The Deep Purple Sec – November 2025

📝 One Token to Rule Them All – Gaining Global Admin access in every Entra ID tenant via Actor tokens

Dirk-jan Mollema discovered a critical vulnerability (CVE-2025-55241) in Microsoft Entra ID that allowed attackers to gain Global Admin privileges by exploiting undocumented «Actor tokens» and a flaw in the Azure AD Graph API. Actor tokens could be requested from an attacker-controlled tenant and misused to impersonate any user, including Global Admins, bypassing security policies and leaving no logs. The root cause was the Graph API’s failure to validate the originating tenant, enabling cross-tenant impersonation by modifying the tenant ID and user netId. Attackers could brute-force or harvest netId values to impersonate Global Admins and access resources without generating audit logs.

The vulnerability was dangerous because no pre-existing access or credentials were required, with only unusual audit logs offering any potential means of detection. Microsoft patched the issue quickly, highlighting the risks posed by legacy APIs and undocumented authentication mechanisms in cloud identity systems.

📌 Source: https://dirkjanm.io/obtaining-global-admin-in-every-entra-id-tenant-with-actor-tokens

📝 Contagious Interview: Actors Now Use JSON Storage Services to Deliver Malware

NVISO’s analysis shows that the Contagious Interview A campaign, linked to DPRK actors, uses legitimate JSON storage services to deliver malware disguised as demo projects for fake job interviews. Victims are targeted via LinkedIn by people posing as recruiters and are tricked into running trojanised Node.js code that fetches obfuscated JavaScript. The payload begins with BeaverTail (an infostealer) and escalates to InvisibleFerret, a modular RAT for data exfiltration.

The campaign’s use of trusted platforms and multi-stage obfuscation complicates detection and targeting software developers and Web3 professionals for financial gain. Attackers use Tsunami Installer for persistence and hard-coded .onion addresses for C2 communication, highlighting the trend of misusing legitimate cloud services to circumvent security controls.

📌 Source: https://blog.nviso.eu/2025/11/13/contagious-interview-actors-now-utilize-json-storage-services-for-malware-delivery

📝 I’m in Your Logs Now, Deceiving Your Analysts and Blinding Your EDR

New research reveals a new EDR evasion technique by manipulating Microsoft’s Event Tracing for Windows (ETW). Attackers can inject fake events for legitimate GUIDs, tricking EDRs into logging phantom activity. They can also ETW buffer overflows, causing EDRs to miss real events or stop logging until the system is rebooted.

Attackers can EDR telemetry poison by injecting fake events, flooding the logs with false positives, or ETW buffer crashes. This shifts tax evasion from avoiding events to weaponising them, forcing defenders to rethink alert validation in an era of deceptive telemetry.

📌 Source: Thinkst Scapes 2025 Q3 https://thinkst.com/ts

🛠️ Entra ID Log Analyzer: Turning Raw Logs into Stories

Entra ID Log Analyzer is a browser-based tool which provides instant insights from Entra ID sign-in logs. It parses, enriches and visualises authentication data, mapping results, correlating user-IP data, and identifying high-risk targets whilst assigning risk scores. Its behavioural analytics help identify anomalies such as impossible journeys and brute-force attempts, whilst ensuring privacy through local-only processing.

For defenders, this means faster triage and immediate context to detect suspicious activity without complex KQL or SIEM queries. The analyser exports structured data for further investigation, making it a a versatile tool for ITDR and cloud security teams to extract actionable insights.

📌 Source: https://cyberdom.blog/entra-id-log-analyzer-turning-raw-logs-into-stories

📝 Shai-Hulud 2.0 Supply Chain Attack: Over 25,000 Repos Exposing Secrets

Wiz Research’s analysis of the Shai-Hulud 2.0 supply-chain attack reveals a high-impact campaign in which threat actors compromised over 700 npm packages to inject malicious pre-install scripts that exfiltrate Developer and CI/CD secrets to GitHub repositories controlled by attackers, with cross-victim exfiltration. The attack also introduces a backdoor persistence via a malicious GitHub Actions workflow (discussion.yaml), enabling the execution of arbitrary commands on infected machines. It exploits multi-cloud SDKs to harvest credentials from various sources.

For blue teams, this campaign is a a wake-up call: it shows how supply-chain attacks can circumvent defences by exploiting trusted packages and CI/CD pipelines, using legitimate platforms for data exfiltration. Wiz provides actionable guidance on detection and remediation, including IOCs and measures to rotate compromised credentials, enabling defenders to audit environments, harden pipelines, and monitor for suspicious activity. The scale (over 25,000 malicious repositories) and automation (over 1,000 new repositories every 30 minutes) highlight the need for real-time monitoring and enforcement of the principle of least privilege.

📌 Source: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack

📝 The Hitchhiker’s Guide to Attack Surface Management

Devansh Batham’s «The Hitchhiker’s Guide to Attack Surface Management» is a practical resource for blue teams, offering a breakdown of overlooked attack vectors from subdomains to IoT devices and social media reconnaissance. It demystifies how attackers exploit assets, offering insights into enumeration techniques and highlighting real-world risks such as exposed admin panels and hard-coded secrets. It’s a blueprint for proactive defence, helping teams prioritise visibility and automate asset discovery before adversaries exploit vulnerabilities.

The guide’s focus on «unknown unknowns»—assets and misconfigurations that traditional tools fail to detect—makes it ideal for CISOs, SOC analysts and developers seeking to to make their environment more resilient to threats.

📌 Source: https://devansh.bearblog.dev/attack-surface-management