Metabase Cloud: The winner takes it all

Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.

Wiz Research analyzes NordStellar logs to map credentials harvested by infostealers like Lumma and RedLine, showing how stolen keys and tokens unlock AWS, Azure, GitHub, and AI platforms.

Wiz earned Leader status in Forrester's Q3 2026 Proactive Security Platforms Wave, scoring 5.0/5.0 on 8 of 21 criteria, including cloud visibility, exposure validation, and remediation augmentation.

Explores hosting red team phishing pages and payloads on Azure services under Microsoft's trusted domains, using their good reputation to slip past web filters as domain fronting fades.

Reviews the Georgia Tech 2013 cyber threat forecast: cloud botnets, mobile browser and wallet flaws, malware obfuscation, counterfeit hardware in the supply chain, and healthcare data risks.

After a dull conference, the author concludes cloud pentesting is fundamentally the same as traditional testing: virtualized or shared, the underlying technology and security controls hardly change.