corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a07df3-590d-7133-afb5-e7c9b447d048

Token Theft in Microsoft Entra ID (Part 1 of 4): Threat Landscape and Attack Techniques

ERNW Insinuator · published 24 August 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at insinuator.net Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
77
Words captured
3,414

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://ernw.de/en/whitepapers/issue-80.html
ernw.de
https://attack.mitre.org/matrices/enterprise/windows/
attack.mitre.org
https://www.bitkom.org/sites/main/files/2025-06/bitkom-pressekonferenz-cloud-report-2025-praesentation.pdf
bitkom.org
https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token
learn.microsoft.com
https://doi.org/10.5220/0011061200003179
doi.org
https://specterops.io/blog/2025/10/15/naa-or-broci-let-me-explain/
specterops.io
https://datatracker.ietf.org/doc/html/rfc6749
datatracker.ietf.org
https://openid.net/specs/openid-connect-core-1_0.html
openid.net
https://datatracker.ietf.org/doc/html/rfc7519
datatracker.ietf.org
https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-2026
cloudsecurityalliance.org
https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2024
microsoft.com
One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens Read at the source ↗
dirkjanm.io
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69836
msrc.microsoft.com
https://www.microsoft.com/en-us/security/blog/2025/02/13/storm-2372-conducts-device-code-phishing-campaign/
microsoft.com
Hackers target travelers through hotel and public Wi‑Fi networks Read at the source ↗
microsoft.com
https://www.microsoft.com/en-us/security/blog/2026/05/04/breaking-the-code-multi-stage-code-of-conduct-phishing-campaign-leads-to-aitm-token-compromise/
microsoft.com
https://github.com/kgretzky/evilginx2
github.com
https://github.com/drk1wi/modlishka
github.com
https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/
microsoft.com
https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025
microsoft.com
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication
learn.microsoft.com
https://datatracker.ietf.org/doc/html/rfc6750
datatracker.ietf.org
https://github.com/dirkjanm/ROADtoken
github.com
https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-27
datatracker.ietf.org
https://github.com/HackmichNet/AzTokenFinder
github.com
https://github.com/anak0ndah/OAuthBandit
github.com
https://github.com/R3alM0m1X82/SpecterBroker
github.com
https://github.com/dirkjanm/ROADtools/wiki/ROADtools-Token-eXchange-(roadtx
github.com
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-plan-prerequisites-phishing-resistant-passwordless-authentication
learn.microsoft.com
https://i.blackhat.com/BH-USA-26/Presentations/BHUS26-Grafnetter-Pass-the-Passkey-WP.pdf
i.blackhat.com
https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-AiTM-phishing-sites-as-entry-point-to-further-financial-fraud/
microsoft.com
https://datatracker.ietf.org/doc/html/rfc8628
datatracker.ietf.org
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-user-consent
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/manage-app-consent-policies
learn.microsoft.com
https://www.bleepingcomputer.com/news/security/phishing-attack-hijacks-office-365-accounts-using-oauth-apps/
bleepingcomputer.com
https://www.huntress.com/blog/dont-sweat-clickfix-techniques
huntress.com
https://www.huntress.com/blog/clickfix-malware-buried-in-images
huntress.com
https://www.uni-muenster.de/Informationssicherheit/sammler/Warnung_ClickFix_20260507.html
uni-muenster.de
https://pushsecurity.com/blog/consentfix
pushsecurity.com
https://entrascopes.com/?appId=04b07795-8ddb-461a-bbee-02f9e1bf7b46
entrascopes.com
https://datatracker.ietf.org/doc/html/rfc8252
datatracker.ietf.org
https://pushsecurity.com/blog/consentfix-debrief
pushsecurity.com
https://entrascopes.com/?authcodeFix=true
entrascopes.com
https://entrascopes.com/?bypass=true&authcodeFix=true
entrascopes.com
https://github.com/MicrosoftDocs/entra-docs/commit/e7d9aa785444780466477e5aa5ded403d7c68439
github.com
https://x.com/DrAzureAD/status/2023707399287115859
x.com
https://pushsecurity.com/blog/consentfix-v3-analyzing-a-new-toolkit/
pushsecurity.com
https://datatracker.ietf.org/doc/html/rfc7636
datatracker.ietf.org
https://learn.microsoft.com/en-us/entra/identity/devices/protecting-tokens-microsoft-entra-id
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
learn.microsoft.com
https://www.microsoft.com/en-us/security/blog/2023/06/08/detecting-and-mitigating-a-multi-stage-aitm-phishing-and-bec-campaign/
microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-device-compliance
learn.microsoft.com
https://learn.microsoft.com/en-us/intune/intune-service/protect/advanced-threat-protection-configure
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-endpoint/configure-real-time-protection-microsoft-defender-antivirus
learn.microsoft.com
https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/licenses
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-endpoint/prerequisites
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/fundamentals/licensing
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-authentication-flows
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/configure-admin-consent-workflow
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/delegate-app-roles
learn.microsoft.com
https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-smartscreen
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-endpoint/network-protection
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-for-identity/alerts-xdr
learn.microsoft.com
https://learn.microsoft.com/en-us/defender-for-identity/deploy/prerequisites-sensor-version-2
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation
learn.microsoft.com
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-token-protection
learn.microsoft.com
https://www.glueckkanja.com/de/posts/2025-12-31-vulnerability-consentfix
glueckkanja.com
https://hm-ts.de/seminare/courses/entra-id-security-essentials-4971973988617027585
hm-ts.de
https://hm-ts.de/seminare/courses/entra-id-security-essentials-4971973988617027586
hm-ts.de
https://troopers.de/
troopers.de
https://hm-ts.de/seminare/courses/hardening-microsoft-environments-online-workshop-11
hm-ts.de
https://hm-ts.de/seminare/courses/hardening-microsoft-environments-online-workshop-12
hm-ts.de
https://ernw.de/en/contact.html
ernw.de