When 'Minor Foothold' Means Full Account Takeover: The Week IAM Bent the Wrong Way

Another week, another reminder that the gap between auth and authz is where attackers actually live.

Let's start with the one that should worry every IAM team: a reported MFA bypass affecting Kali365-style tenant configurations. The pattern is depressingly familiar. Conditional access policies that look airtight on paper, a session token that survives a state change it shouldn't, and suddenly the second factor is decorative. MFA would have helped — if it had actually been enforced at the token-issuance boundary rather than at the sign-in prompt. RFC 6749 didn't promise you bearer tokens were safe to treat as proof of presence. We just decided to pretend.

The Azure privilege-escalation chain is the more interesting protocol story. A low-privilege identity, abused role assignments, and a managed identity that inherits more than its job description suggests. The researcher's framing is the part worth internalizing: a "minor" foothold inside a tenant is rarely minor when the authz model treats service principals as first-class citizens with cross-resource reach. Check Microsoft's advisory channel at msrc.microsoft.com for the formal writeup once it posts.

On the AI side, a new Claude security plugin is making the rounds. The pitch is prompt-injection defense and sensitive-data redaction at the assistant layer. The reality, as always, depends on whether the plugin sees the full tool-call graph or just the user-facing prompt. If your agent can mint OAuth tokens with broad scopes on a user's behalf, a plugin that filters the chat window is theater. Scope down. Rotate refresh tokens. Treat agentic identities like service accounts, because that's what they are.

Elsewhere this week:

• FIFA-themed phishing kits are recycling old credential-harvest templates with fresh domains. Nothing novel. Still working.
• Several fake-installer campaigns are using signed loaders, which renders "check the publisher" advice mostly useless for non-technical users.
• Exposed Kubernetes dashboards keep showing up in scans. In 2024. I have no further comment.

The through-line across all of it is identity sprawl. Human accounts, service principals, agent identities, and OAuth apps now coexist in the same trust fabric, and most orgs can't enumerate them, let alone tier them. Until you can answer "what can this principal do, against what resource, with what token lifetime" without opening four consoles, you're guessing.

The boring fixes still work. Short token lifetimes. Phishing-resistant MFA (WebAuthn, not SMS). Conditional access that re-evaluates on risk signal, not just at sign-in. Strict scope minimization on every OAuth grant.

None of it is glamorous. All of it would have stopped at least three of this week's stories.