ClarityBeta

Security & Threat Intelligence

The Watch

6 min read · 1,178 words · 3 moves to watch
The Signal

An active phishing campaign is exploiting Microsoft's OAuth device code authentication

The lures are AI-generated with high variability, hosted on Railway PaaS for clean reputation, and hundreds of organizations are already compromised.

In Play

  1. M365 OAuth Device Code Flow Under Active Exploitation

    Attackers use AI-generated phishing to trick users into Microsoft device auth flows, capturing OAuth tokens valid for 90 days — no password or MFA required. Railway PaaS provides clean infrastructure. Huntress pushed emergency conditional access updates to tens of thousands of tenants.

    Ask Clarity

  2. EDR Evasion: Deno Backdoors and BYOVD in Commodity Attacks

    MuddyWater deployed Dindoor — a Deno-runtime backdoor — against US financial institutions, a US airport, and Israeli defense in February 2026, specifically choosing Deno to dodge PowerShell/Python-tuned EDR. Separately, BYOVD kernel-mode driver attacks are killing AV/EDR in commodity tax-themed phishing. Your detection logic has two new blind spots.

    Ask Clarity

  3. RSAC 2026: Quantified Security Failures and Vishing Surge

    RSAC data confirms structural gaps: endpoint tools fail 20% of the time (~76 days/year unprotected), patches take 127 days on average, and Mandiant reports vishing hit 11% of incidents while email phishing collapsed to 6%. Four vendors launched non-human identity governance products simultaneously. AI is confirmed generating novel exploits, not just accelerating known ones.

    Ask Clarity

  4. AWS Bedrock Attack Paths + AI Infrastructure Security Gaps

    XM Cyber validated 8 privilege escalation paths through a single over-permissioned AWS Bedrock identity — redirecting logs, stealing credentials, hijacking agents, injecting Lambda layers, stripping guardrails — all without triggering redeployment. Simultaneously, OBLITERATUS enables surgical removal of LLM safety guardrails via SVD decomposition, and GhostClaw npm harvested AI API tokens from 178 developers in one week.

    Ask Clarity

  5. Developer Runtime & Protocol Vulnerabilities

    Nine security vulnerabilities across all maintained Node.js versions require immediate patching. PostgreSQL's CancelRequest protocol sends plaintext tokens over a separate unencrypted connection — even on TLS-secured sessions — enabling replay DoS with no fix possible short of protocol redesign. NIST published first DNS security guidance in 13 years.

    Ask Clarity

Deep Dives

Your M365 Tenant Is One AI Phishing Email From a 90-Day, MFA-Invisible Compromise

The Attack Chain Your Controls Can't See

An active phishing campaign is exploiting a structural gap in Microsoft's authentication architecture: the OAuth device code flow. Originally designed for input-constrained devices like smart TVs and IoT hardware, this flow is enabled by default for all users in most Entra ID configurations. Attackers have turned it into a full MFA bypass.

The attack works like this: AI-generated phishing emails — using QR codes, file-share links, and highly varied lures — direct victims to initiate a Microsoft device authentication flow. The attacker captures the resulting OAuth token, which grants persistent access for up to 90 days without requiring the victim's password or triggering any MFA challenge. The phishing infrastructure runs on Railway, a legitimate cloud PaaS, so URLs pass reputation-based email filters.

This attack succeeds after your email filter, after your MFA — at the identity layer where most organizations have the least detection coverage.

Why Traditional Detection Fails

Detection MethodEffectivenessWhy It Fails
Email signature/pattern matchingLowAI-generated lures with high variability defeat pattern matching
URL reputation filteringLowRailway PaaS domains are initially reputation-neutral
MFA enforcementNoneDevice code flow sidesteps MFA entirely by design
Failed login alertingNoneNo failed logins occur — token grant is clean
Standard identity monitoringLowToken usage looks like legitimate API access

Hundreds of businesses are already compromised. Huntress pushed emergency conditional access policy updates to tens of thousands of tenants. If you haven't taken equivalent action, you're exposed.

The Broader Pattern

This campaign is a proof point for a structural shift in cybercrime. The combination of generative AI for high-variability lure generation at scale, easy-to-deploy cloud platforms for disposable infrastructure, and authentication protocol design gaps creates an operating model that will produce increasingly diverse, increasingly evasive attacks. Your defensive architecture needs to shift from pattern-matching at the perimeter to behavioral analysis at the identity and data layers.

What to do

  1. Block device code authentication flow in Entra ID conditional access policies for all users except explicitly exempted service accounts — this is a single-policy change with the highest ROI available today

  2. Query Entra ID sign-in logs for 'deviceCode' grant type over the past 90 days; investigate anomalous locations, bulk mailbox access, and new forwarding rules

  3. Add railway.app and associated subdomains to email gateway and web proxy blocklists; conduct retroactive email log search for Railway-linked URLs

  4. Run a purple team exercise using AI-generated phishing with QR codes and varied templates to measure your SEG's detection rate; if below 80%, procure supplementary behavioral detection

MuddyWater's Deno Pivot and BYOVD Commodity Attacks: Two New EDR Blind Spots Landing Simultaneously

Your Detection Logic Has a Runtime Gap

Two independent threat developments converge on the same conclusion: your EDR's detection logic has exploitable blind spots, and adversaries at both the nation-state and commodity-crime level are actively targeting them.

MuddyWater's Dindoor: Nation-State Detection Evasion

Iranian APT MuddyWater deployed Dindoor, a backdoor built on the Deno JavaScript runtime, specifically chosen because EDR behavioral signatures are tuned for PowerShell and Python — not Deno. The campaign, active in February 2026, targeted a US financial institution, a US airport, a Canadian non-profit, and an Israeli defense subsidiary.

The operational security is deliberate: C2 runs through Cloudflare-fronted domains, exfiltration uses Rclone to Wasabi cloud storage and Backblaze B2, and staging infrastructure sits on deno.land — all legitimate developer/cloud services that blend with normal traffic. Known malicious domains include uppdatefile[.]com, serialmenot[.]com, and moonzonet[.]com.

The absence of static IOCs is a deliberate design choice. By staging infrastructure on commodity cloud services, MuddyWater ensures their traffic blends with legitimate developer and cloud operations traffic.

BYOVD EDR Kill in Commodity Campaigns

Separately, Huntress documented tax-themed social engineering campaigns deploying Bring Your Own Vulnerable Driver (BYOVD) attacks that load kernel-mode drivers to kill AV and EDR processes. This technique — previously associated with nation-state actors like Lazarus Group — is now appearing in everyday phishing campaigns. A single phishing click can blind your entire detection stack if your EDR lacks kernel-level tamper protection.

The Combined Threat Picture

AttributeMuddyWater DindoorBYOVD Commodity Attacks
Threat levelNation-state (Iran/MOIS)Commodity cybercrime
EDR evasionRuntime selection (Deno)Kernel-mode driver kills EDR process
Detection difficultyHigh — no Deno baselinesMedium — driver loading detectable if monitored
TargetsUS finance, airport, defenseTax-season victims broadly
MITRE ATT&CKT1059, T1566, T1567, T1105T1068, T1562.001

The pattern is unmistakable: adversaries across the sophistication spectrum are engineering around endpoint detection — either by choosing runtimes your signatures don't cover, or by killing the detection agent entirely at the kernel level.

What to do

  1. Add Deno runtime monitoring to EDR/SIEM detection stack: create rules for deno.exe/deno process execution, network connections to deno.land, and outbound traffic to s3.wasabisys.com and Backblaze B2 endpoints

  2. Block IOC domains uppdatefile[.]com, serialmenot[.]com, and moonzonet[.]com at DNS and proxy layers

  3. Validate EDR tamper protection against BYOVD kernel-mode kill techniques and verify Microsoft Vulnerable Driver Block List is deployed across all Windows endpoints

  4. Hunt for Rclone exfiltration patterns across your environment — Rclone to Wasabi or Backblaze B2 is MuddyWater's current exfil method

RSAC 2026 Revealed: Your Endpoint Tools Fail 20% of the Time, Vishing Overtook Email Phishing, and Four Vendors Just Declared Non-Human Identity the New Battleground

The Numbers That Should Recalibrate Your Risk Register

RSAC 2026 delivered a rare convergence of quantified operational data that exposes how wide the gap is between assumed and actual defense posture. These aren't vendor opinions — they're measured benchmarks from production environments and incident data across thousands of organizations.

Endpoint Tools Fail More Than You Think

New data presented at RSAC shows endpoint security tools fail approximately 20% of the time, leaving enterprise devices unprotected for roughly 76 days per year. Meanwhile, mean patching delay has ballooned to 127 days. To put this in context: CVE-2026-21992 (the Oracle Identity Manager CVSS 9.8 pre-auth RCE patched this week) at a 127-day average cycle means the median enterprise won't have it patched until late July 2026 — four months of unauthenticated RCE exposure on identity infrastructure.

The Langflow precedent makes this worse: CVE-2026-33017 was weaponized in 20 hours from advisory to working exploit, with full data exfiltration in 25 hours. The era of 127-day patch cycles against 20-hour exploitation timelines is a structural mismatch that cannot be resolved incrementally.

Vishing Is Now the Dominant Social Engineering Vector

Mandiant's 2025 M-Trends report quantifies a fundamental shift in social engineering:

  • Voice phishing (vishing): 11% of all investigated incidents — the fastest-growing vector
  • Email phishing: 6% — a 73% decline from 22% in 2022

Vishing is the hallmark of The Com and Scattered Spider, the groups behind MGM, Caesars, and Okta breaches. Voice channels lack technical controls equivalent to DMARC/SPF/DKIM for email. Most helpdesks still rely on knowledge-based authentication for phone-initiated identity actions — and that's exactly what these groups exploit.

The Non-Human Identity Governance Race

Four major announcements at RSAC targeted the same blind spot simultaneously:

  • Cisco Duo Agentic Identity — IAM for AI agents as first-class identities
  • Palo Alto Prisma AIRS 3.0 — unified agent, app, identity, and runtime security
  • 1Password Unified Access — discovers shadow AI and unmanaged agents
  • Cloud Security Alliance CSAI — nonprofit defining the agentic control plane framework
When four major players launch competing products in the same week targeting the same gap, that gap is real — and your auditors will notice. Non-human identity governance is moving from 'emerging concern' to 'audit finding' faster than most organizations are prepared for.

AI Is Generating Novel Exploits

Former Deputy NSA Anne Neuberger and Method Security CEO Sam Jones confirmed at a separate event: AI crossed a qualitative threshold in 2026. In 2025, AI accelerated known TTPs. In 2026, AI is generating genuinely novel exploits and attack techniques. Method Security runs autonomous adversary emulation in Fortune 500 production environments — they're seeing this in real conditions. Google has deployed Gemini agents to process 8-10M dark-web events per day, signaling AI-driven SOC triage is moving from concept to production scale.

What to do

  1. Pull actual endpoint agent uptime and critical-CVE time-to-patch data from your environment and benchmark against RSAC findings (20% failure, 127-day delay); brief CISO with the gap analysis

  2. Implement vishing-resistant helpdesk procedures: eliminate phone-only MFA resets, require callback verification to known employee numbers, and add vishing scenarios to next tabletop exercise

  3. Conduct a non-human identity inventory: catalog all service accounts, API keys, AI agents, and automated systems with production data access, classified by sensitivity and last-used timestamp

  4. Formalize tiered patching SLAs: ≤24h for pre-auth RCE/CVSS 9+, ≤72h for authenticated RCE/CVSS 7-8.9, ≤14d for remainder; pre-authorize emergency patching authority to skip CAB

The bottom line

An active phishing campaign is exploiting Microsoft's OAuth device code flow to grant attackers 90-day MFA-invisible access to M365 tenants, MuddyWater is using Deno-based backdoors specifically to evade your PowerShell/Python-tuned EDR, and RSAC 2026 data confirms your endpoint tools fail 20% of the time while patches take 127 days against a 20-hour exploitation window — block device code flow in Entra ID today, add Deno runtime detection to your SIEM, and stop assuming your defenses work as advertised.