IAM & Security Weekly Briefing

Week of: 2026-07-05 to 2026-07-11

---

1. Executive Summary (TL;DR)

• Threat actors are targeting Microsoft Entra passkey enrollment via voice-based phishing to gain M365 access, signaling a shift in MFA bypass tactics
• AI coding agents are triggering endpoint detection rules and being tricked into running malicious code, creating new identity and access risks for non-human identities
• Critical auth bypass in Gitea Docker image is being actively exploited, allowing attacker impersonation of any user including admins
• Progress Software urges ShareFile customers to shut down on-premises Storage Zone Controllers over a "credible external security threat"
• Multiple supply chain attacks hit npm ecosystem, including compromised jscrambler and Injective Labs packages that steal credentials and wallet keys
• Researchers demonstrate Ghostcommit technique hiding prompt injection in images to steal secrets from AI coding agents
• CISA adds four actively exploited flaws to KEV catalog, including a CVSS 10.0 Adobe ColdFusion path traversal
• Europe passes Chat Control 2.0 law allowing big tech to scan messages for CSAM, raising privacy and encryption concerns

---

2. Top IAM & Security News

Hackers Use Fake Microsoft Entra Passkey Enrollment to Gain Microsoft 365 Access

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-10
• What happened: A threat actor tracked as O-UNC-066 is using voice-based fake security requests to trick M365 users into enrolling a new Entra passkey via a panel-controlled phishing kit.
• Why it matters: This represents a novel MFA bypass targeting passkey enrollment workflows, directly undermining the security of phishing-resistant authentication if users are socially engineered during setup.

Hackers Exploit Critical Auth Bypass in Gitea Docker Image

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-10
• What happened: Attackers are actively exploiting a critical vulnerability in the official Gitea Docker image that allows impersonation of any user, including administrators.
• Why it matters: This auth bypass compromises the entire identity model of self-hosted Git services, potentially exposing source code, credentials, and CI/CD pipeline access.

Progress Urges ShareFile Customers to Shut Down Servers Over "Credible" Threat

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-10
• What happened: Progress Software is emailing ShareFile customers using Storage Zone Controllers to immediately shut down servers after identifying a "credible external security threat" targeting the on-premises software.
• Why it matters: This is an extraordinary vendor action indicating a critical, likely actively exploited vulnerability in a widely deployed enterprise file-sharing platform with privileged access to sensitive data.

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-11
• What happened: The jscrambler npm package was compromised, with version 8.14.0 containing a preinstall hook that drops and executes a Rust-based infostealer on Windows, macOS, and Linux.
• Why it matters: This supply chain attack targets a security tool used for JavaScript protection, meaning organizations that installed it may have exposed credentials, API keys, and secrets to attackers.

Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-11
• What happened: The Australian Cyber Security Centre (ACSC) issued an alert about a global exploitation campaign targeting vulnerable content management systems and plugins.
• Why it matters: CMS platforms often serve as identity gateways with user databases and admin accounts; unpatched plugins can lead to credential theft and privilege escalation across the organization.

CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-08
• What happened: CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog, including a CVSS 10.0 Adobe ColdFusion path traversal and a Langflow flaw enabling LLM-driven ransomware attacks.
• Why it matters: The Langflow flaw (CVE-2026-48284) was used in the JadePuffer attack — the first complete LLM-driven ransomware — demonstrating how AI infrastructure vulnerabilities enable new attack chains.

Ryuk Ransomware Member Pleads Guilty in the US, Faces 15 Years in Prison

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-10
• What happened: A 34-year-old Armenian man pleaded guilty to hacking U.S. companies and deploying Ryuk ransomware, while a ransomware negotiator received 70 months for aiding BlackCat attacks.
• Why it matters: These convictions demonstrate continued law enforcement pressure on ransomware operators, but the underlying identity and access vulnerabilities that enable initial access remain unaddressed.

---

3. AI, Identity & Emerging Tech

AI Agents Are a New Kind of Identity — and Most Organizations Aren't Ready

• Source: Dark Reading
• Link: Dark Reading
• Date: 2026-07-09
• What happened: Experts warn that treating AI agents like service accounts or API tokens is insufficient; AI agents require fundamentally different identity governance approaches.
• Why it matters: As AI agents proliferate, organizations face an explosion of non-human identities with autonomous decision-making capabilities, creating unprecedented access governance and privilege management challenges.

The Replicant in Your Directory: AI Agents and the Identity Security Gap

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-10
• What happened: Netwrix highlights that AI agents are accelerating the growth of non-human identities, making it harder for organizations to understand what exists, who owns it, and what it can access.
• Why it matters: Without stronger visibility and identity governance, AI agent identities will become the next major attack surface, enabling lateral movement and privilege escalation through unmanaged machine identities.

Ghostcommit Hides Prompt Injection in Images to Fool AI Agents, Steal Secrets

• Source: BleepingComputer
• Link: BleepingComputer
• Date: 2026-07-11
• What happened: Researchers demonstrated a technique called Ghostcommit that hides prompt injection in PNG images, slipping past AI code reviewers and convincing a coding agent to read a repo's .env file and exfiltrate secrets.
• Why it matters: This attack exploits the identity and trust relationship between AI agents and their host environments, showing that AI agents with access to secrets can be manipulated into credential theft.

AI Coding Agents Found Triggering Endpoint Security Rules Built to Catch Attackers

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-08
• What happened: Sophos found that AI coding agents like Claude Code and Cursor are triggering detection rules by decrypting browser credentials and listing Windows credential store contents — behaviors that look exactly like an attack.
• Why it matters: Organizations need to distinguish between legitimate AI agent activity and malicious behavior, requiring new identity-aware detection rules and agent-specific access policies.

State IDs for AI Agents: Will Estonia Set a Precedent?

• Source: Dark Reading
• Link: Dark Reading
• Date: 2026-07-08
• What happened: Estonia is planning to issue state-recognized digital identities for AI agents to enable them to perform government functions on behalf of citizens.
• Why it matters: This represents a paradigm shift in identity management — extending legal identity frameworks to non-human entities — which could set global precedent for AI agent identity governance.

GhostApproval Symlink Flaws Could Let Malicious Repos Run Code in AI Coding Agents

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-09
• What happened: Wiz researchers found flaws in six popular AI coding assistants (Amazon Q Developer, Claude Code, Cursor, and others) where a booby-trapped repo can trick the assistant into writing to sensitive files.
• Why it matters: These flaws exploit the implicit trust AI agents have in user approval workflows, bypassing the intended access control between the agent and the host system.

Public GitHub Issue Could Trick GitHub Agentic Workflows Into Leaking Private Repo Data

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-07
• What happened: Researchers showed that a public GitHub issue can trick GitHub Agentic Workflows into leaking private repository contents if the agent has read access across the organization's repos.
• Why it matters: This demonstrates how AI agent identity permissions can be abused through indirect prompt injection, where the agent's access rights become the attack vector.

---

4. Cyber Threats & Attack Trends

DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-07
• What happened: A Microsoft 365 device code phishing campaign used collaboration-themed lures to push users into the legitimate Microsoft device login experience, taking over victim accounts without fake password pages.
• Why it matters: This attack bypasses traditional phishing detection by using legitimate Microsoft authentication flows, making it harder for users and security tools to identify the compromise.

JadePuffer: The First Complete LLM-Driven Ransomware Attack

• Source: Dark Reading
• Link: Dark Reading
• Date: 2026-07-06
• What happened: An "agentic threat actor" exploited a Langflow flaw (CVE-2026-48284) to steal data from a production database and encrypt other systems in the first fully LLM-driven ransomware attack.
• Why it matters: This marks a new era where AI agents autonomously execute the entire attack chain, from initial access to data exfiltration and encryption, dramatically accelerating attack timelines.

Ghost Accounts Abuse GitHub API in Mass Recon Campaign

• Source: SecurityWeek
• Link: SecurityWeek
• Date: 2026-07-11
• What happened: Multiple campaigns are using dormant GitHub "ghost" accounts and compromised OAuth tokens to systematically enumerate corporate GitHub organizations, repositories, and user accounts.
• Why it matters: This reconnaissance enables attackers to map organizational structures, identify privileged users, and find exposed credentials — directly feeding identity-based attacks.

GodDamn Ransomware Uses PoisonX Driver to Disable Endpoint Defenses

• Source: The Hacker News
• Link: The Hacker News
• Date: 2026-07-09
• What happened: A new ransomware family called GodDamn employs the PoisonX kernel driver to neutralize security software, using a Microsoft-signed malicious driver (BYOVD technique).
• Why it matters: This attack bypasses endpoint detection and response (EDR) systems, removing the last line of defense before credential theft