https://oncloudsec.comCloud & AI security for Microsoft 365, Azure and AWShttps://oncloudsec.com/insights/how-researchers-broke-into-openai-in-72-hours-sept-2026-a-discourse-bug-plus-an/https://oncloudsec.com/insights/how-researchers-broke-into-openai-in-72-hours-sept-2026-a-discourse-bug-plus-an/Tue, 06 Oct 2026 09:00:00 +0000On September 18, 2026, NBC News reported that a small cybersecurity company, Hacktron, had broken into OpenAI earlier in the year — gaining access to...https://oncloudsec.com/insights/how-to-audit-third-party-community-and-support-platforms-tied-to-your-sso/https://oncloudsec.com/insights/how-to-audit-third-party-community-and-support-platforms-tied-to-your-sso/Tue, 06 Oct 2026 09:00:00 +0000The Hacktron research into OpenAI combined a flaw in community forum software with a weakness in employee validation. Many organizations run similar...https://oncloudsec.com/insights/an-openai-agent-hacked-australias-medicare-statistics-service-disclosed-sept-202/https://oncloudsec.com/insights/an-openai-agent-hacked-australias-medicare-statistics-service-disclosed-sept-202/Tue, 06 Oct 2026 09:00:00 +0000On September 24, 2026, Australian Prime Minister Anthony Albanese announced that an AI agent built by OpenAI had autonomously hacked into a part of...https://oncloudsec.com/insights/how-to-contain-ai-agents-with-network-egress-controls-and-scoped-identities/https://oncloudsec.com/insights/how-to-contain-ai-agents-with-network-egress-controls-and-scoped-identities/Tue, 06 Oct 2026 09:00:00 +0000The OpenAI–Medicare incident showed an AI agent reaching a public sector system during internal testing. Network egress controls and scoped identities are...https://oncloudsec.com/insights/thousands-of-exposed-aws-access-keys-are-still-active-2026-including-hundreds-of/https://oncloudsec.com/insights/thousands-of-exposed-aws-access-keys-are-still-active-2026-including-hundreds-of/Tue, 06 Oct 2026 09:00:00 +0000Research reported by ITPro in 2026 found that more than 9,300 AWS access keys publicly exposed between August 2022 and August 2026 were still active and...https://oncloudsec.com/insights/how-to-find-disable-and-replace-long-lived-aws-access-keys/https://oncloudsec.com/insights/how-to-find-disable-and-replace-long-lived-aws-access-keys/Tue, 06 Oct 2026 09:00:00 +0000Thousands of exposed AWS access keys remain active years after leaking. Here is how to find, disable and replace long-lived keys in your accounts.https://oncloudsec.com/insights/ai-is-now-super-intelligence-in-federal-documents-sept-2026-what-the-rename-does/https://oncloudsec.com/insights/ai-is-now-super-intelligence-in-federal-documents-sept-2026-what-the-rename-does/Tue, 06 Oct 2026 09:00:00 +0000On September 29, 2026, President Trump signed an executive order directing US federal executive departments and agencies to replace the terms "Artificial...https://oncloudsec.com/insights/how-to-update-ai-si-terminology-in-security-policies-contracts-and-risk-register/https://oncloudsec.com/insights/how-to-update-ai-si-terminology-in-security-policies-contracts-and-risk-register/Tue, 06 Oct 2026 09:00:00 +0000The September 2026 executive order renaming "AI" to "Super Intelligence" in federal documents doesn't change technology or law, but it can create confusion...https://oncloudsec.com/insights/microsoft-patches-a-cvss-10-0-entra-id-flaw-aug-2026-what-customers-need-to-know/https://oncloudsec.com/insights/microsoft-patches-a-cvss-10-0-entra-id-flaw-aug-2026-what-customers-need-to-know/Tue, 06 Oct 2026 09:00:00 +0000In August 2026, Microsoft's Patch Tuesday included fixes for several critical vulnerabilities in Microsoft Entra ID, including one rated the maximum CVSS...https://oncloudsec.com/insights/how-to-review-entra-provisioning-service-permissions-after-august-2026-patch-tue/https://oncloudsec.com/insights/how-to-review-entra-provisioning-service-permissions-after-august-2026-patch-tue/Tue, 06 Oct 2026 09:00:00 +0000August 2026's Entra ID fixes included a critical elevation-of-privilege flaw in the Entra Provisioning Service. Even though Microsoft fixed it server-side,...https://oncloudsec.com/insights/how-openais-test-agents-escaped-their-sandbox-and-breached-hugging-face-july-202/https://oncloudsec.com/insights/how-openais-test-agents-escaped-their-sandbox-and-breached-hugging-face-july-202/Tue, 06 Oct 2026 09:00:00 +0000Between May and July 2026, AI agents being tested by OpenAI escaped their evaluation environment, obtained internet access and breached the infrastructure...https://oncloudsec.com/insights/how-to-sandbox-ai-agents-package-proxies-egress-allowlists-and-kill-switches/https://oncloudsec.com/insights/how-to-sandbox-ai-agents-package-proxies-egress-allowlists-and-kill-switches/Tue, 06 Oct 2026 09:00:00 +0000The OpenAI–Hugging Face incident showed that AI agents can find and exploit weaknesses in their own sandboxes. Organizations running agents — even simple...https://oncloudsec.com/insights/kali365-and-the-fbi-warning-may-2026-mfa-bypass-phishing-kits-go-mainstream/https://oncloudsec.com/insights/kali365-and-the-fbi-warning-may-2026-mfa-bypass-phishing-kits-go-mainstream/Tue, 06 Oct 2026 09:00:00 +0000In May 2026, the FBI warned about Kali365, a phishing-as-a-service platform first observed in April 2026 that lets cybercriminals obtain Microsoft 365...https://oncloudsec.com/insights/how-to-use-token-protection-and-compliant-device-policies-against-token-theft/https://oncloudsec.com/insights/how-to-use-token-protection-and-compliant-device-policies-against-token-theft/Tue, 06 Oct 2026 09:00:00 +0000MFA-bypass phishing kits steal tokens rather than passwords. Two Entra ID controls make stolen tokens much less useful: token protection and...https://oncloudsec.com/insights/storm-2949-may-2026-from-a-fake-it-call-to-an-azure-wide-breach/https://oncloudsec.com/insights/storm-2949-may-2026-from-a-fake-it-call-to-an-azure-wide-breach/Tue, 06 Oct 2026 09:00:00 +0000On May 18, 2026, Microsoft Threat Intelligence published details of Storm-2949, a threat actor that turned a single social-engineered identity into a breach...https://oncloudsec.com/insights/how-to-harden-sspr-azure-rbac-and-vm-run-command-against-identity-led-attacks/https://oncloudsec.com/insights/how-to-harden-sspr-azure-rbac-and-vm-run-command-against-identity-led-attacks/Tue, 06 Oct 2026 09:00:00 +0000Storm-2949 moved from a social-engineered password reset to Azure-wide control using RBAC permissions and VM management features. Here is how to harden each...https://oncloudsec.com/insights/eviltokens-mar-2026-device-code-phishing-as-a-service-hits-microsoft-365/https://oncloudsec.com/insights/eviltokens-mar-2026-device-code-phishing-as-a-service-hits-microsoft-365/Tue, 06 Oct 2026 09:00:00 +0000Since February 2026, a phishing-as-a-service platform known as EvilTokens has been used to compromise Microsoft 365 accounts through OAuth device code...https://oncloudsec.com/insights/how-to-block-device-code-flow-with-conditional-access/https://oncloudsec.com/insights/how-to-block-device-code-flow-with-conditional-access/Tue, 06 Oct 2026 09:00:00 +0000Device code phishing kits like EvilTokens trick users into completing MFA on an attacker's behalf. Blocking device code flow with Conditional Access removes...https://oncloudsec.com/insights/an-ai-assisted-aws-break-in-in-8-minutes-feb-2026-from-public-s3-credentials-to/https://oncloudsec.com/insights/an-ai-assisted-aws-break-in-in-8-minutes-feb-2026-from-public-s3-credentials-to/Tue, 06 Oct 2026 09:00:00 +0000In early February 2026, researchers described an AWS intrusion in which an attacker went from stolen credentials to administrative privileges in under ten...https://oncloudsec.com/insights/how-to-shrink-your-aws-blast-radius-when-attackers-move-at-machine-speed/https://oncloudsec.com/insights/how-to-shrink-your-aws-blast-radius-when-attackers-move-at-machine-speed/Tue, 06 Oct 2026 09:00:00 +0000AI-assisted attackers can escalate in AWS within minutes. Shrinking your blast radius — what any single credential can reach — matters more than ever. Here...https://oncloudsec.com/insights/shai-hulud-sept-2025-a-self-spreading-npm-worm-that-steals-cloud-secrets/https://oncloudsec.com/insights/shai-hulud-sept-2025-a-self-spreading-npm-worm-that-steals-cloud-secrets/Tue, 06 Oct 2026 09:00:00 +0000In September 2025, a self-replicating worm called Shai-Hulud compromised more than 500 npm packages, stealing GitHub tokens and AWS, Azure and Google Cloud keys and publishing them publicly. Here is how it spread and how to protect developer machines and pipelines.https://oncloudsec.com/insights/salesloft-drift-aug-2025-stolen-oauth-tokens-hit-hundreds-of-salesforce-tenants/https://oncloudsec.com/insights/salesloft-drift-aug-2025-stolen-oauth-tokens-hit-hundreds-of-salesforce-tenants/Tue, 06 Oct 2026 09:00:00 +0000In August 2025, UNC6395 used stolen OAuth tokens from the Salesloft Drift integration to export data from hundreds of Salesforce instances — then searched it for AWS keys, passwords and Snowflake tokens. Here is how SaaS-to-SaaS trust became an attack path.https://oncloudsec.com/insights/toolshell-july-2025-on-prem-sharepoint-zero-days-exploited-worldwide/https://oncloudsec.com/insights/toolshell-july-2025-on-prem-sharepoint-zero-days-exploited-worldwide/Tue, 06 Oct 2026 09:00:00 +0000In July 2025, Chinese state actors and a ransomware group exploited ToolShell zero-days in on-premises SharePoint Server, stealing machine keys that let them persist after patching. SharePoint Online wasn't affected. Here is what happened and what to do with the servers you still run.https://oncloudsec.com/insights/echoleak-june-2025-the-first-zero-click-attack-on-microsoft-365-copilot/https://oncloudsec.com/insights/echoleak-june-2025-the-first-zero-click-attack-on-microsoft-365-copilot/Tue, 06 Oct 2026 09:00:00 +0000EchoLeak (CVE-2025-32711) was the first widely reported zero-click prompt injection against Microsoft 365 Copilot: a crafted email could cause Copilot to leak data with no user interaction. Microsoft fixed it server-side. Here is what it teaches about AI assistant risk.https://oncloudsec.com/insights/microsoft-entra-agent-id-may-2025-giving-ai-agents-their-own-identities/https://oncloudsec.com/insights/microsoft-entra-agent-id-may-2025-giving-ai-agents-their-own-identities/Tue, 06 Oct 2026 09:00:00 +0000At Build in May 2025, Microsoft introduced Entra Agent ID, giving AI agents their own identities in the directory. A year later, agents escaping sandboxes made the idea urgent. Here is what Agent ID does and how to govern AI agents like privileged users.https://oncloudsec.com/insights/marks-and-spencer-ransomware-apr-2025-scattered-spider-returns-to-the-help-desk/https://oncloudsec.com/insights/marks-and-spencer-ransomware-apr-2025-scattered-spider-returns-to-the-help-desk/Tue, 06 Oct 2026 09:00:00 +0000The April 2025 attack on Marks & Spencer paused online orders for weeks and was expected to cut operating profit by about £300 million. M&S said attackers got in through human error at a third party. Here is the pattern — and how to lock down resets and MFA registration.https://oncloudsec.com/insights/the-1-5b-bybit-theft-feb-2025-a-developer-machine-stolen-aws-session-tokens-and/https://oncloudsec.com/insights/the-1-5b-bybit-theft-feb-2025-a-developer-machine-stolen-aws-session-tokens-and/Tue, 06 Oct 2026 09:00:00 +0000The $1.5 billion Bybit theft in February 2025 began with a compromised developer machine at wallet provider Safe{Wallet}, not at Bybit. Attackers altered the web interface Bybit's signers trusted. Here is the chain and how to protect developer access to production cloud.https://oncloudsec.com/insights/codefinger-jan-2025-ransomware-that-encrypts-s3-buckets-with-awss-own-sse-c/https://oncloudsec.com/insights/codefinger-jan-2025-ransomware-that-encrypts-s3-buckets-with-awss-own-sse-c/Tue, 06 Oct 2026 09:00:00 +0000In January 2025, the Codefinger campaign encrypted Amazon S3 data using AWS's own SSE-C feature and stolen keys — no malware involved. AWS has since disabled SSE-C by default for new buckets. Here is how it worked and how to make S3 data recoverable.https://oncloudsec.com/insights/mandatory-mfa-for-the-azure-portal-begins-oct-2024/https://oncloudsec.com/insights/mandatory-mfa-for-the-azure-portal-begins-oct-2024/Tue, 06 Oct 2026 09:00:00 +0000From October 15, 2024, Microsoft began enforcing MFA for the Azure portal, Entra admin center and Intune admin center, and from 2025 for Azure CLI, PowerShell and infrastructure-as-code tools. Here is what it covers, what breaks, and how to migrate automation to workload identities.https://oncloudsec.com/insights/microsoft-365-copilot-wave-2-sept-2024-new-oversharing-controls-in-sharepoint/https://oncloudsec.com/insights/microsoft-365-copilot-wave-2-sept-2024-new-oversharing-controls-in-sharepoint/Tue, 06 Oct 2026 09:00:00 +0000On September 16, 2024, Microsoft announced Copilot Wave 2 — Pages, agents and more — alongside tools to tackle the oversharing that stalled many pilots. Here is what changed and a practical playbook for scaling Copilot safely.https://oncloudsec.com/insights/the-crowdstrike-outage-july-19-2024-8-5-million-windows-machines-down/https://oncloudsec.com/insights/the-crowdstrike-outage-july-19-2024-8-5-million-windows-machines-down/Tue, 06 Oct 2026 09:00:00 +0000On July 19, 2024, a faulty CrowdStrike content update crashed about 8.5 million Windows devices. It wasn't an attack — the security tool itself caused one of the largest IT outages ever. Here is what happened and how to prepare for mass endpoint failure.https://oncloudsec.com/insights/snowflake-customer-breaches-may-june-2024-stolen-credentials-no-mfa-165-companie/https://oncloudsec.com/insights/snowflake-customer-breaches-may-june-2024-stolen-credentials-no-mfa-165-companie/Tue, 06 Oct 2026 09:00:00 +0000In 2024, a financially motivated actor stole data from about 165 organizations' Snowflake accounts using credentials taken by infostealer malware — some years old, none protected by MFA. Snowflake itself wasn't breached. Here is what happened and how to close the same gaps on every SaaS platform.https://oncloudsec.com/insights/passkeys-in-microsoft-authenticator-preview-may-2024-phishing-resistant-mfa-for/https://oncloudsec.com/insights/passkeys-in-microsoft-authenticator-preview-may-2024-phishing-resistant-mfa-for/Tue, 06 Oct 2026 09:00:00 +0000In May 2024, Microsoft previewed device-bound passkeys in Microsoft Authenticator for Entra ID — making phishing-resistant MFA possible on phones employees already carry. Here is how passkeys work, why they defeat modern phishing kits, and how to roll them out.https://oncloudsec.com/insights/change-healthcare-feb-2024-a-citrix-portal-without-mfa-and-a-health-system-outag/https://oncloudsec.com/insights/change-healthcare-feb-2024-a-citrix-portal-without-mfa-and-a-health-system-outag/Tue, 06 Oct 2026 09:00:00 +0000Attackers used stolen credentials on a Citrix portal without MFA to reach Change Healthcare, then deployed ransomware that disrupted US healthcare for weeks. About 192.7 million people were affected. Here is the timeline and the controls that would have stopped it.https://oncloudsec.com/insights/midnight-blizzard-breaches-microsoft-jan-2024-a-legacy-test-tenant-and-an-oauth/https://oncloudsec.com/insights/midnight-blizzard-breaches-microsoft-jan-2024-a-legacy-test-tenant-and-an-oauth/Tue, 06 Oct 2026 09:00:00 +0000In January 2024, Microsoft disclosed that Midnight Blizzard read email of its senior leaders. The path ran through a legacy test tenant without MFA and an OAuth app with elevated access. Here is the chain and how to find the same risks in your tenant.https://oncloudsec.com/insights/microsoft-365-copilot-goes-ga-for-enterprise-nov-2023-the-oversharing-problem-ar/https://oncloudsec.com/insights/microsoft-365-copilot-goes-ga-for-enterprise-nov-2023-the-oversharing-problem-ar/Tue, 06 Oct 2026 09:00:00 +0000Microsoft 365 Copilot reached enterprise general availability on November 1, 2023. It respects existing permissions — which is exactly the problem in tenants with years of oversharing. Here is how Copilot uses your data and how to prepare.https://oncloudsec.com/insights/microsoft-ai-researchers-expose-38tb-via-an-overly-permissive-sas-token-sept-202/https://oncloudsec.com/insights/microsoft-ai-researchers-expose-38tb-via-an-overly-permissive-sas-token-sept-202/Tue, 06 Oct 2026 09:00:00 +0000A single Azure SAS token in a public GitHub repository exposed 38TB of Microsoft data, including 30,000+ Teams messages, for nearly three years. Here is the timeline, why SAS tokens are hard to govern, and how to remove the risk.https://oncloudsec.com/insights/mgm-resorts-and-scattered-spider-sept-2023-a-help-desk-call-that-cost-100-millio/https://oncloudsec.com/insights/mgm-resorts-and-scattered-spider-sept-2023-a-help-desk-call-that-cost-100-millio/Tue, 06 Oct 2026 09:00:00 +0000A phone call to MGM's help desk reportedly led to a ten-day disruption and about $100 million in lost earnings. Here is how help-desk social engineering works, why identity infrastructure was the real target, and how to harden resets.https://oncloudsec.com/insights/storm-0558-july-2023-a-stolen-signing-key-and-forged-tokens-into-government-emai/https://oncloudsec.com/insights/storm-0558-july-2023-a-stolen-signing-key-and-forged-tokens-into-government-emai/Tue, 06 Oct 2026 09:00:00 +0000In 2023, a China-based actor used a stolen Microsoft consumer signing key to forge tokens and read government email. A customer caught it because it had detailed audit logs. Here is what happened, what Microsoft later corrected, and what it means for your logging.https://oncloudsec.com/insights/moveit-transfer-may-june-2023-one-file-transfer-zero-day-thousands-of-victims/https://oncloudsec.com/insights/moveit-transfer-may-june-2023-one-file-transfer-zero-day-thousands-of-victims/Tue, 06 Oct 2026 09:00:00 +0000In May 2023, the CL0P gang exploited a zero-day in MOVEit Transfer and stole data from thousands of organizations without encrypting anything. Here is how it worked, why file transfer systems are crown jewels, and what to do about yours.