Microsoft again asked Entra ID administrators to migrate users to phishing-resistant methods to avoid sign-in disruptions before it retires SMS and voice authentication in February 2027. This retirement process applies only to Microsoft Entra ID workforce tenant authentication scenarios and not to Azure AD B2C or Microsoft Entra External ID customer identity scenarios. Before Microsoft retires SMS and voice authentication, admins should ensure all users in their organizations use a phishing-resistant method, since they will no longer be able to use them to complete multifactor authentication and log in to their accounts. Admins can choose from passkeys, QR code authentication, FIDO2 security keys, and other Entra ID-supported sign-in methods. "Microsoft-provided SMS and voice authentication will retire starting February 1, 2027. Complete your migration before rollout begins to avoid interrupting users' sign-in experience," Microsoft said in a Microsoft 365 Message Center update on Tuesday.
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authentication in the Oracle Application Object Library of Oracle E-Business Suite. It was patched by Oracle last week as part of its Critical
A credit card skimming group reportedly compromised a shared analytics script used by e-commerce platform Convertr to steal shoppers’ payment data during checkout. The campaign was identified on October 24 and has been attributed to a Brazilian gang, active since at least July 2024, that focuses on infecting online stores running Magento, OpenCart, and WooCommerce platforms. Convertr is a Brazilian e-commerce platform that powers online stores and checkout systems for dozens of major fashion brands in the country, handling R$2 billion ($370M) in sales. E-commerce security firm Sansec says that the attacker modified the Plausible tracker file hosted on a self-managed server operated by Convertr. Ecommerce cybersecurity company Sansec says that the attacker modified the tracker file on a self-hosted server for Plausible, an open source alternative to Google Analytics, managed by Convertr.
French energy giant ENGIE, one of the world's largest power and natural gas providers, confirmed that attackers stole customer data after breaching a marketing platform used by business partners. ENGIE operates in renewable energy, infrastructure, and customer energy supply in 30 countries, employs over 90,000 people, and reported €71.9 billion in revenue last year. An ENGIE spokesperson told BleepingComputer that it cut off the attackers' access to the compromised platform and that they didn't breach the company's internal systems. "ENGIE's internal IT systems were not compromised. ENGIE recently identified unusual data access activity within a tool used by partners as part of their customer prospecting activities and the marketing of energy offers," the spokesperson said. The ENGIE spokesperson didn't say how many customers were affected, but told BleepingComputer the incident is limited to customers in France.
The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. The educational organization detected the breach last Tuesday and disclosed it on Friday. In an update yesterday, the university added another 20,000 staff and students whose PIN codes were exposed. “The University of Copenhagen has confirmed a cyber attack in which hackers gained access to one of the university’s test environments,” the university says. Founded in 1479, the University of Copenhagen is Denmark’s oldest university and one of its leading research institutions. It has approximately 36,800 students and 10,700 employees, with six faculties and more than 200 research centers. The University of Copenhagen is still investigating to determine the extent of the incident, but warns that the following information may have been exposed:
Author: Len Noe, Solutions Architect, BeyondTrust The first question on any incident bridge isn’t about why it happened--it’s whose credentials were used. In my experience, whoever can answer that credential question in the first hour sets the pace for everything after it: what to isolate, what to revoke, whom to notify, and how far the damage could have spread. The teams that can’t answer it spend the first day reconstructing their answer from logs that were never designed to provide it. That discipline is about to be tested by a new kind of actor. On October 16, 2026, the National Institute of Standards and Technology (NIST), the Cybersecurity and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) jointly published ten voluntary practices for incident readiness and response when AI agents act in ways nobody directed.
Researchers found a malicious AGENTS markdown instruction file in a customer’s Downloads folder that tricked an AI coding agent into installing a rogue npm package. They reproduced the attack against OpenAI Codex and demonstrated a related technique against Claude Code to leak OAuth tokens and hijack the account using only the malicious instructions. Markdown files such as AGENTS.md are plain-text files that contain project-specific instructions for AI coding agents, such as the tools to use, how to run tests, and the coding conventions to follow. Researchers at Forever Security, a company that monitors for risks introduced by AI agents and autonomous software, discovered the tactic on a customer’s computer, where a coding agent attempted to install the malicious npm package ‘function-color.’
China-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks at machine speed against hundreds of organizations across aerospace, defense, energy, financial services, government, manufacturing, and more. “Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.” reads the report. “Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.” Storm-0940 has been active since 2021 and has historically relied on password spraying and OAuth application abuse to get into Microsoft 365 environments. Adding ARTEX changed the scale of what they could do. In some attacks, the time between initial targeting and achieving privileged cloud access was under three hours. Before obtaining the ConnectWise credentials, Storm-0940 launched a password spraying attack between October 10 and 14. The attack came from the IP address 144.172.64[.]99. Microsoft recorded more than 151,000 failed login attempts against 327 accounts at eight organizations. Activity peaked on October 11, with 2,900 failed attempts per minute. Forty-eight accounts each received more than 1,000 failed attempts. None of these attempts succeeded. The situation changed on October 15, one day after the ConnectWise breach became public. The AI agents stopped trying passwords and switched to a different attack method. By then, Storm-0940 had obtained the credentials of several ConnectWise cloud application accounts. The agents used these credentials to log directly into customer Microsoft 365 environments. “Storm-0940’s use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.” Microsoft continues. “This allowed the threat actor to operate without requiring an interactive user sign-in. “ The agents used applications that already had permission to access their targets. This allowed the attackers to enter customer environments without requiring users to sign in interactively. In a subset of environments where authentication succeeded, the agents didn’t stop there. They moved into Microsoft Graph and ran directory reconnaissance, modified application credentials to establish persistence, and attempted changes to identities, groups, and privileged roles. Microsoft identified multiple customer environments with evidence of this follow-on activity. The persistence mechanism is the part defenders need to act on now, even if they’ve already disabled the ConnectWise connections. “These changes can remain active as a backdoor even after the original compromised application is mediated.” says the IT giant. An attacker who added their own credentials to a trusted application before you revoked access still has a working key. Reviewing all service principal credential additions since at least October 1 is the right starting point, not October 15 when the public breach was announced. ARTEX is not a tool used only by Storm-0940. Microsoft says threat actors in several regions have used the same framework. Originally open-source, ARTEX was written in Go and can use different AI models to plan and carry out tasks. Researchers at Zscaler and Recorded Future also found a Chinese-speaking group using it to target South Korean financial institutions. The setup used DeepSeek, GLM, and Grok as coordinated AI agents, with GLM checking DeepSeek’s work. After these attacks became public, the project went closed-source. However, anyone who already has a copy can still use it. The speed point is what Microsoft keeps coming back to in its report. Agents don’t take weekends, don’t sleep, and can run multiple attack paths simultaneously. “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.” Microsoft concludes. “Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.” When Storm-0940 had valid application credentials, they didn’t have to iterate slowly. They hit 2,250 tenants with 2,900 sign-in attempts per minute, a pace at which manual detection and response simply can’t keep up. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ARTEX)
Unit 42 explores modern OAuth threats and actionable steps organizations can take to protect their environments. The post The Current Landscape of OAuth Attacks appeared first on Unit 42.
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical.
Confirm this action.
Leaving now will discard your changes.