The Watch

Login-centric detection is blind here by design. Both campaigns operate after a valid token is issued, inside sessions telemetry treats as legitimate.

ShinyHunters ran mid-2025 through mid-2026 against retail, education and manufacturing. Operators posed as IT support and vished employees into approving an attacker-controlled connected app impersonating Salesforce Data Loader. The app inherited user permissions and ran high-volume API exports. No re-authentication. No MFA prompt. Microsoft documents three distinct attack paths. None is a Salesforce platform flaw.

The parallel Entra ID campaign hits Azure tenants now. Attackers spoof legitimate Microsoft OAuth client IDs and POST credentials to the token endpoint via the Resource Owner Password Credentials (ROPC) flow. That validates stolen credentials at scale and skips interactive sign-in logging. The only footprint in default logs is sign-ins with blank application IDs and AADSTS700016 errors. The AADSTS error family also leaks whether username, password, and conditional access each pass. That is a free credential-triage oracle.

None of the three top campaigns this cycle required a CVE. Login-event detection misses all of them.

This ties to the WorkOS Pipes and 'Login with ChatGPT' items. OAuth consent and token brokering are becoming the primary bypass class. Consent-grant monitoring is absent by default in most tenants.

Common thread: trust granted before verification. Signature-feed scanners underweight all three because of it. Two carry no CVE yet.

RabbitMQ 3.13.0+ is the sharpest. An unauthenticated /api/auth endpoint hands out the broker's OAuth client secret. That is full admin takeover. A second flaw lets any zero-permission authenticated user declare queues across a shared vhost. Brokers sit at the trust center of event-driven architectures. Own one and you pivot into everything downstream. Patching does not undo the exposure. Leaked secrets stay valid until rotated.

The U-Boot RCE lives in fdt_get_name/libfdt, code shared with the Linux kernel and barebox. Exposure runs past bootloaders. No auto-patch feed catches it until CVE assignment. The MariaDB regression is the quiet one: a systemd socket-activation default silently re-binds 3306 to all interfaces on update. The Cisco IOS CSRF already carries a CISA-mandated remediation clock.

Two of today's supply-chain hits are confirmed compromises with live IOCs. Not posture warnings.

The @asyncapi npm namespace was hijacked. Three poisoned versions: generator-helpers 1.1.1, generator-components 0.7.1, generator 3.3.1. On import each drops a loader that pulls an encrypted Miasma second stage from IPFS, persisting as sync.js with shell exec, credential theft, and C2 at 85.137.53.71. IPFS staging is censorship-resistant. The loader fires during normal dev/CI import, before the secret scanner runs. Timing is the point. A jscrambler package was also compromised over the weekend. Socket flagged it in six minutes. Batch scanners do not run on that clock.

Structural note. npm 12 went GA with lifecycle scripts disabled by default, which closes the most-abused postinstall path. Legitimate packages break under that setting. The predictable response is a global re-enable, and a global re-enable returns the surface to where it was.

xAI's Grok Build CLI was caught uploading entire repositories to an xAI-controlled Google Cloud Storage bucket, full commit history included, regardless of what the agent read. Full history is where deleted secrets stay. There is no DPA and no contractual no-train assurance. Any repo it touched is confirmed disclosure to an uncontracted processor. Treat it that way.

DOD suspended CMMC Phase 2. Liability moves to self-attestation, whatever the review decides.

The suspension landed weeks before the Nov 10 effective date. A 60-day reform task force is now running, and it has not ruled out killing the program. The driver was cost: a projected $7B+ annual cost to small businesses against ~100 assessors for 100,000+ companies. Do the math on that ratio. Enforcement reverts to NIST SP 800-171 Rev 2 self-assessment plus select government-led evaluations. The framework name changes; the controls in CMMC Phase 2 do not.

The controls survive. Independent verification does not. That is a measurable drop in supply-chain assurance, and it shifts liability onto self-attestation accuracy. A false attestation carries False Claims Act exposure. Programs are freezing external assessor spend and holding readiness investment. Separately, the White House launched Gold Eagle, a federal-plus-industry vulnerability clearinghouse. It is unclear whether Gold Eagle functions as an intel-sharing asset or creates new disclosure and reporting obligations by sector. That answer will arrive before or during an audit.