The Watch

What Changed This Week

Two developments crossed simultaneously that invalidate OTP and push-based MFA as a reliable control for privileged accounts. NovaCookies, a PhaaS platform that splintered from the Sneaky 2FA kit, has expanded Adversary-in-the-Middle phishing from Microsoft-only to multiple services — with Proofpoint tracking peak activity from March through May 2026. Unlike its predecessor, NovaCookies proxies the real login page and steals the authenticated session token, bypassing every MFA method except hardware-bound credentials.

Simultaneously, ClickFix has become what multiple sources call a "dominant malware-delivery vector", impersonating Cloudflare and Google interstitials to drop ResiLoader. It's significant enough that uBlock Origin added native blocking rules — an ad blocker acting as an endpoint control because browsers and EDR weren't catching it.

Why This Is Different From Last Quarter's Phishing

The shift isn't technique — AitM has existed for years. The shift is commoditization and reach. NovaCookies operates as a service platform, meaning operators don't need to build infrastructure or understand the proxy mechanics. When you combine it with a separate M365 password spray that succeeded via previously leaked credentials plus MFA configuration gaps (legacy auth still enabled, per-user MFA instead of conditional access), you get a picture where:

• Token theft works against any service, at scale
• Delivery vectors bypass browser-level controls
• Credential reuse from old breaches feeds the pipeline

Standard MFA is no longer a defensible control against commodity phishing kits. The barrier to running token-theft campaigns has collapsed to a subscription fee.

Your Response Framework

The defensive priority is clear and non-negotiable: FIDO2/passkeys for privileged and high-value accounts. Hardware-bound authentication cannot be proxied — the private key never leaves the device. Everything else is now a speed bump, not a wall.

1. Deploy FIDO2/passkeys for admins and high-value accounts this sprint. Start with IT, security, finance, and executive staff. Conditional Access policies must enforce phishing-resistant methods for these groups.
2. Kill legacy authentication tenant-wide. Disable legacy auth protocols in Entra ID today — they're the gap NovaCookies walks through when conditional access isn't universal.
3. Add session-token anomaly detection. Impossible-travel on token reuse, new device/ASN on active sessions, and concurrent sessions from disparate geolocations. This catches post-compromise even when initial auth succeeds.
4. Push uBlock Origin's ClickFix blocklist to managed browsers and add EDR detection for clipboard-to-shell and browser-spawned PowerShell execution patterns.
5. Force-reset accounts appearing in breach corpora. The M365 spray succeeded because leaked credentials were never rotated — query HaveIBeenPwned or your breach-intel vendor against your directory.

The 'Blind the Monitor' Playbook Is Now Documented

Researchers confirmed what red teams have long suspected: attackers with elevated Azure access can sabotage Microsoft Sentinel itself — altering detection rules, disabling data connectors, and modifying log retention. The result is invisible attack windows where post-exploitation activity generates no alerts because the rules that would fire have been quietly edited or deleted.

This matters more than a typical vulnerability because it's a meta-attack — it doesn't exploit Sentinel code, it exploits the trust relationship between your SOC and its tooling. Three specific tampering vectors were documented:

• Detection rule modification — suppressing or widening thresholds so alerts never fire
• Data connector disablement — cutting telemetry sources at the ingestion layer
• Log retention changes — shortening retention to destroy forensic evidence

Detection is possible via AzureActivity, SentinelAudit, and SentinelHealth logs using targeted KQL queries — but only if you're explicitly watching for it, which most SOCs are not.

Active Campaigns Exploiting Detection Gaps

The timing matters because two active campaigns are hitting healthcare and enterprise targets right now:

Oracle PeopleSoft spree: AdaptHealth filed an SEC breach notice after intruders accessed patient data and internal documents. Attackers made contact on June 15. Multiple sources tie this to a broader PeopleSoft campaign — a repeatable attack pattern targeting cloud-hosted HR and healthcare instances. This is the full HIPAA-plus-securities-compliance nightmare.

Adobe ColdFusion 10.0 CVSS RCE: The late-June security batch patched 11 bugs, including a perfect-score server-takeover exploitable where RDS (Remote Development Services) is enabled. RDS is disabled by default — but "off by default" is not "confirmed off in your environment."

If an attacker can blind your SIEM before the real intrusion begins, your mean-time-to-detect becomes infinite. Monitor the monitor.

Defensive Actions

1. Deploy Sentinel tampering-detection KQL this week. Write rules against AzureActivity, SentinelAudit, and SentinelHealth for: detection-rule edits/deletions, connector state changes, and retention modifications. Alert to a separate, hardened channel.
2. Assess Oracle PeopleSoft exposure immediately. Map every instance (cloud-hosted, HR, healthcare). Hunt for the campaign indicators from the AdaptHealth timeline. If you're in healthcare, brief compliance now.
3. Audit every ColdFusion instance for actual RDS state. Don't trust "off by default" — confirm via direct inspection and apply the late-June 11-bug patch set.
4. Red-team the Sentinel sabotage scenario in a tabletop. Validate your SOC would detect rule tampering and has an out-of-band alerting path if Sentinel itself is compromised.

A Hyperscaler Just Classified Agents as an Exfiltration Vector

Google Cloud embedded agent identity and Model Context Protocol (MCP) attributes directly into VPC Service Controls, explicitly to prevent data exfiltration from compromised autonomous workloads. This isn't a feature announcement — it's a threat-model admission. A cloud provider just declared that autonomous agents are a distinct exfiltration vector serious enough for network-layer enforcement.

The implication: any LLM agent with tool access or cloud credentials now sits outside the IAM and DLP assumptions built for humans and service accounts. Your egress controls have nothing to key on until you enumerate these principals.

Three Converging Signals

1. SkillCloak defeats static vetting. Researchers demonstrated that self-extracting packing defeats all static scanners for AI coding-agent skills/plugins while keeping the malicious payload fully functional. If you're using marketplace-sourced skills with scan-only vetting, that control is now demonstrably insufficient. The AI agent supply chain is a live attack vector.

2. x402 removes attribution checkpoints. Autonomous agents can now discover, invoke, and pay for 20,000+ web-scraping tools in USDC on Base — with no pre-configured API keys or accounts. A compromised agent could autonomously purchase and execute tooling with payment records living on-chain, not in your IAM logs. Two assumptions break simultaneously: attribution and financial rate-limiting.

3. Schema drift erodes guardrails silently. Anthropic's Opus 4.8 and Sonnet 5 are producing malformed tool calls with extraneous off-schema fields — a regression linked to training on the forgiving Claude Code harness. If your harness relies on structured-output validation as a containment boundary, the model is quietly eroding it.

When a hyperscaler builds network-layer controls specifically for agent exfiltration, that's not a product launch — it's a threat-model admission that your current controls don't cover this class of principal.

Building the Foundation

This is a monitor-and-build theme, not a patch-tonight event. The controls don't exist yet in most environments — you need to create them.

1. Inventory every agent principal this quarter. Map LLM agents with tool access, their identities, egress paths, MCP connections, and credential scopes. You cannot enforce policy on principals you haven't cataloged.
2. Move from static to behavioral vetting for agent skills. SkillCloak proves scan-only is insufficient. Implement behavioral sandboxing and explicit allow-listing. Freeze new skill installations until you have a vetting process.
3. Add schema-compliance rate to your agentic monitoring. Malformed tool calls from Opus 4.8/Sonnet 5 should alert, not silently pass. Enforce reject-on-unknown-field at every LLM-to-tool boundary.
4. If on GCP, pilot agent identity rules in VPC Service Controls in a non-prod perimeter — validate they actually block exfiltration from a simulated compromised agent before relying on them.
5. Govern autonomous agent payments. Require any agent that transacts to route through a spend-governed proxy with rate limits, endpoint allowlists, and human-in-the-loop above defined thresholds.