🕵️ RESEARCH & DEEP DIVES
Rogue external MFA providers can steal Microsoft Entra passwords during logins
Varonis Threat Labs developed an attack called TrustSink that uses a rogue external MFA provider in Microsoft Entra to steal users' passwords during legitimate sign-ins.- Affects organizations using Microsoft Entra with external authentication method (EAM) MFA providers; the technique works with any provider relying on the external authentication model.
- Attackers who already control a highly privileged Entra account (Global Administrator or Authentication Policy Administrator) can register a rogue external MFA provider that displays a fake Microsoft password prompt during the login flow.
- The fake prompt appears right after the victim enters their real password on login.microsoftonline.com, so the second password entry is sent to the attacker's server in plaintext with timestamps and source IP addresses.
- The rogue provider returns a valid signed token to Entra so the sign-in completes normally with no error, and the provider persists in the Authentication Methods Policy even after users reset their passwords, capturing replacement credentials at next sign-in.
- Registering the malicious method requires modifying the Authentication Methods Policy plus creating an application, service principal, and consent grant; the technique builds on Dirk-Jan Mollema's x33fcon 2025 research on rogue external MFA providers in Entra ID.
80,000+ AI Relay Servers Mask Chinese Access to US Frontier AI Models
Team Cymru found more than 80,000 relay servers letting users in China anonymously access frontier AI models, likely to distill and clone them.- Applies to frontier AI providers including Anthropic, OpenAI, Google, and xAI, whose models are being accessed via relays.
- Team Cymru identified 80,000+ LLM relay servers across 457 autonomous systems acting as intermediaries between Chinese users and US AI providers.
- Relays pool API keys and subscription accounts, issue their own credentials, and hide the end user's IP and identity, defeating attribution, rate limits, abuse detection, and regional restrictions.
- Over eight days, 4,000+ IPs from China and Hong Kong sent ~14TB and received ~7TB via relays; traffic to Anthropic showed a 58:1 upload-to-download ratio consistent with large-scale model distillation.
- The relays run open source tools Claude Relay Service (CRS 1.x) and sub2api by developer Wei-Shaw, forked 8,000+ times on GitHub with a ~7,000-subscriber Telegram channel.
📋 ADVISORIES
Fortinet appears to have stealth-patched multiple FortiOS 8.0.2 vulnerabilities without CVEs
Kevin Beaumont says Fortinet's FortiOS 8.0.2 quietly fixed a range of vulnerabilities without issuing CVEs or backporting.- Applies to Fortinet FortiOS customers running version 8.0.2.
- A range of vulnerabilities appear to have been patched silently, with no CVE identifiers issued.
- Fixes were reportedly not backported to earlier FortiOS versions.
Gottheimer's AI Cyber Defense Act proposes $100M CISA pilot for critical infrastructure AI defenses
Rep. Josh Gottheimer introduced the AI Cyber Defense Act to fund a $100 million CISA pilot giving critical infrastructure operators access to frontier AI models for cyber defense.- Applies to critical infrastructure owners and operators, with priority for nonprofit, publicly owned, rural and small-sized organizations.
- The bill directs DHS through CISA to provide securely procured AI models and technical assistance to protect against, detect, test for and remediate vulnerabilities.
- Would authorize $100 million from 2027 to 2031, though appropriators must still fund it; inspired by recent cyberattacks on water facilities.
- Introduced by Rep. Josh Gottheimer, D-N.J., with bipartisan co-sponsors Don Bacon, Zach Nunn, Hillary Scholten and Greg Landsman.
- It is separate from the Office of the National Cyber Director's voluntary 'Watershed 250' pilot in Texas, which lacks a dedicated budget.