What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent behaved as intended.
AI agents are moving into production faster than security teams can govern them. They are connecting to apps, handling data, calling APIs, and acting across business systems—often without the same controls applied to human users. According to Okta’s Global CISO Insights 2026 report, only 47% of CISOs are confident they can identify every AI agent in their environment. Even among those who feel
A Kosovar national has pleaded guilty to operating Rydox, a large illegal online marketplace that sold stolen personal information, login credentials, credit card details, and cybercrime tools. Kosovo law enforcement and Albania's Special Anti-Corruption Body (SPAK) arrested 28-year-old Ardit Kutleshi and two other Rydox administrators (Jetmir Kutleshi and Shpend Sokoli) in December 2024. The arrests were part of a joint international law enforcement operation that also shut down the Rydox marketplace, seized the Rydox[.]cc domain, and seized its servers in Kuala Lumpur with the help of the Royal Malaysian Police. Ardit Kutleshi was extradited from Kosovo to the United States in 2025, when he was charged with crimes related to their Rydox admin role, including conspiracy to commit identity theft, aggravated identity theft, two counts of identity theft, access device fraud, and money laundering.
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-5430 WSO2 Multiple Products Path Traversal Vulnerability CVE-2026-71362 Adobe Commerce and Magento Incorrect Authorization Vulnerability The first flaw added to the catalog, tracked as CVE-2026-5430 (CVSS score 10.0), is an authentication bypass in multiple WSO2 products caused by improper verification of JWT signatures, allowing an attacker to use an unsupported signing algorithm to gain unauthorized access and potentially take over accounts. The second flaw added to the catalog, tracked as CVE-2026-71362 (CVSS score 9.1), is an incorrect authorization vulnerability in Adobe Commerce that can allow an unauthenticated attacker to escalate privileges and gain access to sensitive resources without user interaction. In August 2026, hackers began targeting CVE-2026-71362 shortly after its public disclosure. The vulnerability allows unauthenticated attackers to switch customer sessions, hijack accounts and access private data. Cybersecurity firm Sansec blocked the first exploitation attempts after Adobe published its advisory. The flaw affects Commerce, Commerce B2B and Magento Open Source versions through the July 2026 patches. Adobe released an isolated fix and urged users to patch. “Adobe has released APSB26-92 as isolated patch files. The update fixes seven vulnerabilities, including an unauthenticated customer account takeover with a CVSS score of 9.1. Sansec Shield already blocks exploitation attempts.” reads the advisory published by Sansec. “Sansec reviewed the patch and confirmed that the vulnerability lets attackers switch a customer session to another customer account. This gives them access to the victim’s account and private customer data.” Sansec pointed out that an attacker can exploit the flaw without an existing account, administrator privileges, or user interaction. Adobe fixed how Magento handles customer identity in account sessions. The remaining flaws include stored cross-site scripting and authorization issues. According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog. Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by September 27, 2026. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, CISA)
Microsoft has notified IT administrators that users may experience Always On VPN connection issues after installing the September 2026 Windows 11 security updates. Always On VPN is a remote access solution that replaces the legacy DirectAccess technology and works with domain-joined, non-domain-joined, and Microsoft Entra ID–joined devices. It is available on Windows 10, Windows 11, and Windows Server, and it runs seamlessly in the background, establishing a secure tunnel back to the corporate network automatically whenever a device connects to the internet. Always On VPN also lets administrators define which apps and services can use the VPN connection, and it supports modern VPN protocols like IKEv2 and SSTP, plus multi-factor authentication (MFA) for better security. In a service alert seen by BleepingComputer and shared by Microsoft MVP Susan Bradley, Microsoft says that affected customers may experience issues when their systems attempt to connect to their organization's enterprise network via Always On VPN.
Microsoft, Coinbase and law enforcement took down EvilTokens, a phishing kit that compromised 12,000 inboxes through device-code phishing and AI. EvilTokens showed up in February 2026 and moved fast. Within months it had compromised more than 12,000 inboxes across over 10,000 organizations. Microsoft says the EvilTokens platform, operated by Storm-2992, is a phishing-as-a-service kit sold to cybercriminals through Telegram. The service costs $1,500 upfront and $500 per month, with additional tools available for extra fees. Its control panel lets customers build and manage phishing campaigns, customize landing pages, configure domains, track victims, and manage stolen authentication tokens. The platform includes 44 themes and uses AI to create targeted phishing emails based on a victim’s role. Lures can impersonate Microsoft services, document signing platforms, cloud providers, payment systems, and other business services. What made EvilTokens different wasn’t the phishing itself, it was the AI wrapped around it. Once a mailbox was open, an AI assistant sifted through the contents, mapped who controlled payments, and flagged the accounts worth targeting. A task that used to take a skilled operator hours now took the platform seconds, which meant far less skilled criminals could run campaigns that used to require real expertise. “Post-compromise, EvilTokens enabled threat actors to utilize AI assistants to sift through victim mailbox activity and engineer a phishing message based on the accessible email content. EvilTokens also allowed threat actors to conduct Microsoft Graph reconnaissance to map organizational structure and permissions, enabling continued access and potential lateral movement while tokens remain valid.” reads the report published by Microsoft. “While token-targeting phishing is not new, it has become far more common and industrialized over the last several years as organizations adopted multifactor authentication (MFA).” The technique at the core of it is called device code phishing, and it’s worth understanding because it doesn’t touch your password at all. Device code sign-in exists for things like smart TVs and conference room devices that can’t handle a normal login screen. You get a short code on the device, then type it into a browser somewhere else to finish signing in. “Device code phishing occurs when threat actors insert themselves into this process. Instead of a legitimate device requesting access, the threat actor initiates the flow and provides the user with a code through a phishing lure.” states Micorsoft. “When the user enters the code, they unknowingly authorize the threat actor’s session, granting access to the account without exposing credentials.” That gap between devices is exactly what gets abused. A fake email, styled as an invoice or a DocuSign request, sends the victim to a page that’s quietly requested a real Microsoft device code behind the scenes. The victim sees the code, gets told to enter it on Microsoft’s actual login page to “verify their identity,” and does exactly that. Below is the description provided by Coinbase of the attack on Microsoft’s device code login flow: The attacker’s access tokens survived password resets. Attackers registered devices in Entra ID for persistent access, created hidden inbox rules to suppress alerts and delete evidence, then impersonated finance staff, vendors, or executives inside live payment threads to redirect payments, including cryptocurrency. Victims received convincing, AI-generated emails styled as invoices, shared documents, or voicemail notifications, with malicious links embedded. The links led to fake Microsoft or DocuSign pages displaying a code and instructing victims to enter it on Microsoft’s real website to “verify their identity.” Doing so authorized the attacker’s session. Because authentication happened on Microsoft’s legitimate infrastructure, MFA was bypassed entirely. The victim’s own MFA never gets a chance to fire, because the attacker’s session is the one that gets approved, not theirs. No password stolen, no suspicious login flagged, just a normal-looking authentication that happened to authorize the wrong person. From there the kit did the boring but effective part. Attackers registered new devices to keep access alive past a password reset, built hidden inbox rules to bury their tracks, and then slid into ongoing email threads to redirect payments, sometimes in cryptocurrency, sometimes straight to a bank account. Taking it down needed more than one company. Microsoft’s Digital Crimes Unit led the legal side, seizing 50 websites and disabling over 175 domains tied to the operation. Coinbase, Cloudflare, Health-ISAC, OpenAI, Railway, SpyCloud, and Shadowserver all contributed pieces, and the mix says something about how these takedowns actually work now: it’s rarely just the software vendor. Coinbase’s part is the one worth lingering on, because it’s the least obvious. EvilTokens sold its kits for crypto and moved the proceeds through the Tron blockchain, so Coinbase’s Global Intelligence team followed the money instead of the malware. They traced roughly $1.1 million in revenue across four addresses, found over 1,000 deposits from more than 700 separate wallets, and mapped the full path from payment to cash-out. That money trail is what led to a name, and the name led to an arrest. On September 11, London’s Metropolitan Police picked up the operator, seizing devices and evidence for examination. One detail from the investigation lands somewhere between alarming and funny: parts of the platform itself were reportedly “vibe coded,” meaning the criminals used AI to help build their own criminal tooling. The irony writes itself. For anyone defending a network against this, the practical response comes down to a few habits worth making automatic. Treat any device code you didn’t request yourself as an immediate red flag, since no legitimate service asks you to “verify” anything by entering a code it sent you. Verify payment changes through a phone call to a known number, not through the email thread where the request showed up, and push toward passkeys or hardware keys wherever the option exists. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, phishing)
Two MikroTik RouterOS SSH vulnerabilities chained together let attackers take full administrative control of Internet-exposed routers without a password, SSH key, or completed authentication. The chain, which CERT Polska calls MikroTrick, combines an SSH state-machine flaw (CVE-2026-67279) with an argument-injection bug in the RouterOS login process (CVE-2026-86060). Attack logs date to at
Security researchers developed an attack that lets hackers with privileged access register a rogue external MFA provider that steals users' passwords during legitimate login attempts. The technique, dubbed TrustSink by Varonis Threat Labs, can work with any provider that relies on this external authentication model, though the researchers demonstrated the attack using Microsoft Entra. Microsoft Entra supports external MFA providers, which allow organizations to use third-party authentication services to satisfy multifactor authentication requests. According to Microsoft, when a user signs in with a first factor, such as a password, Entra can redirect them to an external MFA provider to complete the required second factor. If the provider returns a valid signed token indicating that the second factor was completed, Entra considers the MFA requirement satisfied.
The EvilTokens platform that compromised more than 12,000 Microsoft accounts at over 10,000 organizations has been disrupted in an effort led by Microsoft’s Digital Crimes Unit (DCU). The phishing-as-a-service (PhaaS) operation emerged in February and was the first to support device code authentication at scale and offer cybercriminals AI-powered features for customizing lures and sifting through compromised inboxes to identify high-value targets. In an announcement today, Microsoft said it coordinated the takedown of EvilTokens’ infrastructure, an action that involved the Health-ISAC, law enforcement, and SpyCloud, an identity threat protection company based in Austin, Texas. Following the investigation, two men, aged 32 and 38, suspected of being administrators of the EvilTokens website were arrested in the U.K.
Security teams have spent decades asking whether an identity has too much access. AI agents raise a harder question: how can we determine which paths an autonomous system can discover, given the access it already has? A person may try several ways to complete a task. A deterministic application follows the flow its developer wrote. But an AI agent is relentless in its pursuit of done. In May
Confirm this action.
Leaving now will discard your changes.