IAM Week in Review: Oct 26 – Nov 1, 2026

Key Takeaways

Identity and Access Management (IAM) environments are currently facing a transition toward phishing-resistant standards as legacy multi-factor authentication (MFA) methods prove insufficient against modern threats. Microsoft is mandating a shift to passkeys by 2027, while attackers are increasingly leveraging legitimate protocols like the Device Authorization Grant (RFC 8628) to bypass traditional defenses.

Security professionals must prioritize the protection of network edge devices and enterprise resource planning (ERP) systems, which have become primary targets for large-scale credential harvesting. The emergence of AI-generated phishing and sophisticated Android spyware further necessitates a move toward hardware-backed credentials and continuous access monitoring.

Microsoft Urges Entra ID Admins To Migrate Users To Passkeys

Microsoft has issued a formal reminder to Entra ID administrators regarding the mandatory transition to phishing-resistant authentication methods. This initiative focuses on the adoption of passkeys based on the FIDO2 standard to replace aging legacy systems. The primary driver for this shift is the planned retirement of SMS and voice-based authentication services in February 2027 (Bleeping Computer 2026).

Administrators must begin planning for this decommissioning to avoid significant sign-in disruptions for their user bases. SMS and voice authentication are increasingly targeted by attackers using techniques like SIM swapping and telephony interception. By moving to passkeys, organizations can ensure that authentication is cryptographically bound to the device and the specific service origin.

The migration process involves updating authentication method policies within the Entra admin center and ensuring user hardware compatibility. Passkeys offer a superior security model by requiring "intent to sign" from the user, typically through a biometric gesture or a local PIN. This mechanism ensures that the credential cannot be easily phished through traditional social engineering or proxy-based attacks.

Implementation Workstream: Passkey Enrollment

To successfully migrate a workforce, IAM teams should follow a structured rollout that prioritizes high-risk accounts. Start by identifying users who currently rely solely on telephony-based MFA methods through the Entra ID authentication methods usage report. This data provides the baseline for the migration effort and helps quantify the remaining risk.

Once the baseline is established, administrators should enable the FIDO2 security key provider in the tenant settings. This allows users to register compatible hardware keys or platform authenticators, such as Windows Hello or Apple iCloud Keychain. A phased enrollment approach is recommended, starting with IT administrators and executive leadership before moving to the general employee population.

Technical Trade-offs

While passkeys offer the highest level of security, they introduce new lifecycle management challenges. Organizations must decide between hardware-bound passkeys (security keys) and synced passkeys (cloud-stored). Hardware-bound keys offer the highest security but require physical distribution, while synced passkeys offer better user recovery options but rely on the security of the underlying consumer cloud account.

Practitioners should also consider the "bootstrap" problem—how a user registers their first passkey if they have no other secure factors. Implementing Temporary Access Passes (TAP) is the standard method for secure, time-limited onboarding in the Entra ID ecosystem. This ensures that the enrollment process itself does not become a vulnerability.

What to do:

• Execute an authentication methods audit in the Entra ID portal to identify every user still utilizing SMS or voice-based factors.
• Configure and enable the "Passkeys (FIDO2)" authentication method policy, ensuring that "Enforce attestation" is considered for high-security environments.
• Develop a communication plan that informs users of the February 2027 deadline and provides clear instructions for registering modern credentials.

American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed

A sophisticated phishing campaign known as Skyw4lker is currently targeting organizations in the United States by exploiting the Device Authorization Grant flow. This protocol, defined in RFC 8628, was originally designed for devices with limited input capabilities, such as smart TVs or IoT sensors. Attackers are now repurposing this flow to gain unauthorized access to corporate cloud environments (The Hacker News 2026).

The Skyw4lker campaign does not rely on traditional credential theft where a user enters their password into a fake form. Instead, it tricks users into visiting a legitimate Microsoft authorization page and entering a specific "user code" provided by the attacker. Once the user completes the login and grants consent on the official site, the attacker's script receives an OAuth 2.0 access token and refresh token.

This method is particularly dangerous because it bypasses many traditional email security filters and DNS-based protections. Since the user interacts with the genuine microsoft.com/devicelogin URL, there are no "lookalike" domains for security tools or users to detect. The resulting session is fully authenticated and often satisfies MFA requirements if the user performed MFA during the legitimate login process.

graph TD A["Attacker sends phishing email with User Code"] -->|"User clicks link"| B["User enters code on official Microsoft site"] subgraph AUTH_PROCESS ["RFC 8628 Flow"] B -->|"User authenticates and consents"| C["Entra ID validates request"] C -->|"Issues tokens to Attacker's client"| D["Attacker obtains Refresh Token"] end D -->|"Persistent API access"| E["Data exfiltration from Outlook/Teams"]

Mitigation Strategies for Device Flow Abuse

IAM professionals must evaluate whether the Device Authorization Grant is necessary for their standard business users. In most corporate environments, this flow is only required by developers using the Azure CLI or users of specific IoT hardware. Disabling the flow for the general population is a highly effective "low-hanging fruit" security measure.

If the flow cannot be disabled entirely, Conditional Access (CA) policies should be used to restrict its use. For example, policies can be configured to only allow the device code flow from known corporate IP ranges or from devices that are marked as compliant in the organization's Unified Endpoint Management (UEM) system. This ensures that even if a user is tricked into entering a code, the token issuance will be blocked if the request originates from an untrusted context.

What to do:

• Implement a Conditional Access policy in Entra ID that explicitly blocks the "Device Code Flow" for all users except those in a specific, audited exception group.
• Configure alerting in the Azure Monitor or SIEM to flag any successful logins using the "Device Code" authentication method from unexpected geographic locations.
• Educate help desk staff to recognize "unsolicited authorization requests" as a primary indicator of a Skyw4lker-style attack.

Hackers Breach Enterprise Firewalls And VPNs, Exposing Over 70,000 Credentials

Recent investigative reports have detailed a massive campaign targeting network edge devices, resulting in the exposure of over 70,000 sets of credentials globally. The attackers focused on widely deployed infrastructure, including Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls (The Hacker News 2026). These devices often serve as the first line of defense, making their compromise a critical failure point for organizational security.

The campaign highlights a significant risk in how organizations manage the identities used for network infrastructure. Often, these devices use local administrative accounts or service accounts that are not integrated with the central identity provider. When these edge devices are breached, the stored credentials can be harvested and used for lateral movement across the internal network.

The scale of this exposure—70,000 credentials—suggests that attackers are using automated tools to probe for vulnerabilities and extract data at high velocity. Once access is gained to the firewall or VPN gateway, the attackers can intercept traffic, redirect users to malicious sites, or use the compromised device as a pivot point to attack internal servers and databases.

Common Risks in Edge Infrastructure

Identity Integration

Strengths

• Centralizing edge device authentication via SAML or OIDC allows for unified logging and the application of global MFA policies.
• Modern gateways typically support external identity providers (IdPs) to reduce the reliance on local, static passwords.

Limitations

• Misconfiguration of the integration can lead to "fail-open" scenarios where the device allows access if the IdP is unreachable.
• Many organizations still rely on legacy RADIUS or LDAP integrations that do not natively support modern phishing-resistant MFA.

Vulnerability Management

Strengths

• Rapid patching of known vulnerabilities in SSL-VPN components is the most effective defense against automated harvesting campaigns.
• Disabling unused features, such as web-based management portals on the public interface, significantly reduces the attack surface.

Limitations

• Edge devices are frequently targeted by zero-day exploits, meaning even fully patched systems can be at risk during the initial hours of an outbreak.
• The "set and forget" nature of network hardware often leads to delayed patching cycles compared to standard operating systems.

What to do:

• Immediately rotate all administrative and service account credentials for every Fortinet and Palo Alto Networks device in the environment.
• Transition edge device management and VPN authentication to a modern identity provider using SAML 2.0 or OpenID Connect to enforce MFA.
• Ensure that management interfaces (HTTPS/SSH) are never exposed to the public internet and are only accessible via a secure management VLAN or "jump box."

AI-Generated Fake Login Pages Are Making Account Takeovers Easier

Generative AI is revolutionizing the phishing landscape by enabling attackers to create highly convincing, localized, and technically sophisticated fake login pages. These pages are no longer just static forms; they are often dynamic proxies that can capture MFA codes in real-time or hijack active session cookies (The Hacker News 2026). This evolution makes traditional security awareness training, which focuses on "spotting the typo," increasingly obsolete.

Attackers use AI to scrape the visual elements of a target organization's legitimate login portal, including logos, background images, and CSS styles. The resulting "pixel-perfect" replicas are then hosted on compromised domains or legitimate cloud hosting services. Some of these pages go beyond simple credential theft and act as "Adversary-in-the-Middle" (AiTM) proxies, relaying the user's credentials to the real service and passing the MFA challenge back to the user.

Once the user completes the MFA challenge on the fake page, the attacker captures the resulting session cookie. This allows the attacker to bypass MFA entirely in subsequent requests, as they are now using a valid, authenticated session. This technique is highly effective against TOTP (authenticator apps) and SMS-based MFA, which do not have the origin-binding protections found in FIDO2.

What to do:

• Accelerate the deployment of FIDO2-based authentication, as it is the only standard that effectively mitigates AiTM proxy attacks through origin verification.
• Implement "Continuous Access Evaluation" (CAE) to allow the identity provider to revoke sessions in real-time if a risk signal, such as an IP change, is detected.
• Use web security gateways to block access to newly registered domains and domains with low reputation scores, which are frequently used to host AI-generated phishing pages.

UCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts

A rentable Android spyware kit named uCreator has been identified as a significant threat to mobile-based authentication. The malware is distributed through tampered versions of popular messaging applications like Telegram and WeChat. Once installed, uCreator can intercept 2FA codes, steal session data, and even clone accounts to gain access to sensitive communications (The Hacker News 2026).

This spyware highlights the inherent risk of using a single mobile device as both a communication tool and an authentication factor. If an employee's device is infected with uCreator, any 2FA codes received via SMS or within the messaging apps themselves are immediately accessible to the attacker. The malware operates at the OS level, allowing it to read screen content and intercept system notifications before the user can even react.

The distribution method—hiding code inside working copies of legitimate apps—is a common tactic to bypass user suspicion. Users who download apps from third-party sources or unofficial repositories are at the highest risk. This underscores the importance of strict mobile device management (MDM) policies that prevent the installation of non-vetted applications on devices with access to corporate data.

What to do:

• Enforce a policy that prohibits the installation of applications from "Unknown Sources" on all mobile devices enrolled in the corporate MDM/UEM.
• Transition high-privilege users away from SMS or app-based OTP and toward hardware security keys that do not rely on the mobile OS for security.
• Conduct regular audits of mobile device compliance, flagging any devices that are rooted, jailbroken, or running unauthorized versions of core applications.

Google To Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.

Google is introducing a significant change to the Android ecosystem by allowing approved third-party app stores to perform one-tap installs and background updates. Starting December 1, 2026, this feature will be available to stores that pass rigorous identity checks and submit their catalogs for ongoing malware scanning by Google (The Hacker News 2026). This change is currently restricted to regions outside the United States.

For IAM and mobile security professionals, this introduces a new layer of complexity in managing the "identity" of the app source. The trust previously centralized in the Google Play Store is now distributed across multiple approved entities. Organizations must now decide which third-party stores they trust and how to reflect that trust in their device posture calculations.

While Google's malware scanning provides a baseline of security, the ability for apps to update in the background without user intervention increases the risk of "version-flip" attacks. In such an attack, a legitimate app is updated with malicious code after it has already been installed. Security teams must ensure that their mobile threat defense (MTD) tools are capable of scanning apps from all sources, not just the official store.

What to do:

• Update Mobile Device Management (MDM) configurations to explicitly define which app stores are permitted to perform background updates on managed devices.
• Review international device policies to account for the geographic availability of this feature, ensuring consistent security across global regions.
• Integrate Mobile Threat Defense (MTD) solutions that provide real-time scanning of all installed packages, regardless of the originating store.

Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch

Threat actors have begun actively probing for CVE-2026-101767, a critical improper authentication vulnerability in the Oracle Application Object Library of the Oracle E-Business Suite (EBS). This flaw carries a CVSS score of 9.8 and allows for remote code execution (RCE), potentially giving attackers full control over the ERP environment (The Hacker News 2026). The speed at which attackers began targeting this flaw—just days after the patch was released—highlights the high value of ERP data.

Oracle EBS is often the core repository for an organization's financial and HR data. A compromise of this system allows an attacker to manipulate payroll, alter supplier information, or create fraudulent identities that can be used for further internal attacks. Because EBS is a complex, legacy-heavy environment, many organizations struggle to apply patches quickly without extensive testing, leaving a wide window of opportunity for exploitation.

From an IAM perspective, the Oracle Application Object Library is a critical component that manages user sessions and permissions. An authentication bypass at this level effectively nullifies the entire security model of the application. Organizations must treat ERP systems as "Tier 0" assets, requiring the highest level of protection and monitoring.

What to do:

• Prioritize the installation of the Oracle October 2026 Critical Patch Update across all production and non-production EBS environments immediately.
• Deploy an Identity-Aware Proxy (IAP) in front of the Oracle EBS web interface to require strong, phishing-resistant authentication before a user can even reach the application login page.
• Implement strict network segmentation, ensuring that the EBS application tier is not directly accessible from the public internet or from general-purpose employee subnets.

FBI Seizes Virtualine Domain Over Alleged Criminal Hosting and Bitcoin Money Laundering

The U.S. Department of Justice has successfully seized the domain of Virtualine, a "bulletproof" hosting provider that facilitated widespread criminal activity. The provider was used to host malware, phishing infrastructure, and illicit content, while also engaging in money laundering via Bitcoin (The Hacker News 2026). This seizure represents a significant disruption to the backend infrastructure used by many account takeover (ATO) actors.

Bulletproof hosting providers are a cornerstone of the cybercrime economy because they intentionally ignore abuse reports and provide a stable platform for malicious activities. When law enforcement takes down such a provider, it forces attackers to migrate their infrastructure, which can temporarily break active phishing campaigns and malware command-and-control (C2) channels.

For identity professionals, this event serves as a reminder to monitor for traffic originating from known bulletproof hosting ranges. Attackers often use these providers to launch automated credential stuffing attacks or to host the proxy servers used in AiTM phishing. By integrating threat intelligence about these providers into the identity provider's risk engine, organizations can proactively block high-risk login attempts.

What to do:

• Review the organization's Web Application Firewall (WAF) and Identity Provider (IdP) logs for any historical traffic associated with the Virtualine IP ranges.
• Update "Impossible Travel" and "Anonymous Proxy" detection rules to ensure that traffic from known bulletproof hosting providers is automatically challenged with MFA or blocked.
• Subscribe to a reputable threat intelligence feed that specifically tracks the infrastructure of bulletproof hosting providers to maintain an up-to-date blocklist.

What To Watch

The coming year will be defined by the "Passkey Tipping Point." As the 2027 deadline for retiring legacy Entra ID authentication methods approaches, organizations will face increasing pressure to modernize their user enrollment and recovery workflows. This transition will likely reveal hidden dependencies on SMS-based systems in legacy applications and automated processes.

We should also expect a continued evolution of "Identity-Centric" attacks. The Skyw4lker campaign and the targeting of Oracle EBS suggest that attackers are moving away from simple password theft and toward the exploitation of core authentication protocols and ERP object libraries. The security of the "Source of Truth" for identities will become a primary focus for auditors and security architects alike.

Finally, the disruption of infrastructure like Virtualine will lead to a fragmentation of the hosting market. Attackers will likely move toward more decentralized or "living off the cloud" techniques, using legitimate services like GitHub, Trello, or AWS to host their malicious payloads and C2 infrastructure. This will require IAM teams to implement more granular, context-aware access policies that can distinguish between legitimate and malicious use of trusted cloud platforms.