Feed aggregator

Article URL: https://blog.google/products-and-platforms/devices/pixel/pixel-watch-breathing-emergency-detection/

Comments URL: https://news.ycombinator.com/item?id=49632830

Points: 3

# Comments: 1

Article URL: https://twitter.com/pmarca/status/2097762851788398971

Comments URL: https://news.ycombinator.com/item?id=49632821

Points: 2

# Comments: 0

Article URL: https://www.aljazeera.com/news/2026/9/9/china-slams-us-claims-of-industrial-scale-ai-theft

Comments URL: https://news.ycombinator.com/item?id=49632814

Points: 4

# Comments: 0

A benchmark for ml methods on tabular biomedical datasets. Select your modality / feature size so you can use this to shortlist a few ml methods.

Comments URL: https://news.ycombinator.com/item?id=49632772

Points: 1

# Comments: 0

Article URL: https://qz.com/openai-agents-unauthorized-websites-communications-researchers-090926

Comments URL: https://news.ycombinator.com/item?id=49632763

Points: 1

# Comments: 0

Is anybody else seeing extremely annoying bug in last week or two where codex/chatgpt conversations fail to sync properly across devices? In my case ios and macos. Opening the same thread-id on different devices presents completely different subsets of conversation history. Often I'll see that one app at some point stopped rendering the user comments but does keep rendering a potentially partial subset of the agent responses - or vice versa, it will show agent responses but not the user message submissions ...

This has produced a lot of confusion for me and severely impacted my capacity to monitor progress on multiple work streams from multiple devices ... I've submitted support requests to openai that supposedly have been 'elevated to a human' but no idea yet if there's any progress ...

This kind of bug basically totally breaks all confidence in the codex app for me ... The experience previously felt pretty solid and predictable to me -- markedly better than the bugginess I experienced earlier this year with the claude harness -- but the experience is now basically completely broken ...

I've uninstalled the chatgpt app from my phone for the time being as the only viable workaround I can think of ...

Comments URL: https://news.ycombinator.com/item?id=49632749

Points: 1

# Comments: 0

Article URL: https://the-101-plays-itself.netlify.app/#theremin,glass

Comments URL: https://news.ycombinator.com/item?id=49632724

Points: 2

# Comments: 0

Article URL: https://www.cxmt.com/en/news/info_21.html

Comments URL: https://news.ycombinator.com/item?id=49632707

Points: 2

# Comments: 0

Article URL: https://lightyearlabs.ca/blog/cloud-rehearsal/

Comments URL: https://news.ycombinator.com/item?id=49632703

Points: 1

# Comments: 1

Article URL: https://rmondello.com/2026/09/07/switching-password-managers-2026/

Comments URL: https://news.ycombinator.com/item?id=49632701

Points: 1

# Comments: 1

Article URL: https://binary.ninja/2026/09/03/binary-ninja-6.0-krypton.html

Comments URL: https://news.ycombinator.com/item?id=49632698

Points: 2

# Comments: 0

Article URL: https://www.metafilter.com/214452/Shuffle-Islands

Comments URL: https://news.ycombinator.com/item?id=49632695

Points: 1

# Comments: 0

The new Apple Watch includes several “intelligent” listening features that have privacy and security baked in. But the protections can’t change the facts of what the tools do.

The term “digital sovereignty” has become ubiquitous. European officials invoke it in debates about cloud infrastructure, AI, semiconductors, and platform regulation. Governments throughout the global majority use it to argue for greater control over data and communications infrastructure and boost their economies. Companies market “sovereign cloud” products designed to reassure their customers that their information stays under local jurisdiction. But digital sovereignty could be something more: an opportunity for users around the world to build more resilient, open  systems and the skills and infrastructure to maintain them.

There is no singular definition of digital sovereignty, nor is there a single coherent position in the digital rights space. Despite its growing popularity, the term remains frustratingly vague. Policymakers, regulators, civil society groups, and others can mean very different things when they use the term. But to start simply with a broad definition, we can say that it means having the capacity to control one’s digital destiny—though the implications of that will obviously differ considerably whether you’re talking about an individual or a country.

We can start by developing  a shared understanding of what digital sovereignty actually means. We’ve also included a glossary of terms at the bottom of this post. 

In Europe and other places where digital sovereignty has become a topic of policy, discussions focus on reducing dependency: on foreign (and particularly American) cloud infrastructure, chips, platforms, and at times, foreign political priorities. The concern is both economic and geopolitical. If essential infrastructure is controlled by companies elsewhere—and thus subject to the laws of another jurisdiction—then what control does a country actually have over its own digital future?

In global majority countries in particular, wars, sanctions, and the growing fragmentation of the internet have demonstrated for many that the physical infrastructure that underlies digital life is neither neutral nor invulnerable. 

Amidst this increasing geopolitical instability governments and civil society should consider whether digital sovereignty can help shore up that infrastructure. 

What are we talking about when we talk about digital sovereignty? 

A recent Franco-German joint paper on digital sovereignty defines it as the “capability and capacity to develop, provide, use, adapt and control digital technologies including hardware in an independent, self-determined and secure manner” and puts forward a framework to operationalize Europe’s capacity to act in the digital domain. 

Some governments, such as Germany’s, have started to put funding behind sovereignty efforts through initiatives like the Sovereign Tech Agency, which “invest[s] globally in the open software components that underpin Germany's and Europe's competitiveness and ability to innovate.” 

Positions on digital sovereignty among EFF’s allies across Europe vary. Open Rights Group have defined digital sovereignty as “the ability of a country to have control over its digital infrastructure, data, and technology” and states it to be “critical for the UK’s economic and national security.” 

Similarly, the European Partnership for Democracy has expressed concern that “a few Big Tech corporations decide our collective destiny,” and argue that the EU should explore “alternative ownership models for tech companies and clearly [define] their purpose and mission.” And our friends at EDRi (of which EFF is a member) have stated clearly that “Europe’s digital sovereignty starts with open source.” Some initiatives, such as DI.DAY, consider digital sovereignty an opportunity to free users from Big Tech dependencies.

Elsewhere in the world, conversations about digital sovereignty often take a different shape. Indigenous discussions of the topic have been ongoing for more than a decade and focus on the inherent right of Native nations to govern their own digital ecosystems. In Southeast Asia, the desire for digital sovereignty has created growth in the sovereign cloud industry, but the conversation isn’t purely economic: Concerns about jurisdiction for where data is held are driving much of the conversation. 

In Latin America, digital public infrastructure is often a key aspect of debates. Across Africa, leaders speak of a desire to shift the continent from being consumers of technology to becoming architects of their own digital infrastructure and data ecosystems. And in the Middle East and North Africa, concerns about reliance on U.S. technology companies—which have engaged in conflict and disproportionate censorship (particularly of Palestinian voices) in the region—are often paramount.

Reem Almasri, a senior researcher based in Jordan, recently spoke to EFF about digital sovereignty, which she sees as “the ability of people and communities to choose, control, and use technology that serves their needs and values,” particularly in light of the role that U.S. companies have played in regional conflicts.

In a January article, Almasri pointed to growing concerns about granting greater sovereignty and influence to governments over citizens’ data, communications, and websites, writing: “This is particularly worrisome in countries that impose high levels of internet and media censorship and run unaccountable surveillance programs on their citizens’ data.”

Indeed, while pushing for greater sovereignty from Big Tech has benefits, there is an inherent risk that some states will pursue digital sovereignty as a means of cutting off or splintering access—as we’ve already seen in Iran, Russia, and elsewhere.

For that reason, it’s no surprise that some, such as Iranian professor Azadeh Akbari, believe that “the current wave pushing digital sovereignty as the key to ending dependency on American and Chinese technology is negligent of its Eurocentric bias.” 

What does EFF believe?

In a world where people have digital sovereignty, civil society should be able to communicate freely, privately, and anonymously if they wish. People should be able to easily understand where their data lives and who has access to it. That data should be easily portable between platforms and services.

At EFF, we view digital sovereignty not as a walled garden, but as an opportunity for resilience and development of industries and skills. We believe that governments can and should take a role in crafting digital sovereignty that centers the autonomy of users rather than just re-creating a state of digital dependency with a new set of companies. Governments should support and use free and open source tools and projects built using principles of interoperability and data portability. This support should include employing full-time developers, UX designers, and community managers. Government policy and legislation should grant users control of their own data and a clear understanding of who can lawfully access it. Digital sovereignty should foster users’ ability to choose how they use digital products and services, free from unfair lock-ins, coercive terms and manipulative defaults. It should also foster the broader public interest internet, the part of the web that provides public goods and useful services without requiring the scale or the business practices of the tech giants.

Encryption backdoors are fundamentally incompatible with a vision of data sovereignty that centers user control. Governments should support the development and normalization of reputable end-to-end encrypted communications as well as strong encryption for data at rest. This support should include employing cryptographers and contributing to strong, peer-reviewed encryption standards strengthened by data minimization as a fundamental design principle, as well as refraining from legislating mandates for “lawful access” or any other reason.  

As technologists, we don’t have to wait for governments to act in order to create the digital sovereignty we want. We get the internet that we build. We can contribute to open source, decentralized, and end-to-end encrypted projects. We can build standards that make interoperability and data portability a feature from the very beginning. We can resist the call of proprietary solutions, user lock-in, and encryption backdoors.

And finally, while digital sovereignty is often framed as a response to the dominance of Big Tech, that does not mean that there is no role for private companies to play. There is no point in replacing the influence of a few mostly US-based tech companies with a handful of giants based elsewhere. Companies can and should build platforms and services on top of open source, decentralized protocols and contribute to the ecosystem. Companies should also minimize processing a person’s data except as strictly necessary to provide them what they asked for, and only with opt-in consent that makes it clear to users what data they are gathering, where it is stored, and who has access to it. And companies should build their tools and platforms in a way that allows interoperability and that makes it easy for users to leave with their data. Some of these practices are already required by law in some jurisdictions, but companies don’t have to merely do the bare minimum the law demands: they should respect their users and support data sovereignty right now.

A glossary of terms

The following terms are useful for understanding this blog post as well as the broader conversation about Digital Sovereignty:

Intermediary liability: the legal responsibility of online service providers (ISPs, websites, social media platforms) for unlawful activities by their users, such as defamation, copyright infringement, or illegal hate speech.

The stack: a secure, open-source technology framework, often focusing on European alternatives, designed to break dependencies on (mostly) US-based technology providers. It comprises interoperable, vendor-neutral, and transparent digital infrastructures designed to regain control over data, infrastructure, and technology.

Digital sovereignty: the ability of people, as nations, organizations, and individuals, to control their own digital destiny by retaining authority over their own data, technology, and infrastructure.

Data sovereignty: the principle that digital information is subject to the laws and governance frameworks of the country or region where it is physically collected, stored, or processed. It dictates that data remains bound by the specific privacy protections and regulations of its originating jurisdiction, regardless of where the collecting organization is located.

Digital commons: a shared, online resource, such as knowledge, software, and data, that is collectively produced, governed, and maintained by a community, intended for public access. Examples include Wikipedia, open source operating systems such as Linux, and Creative Commons licensed content.

Data portability/interoperability: the ability to easily transfer personal data from one service provider to another, or to a personal system, in a structured, machine-readable format. It empowers users to move away from "walled gardens," reducing vendor lock-in and enhancing user autonomy.

Digital dependency: the opposite of digital sovereignty. The inability of people as nations, organizations, and individuals to control their own digital destiny through control over their own data, technology, and infrastructure. 

Decentralization: a shift away from relying on centralized, often US-based, corporate platforms toward a distributed, user-centric internet where individuals, communities, and nations maintain control over their data, digital identity, and infrastructure.

End-to-end encryption (e2ee): a secure communication process where only the sender and intended recipient can access, read, or decrypt messages or data.

Fairness (à la the Digital Fairness Act): the absence of deceptive, manipulative, or addictive design practices that distort consumer choice and exploit vulnerabilities. 

User sovereignty: the concept that individuals possess absolute control over their personal data, digital identity, and online privacy, rejecting the centralization of power by large technology platforms. It emphasizes user consent, decentralization, and the ability to manage personal data using secure and independent tools.

Joel Hellermark, chief AI officer at Workday, argues that artificial intelligence and large language models will transform enterprise work, building company memory through agents, empowering humans and increasing their value

Article URL: https://kova-five-zeta.vercel.app/

Comments URL: https://news.ycombinator.com/item?id=49630291

Points: 1

# Comments: 0

Article URL: https://www.servethehome.com/arm-neoverse-css-n4-launched-for-next-gen-cpus-and-dpus/

Comments URL: https://news.ycombinator.com/item?id=49630286

Points: 1

# Comments: 0

In this article

1. Attack chain overview
2. Attribution
3. Mitigation and protection guidance
4. Learn more

Microsoft Security Research is tracking active cloud-based intrusions spanning multiple accounts in which unusual sign-ins were followed by threat actor-added authentication methods, high-volume Microsoft Graph activity, SharePoint and OneDrive downloads, and email collection through REST APIs. Microsoft Security Research assesses that this sequence is consistent with automated collection from compromised cloud identities using proxy-associated infrastructure, the activity has been observed since May 2026.

The activity begins with identity-focused social engineering and impersonation infrastructure, proceeds through authentication persistence and cloud reconnaissance, and is followed by targeted data access and activity consistent with data collection and potential exfiltration. Domains, IP addresses, and hosting providers can change quickly, but the recurring sequence of identity compromise, persistence, reconnaissance, content discovery, and exfiltration provides a more durable basis for investigation. Defenders should investigate this sequence across identity, Microsoft Graph, SharePoint, OneDrive, and Exchange signals, then revoke sessions and remove unauthorized authentication methods for confirmed compromises.

Attack chain overview Figure 1. Observed attack sequence showing identity compromise through social engineering, MFA persistence, Microsoft Graph reconnaissance, and cloud data collection/exfiltration. Step 1-2 : Initial access: Passkey and SSO lures

The attack often begins with a seemingly routine call or message on a user’s personal phone number from someone claiming to be from the organization’s IT helpdesk. The caller creates a sense of urgency, explaining that a passkey, multifactor authentication (MFA), or single sign-on (SSO) configuration must be updated immediately to avoid disruption. Employees are directed to a website that closely resembles a legitimate Microsoft sign-in experience and may receive the link through SMS messages sent directly to their personal mobile phones.

Despite the frequent use of passkey-themed lures, passkey enrollment is often not the actor’s true objective. Instead, the passkey narrative serves as a convincing pretext to guide victims through adversary-in-the-middle (AiTM) phishing or device-code authentication flows. In AiTM scenarios, the actor captures credentials and session tokens; in device code attacks, the victim unknowingly authorizes access on the actor’s behalf. This initial interaction may leave very little forensic evidence. If the victim opens the phishing link on a personal mobile device that is not onboarded to Microsoft Defender for Endpoint, the related activity may be absent from endpoint telemetry.

In many investigations, the employee’s recollection of a phone call or text message becomes the earliest and sometimes the only evidence explaining how the compromise began. As a result, investigators must often reconstruct the attack by connecting these reports with subsequent sign-ins, device code authentication events, token activity, and authentication method changes.

Reconnaissance on targeted organization

The actor appears to invest heavily in pre-attack research, likely gathering information about employees and organizational structure from public sources such as social networking and professional profiling platforms.

Reusable domains, personalized targeting

In a smaller number of cases, actors take advantage of already compromised accounts to expand their reach. Using a trusted employee identity, they send similar passkey-themed messages through Microsoft Teams, making the request appear legitimate and significantly increasing the likelihood of engagement. To support these operations, the actors rapidly deploy convincing phishing infrastructure built around themes such as passkeys, SSO enrollment, account activation, and identity verification.

A commonly observed technique involves registering generic domains and embedding the target organization’s name as a subdomain, creating URLs that appear familiar at first glance. Multiple domains may be created for the same organization, allowing the actor to rotate infrastructure as needed. These domains are often registered with Nicenic registrar (observed in previous extortion campaigns) and operational within hours, giving defenders little opportunity to identify and block the infrastructure before employees encounter it. Registration alone should not be interpreted as evidence of registrar involvement in the activity. For example, company-name.integratedsso[.]com and company-name.secure-passkey[.]com illustrate how the same company name can appear under different actor-controlled domains.

Together, the phone-based social engineering, personalized targeting, trusted internal messaging, and rapidly changing phishing infrastructure form the opening chapter of a highly coordinated intrusion designed to blend technical deception with human trust.

The actor creates domains following the pattern companyname[.]maliciousdomain[.]com to impersonate organization-specific authentication portals. Including the victim organization’s name in the URL helps establish credibility and can persuade users to proceed with authentication. Example: contoso[.]add-passkey[.]com.

ThemeDomain examples, defangedPasskeypasskeyhelpdesk[.]com, secure-passkey[.]com†, setupmypasskey[.]com†, add-passkey[.]com†SSO and identity providerintegratedsso[.]com†, oktasession[.]comKey setup and synchronizationkeysyncos[.]com, oskeysync[.]com, oskeysetup[.]com, oskeyregister[.]com, syncmykey[.]com, myconnectkey[.]com, oskeyconnect[.]comSetup and verificationvalidationsetupac[.]com, portalsetuphub[.]com Step 3-4 : User identity compromise From one sign-in to broader application access

In one investigated attack sequence, the activity began with an anomalous sign-in to Microsoft OfficeHome application from an unmanaged device, possibly attacker-owned. Once MFA was completed, the actor began accessing identity portals such as My Sign-Ins and enterprise application stores such as My Apps. Sign-in artifacts, including user-agent patterns, indicated possible AiTM phishing.

Using the same session, the actor further accessed several management applications, including Microsoft Approval Management, which is used for identity and approval-related services. SharePoint Online and OneDrive were used to enumerate sensitive files, primarily through the Graph API. The investigation revealed that the actor’s sessions persisted for approximately one hour while enumerating sensitive files and internal applications.

Passkey lure leads to device code phishing

In another investigated attack sequence, the actor was observed using the device code flow to compromise the session token after the passkey lure. In device code phishing, the user is persuaded to enter a code on the legitimate Microsoft authentication page. This approval issues a token to an attacker-controlled client, which can then access permitted resources without stealing a browser cookie. Following the device code flow, the actor successfully replayed the compromised token, effectively bypassing MFA and conducting enumeration and further attack progression.

Reusing the same credentials after an earlier compromise

The third attack pattern involved the actor signing in with compromised credentials, with MFA approved using a previously registered PhoneAppOTP method. This suggests that the attacker had registered the authenticator app days before launching the campaign. Once the sign in was successful, the actor followed the same reconnaissance pattern observed in other attack sequences. This activity was primarily carried out using an automated system developed with Node.js and Microsoft Graph.

To illustrate how the activity unfolded over time, the following timeline summarizes the key events identified during the investigation.

Time, UTCApplication or resourceWhat happened and why it mattersT+0minOfficeHomeSign-in from an unmanaged context received error 50074, requiring secondary authentication / Multifactor authentication (MFA).T+1minOfficeHomeMFA completed (AiTM with non-phishing resistant MFA) followed by error 50140 for the keep-me-signed-in interruption.T+1minOfficeHomeAuthentication succeeded, establishing the session used for subsequent access.T+2minMy AppsThe session enumerated applications assigned to the compromised identity.T+2minMy ProfileOrganizational profile information was accessed.T+3minMicrosoft Approval ManagementIdentity and approval-related services were accessed. This could expose approval workflows available to the identity.T+3minMicrosoft Account Controls V2Account and authentication management interfaces were accessed.T+4minMy SignInsSign-in and security information was accessed through Microsoft Graph using the same source context, session, Chrome user agent, and browser ID as the OfficeHome authentication.T+10minOCaaSThe organizational application catalogue was loaded through My Apps. In this sequence, OCaaS supports application discovery rather than appearing as an isolated background event.T+11 – T+50minSharePoint OnlineThe session requested access to organizational sites and document resources. The sign-in events do not prove that a document was opened or downloaded.T+11 – T+50minOutlook WebMailbox-related services were accessed, creating an opportunity for mailbox and business-context reconnaissance.T+12minWindows App – WebThe session entered the Azure Virtual Desktop authentication flow. A desktop or remote workspace launch was not confirmed.T+14minInternal virtual application and desktop portalAuthentication succeeded to the internal virtual application and desktop portal. This could expose published applications and virtual desktops assigned to the identity, although no internal virtual application and desktop portal resource launch was confirmed.T+15minOwaDownloadAttachmentsOutlook successfully requested the attachment download resource. This is more consequential than generic mailbox access, but the sign-in telemetry does not prove that an attachment was downloaded.T+16minM365ChatClientMicrosoft 365 collaboration, Teams, and search services were accessed.T+16minInternal business workflow applicationAuthentication succeeded to another internal business workflow application. Step 5 : New MFA device for persistence

Following initial access, the actor’s first objective was to transform a temporary compromise into a persistent foothold. Rather than relying solely on stolen credentials, the actor enrolled an MFA method under their control, typically by registering a new phone number, authenticator application, or software-based one-time password (OTP) token. This effectively inserted an actor-controlled factor into the victim’s identity, allowing future authentication challenges to be satisfied without the user’s involvement.

By registering an actor-controlled MFA method, the threat actor ensured that future authentication challenges could be satisfied using a factor they controlled. While MFA enrollment alone does not survive a complete credential and session reset, it provides a durable persistence mechanism when combined with stolen tokens, unrevoked sessions, or subsequent access to valid credentials. As a result, actors frequently establish MFA persistence early in the intrusion to increase the likelihood of maintaining long-term access to the compromised identity.

Phone or authenticator device addition

Detects a newly registered MFA device with a populated device token. The query compares the previous and updated authentication method values and returns newly added device records.

CloudAppEvents | where ActionType == "Update user." | where tostring(RawEventData.ResultStatus) == "Success" | where RawEventData has_any ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails") | extend AccountObjectId = extract(@"User_([a-f0-9\-]+)", 1, tostring(RawEventData.Target)) | where isnotempty(AccountObjectId) | mvexpand ModifiedProp = RawEventData.ModifiedProperties | where tostring(ModifiedProp.Name) in ("StrongAuthenticationPhoneAppDetail", "StrongAuthenticationUserDetails") | extend OldValue = tostring(ModifiedProp.OldValue), NewValue = tostring(ModifiedProp.NewValue) | extend OldDeviceCount = countof(OldValue, @"""Id"""), NewDeviceCount = countof(NewValue, @"""Id""") | where NewDeviceCount > OldDeviceCount Software token addition

Below is a real-world example of attacker controlled Software token added to the user’s identity with Update user operation. This is added as a second NewValue entry containing the device name NO_DEVICE, device token NO_DEVICE_TOKEN, and the SoftwareTokenActivated device tag.

{ [EF1.1][KR1.2] "Id": "[GUID_REDACTED]", "CreationTime": "2026-09-04T16:57:42.0000000Z", "OrganizationId": "[GUID_REDACTED]", "Operation": "Update user.", "RecordType": 8, "Workload": "AzureActiveDirectory", "ResultStatus": "Success", "UserKey": "Not Available", "UserId": "ServicePrincipal_[GUID_REDACTED]", "Version": 1, "UserType": 4, "ObjectId": "[EMAIL_REDACTED]", "ModifiedProperties": [ { "Name": "StrongAuthenticationPhoneAppDetail", "OldValue": [ { "DeviceName": "[DEVICE_NAME_REDACTED]", "DeviceToken": "[DEVICE_TOKEN_REDACTED]", "DeviceTag": "iOS", "PhoneAppVersion": "6.8.53", "OathTokenTimeDrift": 0, "DeviceId": "[GUID_REDACTED]", "Id": "[GUID_REDACTED]", "TimeInterval": 0, "AuthenticationType": 3, "NotificationType": 2, "LastAuthenticatedTimestamp": "2026-09-04T16:54:47.6425033Z", "AuthenticatorFlavor": "Authenticator", "HashFunction": null, "TenantDeviceId": null, "SecuredPartitionId": 20111, "SecuredKeyId": 7 } ], "NewValue": [ { "DeviceName": "[DEVICE_NAME_REDACTED]", "DeviceToken": "[DEVICE_TOKEN_REDACTED]", "DeviceTag": "iOS", "PhoneAppVersion": "6.8.53", "OathTokenTimeDrift": 0, "DeviceId": "[GUID_REDACTED]", "Id": "[GUID_REDACTED]", "TimeInterval": 0, "AuthenticationType": 3, "NotificationType": 2, "LastAuthenticatedTimestamp": "2026-09-04T16:54:47.6425033Z", "AuthenticatorFlavor": "Authenticator", "HashFunction": null, "TenantDeviceId": null, "SecuredPartitionId": 20111, "SecuredKeyId": 7 }, { "DeviceName": "NO_DEVICE", "DeviceToken": "NO_DEVICE_TOKEN", "DeviceTag": "SoftwareTokenActivated", "PhoneAppVersion": "NO_PHONE_APP_VERSION", "OathTokenTimeDrift": 0, "DeviceId": "[GUID_REDACTED]", "Id": "[GUID_REDACTED]", "TimeInterval": 0, "AuthenticationType": 2, "NotificationType": 1, "LastAuthenticatedTimestamp": "2026-09-04T16:57:42.4514487Z", "AuthenticatorFlavor": "Authenticator", "HashFunction": "hmacsha1", "TenantDeviceId": null, "SecuredPartitionId": 20111, "SecuredKeyId": 7 } ] }, { "Name": "Included Updated Properties", "OldValue": "", "NewValue": "StrongAuthenticationPhoneAppDetail" }, { "Name": "TargetId.UserType", "OldValue": "", "NewValue": "Member" } ] } Step 6 : Graph reconnaissance

Once MFA persistence was established, the actor initiated an extensive internal reconnaissance phase using Microsoft Graph to inventory users, groups, permissions, resources, and accessible content across the tenant with the compromised identity. The actor deliberately rotated infrastructure throughout the attack lifecycle, with separate IP addresses often used for authentication, reconnaissance, and exfiltration activities. As a result, piecing together the full intrusion required correlating activity across multiple stages rather than relying on individual network indicators.

The attack underscores a critical detection challenge: Microsoft Graph abuse rarely appears suspicious when viewed through a single API call. Requests to endpoints such as /users, /groups, or /sites are commonplace in enterprise environments. However, when the same identity, application, or access token systematically traverses multiple tenant resources, evaluates privilege and authentication settings, and subsequently accesses mail, files, attachments, or document content, those actions collectively form a clear reconnaissance-to-exfiltration chain. This attack serves as a strong example of why Graph activity must be assessed holistically, with emphasis on behavioral progression and cross-event correlation rather than individual API requests in isolation.

Graph reconnaissance pattern matrix initiated by the actor Recon patternGraph URI examplesWhat it revealsWhy it mattersTenant profile/organization, /subscribedSkus, /licenseDetailsIdentifies the tenant, verified domains, licenses, and enabled services.Useful setup activity; stronger when followed by user, role, or repository discovery.Directory enumeration/users, /groups, /members, /transitiveMembersBuilds a map of identities, groups, and effective membership.Can identify targets, privileged users, and sensitive collaboration groups.Privilege and MFA discovery/directoryRoles, /roleManagement, /authentication/methodsInspects privileged assignments and registered authentication methods.High-value reconnaissance around identity control and persistence.Application and consent discovery/applications, /servicePrincipals, /oauth2PermissionGrants, /appRoleAssignmentsMaps enterprise applications, OAuth grants, and delegated or app-only access.Can expose reusable access paths and high-value service identities.SharePoint and OneDrive discovery/sites, /lists, /drives, /drive/items, /root/children, /searchLocates sites, document libraries, folders, and files.Often converts broad tenant reconnaissance into a collection-ready file map.Mailbox discovery/messages, /mailFolders, /attachmentsEnumerates messages, folders, and attachment metadata.Supports intelligence collection, business email compromise (BEC), and targeted attachment retrieval.Automation and pagination$top, $skip, $skiptoken, $count, /delta, /searchWalks large result sets or repeatedly searches repositories.Raises confidence when combined with broad discovery or sensitive endpoints.Content collection/content, message or attachment retrieval, large ResponseSizeRetrieves the underlying data after discovery.Strongest indicator that reconnaissance has progressed into collection. Hunt for broad Graph reconnaissance in one session

Find identities or applications touching several reconnaissance categories from the same IP within 30 minutes.

let Lookback = 24h; [MI25.1][IM25.2] GraphAPIAuditEvents | where Timestamp > ago(Lookback) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId), Path = tostring(split(tolower(RequestUri), "?")[0]) | extend ReconType = case( Uri has "/organization" or Uri has "/subscribedskus", "Tenant", Uri has "/users" or Uri has "/groups", "Directory", Uri has "/directoryroles" or Uri has "/rolemanagement", "Privilege", Uri has "/applications" or Uri has "/serviceprincipals" or Uri has "/oauth2permissiongrants", "Application", Uri has "/sites" or Uri has "/drive", "Repository", Uri has "/messages" or Uri has "/mailfolders", "Mailbox", "Other") | where ReconType != "Other" and isnotempty(ActorId) | summarize Requests=count(), Categories=dcount(ReconType), DistinctPaths=dcount(Path), ReconTypes=make_set(ReconType, 10), SampleUris=make_set(RequestUri, 10) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m) | where Requests >= 10 and Categories >= 3 and DistinctPaths >= 6 | order by Categories desc, Requests desc Hunt for privilege, MFA, application, and consent discovery

Highlight sensitive control-plane reconnaissance that can expose persistence or escalation opportunities.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId) | where Uri has_any ("/directoryroles", "/rolemanagement", "/authentication/methods", "/applications", "/serviceprincipals", "/oauth2permissiongrants", "/approleassign") | summarize Requests=count(), DistinctPaths=dcount(tostring(split(Uri, "?")[0])), ScopesSeen=make_set(Scopes, 10), SampleUris=make_set(RequestUri, 12) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m) | where Requests >= 4 and DistinctPaths >= 2 | order by Requests desc Hunt for SharePoint and OneDrive repository discovery

Detect search, child traversal, delta queries, and paging used to map file repositories.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId), Path = tostring(split(tolower(RequestUri), "?")[0]) | where Uri has_any ("/sites", "/drives", "/drive/") | where Uri has_any ("/search", "/children", "/delta", "$skiptoken", "%24skiptoken", "$top", "%24top") | summarize Requests=count(), DistinctPaths=dcount(Path), SampleUris=make_set(RequestUri, 12) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 20m) | where Requests >= 8 and DistinctPaths >= 4 | order by Requests desc Hunt for mailbox and attachment reconnaissance

Find concentrated enumeration of messages, mail folders, and attachments.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId), Path = tostring(split(tolower(RequestUri), "?")[0]) | where Uri has_any ("/messages", "/mailfolders", "/attachments") | summarize Requests=count(), DistinctPaths=dcount(Path), MessageRequests=countif(Uri has "/messages"), AttachmentRequests=countif(Uri has "/attachments"), TotalResponseBytes=sum(coalesce(ResponseSize, 0)), SampleUris=make_set(RequestUri, 12) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 30m) | where (Requests >= 8 and DistinctPaths >= 4) or AttachmentRequests >= 3 | order by AttachmentRequests desc, Requests desc Step 7-8 : High-volume cloud data collection and suspected exfiltration

Following reconnaissance, the actor transitioned into large-scale data collection across Microsoft 365 workloads using the compromised identities. Microsoft observed high-volume access and download activity targeting Microsoft SharePoint Online and Microsoft OneDrive for Business, with some intrusions extending into Microsoft Exchange Online through REST API-based access to email content. Across SharePoint and OneDrive, the activity generated significant volumes of FileAccessed and FileDownloaded events, indicating systematic retrieval of cloud-hosted documents and organizational data.

The activity frequently exhibited characteristics of automation rather than interactive user behavior. In several cases, Microsoft observed the python-httpx user agent associated with high-volume SharePoint and OneDrive access patterns. However, the user agent alone should not be treated as malicious. Instead, such activity should be evaluated in the broader context of data volume, affected identities, source infrastructure, prior reconnaissance activity, and evidence of identity compromise.

Unlike rapid smash-and-grab operations, data exfiltration was typically measured and sustained, often spanning several hours to multiple days depending on the volume of files and email content available to the compromised user. The actors generally maintained a controlled pace of collection, with fewer than 1,000 files or emails accessed within any one-hour period, likely helping the activity blend with normal enterprise usage while enabling the gradual extraction of large amounts of sensitive data over time.

Hunt for exfiltration through Exchange Online

Exfiltration of data through REST API using Microsoft Office or One Outlook Web

CloudAppEvents | where isempty(AccountObjectId) | where ApplicationId == '20893' | where AccountDisplayName in ("One Outlook Web", "9199bf20-a13f-4107-85dc-02114787ef48", "d3590ed6-52b3-4102-aeff-aad2292ab01c") | where isnotempty(IPAddress) | extend AccountObjectId = tostring(RawEventData.TokenObjectId) | summarize ExchangeRestEventCount=count() by IPAddress, AccountObjectId, bin(Timestamp,1h) | where ExchangeRestEventCount >= 500 Hunt for exfiltration through Microsoft SharePoint Online, OneDrive for Business

Exfiltration of data through python-httpx user agent

CloudAppEvents | where ApplicationId == "20892" or ApplicationId == "15600" | where ActionType in ("FileDownloaded", "FileAccessed", "SyncDownloadedFull") | where isnotempty(AccountObjectId) | where isnotempty(IPAddress) | where isnotempty(UserAgent) | where UncommonForUser has_any("ISP","UserAgent") | where UserAgent has 'python-httpx' | project Timestamp, AccountObjectId, IPAddress, ISP, UserAgent | summarize FilesAccessedLastWindow = count() by AccountObjectId, IPAddress, ISP, UserAgent, bin(Timestamp,2h) | where FilesAccessedLastWindow >=100 Hunt for anomalous high-volume exfiltration

Exfiltration of data through anonymous proxy

CloudAppEvents | where ApplicationId in (20892, 20893, 15600) | where ActionType in~ ("FileDownloaded", "FileAccessed", "FilePreviewed") | where IsAnonymousProxy == true | where UserAgent !has "ODMTADemand" | extend FileSizeBytes = coalesce(tolong(RawEventData.FileSizeBytes), 0) | summarize FileSizeBytes = sum(FileSizeBytes), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), EventCount = count(), ActionTypes = make_set(ActionType), Applications = make_set(Application) by AccountObjectId, IPAddress, TimeBucket = bin(Timestamp, 2h), UserAgent, ISP | extend FileSizeGB = round(FileSizeBytes / 1024.0 / 1024.0 / 1024.0, 2) | where FileSizeGB >= 5 or EventCount >= 1000 | order by EventCount desc Attribution

Microsoft Threat Intelligence assesses that the initial access activity observed in this campaign is used by a range of threat actors, including Storm-3121, Storm-3032, and others. Storm-3121 conducts initial access activity leading to ShinyHunters and Falcon extortion. Storm-3032 represents a set of actors that splintered from the BlackFile group and now operate under the Helix extortion banner. That being said, Microsoft Defender has detection coverage for the known tactics, techniques and procedures from Storm-3121, Storm-3032 and other operators in the same ecosystem.

Mitigation and protection guidance

Microsoft recommends that organizations investigate identity and cloud-workload signals as a connected sequence, with priority given to unusual sign-ins followed bys authentication method enrollment, Microsoft Graph reconnaissance, token issuance, and abnormal SaaS download or mailbox activity.

Investigate

• Review newly registered authentication methods and devices for users with risky or unusual sign-ins and remove unauthorized methods after validating the user.
• Investigate high-volume or programmatic Microsoft Graph activity involving directory enumeration, role discovery, service principal discovery, SharePoint, OneDrive, or sensitivity-label discovery.
• Correlate SharePoint and OneDrive download anomalies, Exchange REST activity, and mailbox or attachment searches with identity and authentication events.

Contain and remediate

• Revoke active sessions and refresh tokens for confirmed compromised identities, reset credentials, remove attacker-registered authentication methods, remove attacker created mailbox rules, and require secure re-registration of authentication methods.

Reduce future risk

• Do not treat an IP or domain match as conclusive on its own. Validate workload behavior, affected identities, persistence events, and data access volume.
• Enforce phishing-resistant MFA (FIDO2/passkeys, Windows Hello for Business) via Conditional Access
• Enforce Conditional Access that requires a managed, compliant device for Exchange, SharePoint, and Graph-privileged apps
• Enforce strict conditional access controls for security info registration, including setting required sign-in frequency to always (require a new interactive auth), requiring managed devices and/or named locations, and requiring phish-resistant MFA as a required authentication strength, and in a separate policy blocking security info registration with a high sign-in risk condition
• Enforce risk-based access policies for risky sign-ins and risky users – remediate elevated risk with phishing-resistant MFA or secure password change, and block access at the highest risk levels.
• Train users against voice and email phishing that targets MFA and passkey enrollment. Provide a verified channel to report unsolicited authentication requests.
• Block the device code and authentication transfer flows via Conditional Access, except where an explicit business need exists.
• Restrict user consent for applications, require admin approval, and regularly review service principals holding high-privilege Graph permissions such as Mail.Read, Files.Read.All, and Directory.Read.All.
• Limit access from unmanaged devices to web-only sessions without download or sync, and disable anonymous sharing links in SharePoint and OneDrive.
• Enable Microsoft Graph activity logs and mailbox auditing, and alert on anomalous enumeration, authentication-method registration, and high-volume file or mail access.
• Educational training: Verify user identity through a rigorous process before performing any helpdesk-initiated credential or MFA reset, and alert on every such reset.

Microsoft Defender XDR detections

Microsoft Defender XDR customers can refer to the list of applicable detections below. Microsoft Defender XDR coordinates detection, prevention, investigation, and response across endpoints, identities, email, and apps to provide integrated protection against attacks like the threat discussed in this blog.

Customers with provisioned access can also use Microsoft Security Copilot in Microsoft Defender to investigate and respond to incidents, hunt for threats, and protect their organization with relevant threat intelligence.

Tactic Observed activity Microsoft XDR Defender coverage Credential AccessUnusual cloud activity from a tracked potentially malicious IPMicrosoft Defender for Cloud
– A storage account was accessed from a suspicious IP address.

Microsoft Defender for Identity
– Malicious registration of a device with strong MFA.
– Malicious registration of an attacker controlled MFA device.
– Suspicious registration of a new Authenticator MFA method.
– Malicious registration of a new Authenticator MFA method.
– Suspicious registration of a new Phone MFA method.
– Malicious registration of a new Phone MFA method – Malicious registration of a new Email MFA method.

Microsoft Defender XDR
– Malicious sign in from an IP address associated with recognized attacker infrastructure.DiscoveryGraph API reconnaissance activityMicrosoft Defender for Identity
– Suspicious Entra Graph API query observed. Exfiltration Data exfiltration activityMicrosoft Defender for Cloud
– Unusual number of blobs extracted from a storage blob container.
– Unusual amount of data extracted from a storage file share.
– Unusual number of files extracted from a storage file share.
– Unusual amount of data extracted from a sensitive blob container.
– Unusual number of blobs extracted from a sensitive blob container.
– Unusual amount of data extracted from a sensitive storage file share.
– Unusual number of files extracted from a sensitive storage file share.
– Sensitive data was exfiltrated from a publicly exposed blob container.

Microsoft Defender XDR
– Automated mass SharePoint/OneDrive file access via python-httpx. Microsoft Security Copilot

Security Copilot customers can use the standalone experience to create their own prompts or run the following prebuilt promptbooks to investigate activity associated with this intrusion pattern:

• Incident investigation – Generates investigation summaries and helps analysts understand incidents involving compromised identities, suspicious sign-ins, persistence activity, and cloud-based data access.
• Microsoft User analysis – Analyses user accounts, sign-in activity, authentication events, risk indicators, and related identity signals that may help identify compromised accounts.

Customers can also use Microsoft Security Copilot together with Microsoft Threat Intelligence to investigate indicators, threat activity, and related intelligence associated with suspicious sign-ins, Microsoft Graph reconnaissance, and cloud data exfiltration activity.

Note that some promptbooks require access to plugins for Microsoft products such as Microsoft Defender XDR or Microsoft Sentinel.

Threat intelligence reports

Microsoft customers can use the following reports in Microsoft products to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments.

MITRE ATT&CK Techniques observed

Reconnaissance

• T1591 Gather Victim Org Information | Use of themed domains for credential phishing pages
• T1598.003 Phishing for Information: Spear-phishing Link | Use of spear-phishing emails with links to spoofed sign-in pages

Resource Development

• T1583.001 Acquire Infrastructure: Domains | Use of themed domains for credential phishing pages
• T1585.002 Establish Accounts: Email Accounts | Delivery infrastructure that is comprised of accounts from consumer email providers like Hotmail

Initial Access

• T1078.004 Valid Accounts: Cloud Accounts | The compromised cloud identity is used to authenticate to Microsoft cloud services.

Persistence

• T1556.006 Modify Authentication Process: Multi-Factor Authentication | After gaining account access, the threat actor registers a new authentication method, mobile device, or software-based OTP to establish persistent access to the compromised identity.

Discovery

• T1087.004 Account Discovery: Cloud Account | The threat actor uses Microsoft Graph to enumerate tenant users and identities, including information useful for identifying high-value identities and privileged accounts.
• T1069.003 Permission Groups Discovery: Cloud Groups | Microsoft Graph reconnaissance enumerates group memberships and directory roles, allowing the threat actor to understand privilege relationships and identify potentially valuable identities.

Collection

• T1530 Data from Cloud Storage | The actor searches and accesses SharePoint and OneDrive content and performs high-volume file access/download activity to collect targeted cloud-hosted information.
• T1114 Email Collection | Mailboxes, messages, and attachments are searched for material of interest and email is collected through REST APIs.
• T1213 Data from Information Repositories | The actor searches enterprise cloud repositories, including SharePoint content and other organizational cloud data, to identify information of value for collection.

Exfiltration

• T1567 Exfiltration Over Web Service | The campaign performs high-volume cloud data access and uses automated Python-based activity for rapid collection and exfiltration.

Advanced hunting queries

Additional advanced hunting query for Graph reconnaissance:

Hunt for automated pagination, delta, and search behavior

Identify actors walking large Graph result sets or repeatedly querying for data.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId), Path = tostring(split(tolower(RequestUri), "?")[0]) | where Uri has_any ("$top", "%24top", "$skip", "%24skip", "$skiptoken", "%24skiptoken", "$count", "%24count", "/delta", "/search") | summarize AutomatedRequests=count(), DistinctPaths=dcount(Path), SampleUris=make_set(RequestUri, 12) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 15m) | where AutomatedRequests >= 8 and DistinctPaths >= 4 | order by AutomatedRequests desc Hunt for reconnaissance progressing to content collection

Prioritize sessions where broad discovery and content retrieval occur together.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId) | extend ActivityType = case( Uri has "/content" or Uri has "/attachments", "ContentCollection", Uri has "/users" or Uri has "/groups", "DirectoryRecon", Uri has "/directoryroles" or Uri has "/rolemanagement" or Uri has "/authentication/methods", "PrivilegeRecon", Uri has "/applications" or Uri has "/serviceprincipals", "ApplicationRecon", Uri has "/sites" or Uri has "/drives" or Uri has "/drive/", "RepositoryRecon", Uri has "/messages" or Uri has "/mailfolders", "MailboxRecon", "Other") | where ActivityType != "Other" | summarize DiscoveryFirst=minif(Timestamp, ActivityType != "ContentCollection"), CollectionFirst=minif(Timestamp, ActivityType == "ContentCollection"), DiscoveryCategories=dcountif(ActivityType, ActivityType != "ContentCollection"), ContentRequests=countif(ActivityType == "ContentCollection"), TotalResponseBytes=sum(coalesce(ResponseSize, 0)), SampleUris=make_set(RequestUri, 15) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 1h) | where isnotnull(DiscoveryFirst) and isnotnull(CollectionFirst) | where CollectionFirst >= DiscoveryFirst and DiscoveryCategories >= 2 and ContentRequests >= 1 | order by CollectionFirst desc Hunt for exfiltration through Microsoft Graph

Prioritize sessions where broad discovery and content retrieval occur together.

GraphAPIAuditEvents | where Timestamp > ago(24h) | where toint(ResponseStatusCode) between (200 .. 299) | extend Uri = tolower(RequestUri), ActorId = coalesce(AccountObjectId, ServicePrincipalId, ApplicationId) | extend ActivityType = case( Uri has "/content" or Uri has "/attachments", "ContentCollection", Uri has "/users" or Uri has "/groups", "DirectoryRecon", Uri has "/directoryroles" or Uri has "/rolemanagement" or Uri has "/authentication/methods", "PrivilegeRecon", Uri has "/applications" or Uri has "/serviceprincipals", "ApplicationRecon", Uri has "/sites" or Uri has "/drives" or Uri has "/drive/", "RepositoryRecon", Uri has "/messages" or Uri has "/mailfolders", "MailboxRecon", "Other") | where ActivityType != "Other" | summarize DiscoveryFirst=minif(Timestamp, ActivityType != "ContentCollection"), CollectionFirst=minif(Timestamp, ActivityType == "ContentCollection"), DiscoveryCategories=dcountif(ActivityType, ActivityType != "ContentCollection"), ContentRequests=countif(ActivityType == "ContentCollection"), TotalResponseBytes=sum(coalesce(ResponseSize, 0)), SampleUris=make_set(RequestUri, 15) by ActorId, IpAddress, ApplicationId, bin(Timestamp, 1h) | where isnotnull(DiscoveryFirst) and isnotnull(CollectionFirst) | where CollectionFirst >= DiscoveryFirst and DiscoveryCategories >= 2 and ContentRequests >= 1 | order by CollectionFirst desc Indicators of compromise (IOC) Indicators TypeDescriptionpasskeyhelpdesk[.]com DomainsPasskey support luresecure-passkey[.]comDomainsPasskey security setupmypasskey[.]comDomainsPasskey setup add-passkey[.]comDomainsPasskey enrollment integratedsso[.]comDomainsSSO oktasession[.]com DomainsIdentity-provider session keysyncos[.]com DomainsKey synchronization oskeysync[.]com DomainsKey synchronization oskeysetup[.]com DomainsKey setup oskeyregister[.]com DomainsKey registration syncmykey[.]com DomainsKey synchronization myconnectkey[.]com DomainsKey connection oskeyconnect[.]com DomainsKey connection validationsetupac[.]com DomainsAccount validation and setup portalsetuphub[.]com DomainsPortal setup Learn more

For the latest security research from the Microsoft Threat Intelligence community, check out the Microsoft Threat Intelligence Blog.

To get notified about new publications and to join discussions on social media, follow us on LinkedIn, X (formerly Twitter), and Bluesky.

To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.

Review our documentation to learn more about our real-time protection capabilities and see how to enable them within your organization.  

• Evaluate your AI readiness with our latest Zero Trust for AI workshop.
• Microsoft 365 Copilot AI security documentation
• How Microsoft discovers and mitigates evolving attacks against AI guardrails
• Learn more about securing Copilot Studio agents with Microsoft Defender 

The post Passkey-themed social engineering leads to identity and cloud compromise appeared first on Microsoft Security Blog.

Article URL: https://arxiv.org/abs/2606.05608

Comments URL: https://news.ycombinator.com/item?id=49630272

Points: 1

# Comments: 0

Article URL: https://thetruesize.com/

Comments URL: https://news.ycombinator.com/item?id=49630262

Points: 1

# Comments: 0