARToken and the New Token-Theft Playbook
A phishing kit tied to Microsoft 365 targeting shows how attackers can lean on legitimate cloud login flows, trusted collaboration branding, and edge-hosted delivery to turn identity into the attack surface.
When the Directory Falls, the Backup Is Not the Finish Line
Identity recovery is less about bringing servers back online and more about proving that authentication, authorization, and trust can safely resume.
81 Million Login Probes Turn a Routine Identity Weakness Into a Cloud Alarm
A two-week burst of automated sign-in attempts shows how password spraying can strain cloud defenses even when the full extent of account impact is still unclear.
The SaaS Blind Spot: Why Security Teams Are Now Chasing Settings, Identities, and OAuth Grants
SSPM shifts cloud defense toward the place many teams least control: the configuration and delegated access of SaaS apps they use every day.
81 Million Logins, 78 Compromises: The Password-Spray Flood Hitting Microsoft 365
A massive credential campaign against Microsoft 365 shows how distributed password spraying can turn identity controls into the real front line of cloud defense.
81 Million Login Attempts, 78 Accounts: The Quiet Machinery Behind a Microsoft 365 Spray Campaign
A two-week wave of password spraying against Microsoft 365 shows how weak credentials and permissive sign-in controls can turn identity into the softest layer of cloud security.
How a Port Can Go Dark Without Touching the Control Room
The Porto di Ancona case points to a harsh lesson for critical infrastructure: cloud identity failures can disrupt operations even when industrial systems are reportedly untouched.
81 Million Login Shots Fired at Azure CLI - and Identity Teams Take the Hit
A huge password-spray wave against Microsoft’s command-line cloud tooling shows why authentication, not code, is often the real battleground in modern cloud attacks.
Millions of Password Guesses, One Cloud Blind Spot: Azure CLI Becomes a Credential Testbed
A high-volume spray campaign against Azure CLI sign-ins shows how cloud attackers often hunt for weak identity settings instead of breaking software.
When AI learns to race defenders, the patch window starts to vanish
A frontier model tied to Anthropic is described as finding thousands of bugs in weeks, exposing a deeper problem: remediation is still human-speed while discovery may no longer be.
Why a 40% Business Discount on Password Management Still Signals a Security Problem
NordPass is pushing its Business plans with a steep discount, and the real message is that safer credential handling remains a budget decision for many companies.
AppViewX Bets on the Hidden Identity Layer Powering Cloud and AI Workloads
A new partner push around machine and agent identity security shows how enterprise trust is moving beyond human logins and into the cryptographic systems that keep software, devices, and AI agents in check.
AppViewX Pushes Machine Identity Into the Channel Playbook
AppViewX has launched its first global Partner Program, pairing machine and agent identity security with enablement and co-selling support after its Agent Identity Security rollout.
WhatsApp’s New Handle Game Could Shrink a Big Privacy Leak, But It Also Changes the Attack Surface
Username reservations ahead of WhatsApp’s planned 2026 rollout are designed to let people chat without handing over a phone number, a modest-looking change with outsized identity and abuse implications.
DragonForce’s Latest Leak-Site Claim Puts an Agritech SaaS Platform in the Frame
A public victim listing names Agroprime, but the available evidence does not independently confirm compromise, data theft, or operational disruption.
Netflix Tightens Profile Access, Turning Shared Logins Into Verified Identities
A move toward unique email addresses for most profiles adds friction to shared accounts and pushes Netflix further into profile-level access control.