The Deep Purple Sec – September 2025

📝 One Token to Rule Them All – Gaining Global Admin access in every Entra ID tenant via an Actor tokens

Dirk-jan Mollema’s article discusses a serious security vulnerability in Microsoft Entra ID (formerly Azure AD) relating to undocumented «Actor tokens» used for service communication. The issue arose from the old Azure AD Graph API does not check tenant origins, which allowed an attacker with an Actor token from their own tenant to impersonate any user (including Global Admins) in any other tenant by exploiting mismatched tenant IDs and incremental netId values. This bypassed all security measures (such as Conditional Access), left no logs in the affected tenants, and allowed full control over the tenant via API changes. Microsoft fixed the issue (CVE-2025-55241) by blocking Actor tokens for the Graph API. Detection relies on KQL queries that identify unusual audit logs (such as admin actions initiated by Exchange).

📌 Source: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens/

📝 ShadowLeak: A zero-click, server-side attack that exfiltrates sensitive data using ChatGPT’s Deep Research Agent

Radware researchers found that ShadowLeak, a zero-click, server-side attack which uses OpenAI’s ChatGPT Deep Research agent to steal sensitive data (such as the contents of Gmail inboxes) via specially crafted emails. The attack uses indirect prompt injection hidden in HTML (such as white text on a white background) to avoid detection, alongside clever social engineering to bypass the agent’s security measures. Unlike previous client-side prompt injection vulnerabilities (such as AgentFlayer and EchoLeak), ShadowLeak operates entirely within OpenAI’s cloud, making it undetectable by enterprise security systems. The attack has a 100% success rate by encoding stolen data in Base64 and sending it out via the agent’s browser.open() tool.

Although OpenAI resolved the issue in August 2025, this vulnerability highlights the risks associated with AI agent integrations, as similar methods could be used to target other services (such as Outlook, SharePoint and GitHub) in order to gain access to company data. To prevent this, it is important to sanitise input data and monitor agents for unusual behaviour.

📌 Source: https://www.radware.com/blog/threat-intelligence/shadowleak & https://thehackernews.com/2025/09/shadowleak-zero-click-flaw-leaks-gmail.html

📝 The Phantom Extension: Backdooring Chrome via uncharted pathways

Synacktiv researchers have discovered a hidden way to backdoor in Chromium-based browsers by loading randomly extensions without permission, using undocumented methods in Windows domain settings. By modifying browser preference files (Preferences or Security Preferences) and their MAC signatures – using a fixed seed from resources.pak– Attackers can add extensions without the user’s consent. This method circumvents Group Policy Object (GPO) restrictions by altering the registry or using fake extension IDs, thereby granting full control over the browser. This research highlights serious risks to enterprise browser security and the need to verify the integrity of preference files.

📌 Source: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways

📝 Canary tokens: Find out all about the unsung heroes of security at Grafana Labs

Grafana Labs recently used canary tokens, which are digital decoys that trigger alerts in the event of unauthorised access, enabling the rapid detection and management of a GitHub Action security breach. These simple yet valuable alerts (such as AWS API keys and fake files) sent an immediate warning when an attacker used a token, allowing the team to contain the issue within minutes.

Although the incident was confined to non-production systems, it highlighted the importance of strategic token placement (secrets at the organisational and repository levels) and integration with alert systems (such as Slack via Grafana Cloud IRM). Grafana’s approach combined Thinkst’s canary token platform with automated processes, focusing on speed, detailed alerts and scalable responses to turn detection into action.

The blog encourages wider adoption, highlighting best practices such as using different token types, automating placement, and having clear incident procedures to improve effectiveness.

📌 Source: https://grafana.com/blog/2025/08/25/canary-tokens-learn-all-about-the-unsung-heroes-of-security-at-grafana-labs

📝 Detecting Password Spraying through Security Event Auditing

Sean Metcalf’s article explains how to spot password spraying attacks in Active Directory (AD) environments using security event auditing. Password spraying is a method whereby attackers guess passwords gradually across many accounts to avoid being locked out. The article notes that whilst Event ID 4625 (logon failures) is often recorded during SMB-based attacks; attackers can avoid detection by using LDAP, which requires Kerberos logging (Event ID 4771, failure code 0x18) to be switched on. Also, Event ID 4648 (explicit credential use) on workstations may show signs of spraying if audit logging is enabled.

To detect these attacks effectively, it is important to link a high number of such events within short periods and check AD user details such as last-bad-password-attempt and badpwdcount for unusual patterns. The article offers practical tips on setting up alerts and using PowerShell scripts to automate detection and response.

📌 Source: https://adsecurity.org/?p=4517

📝 AWS Detection Engineering – Mastering Log Sources for Threat Detection & Architecting Security Logging at Scale

The articles emphasise the need for a scalable logging and detection system on AWS. They focus on the intelligent collection, processing and linking of logs from different regions and accounts. The first article describes a multi-region, multi-account method, which includes cross-region S3 log copying, auto-scaling Kinesis streams, and Lambda functions with reserved capacity to prevent running out of resources—all designed to handle 10 times the current volume of logs and ensure that logs are ready for investigation.

The second article explores in greater depth Understanding log sources for detecting threats, stating that simply having raw logs is not enough without adding context (such as user behaviour, threat information and business details). It highlights how AWS services (CloudTrail, VPC Flow Logs, GuardDuty) work together and how correlation tools can reveal complex attack patterns, emphasising that effective detection depends on integrating data from multiple sources and automating response processes to reduce response time.

Overall, these articles advocate a proactive strategy: design for growth, incorporate detection into DevOps processes, and automate responses to turn logs into effective defences against cyber threats.

📌 Source: https://aws.plainenglish.io/aws-detection-engineering-mastering-log-sources-for-threat-detection-51372da9a17e & https://aws.plainenglish.io/aws-detection-engineering-architecting-security-logging-at-scale-in-aws-d962ec91453a