nOAuth Abuse Update: Potential Pivot into Microsoft 365

Semperis found 9 of 104 tested SaaS apps vulnerable to nOAuth abuse: with an Entra tenant and a victim's email, an attacker can take over accounts. The flaw is severe and hard to defend against.

SaaS threat update: UNC6040 (ShinyHunters/Scattered Spider) runs credential attacks and OAuth phishing; suspected nation-state UNC6395 spread beyond Salesloft to 700+ customers.

Wiz for Microsoft 365 is GA: M365 posture, data, and access risks join the Security Graph, linking SharePoint/OneDrive exposure, Entra identity risk, and Copilot Studio agents to cloud attack paths.

Wiz analyzes the Vercel incident: stolen Context.ai OAuth tokens, a broad 'Allow All' grant, and a suspected infostealer infection enabled a double supply chain attack via trusted SaaS tools.

Three OAuth techniques attackers use in Azure, and how Entra ID sign-in logs and JWT claims expose them; includes Wiz telemetry on prevalence and ready-to-use KQL detection queries.

NetSPI launches SaaS Security Assessments for Salesforce and Microsoft 365, pairing automated and manual testing against CIS Benchmarks to uncover misconfigurations in an often-overlooked surface.