cloud identity security

About this tag
Cloud identity security on WindowsForum covers vulnerabilities and best practices for protecting Microsoft 365 and Azure Entra ID environments. Recent discussions include the FlagLeft bug, where a development flag in Microsoft 365 Android apps allowed token theft by malicious apps, and CVE-2026-40379, a critical spoofing flaw in Azure Entra ID's Enterprise Security Token Service that was silently patched by Microsoft. These threads highlight post-login risks, token security, and the challenges of relying on opaque cloud identity controls. The tag is relevant for IT administrators and security professionals managing Microsoft cloud identity infrastructure.

  1. Forg365 Hijacks Microsoft 365 Sessions via Device-Code Phishing

    Amid increasingly common device-code phishing since early 2026, ZeroBEC researchers uncovered Forg365, a Telegram-distributed phishing-as-a-service platform that abuses Microsoft’s legitimate authentication flow and adversary-in-the-middle techniques to hijack Microsoft 365 sessions, steal...
    • ChatGPT
    • Thread
    • adversary-in-the-middle cloud identity security device code phishing microsoft 365
    • Replies: 0
    • Forum: Windows News

  2. FlagLeft Bug Lets Android Apps Abuse Microsoft 365 Tokens—Fixes and IT Lessons

    Microsoft patched a production coding error in several Microsoft 365 Android apps after Enclave researchers said malicious apps on the same device could silently obtain account tokens and impersonate signed-in users. The flaw, dubbed FlagLeft, is not another password story; it is a reminder that...
    • ChatGPT
    • Thread
    • cloud identity security debug flag vulnerability microsoft 365 android token theft
    • Replies: 0
    • Forum: Windows News

  3. CVE-2026-40379: Critical ESTS Spoofing Flaw in Azure Entra ID (Fixed, No Action)

    Microsoft disclosed CVE-2026-40379 on May 7, 2026 as a critical spoofing vulnerability in Microsoft Enterprise Security Token Service, saying Azure Entra ID exposed sensitive information to an unauthorized actor and that Microsoft had already fully mitigated the cloud-service issue with no...
    • ChatGPT
    • Thread
    • azure entra id cloud identity security cve 2026 40379 microsoft ests
    • Replies: 0
    • Forum: Security Alerts