Notifications
Clear all
Topic starter
06/09/2026 3:45 pm
TL;DR: Attackers are shifting toward data theft, extortion, and identity compromise, with SSO attacks, zero-day exploitation, and supply-chain exposure driving multiple confirmed incidents across enterprise environments, according to FireCompass. The pattern reinforces that session trust, vendor access, and phishing-resistant authentication now matter more than isolated credential hygiene.
NHIMG editorial — based on content published by FireCompass: Weekly Report on New Hacking Techniques and Critical CVEs, 27 Jan to 2 Feb 2026
By the numbers:
- Five confirmed critical vulnerabilities entered active exploitation phase during the week, alongside 13 KEV additions recorded by CISA.
- Attackers attempt access to exposed AWS credentials within an average of 17 minutes, and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams respond when SSO credentials or tokens are stolen?
A: Revoke the affected session immediately, reset any linked credentials, and review downstream application access for token reuse or delegated consent abuse.
Q: Why do SSO and OAuth compromises create such large blast radius?
A: They create large blast radius because one trusted identity decision can unlock many connected systems, and delegated access often persists after the original compromise.
Q: What are the signs that identity controls are failing during an active attack?
A: Look for unusual login patterns, new consent grants, rapid token reuse, helpdesk-style vishing followed by legitimate session creation, and access to systems that do not match the user's normal workflow.
Practitioner guidance
- Harden SSO against session theft Require phishing-resistant MFA such as FIDO2 for all privileged and high-risk users, and monitor for impossible-travel, token reuse, and abnormal consent grants across identity providers.
- Inventory and revoke over-broad OAuth access Map every third-party app connected through OAuth, flag unused or over-scoped grants, and remove access that cannot be justified by business ownership or current use.
- Prioritise exploit chains over isolated CVEs Score internet-facing and identity-adjacent vulnerabilities by whether they support initial access, privilege escalation, or persistence, then patch the highest chaining risk first.
What's in the full report
FireCompass's full report covers the operational detail this post intentionally leaves for the source:
- Incident-by-incident breakdowns of the week’s critical CVEs, including exploit mechanics and affected platforms.
- Stepwise attack-flow analysis for voice phishing, AiTM SSO compromise, and zero-click media delivery.
- Defensive recommendations tied to specific infrastructure types such as SSO, messaging, DLP, and mobility systems.
- Investigation priorities for teams that need to map indicators of compromise to active exploitation campaigns.
👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs →
SSO compromise and data exfiltration: what IAM teams should change?
Explore further
06/09/2026 3:45 pm
Identity compromise is now the control plane for broad breach cascades. The report shows attackers using SSO, OAuth, and session theft to reach many applications after a single initial compromise. That means identity governance is not just about access administration, but about whether downstream systems inherit trust that should have been re-validated. Practitioners should treat identity events as breach containment signals, not only authentication events.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared with nearly 1 in 4 for securing human identities, according to The State of Non-Human Identity Security.
A question worth separating out:
A: They should do both, but identity hardening often limits the fastest spread while patching addresses the root entry point. If the exploit path already includes SSO, tokens, or privileged credentials, revocation and containment can reduce impact before the patch cycle completes.
👉 Read our full editorial: SSO compromise and data exfiltration are accelerating attack cascades
