Topic starter
14/07/2026 5:23 pm
TL;DR: A global crackdown on fraud networks led to 5,811 arrests and $293 million in seized assets, while Forg365 used device-code phishing and a persistence extension to keep Microsoft 365 access alive without reauthentication, according to SentinelOne. The pattern shows that identity abuse now spans fraud, human account takeover, and espionage, not just one threat class.
Editorial analysis by NHI Mgmt Group, based on content published by SentinelOne: “The Good, the Bad and the Ugly in Cybersecurity – Week 28”.
By the numbers:
- Operation First Light 2026 spanned 97 countries and blocked over 31,000 fraudulent bank accounts and virtual wallets.
Key questions
Q: What breaks when device code phishing is not separately governed?
A: MFA can still fail if the user is tricked into approving a legitimate device authorization request.
Q: Why do stolen tokens often survive password resets and MFA changes?
A: Because tokens are issued after authentication and often remain valid independently of later password or MFA updates.
Q: What are the signs that a compromised cloud identity is being used for persistence?
A: Watch for new roles, altered trust policies, unusual token issuance, access at odd hours, and identity-management actions that do not match the workload’s normal function.
Practitioner guidance
- Audit device-code authentication use Inventory where device-code flows are permitted, justify each exception, and alert on unexpected device-code approvals in Microsoft Entra and related identity logs.
- Revoke OAuth grants during compromise handling Add OAuth consent grants, refresh tokens, and session cookies to your containment checklist so that account recovery actually severs attacker persistence.
- Separate phishing response from password-only remediation When a campaign uses token capture or adversary-in-the-middle techniques, require token invalidation and app consent review instead of relying on password resets alone.
Bottom line: Identity abuse in this article is not limited to one threat type. Fraud, phishing, and espionage all depend on controlling or extending trust inside identity systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:26 pm
Identity abuse is now a cross-domain governance problem, not a single-threat category. Fraud operations, phishing kits, and espionage intrusions may differ in motive, but they increasingly converge on the same control surfaces: authentication events, token lifecycles, and delegated access paths. That means the governance model has to span human users, service access, and post-compromise token handling. The practitioner conclusion is straightforward: treat identity abuse as a lifecycle issue across the full access chain.
A question worth separating out:
Q: How should teams respond when fraud, phishing, and espionage all use the same identity path?
A: Treat the access path as the primary object of defence and response, not the incident label. Fraud, phishing, and espionage can all exploit the same account, token, or delegated trust mechanism, so containment must focus on revocation, telemetry, and scope review across the identity estate. Separate motives do not justify separate controls.
👉 Read our full editorial: Fraud, phishing, and espionage show identity abuse at scale