VS Code Zero-Day Vulnerability Exposes GitHub Tokens to Theft

A security researcher just revealed a shocking VS Code zero-day vulnerability that lets attackers swipe your GitHub authentication tokens with just one click, exposing your online projects to potential theft. This exploit cleverly abuses VS Code's system to run malicious code and extract sensitive tokens.

https://osintsights.com/vs-code-zero-day-vulnerability-exposes-github-tokens-to-theft?utm_source=mastodon&utm_medium=social

#VsCodeZeroday #Github #Oauth #EmergingThreats #SupplyChain

#Keycloak question: is there a way to allow multiple service accounts/machines to use one OIDC client?

Normally we'd go one OIDC client in confidential mode with the service account using client credentials flow - per machine access.

However, each OIDC client/service account means a new OIDC audience - and AWS has a hard limit of 100.

Direct Access grant flow is deprecated already and removed entirely I think from Oauth2.1 spec in strict mode.

Maybe we could just create users to represent the machines - but we'd have to find a way to exempt them from Realm policies like MFA etc and it still feels icky.

CC @4censord #OIDC #Oauth #Oauth2

OAuth device code phishing (RFC 8628 abuse) bypasses MFA and delivers 90-day M365 refresh tokens to attackers without a password. This guide covers how to disable device authorization grant in Entra ID, Keycloak, and Auth0, plus SIEM detection rules for Sentinel and Splunk.

https://iamdevbox.com/posts/oauth-device-code-flow-security-prevent-device-code-phishing/?utm_source=mastodon&utm_medium=social&utm_campaign=blog_post

#OAuth #Security #Phishing #RFC8628 #EntraID

Trying the Element #Matrix chat client again on Android is a mess. I've used #Element (classic) before and now installed #ElementX.

Even after clearing app data and uninstalling both , after reinstalling both remember my account 🤔, but repeatedly fail to login with #OAuth "already used" and that's it. No way to login. Awful UX.

🔑 Credential Theft Alert: OAuth tokens stolen via SSO redirect attacks

Attackers exploiting OAuth 2.0 redirect URI bypasses to hijack SSO sessions on enterprise cloud platforms. Mandatory MFA alone isn't enough when token injection bridges the gap between auth and session.

Full guide → https://cyber.murati.net
#cybersecurity #infosec #SSO #OAuth #credentialtheft

Managing Shadow AI Tools Requires a Proactive Security Approach

Employees are now using three to five AI tools daily, outpacing the controls in place to manage them, and creating a growing security gap that's hard to ignore. This surge in shadow AI tools is fueled by three key areas: OAuth connections, browser extensions, and bundled AI.

https://osintsights.com/managing-shadow-ai-tools-requires-a-proactive-security-approach?utm_source=mastodon&utm_medium=social

#ShadowAiTools #Oauth #BrowserExtensions #ArtificialIntelligence #EmergingThreats