[{"data":1,"prerenderedAt":46064},["ShallowReactive",2],{"application-flags":3,"navbar":7,"always-visible-banner":36,"navbar-about-highlight":108,"navbar-resource-highlight":182,"blog-topics":226,"trust-badges":656,"solution-nav":677,"fa-icon-solid-faUserSecret":800,"fa-icon-sharp-regular-faLaptopCode":804,"fa-icon-solid-faPlugCircleXmark":806,"fa-icon-sharp-regular-faPuzzlePiece":808,"fa-icon-solid-faFileCircleXmark":810,"fa-icon-solid-faGhost":813,"fa-icon-solid-faQrcode":816,"fa-icon-solid-faCookieBite":818,"fa-icon-sharp-regular-faFishingRod":820,"fa-icon-sharp-regular-faUserSecret":822,"fa-icon-sharp-regular-faRadar":824,"fa-icon-sharp-regular-faSatelliteDish":826,"fa-icon-sharp-regular-faShieldCheck":828,"fa-icon-sharp-regular-faBrainCircuit":830,"fa-icon-solid-faMobileScreenButton":832,"fa-icon-brands-faChrome":834,"fa-icon-solid-faDisplay":836,"fa-icon-solid-faFilter":838,"fa-icon-solid-faCloudArrowUp":840,"blog-topic-siem":842},[4],{"name":5,"enabled":6},"maintenanceMode",false,[8],{"createdDate":9,"id":10,"name":11,"modelId":12,"published":13,"meta":14,"query":22,"data":23,"variations":28,"lastUpdated":29,"firstPublished":30,"testRatio":31,"createdBy":32,"lastUpdatedBy":33,"folders":34,"rev":35},1742208588866,"1c7a4e423bf54ac1a328bb4063459ef2","Banner","1c6207a5f24948ab82d4a0b17f251193","published",{"breakpoints":15,"hasAutosaves":19,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},768,640,320,true,"data","",[],{"link":24,"text":25,"type":26,"url":27},{},"Get our latest report analyzing browser attack techniques in 2026","web-banner","https://pushsecurity.com/resources/browser-attacks-report",{},1774258294825,1742208637545,1,"CydmZnOWU1XuAaLhEDCoYNM4Z8W2","jKjF9r5jcvXU8tzZEfFQm31Iyvr2",[],"j7ew2tin4q",{"createdBy":37,"createdDate":38,"data":39,"folders":94,"id":95,"lastUpdated":96,"lastUpdatedBy":97,"meta":98,"modelId":102,"name":103,"published":13,"query":104,"testRatio":31,"variations":105,"firstPublished":106,"stageModifiedSincePublish":6,"rev":107},"ST0tXQM8slWpFrmioqKHmENB2qe2",1774965361051,{"ctaText":40,"text":41,"url":21,"blocks":42,"state":90},"ewrererw","testrfesssssssssss",[43,70,78],{"@type":44,"@version":45,"id":46,"component":47,"responsiveStyles":60},"@builder.io/sdk:Element",2,"builder-ca12c06a52de41d7b8743da53118cd38",{"name":48,"tag":48,"options":49,"isRSC":59},"TopBannerContent",{"text":50,"ctaText":51,"url":52,"mainText":53,"cta":56},"New Webinar Series: Join John Hammond, Troy Hunt, and Matt Johansen for the State of Browser Attacks","Save Your Spot","https://pushsecurity.com/webinar/state-of-browser-security",{"content":54,"fontSize":55},"\u003Cp class=\"\">Do you know how much AI is in your workforce? Find out August 20th.\u003C/p>","text-base",{"content":57,"fontSize":55,"url":58},"\u003Cp class=\"\">Save your seat →\u003C/p>","https://pushsecurity.com/webinar/shadow-ai",null,{"large":61},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66,"marginTop":67,"marginBottom":67,"fontSize":68,"fontWeight":69},"flex","column","relative","0","border-box",".56rem","1.125rem","700",{"@type":44,"@version":45,"id":71,"component":72,"responsiveStyles":76},"builder-a2e1f4b9f30b464bb814d7f5de5b0aa7",{"name":73,"options":74,"isRSC":59},"Custom Code",{"code":75,"scriptsClientOnly":6},"\u003Cstyle>\n  .top-banner.bg-web-orange{background:rgb(114, 79, 255);}\n\u003C/style>\n",{"large":77},{"display":62,"flexDirection":63,"position":64,"flexShrink":65,"boxSizing":66},{"id":79,"@type":44,"tagName":80,"properties":81,"responsiveStyles":85},"builder-pixel-k74nkzlquog","img",{"src":82,"aria-hidden":83,"alt":21,"role":84,"width":65,"height":65},"https://cdn.builder.io/api/v1/pixel?apiKey=f3a1111ff5be48cdbb123cd9f5795a05","true","presentation",{"large":86},{"height":65,"width":65,"display":87,"opacity":65,"overflow":88,"pointerEvents":89},"block","hidden","none",{"deviceSize":91,"location":92},"large",{"path":21,"query":93},{},[],"fd266d0172cc47429be7ad10f48c99ad",1786155414606,"kYgMv6WsbvfmlOUYqR2SFwGzw6e2",{"breakpoints":99,"hasAutosaves":6,"hasErrors":6,"hasLinks":6,"kind":100,"lastPreviewUrl":101},{"medium":16,"small":17,"xsmall":18},"component","https://pushsecurity.com/?builder.space=f3a1111ff5be48cdbb123cd9f5795a05&builder.user.permissions=read%2Ccreate%2Cpublish%2CeditDesigns%2CeditLayouts%2CeditLayers%2CeditContentPriority%2CeditFolders%2CcreateProjects%2CsendPullRequests%2CfusionHostingPublish&builder.user.role.name=Designer&builder.user.role.id=creator&builder.cachebust=true&builder.preview=always-visible-banner&builder.noCache=true&builder.allowTextEdit=true&__builder_editing__=true&builder.overrides.always-visible-banner=fd266d0172cc47429be7ad10f48c99ad&builder.overrides.fd266d0172cc47429be7ad10f48c99ad=fd266d0172cc47429be7ad10f48c99ad&builder.options.locale=Default","0678d178ec8b41efb8a23c09dba7874d","always visible banner",[],{},1774968080803,"1lcyl36j3gz",[109,145],{"createdBy":32,"createdDate":110,"data":111,"folders":134,"id":135,"lastUpdated":136,"lastUpdatedBy":32,"meta":137,"modelId":139,"name":140,"published":13,"query":141,"stageModifiedSincePublish":6,"testRatio":31,"variations":142,"firstPublished":143,"rev":144},1776247359804,{"link":112,"testimonial":113,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":117},"@builder.io/core:Reference","f028f2b685bb47cd8bf9e82a26dd5a79","testimonial",{"query":118,"folders":119,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":123,"variations":127,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":130,"rev":132},[],[],1735823466309,"We found Push to be more accurate when compared to competitors and the browser agent offered features that others couldn’t match.","42035571a56940ac98bff4544aa79aa5",{"author":124,"jobTitle":125,"quote":121,"image":126},"Jason Waits","\u003Cp>CISO at Inductive Automation\u003C/p>","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ff04c0c0689ce4a89ac0f0708d78c0a07",{},1735910703862,1735823501152,{"kind":20,"lastPreviewUrl":21,"breakpoints":131,"hasAutosaves":19},{"small":17,"medium":16},"xal7chkxmdh","/customer-stories/inductive-automation",[],"9136a8f18b3b4a6ba29b8653a99372b1",1776247404986,{"breakpoints":138,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"20d9eaa352304613b3d1a794b400703d","testimonial-inductive-automation",[],{},1776247404973,"5mqgwlt47hs",{"createdBy":32,"createdDate":146,"data":147,"folders":174,"id":175,"lastUpdated":176,"lastUpdatedBy":32,"meta":177,"modelId":139,"name":172,"published":13,"query":179,"stageModifiedSincePublish":6,"testRatio":31,"variations":180,"firstPublished":181,"rev":144},1776255761419,{"description":148,"image":149,"link":150,"testimonial":153,"title":172,"type":173},"Learn about the latest techniques being used in the wild.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F7b4a5ebf81d64e8c9d7fc35f6c96c4a9",{"text":151,"url":152},"Download now","/resources/browser-attacks-report",{"@type":114,"id":154,"model":116,"value":155},"192acbb1f9ca4cac918c0ec435a8bae3",{"query":156,"folders":157,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":160,"variations":166,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":169,"rev":171},[],[],1728981467463,"Push does for identity what CrowdStrike did for the endpoint",{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},"https://cdn.builder.io/o/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F8b30e8ca50064058bbaef0f3c6164575%2Fcompressed?apiKey=f3a1111ff5be48cdbb123cd9f5795a05&token=8b30e8ca50064058bbaef0f3c6164575&alt=media&optimized=true","\u003Cp>Deputy CISO at Microsoft\u003C/p>\u003Cp>Former LinkedIn, Slack, Palantir\u003C/p>","Geoff Belknap","Push does for identity what CrowdStrike did for the endpoint.","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F748f0ad0a5064a00a13f4721fcc8dea1",{},1742902158597,1728981782923,{"kind":20,"lastPreviewUrl":21,"breakpoints":170,"hasAutosaves":19},{"small":17,"medium":16},"kg131t0jkvo","Report: 2026 Browser Attack Techniques","resource",[],"05a9322735fc427db12e2740e4302300",1776255810913,{"breakpoints":178,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},[],{},1776255810900,[183,205],{"createdBy":32,"createdDate":184,"data":185,"folders":195,"id":196,"lastUpdated":197,"lastUpdatedBy":32,"meta":198,"modelId":200,"name":172,"published":13,"query":201,"stageModifiedSincePublish":6,"testRatio":31,"variations":202,"firstPublished":203,"rev":204},1776256900280,{"description":148,"image":149,"link":186,"testimonial":187,"title":172,"type":173},{"text":151,"url":152},{"@type":114,"id":154,"model":116,"value":188},{"query":189,"folders":190,"createdDate":158,"id":154,"name":159,"modelId":122,"published":13,"data":191,"variations":192,"lastUpdated":167,"firstPublished":168,"testRatio":31,"createdBy":37,"lastUpdatedBy":32,"meta":193,"rev":171},[],[],{"video":161,"jobTitle":162,"author":163,"qoute":21,"quote":164,"image":165},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":194,"hasAutosaves":19},{"small":17,"medium":16},[],"1f429607996e4e5fae8fe3f9b9610e55",1776256937553,{"breakpoints":199,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"4829faa81e7c4ee8bd2d000e160e8d3c",[],{},1776256937540,"470xio0yv7r",{"createdBy":32,"createdDate":206,"data":207,"folders":217,"id":218,"lastUpdated":219,"lastUpdatedBy":32,"meta":220,"modelId":200,"name":222,"published":13,"query":223,"stageModifiedSincePublish":6,"testRatio":31,"variations":224,"firstPublished":225,"rev":204},1776256949234,{"link":208,"testimonial":209,"testimonialLink":133,"type":116},{},{"@type":114,"id":115,"model":116,"value":210},{"query":211,"folders":212,"createdDate":120,"id":115,"name":121,"modelId":122,"published":13,"data":213,"variations":214,"lastUpdated":128,"firstPublished":129,"testRatio":31,"createdBy":37,"lastUpdatedBy":37,"meta":215,"rev":132},[],[],{"author":124,"jobTitle":125,"quote":121,"image":126},{},{"kind":20,"lastPreviewUrl":21,"breakpoints":216,"hasAutosaves":19},{"small":17,"medium":16},[],"ce043785b71b4ece98eac811ecf4ba10",1776256974140,{"breakpoints":221,"hasAutosaves":6,"kind":20,"lastPreviewUrl":21},{"medium":16,"small":17,"xsmall":18},"inductive-automation",[],{},1776256974130,{"id":227,"extension":228,"items":229,"meta":653,"stem":654,"__hash__":655},"blogTopics/blogtopics.json","json",[230,239,247,256,265,274,283,292,301,310,319,328,337,346,355,363,372,381,390,399,408,417,426,435,443,452,461,470,479,488,497,506,514,523,532,540,549,558,566,575,584,593,602,611,619,628,637,645],{"sys":231,"faqItemsCollection":233,"name":235,"slug":236,"tier":31,"intro":237,"faqTitle":59,"postCount":238,"hasPage":19},{"id":232},"topic-ai",{"items":234},[],"AI","ai","AI is reshaping both sides of the security equation: employees adopt AI tools faster than security teams can track them, while attackers use AI to scale and automate campaigns. Shadow AI adoption may now outpace wider shadow SaaS, and attackers are already turning AI chatbot platforms into malware delivery channels. Push has researched the offensive potential of computer-using agents and now applies AI agents to its own threat hunting. This hub covers AI as risk, target, and defensive tool.",22,{"sys":240,"faqItemsCollection":242,"name":244,"slug":245,"tier":45,"intro":246,"faqTitle":59,"postCount":238,"hasPage":19},{"id":241},"topic-ai-attacks",{"items":243},[],"AI attacks","ai-attacks","AI attacks run in both directions: attackers using AI to scale phishing, malware delivery, and identity attacks, and AI platforms themselves becoming the attack surface. Push has researched how computer-using agents can automate identity attacks, and has seen the poisoned tenant technique it coined used against its own employees in the wild.",{"sys":248,"faqItemsCollection":250,"name":252,"slug":253,"tier":45,"intro":254,"faqTitle":59,"postCount":255,"hasPage":19},{"id":249},"topic-ai-governance",{"items":251},[],"AI governance","ai-governance","AI governance is how organizations set and enforce rules for workplace AI use — which tools are allowed, what data can enter them, and how to evidence it to regulators. With US, EU, and UK AI regulations converging on obligations most organizations can’t yet meet, Push’s research makes the case that enforcement starts in the browser, where AI tools are actually used.",9,{"sys":257,"faqItemsCollection":259,"name":261,"slug":262,"tier":45,"intro":263,"faqTitle":59,"postCount":264,"hasPage":19},{"id":258},"topic-aitm",{"items":260},[],"AiTM phishing","aitm","Adversary-in-the-middle (AiTM) phishing proxies a real login page through an attacker-controlled site, capturing credentials, MFA codes, and session tokens in real time to bypass multi-factor authentication. Push’s research into kits like Evilginx and Sneaky2FA documents how they evade URL- and signature-based detection — and why analyzing toolkit behavior in the browser catches attacks that blocklists miss.",77,{"sys":266,"faqItemsCollection":268,"name":270,"slug":271,"tier":45,"intro":272,"faqTitle":59,"postCount":273,"hasPage":6},{"id":267},"topic-bec",{"items":269},[],"BEC","bec","Business email compromise (BEC) turns a hijacked mailbox into a fraud tool: attackers use mail rules, auto-forwarding, and payment redirection to steal money while staying invisible to the account owner. Alongside a first-hand case study of a BEC attack that nearly cost an engineering firm millions, Push breaks down these mailbox persistence tricks and how to detect them.",3,{"sys":275,"faqItemsCollection":277,"name":279,"slug":280,"tier":31,"intro":281,"faqTitle":59,"postCount":282,"hasPage":19},{"id":276},"topic-browser-attacks",{"items":278},[],"Browser attacks","browser-attacks","Browser attacks target users through the web pages, sessions, and extensions they rely on every day — bypassing endpoint and network defenses that never see inside the browser. Techniques like AiTM phishing kits, ClickFix-style copy-paste attacks, OAuth consent abuse, malvertising, and browser sync abuse have become a leading path to account takeover. Push researchers analyze these attacks in the wild, from infiltrating criminal phishing panels to dissecting toolkits like ConsentFix and Sneaky2FA. Use this hub to track how the techniques evolve and how to defend against them.",118,{"sys":284,"faqItemsCollection":286,"name":288,"slug":289,"tier":45,"intro":290,"faqTitle":59,"postCount":291,"hasPage":19},{"id":285},"topic-browser-extensions",{"items":287},[],"Browser extensions","browser-extensions","Browser extensions cut both ways for security teams: malicious or compromised extensions are a growing attack vector, while an extension is also the lightest-weight way to deploy security controls into the browsers employees already use. These posts cover both sides — extension-borne risks like browser sync attacks and the limits of risk scoring, and how Push uses its extension to detect threats and block risky extensions.",30,{"sys":293,"faqItemsCollection":295,"name":297,"slug":298,"tier":31,"intro":299,"faqTitle":59,"postCount":300,"hasPage":19},{"id":294},"topic-browser-security",{"items":296},[],"Browser security","browser-security","Work now happens in the browser, making browser security — visibility and control at the point where users meet the web — a core layer of enterprise defense. Endpoint, network, and email tools miss attacks that unfold inside the browser session, from AiTM phishing to risky extensions and shadow SaaS. Push has published extensively on choosing between enterprise browsers and browser extensions, using browser telemetry, and making the business case for browser security. Start here for both strategy and hands-on guidance.",127,{"sys":302,"faqItemsCollection":304,"name":306,"slug":307,"tier":45,"intro":308,"faqTitle":59,"postCount":309,"hasPage":19},{"id":303},"topic-casb",{"items":305},[],"CASB","casb","Cloud access security brokers (CASBs) govern cloud app usage through API integrations and network proxies — an approach that works for sanctioned apps but struggles with the long tail of shadow SaaS employees adopt on their own. Because every SaaS signup happens in a browser, Push captures that adoption in real time at the point of login, and these posts cover what proxy-based discovery misses.",12,{"sys":311,"faqItemsCollection":313,"name":315,"slug":316,"tier":45,"intro":317,"faqTitle":59,"postCount":318,"hasPage":19},{"id":312},"topic-clickfix",{"items":314},[],"ClickFix","clickfix","ClickFix attacks trick users into copying and running malicious commands themselves — typically through fake CAPTCHA, error, or fix-it prompts — so malware executes without a download for security tools to scan. Push researchers track the technique’s evolution in the wild and identified the ConsentFix and InstallFix variants, which extend it to OAuth consent grants and fake install guides.",39,{"sys":320,"faqItemsCollection":322,"name":324,"slug":325,"tier":45,"intro":326,"faqTitle":59,"postCount":327,"hasPage":19},{"id":321},"topic-credential-phishing",{"items":323},[],"Credential phishing","credential-phishing","Credential phishing steals usernames and passwords through fake login pages impersonating the services employees use, handing attackers direct access to corporate accounts. Attackers don’t hack in — they log in. Push’s browser extension analyzes login pages as users actually see them, blocking cloned pages and stopping employees from entering company passwords on lookalike sites.",89,{"sys":329,"faqItemsCollection":331,"name":333,"slug":334,"tier":45,"intro":335,"faqTitle":59,"postCount":336,"hasPage":19},{"id":330},"topic-credential-stuffing",{"items":332},[],"Credential stuffing","credential-stuffing","Credential stuffing is an attack where criminals replay username-password pairs stolen from one breach against other services, exploiting password reuse to take over accounts. Major breaches have shown how far a single set of stolen credentials can travel. Push detects verified stolen credentials by comparing employee passwords against breach datasets and dark-web threat intelligence, eliminating false positives.",64,{"sys":338,"faqItemsCollection":340,"name":342,"slug":343,"tier":31,"intro":344,"faqTitle":59,"postCount":345,"hasPage":19},{"id":339},"topic-detection-and-response",{"items":341},[],"Detection & response","detection-and-response","Detection and response is being reshaped as attacks move into the browser, where EDR, SIEM, and network tools have limited visibility. Modern phishing kits evade signature-based detection, and most malicious pages have never been seen before — so technique-level, in-browser detection matters more than known-bad indicators. Push’s work here spans high-fidelity browser telemetry, session token theft detection, and agentic threat hunting, plus practical IR guidance for compromised SaaS accounts and malicious OAuth apps. These posts cover both the philosophy and the workflows.",101,{"sys":347,"faqItemsCollection":349,"name":351,"slug":352,"tier":45,"intro":353,"faqTitle":59,"postCount":354,"hasPage":19},{"id":348},"topic-detection-engineering",{"items":350},[],"Detection engineering","detection-engineering","Detection engineering turns threat research into reliable, high-fidelity detections — and as AI accelerates the churn of attacker infrastructure, indicator-based detection is collapsing in favor of technique-level approaches. Here you’ll find teardowns of AiTM kits, ClickFix pages, and malvertising campaigns, alongside Push’s own account of building an agentic threat hunting pipeline that turns hunts into shipped detections.",42,{"sys":356,"faqItemsCollection":358,"name":360,"slug":361,"tier":45,"intro":362,"faqTitle":59,"postCount":238,"hasPage":19},{"id":357},"topic-device-code-phishing",{"items":359},[],"Device code phishing","device-code-phishing","Device code phishing abuses the OAuth device authorization flow: attackers generate a legitimate sign-in code, trick the victim into entering it on the vendor’s real login page, and walk away with access tokens — no fake site or password capture required. Push research tracked a sharp spike in adoption during 2026 as attackers use the technique to sidestep standard access controls.",{"sys":364,"faqItemsCollection":366,"name":368,"slug":369,"tier":45,"intro":370,"faqTitle":59,"postCount":371,"hasPage":19},{"id":365},"topic-dlp",{"items":367},[],"DLP","dlp","Data loss prevention (DLP) is the practice of stopping sensitive data from leaving your control — a problem that has shifted from email and endpoints to the browser, where employees move data into SaaS and AI tools. Push applies controls at that point of use, from keeping corporate credentials out of personal password managers to governing what flows into unsanctioned apps.",15,{"sys":373,"faqItemsCollection":375,"name":377,"slug":378,"tier":45,"intro":379,"faqTitle":59,"postCount":380,"hasPage":19},{"id":374},"topic-edr",{"items":376},[],"EDR","edr","Endpoint detection and response (EDR) watches processes, files, and memory on the device — a vantage point that never sees the phishing pages, stolen sessions, and identity attacks playing out inside the browser. That’s not an EDR failure; attackers have simply moved where it can’t follow. These posts map that gap and show how Push pairs browser-level detection and response with endpoint security to close it.",24,{"sys":382,"faqItemsCollection":384,"name":386,"slug":387,"tier":45,"intro":388,"faqTitle":59,"postCount":389,"hasPage":19},{"id":383},"topic-enterprise-browser",{"items":385},[],"Enterprise browser","enterprise-browser","An enterprise browser is a standalone, security-hardened browser that organizations deploy in place of Chrome, Edge, or other defaults. The real buying question is whether replacing the browser beats securing the browsers employees already use — a trade-off these posts examine directly, alongside analysis of Omdia’s secure enterprise browser market report and Push’s framework for weighing full browsers against extension-based deployment.",6,{"sys":391,"faqItemsCollection":393,"name":395,"slug":396,"tier":45,"intro":397,"faqTitle":59,"postCount":398,"hasPage":19},{"id":392},"topic-ghost-logins",{"items":394},[],"Ghost logins","ghost-logins","Ghost logins are overlooked authentication routes into an account — like a password login lingering behind SSO, or a forgotten secondary auth method — that attackers exploit for account takeover and persistence. Push coined the term after research showing how these forgotten login paths let attackers sidestep the MFA and SSO controls guarding an account’s primary sign-in method.",48,{"sys":400,"faqItemsCollection":402,"name":404,"slug":405,"tier":45,"intro":406,"faqTitle":59,"postCount":407,"hasPage":19},{"id":401},"topic-identity-attacks",{"items":403},[],"Identity attacks","identity-attacks","Identity attacks target user accounts rather than infrastructure — phishing credentials, stealing sessions, abusing OAuth grants — because logging in is easier than hacking in. Identity-based techniques are now the leading cause of breaches. Push’s offensive research maps these techniques continuously, coining attacks like SAMLjacking and the poisoned tenant before they appeared in the wild.",56,{"sys":409,"faqItemsCollection":411,"name":413,"slug":414,"tier":31,"intro":415,"faqTitle":59,"postCount":416,"hasPage":19},{"id":410},"topic-identity-security",{"items":412},[],"Identity security","identity-security","Identity security is the practice of protecting workforce accounts, credentials, and sessions — the primary route attackers now use to breach organizations. Instead of hacking in, attackers log in: through phished credentials, stolen session tokens, MFA bypass, and forgotten ghost logins. Push’s research team documents these techniques continuously, from cross-IdP impersonation and SAMLjacking to analyses of major identity-driven breaches. This hub collects that research alongside practical guidance on MFA, SSO, and stopping account takeover.",154,{"sys":418,"faqItemsCollection":420,"name":422,"slug":423,"tier":45,"intro":424,"faqTitle":59,"postCount":425,"hasPage":19},{"id":419},"topic-infostealer",{"items":421},[],"Infostealer","infostealer","Infostealers are malware built to harvest saved passwords, cookies, and session tokens from infected devices, supplying the stolen credentials behind some of the most consequential breaches of recent years. Push traces the ecosystem trading this data and checks employee passwords against threat intel feeds, flagging verified stolen credentials before attackers can log in with them.",52,{"sys":427,"faqItemsCollection":429,"name":431,"slug":432,"tier":45,"intro":433,"faqTitle":59,"postCount":434,"hasPage":19},{"id":428},"topic-legitimate-service-abuse",{"items":430},[],"Legitimate service abuse","legitimate-service-abuse","Legitimate service abuse means staging attacks on trusted platforms — Google Ads, AI chatbot share pages, office.com links, Slack, SaaS tenants — so malicious content inherits the reputation of the service hosting it. Push research has documented the pattern repeatedly, from malvertising run through hijacked Google Ad Manager accounts to phishing links generated by Active Directory Federation Services.",28,{"sys":436,"faqItemsCollection":438,"name":440,"slug":441,"tier":45,"intro":442,"faqTitle":59,"postCount":291,"hasPage":19},{"id":437},"topic-malvertising",{"items":439},[],"Malvertising","malvertising","Malvertising uses paid search and display ads to put phishing pages and malware in front of users, often by impersonating trusted brands at the top of Google results. Push tracks these campaigns continuously — intercepting live attacks spoofing well-known brands — and has documented how criminals hijack Google Ads accounts to fund and run them.",{"sys":444,"faqItemsCollection":446,"name":448,"slug":449,"tier":45,"intro":450,"faqTitle":59,"postCount":451,"hasPage":19},{"id":445},"topic-malware-delivery",{"items":447},[],"Malware delivery","malware-delivery","Malware delivery has moved into the browser: rather than email attachments, attackers now rely on malvertising, fake install guides, and ClickFix-style copy-paste lures to get code running on endpoints. Push research on techniques like InstallFix maps the playbook, and in-browser detection of malicious copy and paste blocks these attacks before commands reach the endpoint.",13,{"sys":453,"faqItemsCollection":455,"name":457,"slug":458,"tier":45,"intro":459,"faqTitle":59,"postCount":460,"hasPage":19},{"id":454},"topic-mfa",{"items":456},[],"MFA","mfa","Multi-factor authentication (MFA) requires a second proof of identity beyond a password, and it remains one of the most effective controls against account takeover. Regulators from Cyber Essentials to NYDFS now mandate it across cloud services. Push enforces MFA in the browser on third-party apps — even those with no native enforcement option — and shows security teams where coverage gaps remain.",83,{"sys":462,"faqItemsCollection":464,"name":466,"slug":467,"tier":45,"intro":468,"faqTitle":59,"postCount":469,"hasPage":19},{"id":463},"topic-mfa-bypass",{"items":465},[],"MFA bypass","mfa-bypass","MFA bypass covers the techniques attackers use to defeat multi-factor authentication — AiTM phishing kits, consent phishing, device code phishing, and MFA downgrade attacks among them. None of these break the second factor; they route around it. Push researchers regularly get hands-on with phishing kits like Evilginx and Sneaky2FA, analyzing how these attacks work in the wild and how they evolve.",58,{"sys":471,"faqItemsCollection":473,"name":475,"slug":476,"tier":45,"intro":477,"faqTitle":59,"postCount":478,"hasPage":19},{"id":472},"topic-non-email-phishing",{"items":474},[],"Non-email phishing","non-email-phishing","Non-email phishing delivers malicious links through channels your secure email gateway never sees — social media messages, IM apps like Slack and Teams, search ads, and SMS. Push has intercepted live campaigns arriving via LinkedIn DMs, malvertising, and messaging platforms, which is why it detects phishing pages in the browser at the point of click, regardless of delivery channel.",51,{"sys":480,"faqItemsCollection":482,"name":484,"slug":485,"tier":45,"intro":486,"faqTitle":59,"postCount":487,"hasPage":19},{"id":481},"topic-oauth-abuse",{"items":483},[],"OAuth abuse","oauth-abuse","OAuth abuse is attackers exploiting app-to-app authorization — consent phishing, malicious OAuth apps, stolen tokens, and device code flows — to gain persistent access to cloud tenants without touching a password or MFA prompt. Push tracks these techniques continuously and discovered ConsentFix, a browser-native attack in the wild that pairs OAuth consent phishing with a ClickFix-style prompt.",70,{"sys":489,"faqItemsCollection":491,"name":493,"slug":494,"tier":45,"intro":495,"faqTitle":59,"postCount":496,"hasPage":19},{"id":490},"topic-passkeys",{"items":492},[],"Passkeys","passkeys","Passkeys are phishing-resistant credentials that replace passwords with cryptographic key pairs bound to a user’s device. They defeat conventional credential phishing, but attackers adapt: Push research has documented MFA downgrade, app-specific password phishing, and device code phishing being used in the wild to route around passkey-protected accounts. Deploying passkeys is step one; closing those fallback paths is step two.",21,{"sys":498,"faqItemsCollection":500,"name":502,"slug":503,"tier":45,"intro":504,"faqTitle":59,"postCount":505,"hasPage":19},{"id":499},"topic-password-security",{"items":501},[],"Password security","password-security","Password security is the practice of keeping workforce credentials strong, unique, and out of attackers’ hands — still a frontline defense while most SaaS logins depend on passwords. Expiration policies don’t fix weak or reused passwords; visibility does. Push observes real logins in the browser to flag weak, reused, and breached passwords and guide employees to reset them on any app.",79,{"sys":507,"faqItemsCollection":509,"name":511,"slug":512,"tier":45,"intro":513,"faqTitle":59,"postCount":318,"hasPage":19},{"id":508},"topic-phaas",{"items":510},[],"PhaaS","phaas","Phishing-as-a-service (PhaaS) platforms sell ready-made phishing kits, hosted infrastructure, and management panels on subscription, letting low-skill criminals run MFA-bypassing campaigns at scale. Kits like Evilginx, Tycoon2FA, Sneaky2FA, FlowerStorm, and EvilTokens each add their own evasion and session-theft capabilities, and new entrants appear regularly. Push researchers continuously get hands-on with these tools — investigating attacks in the wild, reverse-engineering kit behavior, and turning that research into detections.",{"sys":515,"faqItemsCollection":517,"name":519,"slug":520,"tier":31,"intro":521,"faqTitle":59,"postCount":522,"hasPage":19},{"id":516},"topic-phishing",{"items":518},[],"Phishing","phishing","Phishing remains the most common way attackers compromise business accounts — and it has moved far beyond suspicious emails. Modern campaigns use AiTM toolkits that bypass MFA, consent phishing against OAuth, device code phishing, and lures delivered through malvertising, LinkedIn, and Slack. Push detects and blocks these attacks in the browser, and its researchers publish teardowns of live campaigns and kits like Evilginx and Sneaky2FA. Read on for how phishing actually works today and what stops it.",91,{"sys":524,"faqItemsCollection":526,"name":528,"slug":529,"tier":45,"intro":530,"faqTitle":59,"postCount":531,"hasPage":19},{"id":525},"topic-public-breach",{"items":527},[],"Public breach","public-breach","Public breaches are the disclosed incidents that show how attacks actually unfold once the headlines fade. Push’s breach analyses keep finding identity at the entry point: stolen credentials, OAuth abuse, and missing MFA recur across the incidents analyzed here.",29,{"sys":533,"faqItemsCollection":535,"name":537,"slug":538,"tier":45,"intro":539,"faqTitle":59,"postCount":451,"hasPage":19},{"id":534},"topic-ransomware",{"items":536},[],"Ransomware","ransomware","Ransomware attacks increasingly begin with an identity, not an exploit: stolen credentials, MFA bypass, and help desk scams give operators their initial foothold. The analysis here follows that front end of the kill chain — how identity compromise leads to ransomware deployment, and the breaches driving regulators toward tighter MFA requirements.",{"sys":541,"faqItemsCollection":543,"name":545,"slug":546,"tier":31,"intro":547,"faqTitle":59,"postCount":548,"hasPage":19},{"id":542},"topic-saas-security",{"items":544},[],"SaaS security","saas-security","SaaS security means protecting the sprawl of cloud apps, accounts, and integrations your employees adopt — often without IT ever knowing. Shadow SaaS, risky OAuth grants, ghost logins, and unmanaged third-party access create attack paths traditional controls can’t see, as recent high-profile breaches have demonstrated. Building on the original SaaS attack matrix, Push continues to map SaaS-native attack techniques alongside practical guides for discovering and securing unsanctioned apps, and this hub gathers all of it.",96,{"sys":550,"faqItemsCollection":552,"name":554,"slug":555,"tier":45,"intro":556,"faqTitle":59,"postCount":557,"hasPage":6},{"id":551},"topic-security-training",{"items":553},[],"Security training","security-training","Security training aims to teach employees to recognize and avoid attacks — yet modern phishing routinely fools even seasoned security professionals. Push argues that training budgets work harder as real-time, in-browser intervention: guardrails and warnings at the moment of risk, rather than lessons employees must recall under pressure.",4,{"sys":559,"faqItemsCollection":561,"name":563,"slug":564,"tier":45,"intro":565,"faqTitle":59,"postCount":389,"hasPage":19},{"id":560},"topic-seo-poisoning",{"items":562},[],"SEO poisoning","seo-poisoning","SEO poisoning manipulates search engine results so malicious pages rank prominently for the software, tools, or services users are actively searching for, turning a routine search into an infection vector. It often pairs with malvertising and ClickFix-style payloads — Push has documented attackers abusing shared pages on legitimate AI chatbot domains to deliver malware from trusted infrastructure.",{"sys":567,"faqItemsCollection":569,"name":571,"slug":572,"tier":45,"intro":573,"faqTitle":59,"postCount":574,"hasPage":19},{"id":568},"topic-session-hijacking",{"items":570},[],"Session hijacking","session-hijacking","Session hijacking is the theft of an authenticated session — usually via stolen session cookies or tokens — letting attackers walk past passwords and MFA into a live account. AiTM phishing kits and infostealers have made it a mainstream attack technique across both criminal and targeted intrusions. Push’s browser agent detects session token theft by adding telemetry to the user agent string, creating a high-fidelity signal for security teams.",74,{"sys":576,"faqItemsCollection":578,"name":580,"slug":581,"tier":45,"intro":582,"faqTitle":59,"postCount":583,"hasPage":19},{"id":577},"topic-shadow-ai",{"items":579},[],"Shadow AI","shadow-ai","Shadow AI is employees’ unsanctioned use of AI tools at work, putting corporate data into chatbots and assistants that security teams never approved and can’t see. Push’s own browser telemetry shows AI adoption acting as a force multiplier for shadow IT — potentially now outscaling shadow SaaS — and this hub tracks that research, real-world breach examples, and practical controls.",20,{"sys":585,"faqItemsCollection":587,"name":589,"slug":590,"tier":45,"intro":591,"faqTitle":59,"postCount":592,"hasPage":19},{"id":586},"topic-shadow-saas",{"items":588},[],"Shadow SaaS","shadow-saas","Shadow SaaS is the cloud applications employees adopt for work without IT approval, each one creating unmanaged accounts, identities, and data outside your security controls. Push covers the problem end to end — from browser-based SaaS discovery to in-browser app banners and MFA enforcement — alongside breach analyses that show where unmanaged accounts lead.",75,{"sys":594,"faqItemsCollection":596,"name":598,"slug":599,"tier":45,"intro":600,"faqTitle":59,"postCount":601,"hasPage":19},{"id":595},"topic-siem",{"items":597},[],"SIEM","siem","A SIEM is only as good as the telemetry feeding it, and most log sources never see what happens inside the browser — where phishing, session token theft, and account takeover actually play out. Push streams browser-level detections and identity telemetry into SIEMs, and these posts show how that data improves detection fidelity and cuts alert fatigue.",19,{"sys":603,"faqItemsCollection":605,"name":607,"slug":608,"tier":45,"intro":609,"faqTitle":59,"postCount":610,"hasPage":19},{"id":604},"topic-social-engineering",{"items":606},[],"Social engineering","social-engineering","Social engineering is the manipulation of people — through phishing pages, help desk impersonation, vishing calls, and poisoned tenant invites — into handing over access that no exploit could take. Coverage here tracks how threat actors run these plays — drawing on Push’s ongoing investigation of live phishing infrastructure and criminal tooling.",59,{"sys":612,"faqItemsCollection":614,"name":616,"slug":617,"tier":31,"intro":618,"faqTitle":59,"postCount":557,"hasPage":6},{"id":613},"topic-supply-chain-security",{"items":615},[],"Supply chain security","supply-chain-security","Supply chain security extends beyond your own perimeter to the vendors, platforms, and browser extensions your organization depends on. A compromised third party can hand attackers legitimate access — as recent campaigns against SaaS providers have shown. Push’s research examines the browser-extension supply chain in particular: why extension risk scores fail to predict compromise, and how developers can harden extensions against takeover. These posts frame supply chain risk through a browser and identity lens.",{"sys":620,"faqItemsCollection":622,"name":624,"slug":625,"tier":45,"intro":626,"faqTitle":59,"postCount":627,"hasPage":19},{"id":621},"topic-swg",{"items":623},[],"SWG","swg","A secure web gateway (SWG) filters and inspects web traffic in transit, sitting in the network path between users and the internet. That position shows you the packet but not the session: Push’s research on AitM phishing kits documents how attackers break the signatures proxies rely on, and these posts explain why phishing detection is moving from the network path into the browser itself.",17,{"sys":629,"faqItemsCollection":631,"name":633,"slug":634,"tier":45,"intro":635,"faqTitle":59,"postCount":636,"hasPage":19},{"id":630},"topic-third-party-risk",{"items":632},[],"Third-party risk","third-party-risk","Third-party risk is the exposure your organization inherits from vendors, SaaS providers, and integrations that hold your data or access your tenants — a chain now extended one employee sign-up at a time. This hub collects Push’s breach analyses and guides for assessing OAuth integrations, managing browser extensions, and responding when a supplier is compromised.",44,{"sys":638,"faqItemsCollection":640,"name":642,"slug":643,"tier":31,"intro":644,"faqTitle":59,"postCount":398,"hasPage":19},{"id":639},"topic-threat-landscape",{"items":641},[],"Threat landscape","threat-landscape","The enterprise threat landscape is now defined by identity attacks: criminals log in with phished, stolen, or stuffed credentials rather than breaking infrastructure. Threat actors keep proving how effective help desk scams, MFA bypass, and session theft are against well-defended organizations. Drawing on breach analyses, annual phishing trend reviews, and in-the-wild campaign tracking, Push documents how attacker TTPs are shifting. This hub is where to follow those changes.",{"sys":646,"faqItemsCollection":648,"name":650,"slug":651,"tier":45,"intro":652,"faqTitle":59,"postCount":371,"hasPage":19},{"id":647},"topic-vishing",{"items":649},[],"Vishing","vishing","Vishing — voice phishing — uses phone calls to impersonate IT support, help desks, or employees, talking targets into password resets, MFA approvals, or opening attacker-controlled pages. Threat actors now routinely pair calls with AiTM phishing to hijack SSO accounts, a chain Push has analyzed across campaigns targeting hundreds of organizations.",{},"blogtopics","w0ITersBlkytyrxHNkTEFmGsSW5X9NfdbmeXV1u8bAo",[657,661,665,669,673],{"title":658,"logo":659,"createdDate":660},"SOC2","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fb6727a5e00004d6e9e69fc3068b8b64c",1784291539953,{"title":662,"logo":663,"createdDate":664},"GDPR","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Ffe49f53211674deaa5a6640d929cdf42?format=webp",1784291672535,{"title":666,"logo":667,"createdDate":668},"Cyber essentials","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F53558c1045a342a7a28def960cd54ae7?format=webp",1784291702710,{"title":670,"logo":671,"createdDate":672},"ISO IEC 27001","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2F578a404a61cf45db951a41fe3554d12d",1784291766222,{"title":674,"logo":675,"createdDate":676},"ISO IEC 27701","https://cdn.builder.io/api/v1/image/assets%2Ff3a1111ff5be48cdbb123cd9f5795a05%2Fbe219844b13242fbba531959579a753c",1784291858848,[678,730,775],{"id":679,"label":680,"text":21,"navIcon":681,"items":682},"stop-browser-based-attacks","Stop browser-based attacks","solid:faShieldHalved",[683,688,693,698,703,708,712,717,721,725],{"title":684,"text":685,"url":686,"navIcon":687},"Adversary-in-the-Middle","Detect and block AiTM proxies stealing session tokens.","/solution/stop-browser-based-attacks/adversary-in-the-middle-attacks","solid:faUserSecret",{"title":689,"text":690,"url":691,"navIcon":692},"ClickFix (+Fix variants)","Block attacks that trick users into running malicious code.","/solution/stop-browser-based-attacks/clickfix-fix-variants","sharp-regular:faLaptopCode",{"title":694,"text":695,"url":696,"navIcon":697},"Malicious OAuth integrations","Detect suspicious OAuth consent flows and stop persistent access.","/solution/stop-browser-based-attacks/malicious-oauth-integrations","solid:faPlugCircleXmark",{"title":699,"text":700,"url":701,"navIcon":702},"Malicious browser extensions","Shine a light on risky browser extensions.","/solution/stop-browser-based-attacks/malicious-browser-extensions","sharp-regular:faPuzzlePiece",{"title":704,"text":705,"url":706,"navIcon":707},"Malicious file downloads","Gain visibility into browser downloads and block malicious files.","/solution/stop-browser-based-attacks/malicious-file-downloads","solid:faFileCircleXmark",{"title":395,"text":709,"url":710,"navIcon":711},"Surface hidden login paths that bypass SSO and expose accounts.","/solution/stop-browser-based-attacks/ghost-logins","solid:faGhost",{"title":713,"text":714,"url":715,"navIcon":716},"Mobile phishing (QR & SMS)","Detect phishing links delivered via SMS and QR codes.","/solution/stop-browser-based-attacks/mobile-phishing-qr-code-sms","solid:faQrcode",{"title":333,"text":718,"url":719,"navIcon":720},"Identify reused and compromised credentials across SaaS logins.","/solution/stop-browser-based-attacks/credential-stuffing","custom:credentialStuffing",{"title":571,"text":722,"url":723,"navIcon":724},"Detect and block stolen session tokens before attackers get access.","/solution/stop-browser-based-attacks/session-hijacking","solid:faCookieBite",{"title":726,"text":727,"url":728,"navIcon":729},"Zero-day phishing","Detect phishing TTPs directly in the browser and stop credential theft.","/solution/stop-browser-based-attacks/zero-day-phishing","sharp-regular:faFishingRod",{"id":731,"label":732,"text":21,"navIcon":733,"items":734},"achieve-security-outcomes","Achieve security outcomes","solid:faCheckToSlot",[735,740,745,750,755,760,765,770],{"title":736,"text":737,"url":738,"navIcon":739},"Stop account takeover","Stop ATO with stolen credential and compromised token detection.","/solution/achieve-security-outcomes/stop-account-takeover","sharp-regular:faUserSecret",{"title":741,"text":742,"url":743,"navIcon":744},"Harden unmanaged identities","Harden access paths with visibility, detection, and guardrails.","/solution/achieve-security-outcomes/harden-unmanaged-identities","sharp-regular:faRadar",{"title":746,"text":747,"url":748,"navIcon":749},"Investigate browser-related incidents","Investigate and respond faster with unique browser telemetry.","/solution/achieve-security-outcomes/investigate-browser-related-incidents","sharp-regular:faSatelliteDish",{"title":751,"text":752,"url":753,"navIcon":754},"Secure shadow SaaS","See and control shadow SaaS in the browser.","/solution/achieve-security-outcomes/secure-shadow-saas","sharp-regular:faShieldCheck",{"title":756,"text":757,"url":758,"navIcon":759},"Secure AI","See and control AI apps in the browser.","/solution/achieve-security-outcomes/secure-ai","sharp-regular:faBrainCircuit",{"title":761,"text":762,"url":763,"navIcon":764},"Secure BYOD","Extend consistent browser-based protection to unmanaged devices.","/solution/achieve-security-outcomes/secure-bring-your-own-device","solid:faMobileScreenButton",{"title":766,"text":767,"url":768,"navIcon":769},"Secure Chromebooks","Secure browser activity on Chromebooks without endpoint agents.","/solution/achieve-security-outcomes/secure-chromebooks","brands:faChrome",{"title":771,"text":772,"url":773,"navIcon":774},"Investigate and stop data loss","Detect and prevent data loss across AI tools, apps, and sessions.","/solution/achieve-security-outcomes/investigate-and-stop-data-loss","custom:investigateAndStopDataLoss",{"id":776,"label":777,"text":21,"navIcon":778,"items":779},"tool-replacements","Tool replacements","solid:faScrewdriverWrench",[780,785,790,795],{"title":781,"text":782,"url":783,"navIcon":784},"Remote browser isolation","Detect attacks that look like normal browsing.","/solution/tool-replacements/remote-browser-isolation","solid:faDisplay",{"title":786,"text":787,"url":788,"navIcon":789},"Secure web gateways","Detect attacks inside the browser after SWGs allowed the connection.","/solution/tool-replacements/secure-web-gateways","solid:faFilter",{"title":791,"text":792,"url":793,"navIcon":794},"Cloud access security broker","Catch browser-based identity threats in real time, not after the fact.","/solution/tool-replacements/cloud-access-security-broker","solid:faCloudArrowUp",{"title":796,"text":797,"url":798,"navIcon":799},"Security awareness training","Block real phishing instead of training users on simulations.","/solution/tool-replacements/security-awareness-training","custom:securityAwareness",{"w":801,"h":802,"d":803},448,512,"M171-16c-36.4 0-57.8 58.3-68.3 112L72 96c-13.3 0-24 10.7-24 24s10.7 24 24 24l24 0 0 32c0 17 3.3 33.2 9.3 48l-9.3 0 0 0-20.5 0c-15.2 0-27.5 12.3-27.5 27.5 0 3 .5 5.9 1.4 8.7l28.9 86.6C40.2 379.6 16 428.1 16 482.3 16 498.7 29.3 512 45.7 512l356.6 0c16.4 0 29.7-13.3 29.7-29.7 0-54.2-24.2-102.7-62.3-135.4l28.9-86.6c.9-2.8 1.4-5.7 1.4-8.7 0-15.2-12.3-27.5-27.5-27.5l-20.5 0 0 0-9.3 0c6-14.8 9.3-31 9.3-48l0-32 24 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-30.7 0c-10.4-53.7-31.9-112-68.3-112-9.6 0-19 3.9-27.5 8.2-8.2 4.1-18.4 7.8-25.5 7.8s-17.3-3.7-25.5-7.8C190-12.1 180.6-16 171-16zm93.7 484.4l-24.8-70.9 27.9-32.5c2.7-3.2 4.2-7.2 4.2-11.4 0-9.7-7.8-17.5-17.5-17.5l-61 0c-9.7 0-17.5 7.8-17.5 17.5 0 4.2 1.5 8.2 4.2 11.4l27.9 32.5-24.8 70.9-57-180.4 35.7 0c18.4 10.2 39.5 16 62 16s43.6-5.8 62-16l35.7 0-57 180.4zM224 256c-34.7 0-64.2-22.1-75.3-53 5.7 3.2 12.3 5 19.3 5l12.4 0c16.5 0 31.1-10.6 36.3-26.2 2.3-7 12.2-7 14.5 0 5.2 15.6 19.9 26.2 36.3 26.2l12.4 0c7 0 13.6-1.8 19.3-5-11.1 30.9-40.6 53-75.3 53z",{"w":17,"h":802,"d":805},"M112 80l416 0 0 224 48 0 0-272-512 0 0 272 48 0 0-224zM48 404.1l0-4.1 544 0 0 4.1-27.9 27.9-488.2 0-27.9-27.9zM592 352l-592 0 0 72 56 56 528 0 56-56 0-72-48 0zM281 169l17-17-33.9-33.9c-6.1 6.1-27.8 27.8-65 65l-17 17c6.1 6.1 27.8 27.8 65 65l17 17 33.9-33.9c-9-9-25-25-48-48l31-31zM393 135l-17-17-33.9 33.9c9 9 25 25 48 48-23 23-39 39-48 48L376 281.9c6.1-6.1 27.8-27.8 65-65l17-17c-6.1-6.1-27.8-27.8-65-65z",{"w":17,"h":802,"d":807},"M192-32c17.7 0 32 14.3 32 32l0 96 128 0 0-96c0-17.7 14.3-32 32-32s32 14.3 32 32l0 96 64 0c17.7 0 32 14.3 32 32s-14.3 32-32 32l0 48.7c-98.6 8.1-176 90.7-176 191.3 0 27.3 5.7 53.3 16 76.9l0 3.1c0 17.7-14.3 32-32 32s-32-14.3-32-32l0-66.7C165.2 398.1 96 319.1 96 224l0-64c-17.7 0-32-14.3-32-32S78.3 96 96 96l64 0 0-96c0-17.7 14.3-32 32-32zM496 256a144 144 0 1 1 0 288 144 144 0 1 1 0-288zm59.3 107.3c6.2-6.2 6.2-16.4 0-22.6s-16.4-6.2-22.6 0l-36.7 36.7-36.7-36.7c-6.2-6.2-16.4-6.2-22.6 0s-6.2 16.4 0 22.6l36.7 36.7-36.7 36.7c-6.2 6.2-6.2 16.4 0 22.6s16.4 6.2 22.6 0l36.7-36.7 36.7 36.7c6.2 6.2 16.4 6.2 22.6 0s6.2-16.4 0-22.6l-36.7-36.7 36.7-36.7z",{"w":802,"h":802,"d":809},"M201.1 57.3c-7 5.3-9.1 10.7-9.1 14.7 0 4.5 2.8 11.2 12.4 16.9l11.6 7 0 48.1-168 0 0 60.5c7.4-2.9 15.5-4.5 24-4.5 43.1 0 72 39.4 72 80s-28.9 80-72 80c-8.5 0-16.6-1.6-24-4.5l0 108.5 108.5 0c-2.9-7.4-4.5-15.5-4.5-24 0-43.1 39.4-72 80-72s80 28.9 80 72c0 8.5-1.6 16.6-4.5 24l60.5 0 0-168 48.1 0 7 11.6c5.8 9.6 12.4 12.4 16.9 12.4 4 0 9.5-2.1 14.7-9.1s9.3-17.9 9.3-30.9-4-23.8-9.3-30.9-10.7-9.1-14.7-9.1c-4.5 0-11.2 2.8-16.9 12.4l-7 11.6-48.1 0 0-120-120 0 0-48.1 11.6-7c9.6-5.8 12.4-12.4 12.4-16.9 0-4-2.1-9.5-9.1-14.7S245 48 232 48 208.2 52 201.1 57.3zM172.3 18.9C188.5 6.8 209.6 0 232 0S275.5 6.8 291.7 18.9 320 49.5 320 72c0 8.6-1.8 16.7-4.9 24l100.9 0 0 100.9c7.3-3.1 15.4-4.9 24-4.9 22.5 0 41 12.2 53.1 28.3s18.9 37.3 18.9 59.7-6.8 43.5-18.9 59.7-30.6 28.3-53.1 28.3c-8.6 0-16.7-1.8-24-4.9l0 148.9-168 0 0-49.3 8.2-7.2c5.4-4.7 7.8-10.3 7.8-15.5 0-9.9-10.7-24-32-24s-32 14.1-32 24c0 5.3 2.4 10.8 7.8 15.5l8.2 7.2 0 49.3-216 0 0-216 49.3 0 7.2 8.2c4.7 5.4 10.3 7.8 15.5 7.8 9.9 0 24-10.7 24-32s-14.1-32-24-32c-5.3 0-10.8 2.4-15.5 7.8L49.3 264 0 264 0 96 148.9 96c-3.1-7.3-4.9-15.4-4.9-24 0-22.5 12.2-41 28.3-53.1z",{"w":811,"h":802,"d":812},576,"M96 0C60.7 0 32 28.7 32 64l0 384c0 35.3 28.7 64 64 64l180 0c-22.7-31.5-36-70.2-36-112 0-100.6 77.4-183.2 176-191.3l0-38.1c0-17-6.7-33.3-18.7-45.3L290.7 18.7C278.7 6.7 262.5 0 245.5 0L96 0zM357.5 176L264 176c-13.3 0-24-10.7-24-24L240 58.5 357.5 176zM432 544a144 144 0 1 0 0-288 144 144 0 1 0 0 288zm59.3-180.7l-36.7 36.7 36.7 36.7c6.2 6.2 6.2 16.4 0 22.6s-16.4 6.2-22.6 0l-36.7-36.7-36.7 36.7c-6.2 6.2-16.4 6.2-22.6 0s-6.2-16.4 0-22.6l36.7-36.7-36.7-36.7c-6.2-6.2-6.2-16.4 0-22.6s16.4-6.2 22.6 0l36.7 36.7 36.7-36.7c6.2-6.2 16.4-6.2 22.6 0s6.2 16.4 0 22.6z",{"w":814,"h":802,"d":815},384,"M40.1 467.1l-11.2 9C25.7 478.6 21.8 480 17.8 480 8 480 0 472 0 462.2L0 192C0 86 86 0 192 0S384 86 384 192l0 270.2c0 9.8-8 17.8-17.8 17.8-4 0-7.9-1.4-11.1-3.9l-11.2-9c-13.4-10.7-32.8-9-44.1 3.9L269.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6l-26.6-30.5c-12.7-14.6-35.4-14.6-48.2 0L141.3 506c-3.3 3.8-8.2 6-13.3 6s-9.9-2.2-13.3-6L84.2 471c-11.3-12.9-30.7-14.6-44.1-3.9zM160 192a32 32 0 1 0 -64 0 32 32 0 1 0 64 0zm96 32a32 32 0 1 0 0-64 32 32 0 1 0 0 64z",{"w":801,"h":802,"d":817},"M64 160l64 0 0-64-64 0 0 64zM0 80C0 53.5 21.5 32 48 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48L0 80zM64 416l64 0 0-64-64 0 0 64zM0 336c0-26.5 21.5-48 48-48l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96zM320 96l0 64 64 0 0-64-64 0zM304 32l96 0c26.5 0 48 21.5 48 48l0 96c0 26.5-21.5 48-48 48l-96 0c-26.5 0-48-21.5-48-48l0-96c0-26.5 21.5-48 48-48zM288 352a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm0 64c17.7 0 32 14.3 32 32s-14.3 32-32 32-32-14.3-32-32 14.3-32 32-32zm96 32c0-17.7 14.3-32 32-32s32 14.3 32 32-14.3 32-32 32-32-14.3-32-32zm32-96a32 32 0 1 1 0-64 32 32 0 1 1 0 64zm-32 32a32 32 0 1 1 -64 0 32 32 0 1 1 64 0z",{"w":802,"h":802,"d":819},"M257.5 27.6c-.8-5.4-4.9-9.8-10.3-10.6-22.1-3.1-44.6 .9-64.4 11.4l-74 39.5C89.1 78.4 73.2 94.9 63.4 115L26.7 190.6c-9.8 20.1-13 42.9-9.1 64.9l14.5 82.8c3.9 22.1 14.6 42.3 30.7 57.9l60.3 58.4c16.1 15.6 36.6 25.6 58.7 28.7l83 11.7c22.1 3.1 44.6-.9 64.4-11.4l74-39.5c19.7-10.5 35.6-27 45.4-47.2l36.7-75.5c9.8-20.1 13-42.9 9.1-64.9-.9-5.3-5.3-9.3-10.6-10.1-51.5-8.2-92.8-47.1-104.5-97.4-1.8-7.6-8-13.4-15.7-14.6-54.6-8.7-97.7-52-106.2-106.8zM208 144a32 32 0 1 1 0 64 32 32 0 1 1 0-64zM144 336a32 32 0 1 1 64 0 32 32 0 1 1 -64 0zm224-64a32 32 0 1 1 0 64 32 32 0 1 1 0-64z",{"w":801,"h":802,"d":821},"M284.6 0l91.4 0 0 160-48 0 0-112-36.6 0-203.4 58.1 0 181.9 40 0 0 224-128 0 0-224 40 0 0-218.1 17.4-5 224-64 3.2-.9zM80 336l-32 0 0 128 32 0 0-128zm176 8c0-76.8 64-136 96-152 32 16 96 75.2 96 152 0 32-16 80-64 112l32 40 0 16-128 0 0-16 32-40c-48-32-64-80-64-112zm128-32a24 24 0 1 0 -48 0 24 24 0 1 0 48 0z",{"w":801,"h":802,"d":823},"M144-16l-48 112-48 0 0 48 48 0 0 32c0 17 3.3 33.2 9.3 48l-73.3 0 0 32 5.3 16 26.7 80-64 160 51.7 0 56.9-142.2 6.5-16.3c-1-3.1-10.1-30.3-27.2-81.5l51.4 0c22.6 19.9 52.2 32 84.7 32s62.1-12.1 84.7-32l51.4 0c-17.1 51.2-26.1 78.4-27.2 81.5l6.5 16.3 56.9 142.2 51.7 0-64-160 26.7-80 5.3-16 0-32-73.3 0c6-14.8 9.3-31 9.3-48l0-32 48 0 0-48-48 0-48-112-32 0-48 32-48-32-32 0zm80 272c-32.8 0-61-19.7-73.3-48l57.3 0 16-40 16 40 57.3 0c-12.3 28.3-40.5 48-73.3 48zm17.5 139.6l30.5-35.6 0-24-96 0 0 24 30.5 35.6-46.5 116.4 128 0-46.5-116.4z",{"w":802,"h":802,"d":825},"M497.4 49l17-17-33.9-33.9C473.6 4.9 453.3 25.2 419.7 58.8 375.4 22.1 318.5 0 256.4 0 115.1 0 .4 114.6 .4 256s114.6 256 256 256 256-114.6 256-256l-48 0c0 114.9-93.1 208-208 208s-208-93.1-208-208 93.1-208 208-208c48.8 0 93.7 16.8 129.1 44.9l-45.7 45.7c-23.5-16.8-52.3-26.6-83.4-26.6-79.5 0-144 64.5-144 144s64.5 144 144 144 144-64.5 144-144l-48 0c0 53-43 96-96 96s-96-43-96-96 43-96 96-96c17.8 0 34.5 4.8 48.8 13.3-52 52-79.5 79.5-82.7 82.7l33.9 33.9 17-17 224-224z",{"w":802,"h":802,"d":827},"M208 0l24 0C386.6 0 512 125.4 512 280l0 24-48 0 0-24C464 151.9 360.1 48 232 48l-24 0 0-48zm24 96c101.6 0 184 82.4 184 184l0 24-48 0 0-24c0-75.1-60.9-136-136-136l-24 0 0-48 24 0zM48 256c0 114.9 93.1 208 208 208 22.9 0 45-3.7 65.6-10.5l-263-263C51.7 211 48 233.1 48 256zM0 256c0-36.5 7.6-71.3 21.4-102.7 6.7-15.3 14.9-29.9 24.4-43.5 7.7 7.7 61.5 61.5 161.2 161.2 30.5-30.5 49.5-49.5 57-57L297.9 248c-7.5 7.5-26.5 26.5-57 57 99.7 99.7 153.5 153.5 161.2 161.2-13.6 9.5-28.2 17.7-43.5 24.4-31.4 13.8-66.2 21.4-102.7 21.4-141.4 0-256-114.6-256-256z",{"w":802,"h":802,"d":829},"M267.6 4.5l207.5 80.5 19.2 7.4 1.2 20.5c2.9 50-4.9 126.3-37.3 200.9-32.7 75.2-91.1 150-189.4 192.5l-12.7 5.5-12.7-5.5C144.9 463.9 86.6 389.2 53.9 313.9 21.5 239.3 13.7 162.9 16.6 113L17.8 92.5 37 85 244.5 4.5 256 0 267.6 4.5zM64.1 126C63.1 169.5 71 232.9 97.9 294.8 126.1 359.7 175 422.4 256 459.6 337.1 422.4 385.9 359.7 414.2 294.8 441 232.9 449 169.5 448 126L256 51.5 64.1 126zm302.3 44.7L352.3 190.1 249.8 330.9 233 354c-8.8-9.1-30.9-32-66.2-68.6l-16.7-17.3 34.5-33.3c9.5 9.8 23.9 24.7 43.2 44.7l85.6-117.7 14.1-19.4 38.8 28.2z",{"w":802,"h":802,"d":831},"M192 48l40 0 0 108-12.4 0c-7.6-16.5-24.3-28-43.6-28-26.5 0-48 21.5-48 48s21.5 48 48 48c19.4 0 36.1-11.5 43.6-28l12.4 0 0 56-92 0 0 56.4c-16.5 7.6-28 24.3-28 43.6 0 26.5 21.5 48 48 48s48-21.5 48-48c0-19.4-11.5-36.1-28-43.6l0-16.4 52 0 0 172-40 0c-16.8 0-31.2-10.3-37.1-25.1l-6.4-16-17.2 1c-1.1 .1-2.2 .1-3.2 .1-30.9 0-56-25.1-56-56 0-9.5 2.4-18.5 6.5-26.3l8.7-16.2-13.4-12.6c-11-10.2-17.8-24.8-17.8-40.9 0-21.6 12.2-40.4 30.3-49.8l22.6-11.7-13.1-21.9c-5-8.4-7.9-18.1-7.9-28.6 0-30.9 25.1-56 56-56l24 0 0-32c0-13.3 10.7-24 24-24zm88 148l12.4 0c7.6 16.5 24.3 28 43.6 28 26.5 0 48-21.5 48-48s-21.5-48-48-48c-19.4 0-36.1 11.5-43.6 28l-12.4 0 0-108 40 0c13.3 0 24 10.7 24 24l0 32 24 0c30.9 0 56 25.1 56 56 0 10.5-2.9 20.3-7.9 28.6l-13.1 21.9 22.6 11.7c18 9.3 30.3 28.1 30.3 49.8 0 16.1-6.8 30.7-17.8 40.9l-13.4 12.6 8.7 16.2c4.2 7.8 6.5 16.7 6.5 26.3 0 30.9-25.1 56-56 56-1.1 0-2.2 0-3.2-.1l-17.2-1-6.4 16C351.2 453.7 336.8 464 320 464l-40 0 0-76 92 0 0-56.4c16.5-7.6 28-24.3 28-43.6 0-26.5-21.5-48-48-48s-48 21.5-48 48c0 19.4 11.5 36.1 28 43.6l0 16.4-52 0 0-152zM192 512l128 0c31.1 0 58.4-16.2 74.1-40.5 52.7-5.1 93.9-49.5 93.9-103.5 0-11.5-1.9-22.5-5.3-32.9 13.4-17.5 21.3-39.4 21.3-63.1 0-32-14.5-60.6-37.1-79.7 3.3-10.2 5.1-21.1 5.1-32.3 0-49.6-34.8-91.1-81.3-101.5-6.3-33.3-35.6-58.5-70.7-58.5L192 0c-35.1 0-64.4 25.2-70.7 58.5-46.5 10.4-81.3 51.9-81.3 101.5 0 11.3 1.8 22.2 5.1 32.3-22.7 19.1-37.1 47.7-37.1 79.7 0 23.7 8 45.6 21.3 63.1-3.5 10.4-5.3 21.4-5.3 32.9 0 54 41.2 98.5 93.9 103.5 15.6 24.3 42.9 40.5 74.1 40.5zM336 192a16 16 0 1 1 0-32 16 16 0 1 1 0 32zm32 96a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zM176 352a16 16 0 1 1 -32 0 16 16 0 1 1 32 0zm16-176a16 16 0 1 1 -32 0 16 16 0 1 1 32 0z",{"w":814,"h":802,"d":833},"M16 64C16 28.7 44.7 0 80 0L304 0c35.3 0 64 28.7 64 64l0 384c0 35.3-28.7 64-64 64L80 512c-35.3 0-64-28.7-64-64L16 64zm64 0l0 304 224 0 0-304-224 0zM192 472c17.7 0 32-14.3 32-32s-14.3-32-32-32-32 14.3-32 32 14.3 32 32 32z",{"w":802,"h":802,"d":835},"M0 256c0-46.6 12.5-90.4 34.3-128.9L144.1 318.3c21.9 39.2 63.8 65.7 111.9 65.7 14.3 0 27.1-2.3 40.8-6.6L220.5 509.6C95.9 492.3 0 385.3 0 256zm365.1 65.6c12.3-19.2 18.9-42.5 18.9-65.6 0-38.2-16.8-72.5-43.3-96l152.7 0c12 29.6 18.6 62.1 18.6 96 0 141.4-114.6 255.1-256 256L365.1 321.6zM477.8 128L256 128c-62.9 0-113.7 44.1-125.5 102.7L54.2 98.5C101 38.5 174 0 256 0 350.8 0 433.5 51.5 477.8 128zM344 256a88 88 0 1 1 -176 0 88 88 0 1 1 176 0z",{"w":802,"h":802,"d":837},"M448 96l0 256-384 0 0-256 384 0zM64 32C28.7 32 0 60.7 0 96L0 352c0 35.3 28.7 64 64 64l144 0-16 48-72 0c-13.3 0-24 10.7-24 24s10.7 24 24 24l272 0c13.3 0 24-10.7 24-24s-10.7-24-24-24l-72 0-16-48 144 0c35.3 0 64-28.7 64-64l0-256c0-35.3-28.7-64-64-64L64 32z",{"w":802,"h":802,"d":839},"M32 64C19.1 64 7.4 71.8 2.4 83.8S.2 109.5 9.4 118.6L192 301.3 192 416c0 8.5 3.4 16.6 9.4 22.6l64 64c9.2 9.2 22.9 11.9 34.9 6.9S320 492.9 320 480l0-178.7 182.6-182.6c9.2-9.2 11.9-22.9 6.9-34.9S492.9 64 480 64L32 64z",{"w":811,"h":802,"d":841},"M144 480c-79.5 0-144-64.5-144-144 0-63.4 41-117.2 97.9-136.5-1.3-7.7-1.9-15.5-1.9-23.5 0-79.5 64.5-144 144-144 55.4 0 103.5 31.3 127.6 77.1 14.2-8.3 30.8-13.1 48.4-13.1 53 0 96 43 96 96 0 15.7-3.8 30.6-10.5 43.7 44 20.3 74.5 64.7 74.5 116.3 0 70.7-57.3 128-128 128l-304 0zM305 191c-9.4-9.4-24.6-9.4-33.9 0l-72 72c-9.4 9.4-9.4 24.6 0 33.9s24.6 9.4 33.9 0l31-31 0 102.1c0 13.3 10.7 24 24 24s24-10.7 24-24l0-102.1 31 31c9.4 9.4 24.6 9.4 33.9 0s9.4-24.6 0-33.9l-72-72z",[843,2567,4437,7545,9046,11877,12849,13789,17379,19697,23132,26842,28065,34110,36726,38006,39751,41858,42452],{"id":844,"title":845,"authorsCollection":846,"content":854,"extension":228,"faqItemsCollection":2494,"faqTitle":59,"featured":6,"hashTags":59,"meta":2496,"metaTitle":2497,"ogImage":59,"postType":2498,"publishedDate":2499,"relatedBlogPostsCollection":2500,"slug":2502,"stem":2503,"subtitle":59,"summary":2504,"synopsis":2515,"sys":2516,"tagsCollection":2519,"topicsCollection":2528,"__hash__":2566},"blog/blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks.json","Guide: How to use Push controls to protect your users from modern browser threats",{"items":847},[848],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":852},"Kelly Davenport","Kelly","Product Team",{"url":853},"https://images.ctfassets.net/y1cdw1ablpvd/1hi8bEuVfn5sF57LivAq6d/9a3b82426c697d765e2e450e33a18424/kelly_profile_pic.jpeg",{"json":855,"links":2233},{"data":856,"content":857,"nodeType":2232},{},[858,867,892,899,908,915,922,929,935,939,949,956,962,968,985,1198,1210,1219,1226,1233,1240,1260,1266,1273,1276,1284,1291,1324,1331,1347,1368,1403,1409,1416,1435,1442,1449,1452,1460,1467,1560,1567,1574,1582,1589,1596,1603,1609,1617,1624,1631,1638,1644,1651,1659,1678,1686,1693,1699,1702,1710,1717,1724,1835,1841,1848,1855,1862,1869,1876,1884,1891,1898,1923,1929,1945,1960,1976,1982,1990,1997,2005,2012,2015,2023,2030,2063,2069,2093,2100,2103,2111,2118,2134,2140,2147,2154,2157,2165,2183,2190],{"data":859,"content":860,"nodeType":866},{},[861],{"data":862,"marks":863,"value":864,"nodeType":865},{},[],"Here are two things that can’t both be true:","text","paragraph",{"data":868,"content":869,"nodeType":891},{},[870,881],{"data":871,"content":872,"nodeType":880},{},[873],{"data":874,"content":875,"nodeType":866},{},[876],{"data":877,"marks":878,"value":879,"nodeType":865},{},[],"Users are the weakest link in security. They just need to stop clicking on things.","list-item",{"data":882,"content":883,"nodeType":880},{},[884],{"data":885,"content":886,"nodeType":866},{},[887],{"data":888,"marks":889,"value":890,"nodeType":865},{},[],"The internet is a giant clicking-on-things machine.","unordered-list",{"data":893,"content":894,"nodeType":866},{},[895],{"data":896,"marks":897,"value":898,"nodeType":865},{},[],"In particular, when we look at the TTPs of modern browser-based attacks that target employees, it’s obvious where this disconnect has real consequences. ",{"data":900,"content":906,"nodeType":907},{"target":901},{"sys":902},{"id":903,"type":904,"linkType":905},"2x3blnHzZYcJ8c439C4NqI","Link","Entry",[],"embedded-entry-block",{"data":909,"content":910,"nodeType":866},{},[911],{"data":912,"marks":913,"value":914,"nodeType":865},{},[],"Here’s why: Security tooling hasn’t kept up with adversary advances, and normal human behaviors are being expressly targeted via the browser to achieve compromise of accounts and endpoints. If you list the pitfalls facing the common end-user encountering these kinds of attack methods, the picture becomes even more stark.",{"data":916,"content":917,"nodeType":866},{},[918],{"data":919,"marks":920,"value":921,"nodeType":865},{},[],"To solve these problems, you need security tooling that sits in line with the user where they’re already working: In the browser. In this Push product guide, we’ll cover how you can use Push to provide point-in-time guidance — everything from block pages to informational banners — to protect users from modern browser-based TTPs and to guide them to remediate common vulnerabilities that can lead to account takeover.",{"data":923,"content":924,"nodeType":866},{},[925],{"data":926,"marks":927,"value":928,"nodeType":865},{},[],"We’ve also recently introduced custom branding and styling options for user-facing block pages and banners so you can provide a cohesive and trustworthy experience across your security ecosystem.",{"data":930,"content":934,"nodeType":907},{"target":931},{"sys":932},{"id":933,"type":904,"linkType":905},"7fwCnr9bz76rWWCL6EReOT",[],{"data":936,"content":937,"nodeType":938},{},[],"hr",{"data":940,"content":941,"nodeType":948},{},[942],{"data":943,"marks":944,"value":947,"nodeType":865},{},[945],{"type":946},"bold","Why you can’t train users to recognize modern browser-based attack methods","heading-1",{"data":950,"content":951,"nodeType":866},{},[952],{"data":953,"marks":954,"value":955,"nodeType":865},{},[],"User awareness training can help you build your workforce’s basic security baseline. But it’s not a reliable remedy for modern browser-based TTPs. When you look at the creative methods attackers are using — and rapidly improving on — it’s obvious why.",{"data":957,"content":961,"nodeType":907},{"target":958},{"sys":959},{"id":960,"type":904,"linkType":905},"eHla7GPCH5eTpdfEqW5Zo",[],{"data":963,"content":967,"nodeType":907},{"target":964},{"sys":965},{"id":966,"type":904,"linkType":905},"29vUtbEUam8fhbwnQdINRJ",[],{"data":969,"content":970,"nodeType":866},{},[971,975,981],{"data":972,"marks":973,"value":974,"nodeType":865},{},[],"To avoid account or endpoint compromise while going about your daily work as a user, you would need to accomplish these ",{"data":976,"marks":977,"value":980,"nodeType":865},{},[978],{"type":979},"italic","extremely 100% achievable activities",{"data":982,"marks":983,"value":984,"nodeType":865},{},[],", including:",{"data":986,"content":987,"nodeType":1197},{},[988,1015,1058,1081,1117,1152],{"data":989,"content":990,"nodeType":1014},{},[991,1003],{"data":992,"content":993,"nodeType":1002},{},[994],{"data":995,"content":996,"nodeType":866},{},[997],{"data":998,"marks":999,"value":1001,"nodeType":865},{},[1000],{"type":946},"Scenario","table-header-cell",{"data":1004,"content":1005,"nodeType":1002},{},[1006],{"data":1007,"content":1008,"nodeType":866},{},[1009],{"data":1010,"marks":1011,"value":1013,"nodeType":865},{},[1012],{"type":946},"Threat","table-row",{"data":1016,"content":1017,"nodeType":1014},{},[1018,1044],{"data":1019,"content":1020,"nodeType":1043},{},[1021],{"data":1022,"content":1023,"nodeType":866},{},[1024,1028,1039],{"data":1025,"marks":1026,"value":1027,"nodeType":865},{},[],"While using search engines, never click on a ",{"data":1029,"content":1033,"nodeType":1038},{"target":1030},{"sys":1031},{"id":1032,"type":904,"linkType":905},"2YmiesBvJHGw4wiKEKzLUq",[1034],{"data":1035,"marks":1036,"value":1037,"nodeType":865},{},[],"malicious link","entry-hyperlink",{"data":1040,"marks":1041,"value":1042,"nodeType":865},{},[]," in sponsored or organic results (it's often the first link you see, too).","table-cell",{"data":1045,"content":1046,"nodeType":1043},{},[1047],{"data":1048,"content":1049,"nodeType":866},{},[1050,1054],{"data":1051,"marks":1052,"value":1053,"nodeType":865},{},[],"M",{"data":1055,"marks":1056,"value":1057,"nodeType":865},{},[],"alvertising, SEO poisoning, compromised legitimate webpages, vibecoded phishing webpages.",{"data":1059,"content":1060,"nodeType":1014},{},[1061,1071],{"data":1062,"content":1063,"nodeType":1043},{},[1064],{"data":1065,"content":1066,"nodeType":866},{},[1067],{"data":1068,"marks":1069,"value":1070,"nodeType":865},{},[],"Know when to trust an email coming from an app you use every day, and when it could be malicious (it looks the same).",{"data":1072,"content":1073,"nodeType":1043},{},[1074],{"data":1075,"content":1076,"nodeType":866},{},[1077],{"data":1078,"marks":1079,"value":1080,"nodeType":865},{},[],"Using SaaS services to distribute malicious links using trusted sites (also a handy way of evading email controls).",{"data":1082,"content":1083,"nodeType":1014},{},[1084,1107],{"data":1085,"content":1086,"nodeType":1043},{},[1087],{"data":1088,"content":1089,"nodeType":866},{},[1090,1094,1103],{"data":1091,"marks":1092,"value":1093,"nodeType":865},{},[],"When reading a LinkedIn DM from a colleague, anticipate that they might have been hacked and have sent you a malicious link. (Yes, this was a ",{"data":1095,"content":1097,"nodeType":1102},{"uri":1096},"https://pushsecurity.com/blog/how-push-stopped-a-high-risk-linkedin-spear-phishing-attack/",[1098],{"data":1099,"marks":1100,"value":1101,"nodeType":865},{},[],"real scenario","hyperlink",{"data":1104,"marks":1105,"value":1106,"nodeType":865},{},[],"). ",{"data":1108,"content":1109,"nodeType":1043},{},[1110],{"data":1111,"content":1112,"nodeType":866},{},[1113],{"data":1114,"marks":1115,"value":1116,"nodeType":865},{},[],"Abuse of social media, IM platforms, and other apps where you can be directly contacted by users external to your organization. ",{"data":1118,"content":1119,"nodeType":1014},{},[1120,1130],{"data":1121,"content":1122,"nodeType":1043},{},[1123],{"data":1124,"content":1125,"nodeType":866},{},[1126],{"data":1127,"marks":1128,"value":1129,"nodeType":865},{},[],"When logging in to an app, never follow benign-seeming but actually malicious instructions to enter a code onto a legitimate page to complete your login.",{"data":1131,"content":1132,"nodeType":1043},{},[1133],{"data":1134,"content":1135,"nodeType":866},{},[1136,1140,1148],{"data":1137,"marks":1138,"value":1139,"nodeType":865},{},[],"AiTM phishing, OAuth consent phishing, ",{"data":1141,"content":1143,"nodeType":1102},{"uri":1142},"https://pushsecurity.com/blog/device-code-phishing/",[1144],{"data":1145,"marks":1146,"value":1147,"nodeType":865},{},[],"device code phishing",{"data":1149,"marks":1150,"value":1151,"nodeType":865},{},[],".",{"data":1153,"content":1154,"nodeType":1014},{},[1155,1165],{"data":1156,"content":1157,"nodeType":1043},{},[1158],{"data":1159,"content":1160,"nodeType":866},{},[1161],{"data":1162,"marks":1163,"value":1164,"nodeType":865},{},[],"Know which instructions to follow and which are malicious when verifying that you're human on a CAPTCHA-style page.",{"data":1166,"content":1167,"nodeType":1043},{},[1168],{"data":1169,"content":1170,"nodeType":866},{},[1171,1174,1181,1185,1193],{"data":1172,"marks":1173,"value":21,"nodeType":865},{},[],{"data":1175,"content":1177,"nodeType":1102},{"uri":1176},"https://pushsecurity.com/blog/the-most-advanced-clickfix-yet/",[1178],{"data":1179,"marks":1180,"value":315,"nodeType":865},{},[],{"data":1182,"marks":1183,"value":1184,"nodeType":865},{},[],"-style attacks that trick the user into running a malicious script or command, or ",{"data":1186,"content":1188,"nodeType":1102},{"uri":1187},"https://pushsecurity.com/blog/consentfix/",[1189],{"data":1190,"marks":1191,"value":1192,"nodeType":865},{},[],"ConsentFix",{"data":1194,"marks":1195,"value":1196,"nodeType":865},{},[]," (which is even sneakier and simply involves copying a URL).","table",{"data":1199,"content":1200,"nodeType":866},{},[1201,1205],{"data":1202,"marks":1203,"value":1204,"nodeType":865},{},[],"And we're barely scratching the surface here. ",{"data":1206,"marks":1207,"value":1209,"nodeType":865},{},[1208],{"type":946},"Easy, right?",{"data":1211,"content":1212,"nodeType":1218},{},[1213],{"data":1214,"marks":1215,"value":1217,"nodeType":865},{},[1216],{"type":946},"Can't we block users from interacting with bad content? ","heading-2",{"data":1220,"content":1221,"nodeType":866},{},[1222],{"data":1223,"marks":1224,"value":1225,"nodeType":865},{},[],"So if you can’t train your way out of these problems, what about locking down and blocking your way out of the problem?",{"data":1227,"content":1228,"nodeType":866},{},[1229],{"data":1230,"marks":1231,"value":1232,"nodeType":865},{},[],"This, too, simply isn’t really feasible. ",{"data":1234,"content":1235,"nodeType":866},{},[1236],{"data":1237,"marks":1238,"value":1239,"nodeType":865},{},[],"Modern cloud-first adversaries routinely rotate domains on malicious pages; use trusted services like SharePoint, Adobe, Google Sites, Cloudflare, and Atlassian to deliver lures; target end-users across multiple channels, including social media, forums, chat platforms, Google search results, email, and webpages; and use legitimate security tools like bot protection to bypass detection by other legitimate security tools, such as web content scanning and analysis solutions.",{"data":1241,"content":1242,"nodeType":866},{},[1243,1247,1251,1256],{"data":1244,"marks":1245,"value":1246,"nodeType":865},{},[],"To safely navigate the internet today, y",{"data":1248,"marks":1249,"value":1250,"nodeType":865},{},[],"ou need to be able to spot malicious pages and content ",{"data":1252,"marks":1253,"value":1255,"nodeType":865},{},[1254],{"type":946},"the first time they're seen in the wild",{"data":1257,"marks":1258,"value":1259,"nodeType":865},{},[],". If you're relying on indicators of known bad, you're always a step behind, leaving users exposed.",{"data":1261,"content":1265,"nodeType":907},{"target":1262},{"sys":1263},{"id":1264,"type":904,"linkType":905},"3ZfqOLRdJZJIc78rj9E9JZ",[],{"data":1267,"content":1268,"nodeType":866},{},[1269],{"data":1270,"marks":1271,"value":1272,"nodeType":865},{},[],"To protect users while they work online, you need a purpose-built security tool that can respond in real time to modern TTPs and guide users securely — without introducing extra work or a lot of friction. Push can help with that.",{"data":1274,"content":1275,"nodeType":938},{},[],{"data":1277,"content":1278,"nodeType":948},{},[1279],{"data":1280,"marks":1281,"value":1283,"nodeType":865},{},[1282],{"type":946},"Why in-browser controls?",{"data":1285,"content":1286,"nodeType":866},{},[1287],{"data":1288,"marks":1289,"value":1290,"nodeType":865},{},[],"Simply put, using in-browser security controls gets you the closest to the user and their work in order to protect them from modern browser-based threats. Adding in-browser controls also solves two tricky problems for security teams: ",{"data":1292,"content":1293,"nodeType":891},{},[1294,1309],{"data":1295,"content":1296,"nodeType":880},{},[1297],{"data":1298,"content":1299,"nodeType":866},{},[1300,1305],{"data":1301,"marks":1302,"value":1304,"nodeType":865},{},[1303],{"type":946},"Filling the gap between solution layers",{"data":1306,"marks":1307,"value":1308,"nodeType":865},{},[]," in order to detect and block attack methods like Adversary-in-the-Middle phishing, malicious browser extensions, and ClickFix-style social engineering attacks that other tools miss.",{"data":1310,"content":1311,"nodeType":880},{},[1312],{"data":1313,"content":1314,"nodeType":866},{},[1315,1320],{"data":1316,"marks":1317,"value":1319,"nodeType":865},{},[1318],{"type":946},"Providing just-in-time security enforcement",{"data":1321,"marks":1322,"value":1323,"nodeType":865},{},[]," to end-users when it’s the right moment to act on that guidance, reducing your attack surface across your online apps, browser extensions, and accounts, and ensuring your app usage policies are followed.",{"data":1325,"content":1326,"nodeType":1218},{},[1327],{"data":1328,"marks":1329,"value":1330,"nodeType":865},{},[],"Fill the gap between solution layers",{"data":1332,"content":1333,"nodeType":866},{},[1334,1338,1343],{"data":1335,"marks":1336,"value":1337,"nodeType":865},{},[],"Most existing security solutions operate just ",{"data":1339,"marks":1340,"value":1342,"nodeType":865},{},[1341],{"type":979},"outside",{"data":1344,"marks":1345,"value":1346,"nodeType":865},{},[]," the context of a user interacting with a webpage. This leaves blind spots that attackers are exploiting between layers of security tooling.",{"data":1348,"content":1349,"nodeType":866},{},[1350,1354,1364],{"data":1351,"marks":1352,"value":1353,"nodeType":865},{},[],"For example, network proxies see HTTP requests, URLs, and page headers, but not the ",{"data":1355,"content":1359,"nodeType":1038},{"target":1356},{"sys":1357},{"id":1358,"type":904,"linkType":905},"5caCcGCqMMPm5KlwUv0sbz",[1360],{"data":1361,"marks":1362,"value":1363,"nodeType":865},{},[],"structural elements",{"data":1365,"marks":1366,"value":1367,"nodeType":865},{},[]," of the DOM or on-page user interactions that are key to fingerprinting the behavior of AiTM phishing kits or ClickFix-style social engineering attacks. ",{"data":1369,"content":1370,"nodeType":866},{},[1371,1375,1385,1389,1399],{"data":1372,"marks":1373,"value":1374,"nodeType":865},{},[],"Similarly, ",{"data":1376,"content":1380,"nodeType":1038},{"target":1377},{"sys":1378},{"id":1379,"type":904,"linkType":905},"6YWYKGESlyUKQxvhKmBzeH",[1381],{"data":1382,"marks":1383,"value":1384,"nodeType":865},{},[],"EDR tools",{"data":1386,"marks":1387,"value":1388,"nodeType":865},{},[]," only see the bad thing when it hits the endpoint, and many ",{"data":1390,"content":1394,"nodeType":1038},{"target":1391},{"sys":1392},{"id":1393,"type":904,"linkType":905},"2k2aDK5dyQKlQBrk66pMXE",[1395],{"data":1396,"marks":1397,"value":1398,"nodeType":865},{},[],"cloud security tools",{"data":1400,"marks":1401,"value":1402,"nodeType":865},{},[]," rely on complex policy configurations across a core set of apps to provide security protection — leaving a gap in detection and response capabilities outside their purview.",{"data":1404,"content":1408,"nodeType":907},{"target":1405},{"sys":1406},{"id":1407,"type":904,"linkType":905},"50NyBpr96dKspvTzJTBOlC",[],{"data":1410,"content":1411,"nodeType":1218},{},[1412],{"data":1413,"marks":1414,"value":1415,"nodeType":865},{},[],"Provide just-in-time security enforcement",{"data":1417,"content":1418,"nodeType":866},{},[1419,1423,1431],{"data":1420,"marks":1421,"value":1422,"nodeType":865},{},[],"As some of our customers like to say, Push provides security teams with a ",{"data":1424,"content":1426,"nodeType":1102},{"uri":1425},"/customer-stories/upvest",[1427],{"data":1428,"marks":1429,"value":1430,"nodeType":865},{},[],"“seat on the user’s side”",{"data":1432,"marks":1433,"value":1434,"nodeType":865},{},[]," of the equation so you can enforce security best practices.",{"data":1436,"content":1437,"nodeType":866},{},[1438],{"data":1439,"marks":1440,"value":1441,"nodeType":865},{},[],"Having that seat on the user’s side also helps you deliver guidance in the right context for it to be followed: When the user is engaged in doing the behavior you want to influence (or prevent). The right information, at the right time, in the right format — not a belated reminder through a different channel that’s easy to ignore.",{"data":1443,"content":1444,"nodeType":866},{},[1445],{"data":1446,"marks":1447,"value":1448,"nodeType":865},{},[],"With those outcomes in mind, let’s look at some specific solutions from the Push platform.",{"data":1450,"content":1451,"nodeType":938},{},[],{"data":1453,"content":1454,"nodeType":948},{},[1455],{"data":1456,"marks":1457,"value":1459,"nodeType":865},{},[1458],{"type":946},"How Push helps you protect users from browser-based ATO, ClickFix, and similar attacks",{"data":1461,"content":1462,"nodeType":866},{},[1463],{"data":1464,"marks":1465,"value":1466,"nodeType":865},{},[],"The Push platform provides out-of-the-box detections for browser-based attacks, including:",{"data":1468,"content":1469,"nodeType":891},{},[1470,1493,1516,1537],{"data":1471,"content":1472,"nodeType":880},{},[1473],{"data":1474,"content":1475,"nodeType":866},{},[1476,1479,1489],{"data":1477,"marks":1478,"value":21,"nodeType":865},{},[],{"data":1480,"content":1484,"nodeType":1038},{"target":1481},{"sys":1482},{"id":1483,"type":904,"linkType":905},"7KRnTSnJAbbiho69gNyN0B",[1485],{"data":1486,"marks":1487,"value":1488,"nodeType":865},{},[],"AiTM phishing kits",{"data":1490,"marks":1491,"value":1492,"nodeType":865},{},[]," that can bypass MFA",{"data":1494,"content":1495,"nodeType":880},{},[1496],{"data":1497,"content":1498,"nodeType":866},{},[1499,1502,1512],{"data":1500,"marks":1501,"value":21,"nodeType":865},{},[],{"data":1503,"content":1507,"nodeType":1038},{"target":1504},{"sys":1505},{"id":1506,"type":904,"linkType":905},"jN3GN5ddMJZiDtl0fgUVd",[1508],{"data":1509,"marks":1510,"value":1511,"nodeType":865},{},[],"Cloned login pages",{"data":1513,"marks":1514,"value":1515,"nodeType":865},{},[]," designed to steal user credentials",{"data":1517,"content":1518,"nodeType":880},{},[1519],{"data":1520,"content":1521,"nodeType":866},{},[1522,1525,1534],{"data":1523,"marks":1524,"value":21,"nodeType":865},{},[],{"data":1526,"content":1530,"nodeType":1038},{"target":1527},{"sys":1528},{"id":1529,"type":904,"linkType":905},"5NyiWgjMDwk16XZ0S681JK",[1531],{"data":1532,"marks":1533,"value":699,"nodeType":865},{},[],{"data":1535,"marks":1536,"value":21,"nodeType":865},{},[],{"data":1538,"content":1539,"nodeType":880},{},[1540],{"data":1541,"content":1542,"nodeType":866},{},[1543,1546,1556],{"data":1544,"marks":1545,"value":21,"nodeType":865},{},[],{"data":1547,"content":1551,"nodeType":1038},{"target":1548},{"sys":1549},{"id":1550,"type":904,"linkType":905},"7jygmadjoz0asAHv7e5PuK",[1552],{"data":1553,"marks":1554,"value":1555,"nodeType":865},{},[],"Malicious copy and paste attacks",{"data":1557,"marks":1558,"value":1559,"nodeType":865},{},[]," like ClickFix, FileFix, and similar",{"data":1561,"content":1562,"nodeType":866},{},[1563],{"data":1564,"marks":1565,"value":1566,"nodeType":865},{},[],"For each of these attack vectors, Push delivers detection events and associated metadata for quick triage by the security team, as well as employee-facing warn or block screens, based on your selected configuration.",{"data":1568,"content":1569,"nodeType":866},{},[1570],{"data":1571,"marks":1572,"value":1573,"nodeType":865},{},[],"Here’s a snapshot of the capabilities of these controls and what end-users will experience.",{"data":1575,"content":1576,"nodeType":1218},{},[1577],{"data":1578,"marks":1579,"value":1581,"nodeType":865},{},[1580],{"type":946},"The scenario:",{"data":1583,"content":1584,"nodeType":866},{},[1585],{"data":1586,"marks":1587,"value":1588,"nodeType":865},{},[],"When a user encounters a malicious page — whether that’s an AiTM phishing tool running on a webpage, or a ClickFix-style attack — or attempts to install a malicious extension, Push immediately steps in. ",{"data":1590,"content":1591,"nodeType":866},{},[1592],{"data":1593,"marks":1594,"value":1595,"nodeType":865},{},[],"Push can prevent users from entering their credentials on phishing pages, including cloned login pages, or from pasting malicious clipboard contents that can run malware on their device. Push can also prevent users from installing known-bad browser extensions. ",{"data":1597,"content":1598,"nodeType":866},{},[1599],{"data":1600,"marks":1601,"value":1602,"nodeType":865},{},[],"In each of these scenarios, Push admins get detailed detection information they can use to triage the incident.",{"data":1604,"content":1608,"nodeType":907},{"target":1605},{"sys":1606},{"id":1607,"type":904,"linkType":905},"5jR3YVUiusHGnXDOyrgYpr",[],{"data":1610,"content":1611,"nodeType":1218},{},[1612],{"data":1613,"marks":1614,"value":1616,"nodeType":865},{},[1615],{"type":946},"How it works:",{"data":1618,"content":1619,"nodeType":866},{},[1620],{"data":1621,"marks":1622,"value":1623,"nodeType":865},{},[],"Rather than relying on known-bad intelligence like domains or URLs, Push performs a behavioral and structural analysis of malicious pages in real time.",{"data":1625,"content":1626,"nodeType":866},{},[1627],{"data":1628,"marks":1629,"value":1630,"nodeType":865},{},[],"That means a phishing page never has to appear in a threat intelligence feed in order to be detected and blocked.",{"data":1632,"content":1633,"nodeType":866},{},[1634],{"data":1635,"marks":1636,"value":1637,"nodeType":865},{},[],"Similarly, for malicious copy and paste attacks like ClickFix, Push analyzes the content copied to the clipboard but also evaluates the context of the page to reduce false positives. In blocking mode, Push’s control for ClickFix-style attacks replaces the malicious clipboard contents with safe text — preventing potential endpoint compromise before it can occur.",{"data":1639,"content":1643,"nodeType":907},{"target":1640},{"sys":1641},{"id":1642,"type":904,"linkType":905},"3OkejjEjV9xflBc5ouOVFn",[],{"data":1645,"content":1646,"nodeType":866},{},[1647],{"data":1648,"marks":1649,"value":1650,"nodeType":865},{},[],"Finally, for identifying malicious browser extensions, Push takes a slightly different approach — combining both behavioral detections and curated intelligence of known-bad extensions from our own research and from trusted industry sources. We’ve found this combination provides the highest-fidelity way to identify malicious extensions without relying on approaches like analyzing extension permissions, which often isn’t actionable. ",{"data":1652,"content":1653,"nodeType":1218},{},[1654],{"data":1655,"marks":1656,"value":1658,"nodeType":865},{},[1657],{"type":946},"Your security team gets:",{"data":1660,"content":1661,"nodeType":866},{},[1662,1666,1674],{"data":1663,"marks":1664,"value":1665,"nodeType":865},{},[],"Readymade detection and alerting, combined with detailed telemetry. Detections and their associated metadata can be consumed via ",{"data":1667,"content":1669,"nodeType":1102},{"uri":1668},"/help/audience/administrators/docs/getting-started/#api-and-webhooks",[1670],{"data":1671,"marks":1672,"value":1673,"nodeType":865},{},[],"Push’s REST API and webhooks",{"data":1675,"marks":1676,"value":1677,"nodeType":865},{},[],". ",{"data":1679,"content":1680,"nodeType":1218},{},[1681],{"data":1682,"marks":1683,"value":1685,"nodeType":865},{},[1684],{"type":946},"Your end-users see:",{"data":1687,"content":1688,"nodeType":866},{},[1689],{"data":1690,"marks":1691,"value":1692,"nodeType":865},{},[],"An immediate block screen in your company colors and brand style, providing a highly memorable, contextual moment of learning — and reassuring them that an incident has been prevented.",{"data":1694,"content":1698,"nodeType":907},{"target":1695},{"sys":1696},{"id":1697,"type":904,"linkType":905},"4QfjDDfKjohKr1qqDLRT0m",[],{"data":1700,"content":1701,"nodeType":938},{},[],{"data":1703,"content":1704,"nodeType":948},{},[1705],{"data":1706,"marks":1707,"value":1709,"nodeType":865},{},[1708],{"type":946},"How Push helps you remediate account vulnerabilities at scale",{"data":1711,"content":1712,"nodeType":866},{},[1713],{"data":1714,"marks":1715,"value":1716,"nodeType":865},{},[],"Just-in-time security enforcement works best when it’s trustworthy and contextual — without making a lot more work for your team. Push also provides readymade controls for remediating common account vulnerabilities that contribute to your attack surface online, helping you harden existing accounts and reduce behaviors that introduce new risks.",{"data":1718,"content":1719,"nodeType":866},{},[1720],{"data":1721,"marks":1722,"value":1723,"nodeType":865},{},[],"With Push, you can:",{"data":1725,"content":1726,"nodeType":891},{},[1727,1750,1788,1812],{"data":1728,"content":1729,"nodeType":880},{},[1730],{"data":1731,"content":1732,"nodeType":866},{},[1733,1736,1746],{"data":1734,"marks":1735,"value":21,"nodeType":865},{},[],{"data":1737,"content":1741,"nodeType":1038},{"target":1738},{"sys":1739},{"id":1740,"type":904,"linkType":905},"6FYHbkcRUrtznPo7RarRsz",[1742],{"data":1743,"marks":1744,"value":1745,"nodeType":865},{},[],"Prevent the phishing or reuse of high-value passwords",{"data":1747,"marks":1748,"value":1749,"nodeType":865},{},[],", like your IdP, AWS, or code repository passwords.",{"data":1751,"content":1752,"nodeType":880},{},[1753],{"data":1754,"content":1755,"nodeType":866},{},[1756,1760,1770,1774,1784],{"data":1757,"marks":1758,"value":1759,"nodeType":865},{},[],"Remediate ",{"data":1761,"content":1765,"nodeType":1038},{"target":1762},{"sys":1763},{"id":1764,"type":904,"linkType":905},"2WAc5HflKonFN7Jc53ROgj",[1766],{"data":1767,"marks":1768,"value":1769,"nodeType":865},{},[],"missing MFA",{"data":1771,"marks":1772,"value":1773,"nodeType":865},{},[]," or ",{"data":1775,"content":1779,"nodeType":1038},{"target":1776},{"sys":1777},{"id":1778,"type":904,"linkType":905},"2dAP36chda6ZDGKzw0Itfs",[1780],{"data":1781,"marks":1782,"value":1783,"nodeType":865},{},[],"insecure passwords",{"data":1785,"marks":1786,"value":1787,"nodeType":865},{},[]," on any work app, even those not managed by your SSO solution.",{"data":1789,"content":1790,"nodeType":880},{},[1791],{"data":1792,"content":1793,"nodeType":866},{},[1794,1798,1808],{"data":1795,"marks":1796,"value":1797,"nodeType":865},{},[],"Use ",{"data":1799,"content":1803,"nodeType":1038},{"target":1800},{"sys":1801},{"id":1802,"type":904,"linkType":905},"2ZpKnuljaUH0jzVaae4SMN",[1804],{"data":1805,"marks":1806,"value":1807,"nodeType":865},{},[],"in-browser banners",{"data":1809,"marks":1810,"value":1811,"nodeType":865},{},[]," to add guardrails to app usage, including blocking unapproved SaaS or collecting a business reason to access an app before approving it.",{"data":1813,"content":1814,"nodeType":880},{},[1815],{"data":1816,"content":1817,"nodeType":866},{},[1818,1821,1831],{"data":1819,"marks":1820,"value":21,"nodeType":865},{},[],{"data":1822,"content":1826,"nodeType":1038},{"target":1823},{"sys":1824},{"id":1825,"type":904,"linkType":905},"3ibVBa6u0XfcXXDVtON5th",[1827],{"data":1828,"marks":1829,"value":1830,"nodeType":865},{},[],"Block unwanted or unapproved browser extensions",{"data":1832,"marks":1833,"value":1834,"nodeType":865},{},[]," from being installed, or disable them if they’ve been installed previously.",{"data":1836,"content":1837,"nodeType":866},{},[1838],{"data":1839,"marks":1840,"value":1573,"nodeType":865},{},[],{"data":1842,"content":1843,"nodeType":1218},{},[1844],{"data":1845,"marks":1846,"value":1581,"nodeType":865},{},[1847],{"type":946},{"data":1849,"content":1850,"nodeType":866},{},[1851],{"data":1852,"marks":1853,"value":1854,"nodeType":865},{},[],"Push uses in-browser controls to intervene when a user is missing MFA; reusing a high-value password; using an insecure password; attempting to log in to an unapproved app; or attempting to install a blocked extension. ",{"data":1856,"content":1857,"nodeType":866},{},[1858],{"data":1859,"marks":1860,"value":1861,"nodeType":865},{},[],"Push can block users from reusing passwords set as “protected” (meaning they can’t be reused on any other page or app) or from using unapproved apps or extensions. Push can guide users to update their password or register for MFA on accounts where they lack it. Push can also provide any other specific security or policy guidance to employees via banners that appear on apps in your environment, including GenAI apps. ",{"data":1863,"content":1864,"nodeType":866},{},[1865],{"data":1866,"marks":1867,"value":1868,"nodeType":865},{},[],"For all of these scenarios, you can tune Push controls to your preferred mode (informing vs. blocking, for example) and select which employees, employee groups, and apps or accounts to focus on.",{"data":1870,"content":1871,"nodeType":866},{},[1872],{"data":1873,"marks":1874,"value":1875,"nodeType":865},{},[],"You can also customize the message that employees see, to match your organizational culture and policies.",{"data":1877,"content":1878,"nodeType":1218},{},[1879],{"data":1880,"marks":1881,"value":1883,"nodeType":865},{},[1882],{"type":946},"How it works: ",{"data":1885,"content":1886,"nodeType":866},{},[1887],{"data":1888,"marks":1889,"value":1890,"nodeType":865},{},[],"The Push browser agent observes real-time user behavior and securely analyzes users’ account vulnerabilities in order to identify risks and execute your preconfigured controls. ",{"data":1892,"content":1893,"nodeType":866},{},[1894],{"data":1895,"marks":1896,"value":1897,"nodeType":865},{},[],"To identify MFA status, Push uses the app’s own API to query the logged-in user’s registered MFA methods. To analyze password security, Push creates a salted, truncated hash that is stored locally in the user’s browser and then used for comparison to find reused passwords, leaked passwords, and shared passwords. ",{"data":1899,"content":1900,"nodeType":866},{},[1901,1905,1910,1914,1919],{"data":1902,"marks":1903,"value":1904,"nodeType":865},{},[],"Using the ",{"data":1906,"marks":1907,"value":1909,"nodeType":865},{},[1908],{"type":946},"MFA enforcement",{"data":1911,"marks":1912,"value":1913,"nodeType":865},{},[]," and ",{"data":1915,"marks":1916,"value":1918,"nodeType":865},{},[1917],{"type":946},"Strong password enforcement",{"data":1920,"marks":1921,"value":1922,"nodeType":865},{},[]," controls, you can then automatically display a banner to users with those account vulnerabilities, guiding them to fix the issue.",{"data":1924,"content":1928,"nodeType":907},{"target":1925},{"sys":1926},{"id":1927,"type":904,"linkType":905},"7Ka4CumZk9it6GsdlNHREA",[],{"data":1930,"content":1931,"nodeType":866},{},[1932,1936,1941],{"data":1933,"marks":1934,"value":1935,"nodeType":865},{},[],"Using Push’s ",{"data":1937,"marks":1938,"value":1940,"nodeType":865},{},[1939],{"type":946},"Password protection",{"data":1942,"marks":1943,"value":1944,"nodeType":865},{},[]," control, you can select apps where you want to essentially “pin” the high-value password to only that app and prevent its reuse (or phishing) on any other domain. ",{"data":1946,"content":1947,"nodeType":866},{},[1948,1951,1956],{"data":1949,"marks":1950,"value":1935,"nodeType":865},{},[],{"data":1952,"marks":1953,"value":1955,"nodeType":865},{},[1954],{"type":946},"Browser extension blocking",{"data":1957,"marks":1958,"value":1959,"nodeType":865},{},[]," control, you can create a blocklist or allowlist of extensions and prevent users from installing or enabling blocked extensions.",{"data":1961,"content":1962,"nodeType":866},{},[1963,1967,1972],{"data":1964,"marks":1965,"value":1966,"nodeType":865},{},[],"Finally, using Push’s ",{"data":1968,"marks":1969,"value":1971,"nodeType":865},{},[1970],{"type":946},"App banners",{"data":1973,"marks":1974,"value":1975,"nodeType":865},{},[]," feature, you can add custom messages in a range of modes — from informing to blocking — to apps in use across your business, or even specific URL patterns.",{"data":1977,"content":1981,"nodeType":907},{"target":1978},{"sys":1979},{"id":1980,"type":904,"linkType":905},"5Mq4PEzEhW8p1qLvS9aZMm",[],{"data":1983,"content":1984,"nodeType":1218},{},[1985],{"data":1986,"marks":1987,"value":1989,"nodeType":865},{},[1988],{"type":946},"Your security team gets: ",{"data":1991,"content":1992,"nodeType":866},{},[1993],{"data":1994,"marks":1995,"value":1996,"nodeType":865},{},[],"A flexible and highly configurable set of controls to solve account vulnerabilities at scale and to enforce your security controls around browser extensions and app usage.",{"data":1998,"content":1999,"nodeType":1218},{},[2000],{"data":2001,"marks":2002,"value":2004,"nodeType":865},{},[2003],{"type":946},"Your end-users see: ",{"data":2006,"content":2007,"nodeType":866},{},[2008],{"data":2009,"marks":2010,"value":2011,"nodeType":865},{},[],"Contextual, actionable guidance in the midst of their actual workflow, helping them fix the issue or guiding them to safety.",{"data":2013,"content":2014,"nodeType":938},{},[],{"data":2016,"content":2017,"nodeType":948},{},[2018],{"data":2019,"marks":2020,"value":2022,"nodeType":865},{},[2021],{"type":946},"Implementation tips",{"data":2024,"content":2025,"nodeType":866},{},[2026],{"data":2027,"marks":2028,"value":2029,"nodeType":865},{},[],"Push allows you to set the scope and mode of each control, making it simple to roll out. ",{"data":2031,"content":2032,"nodeType":866},{},[2033,2037,2042,2046,2050,2054,2059],{"data":2034,"marks":2035,"value":2036,"nodeType":865},{},[],"We recommend starting in ",{"data":2038,"marks":2039,"value":2041,"nodeType":865},{},[2040],{"type":946},"Monitor",{"data":2043,"marks":2044,"value":2045,"nodeType":865},{},[]," mode for controls that intervene in end-user activities. That way, you can perform testing with sample malicious sites or scenarios like reused protected passwords, tune out any benign true positives, and develop the messaging you want to use on warn or block pages. (For controls without an explicit monitor mode, like ",{"data":2047,"marks":2048,"value":1918,"nodeType":865},{},[2049],{"type":946},{"data":2051,"marks":2052,"value":2053,"nodeType":865},{},[],", you can still monitor for related events on the ",{"data":2055,"marks":2056,"value":2058,"nodeType":865},{},[2057],{"type":946},"Events",{"data":2060,"marks":2061,"value":2062,"nodeType":865},{},[]," page, such as account security findings, or by consuming webhooks into a downstream tool.)",{"data":2064,"content":2068,"nodeType":907},{"target":2065},{"sys":2066},{"id":2067,"type":904,"linkType":905},"7vk8DHv01cM1o2C0ZpAvZu",[],{"data":2070,"content":2071,"nodeType":866},{},[2072,2076,2081,2084,2089],{"data":2073,"marks":2074,"value":2075,"nodeType":865},{},[],"When you’re ready, set the mode to ",{"data":2077,"marks":2078,"value":2080,"nodeType":865},{},[2079],{"type":946},"Warn",{"data":2082,"marks":2083,"value":1773,"nodeType":865},{},[],{"data":2085,"marks":2086,"value":2088,"nodeType":865},{},[2087],{"type":946},"Block",{"data":2090,"marks":2091,"value":2092,"nodeType":865},{},[]," and use the scope options to perform a phased rollout to your user population by adding additional user groups to the control until you have complete coverage of your population.",{"data":2094,"content":2095,"nodeType":866},{},[2096],{"data":2097,"marks":2098,"value":2099,"nodeType":865},{},[],"By consuming webhook events into your SIEM, you can integrate Push alerts into your existing security workflows, monitoring for new detections or tracking when account vulnerabilities are resolved.",{"data":2101,"content":2102,"nodeType":938},{},[],{"data":2104,"content":2105,"nodeType":948},{},[2106],{"data":2107,"marks":2108,"value":2110,"nodeType":865},{},[2109],{"type":946},"Enhancing user trust with custom branding",{"data":2112,"content":2113,"nodeType":866},{},[2114],{"data":2115,"marks":2116,"value":2117,"nodeType":865},{},[],"We recently released the option to customize the look and feel of all employee-facing banners and block pages. ",{"data":2119,"content":2120,"nodeType":866},{},[2121,2125,2130],{"data":2122,"marks":2123,"value":2124,"nodeType":865},{},[],"From the ",{"data":2126,"marks":2127,"value":2129,"nodeType":865},{},[2128],{"type":946},"Settings",{"data":2131,"marks":2132,"value":2133,"nodeType":865},{},[]," page in the Push admin console, you can upload your logo, add accent colors, and choose from light or dark backgrounds.",{"data":2135,"content":2139,"nodeType":907},{"target":2136},{"sys":2137},{"id":2138,"type":904,"linkType":905},"51lk1VRP20G7H4PAoRZANI",[],{"data":2141,"content":2142,"nodeType":866},{},[2143],{"data":2144,"marks":2145,"value":2146,"nodeType":865},{},[],"Custom branding increases the trustworthiness of these in-the-moment security guardrails so that users recognize them immediately and act on their guidance.",{"data":2148,"content":2149,"nodeType":866},{},[2150],{"data":2151,"marks":2152,"value":2153,"nodeType":865},{},[],"The result: Better compliance and lower friction for you and your employees.",{"data":2155,"content":2156,"nodeType":938},{},[],{"data":2158,"content":2159,"nodeType":948},{},[2160],{"data":2161,"marks":2162,"value":2164,"nodeType":865},{},[2163],{"type":946},"Learn more about Push",{"data":2166,"content":2167,"nodeType":866},{},[2168,2172,2179],{"data":2169,"marks":2170,"value":2171,"nodeType":865},{},[],"Push Security’s browser-based security platform stops browser-based attacks like AiTM phishing, credential stuffing, malicious browser extensions, ClickFix, and session hijacking — ",{"data":2173,"content":2174,"nodeType":1102},{"uri":152},[2175],{"data":2176,"marks":2177,"value":2178,"nodeType":865},{},[],"modern attack techniques",{"data":2180,"marks":2181,"value":2182,"nodeType":865},{},[]," that are the leading cause of breaches today.",{"data":2184,"content":2185,"nodeType":866},{},[2186],{"data":2187,"marks":2188,"value":2189,"nodeType":865},{},[],"You don’t need to wait until it all goes wrong either. You can also use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":2191,"content":2192,"nodeType":866},{},[2193,2197,2205,2209,2217,2221,2229],{"data":2194,"marks":2195,"value":2196,"nodeType":865},{},[],"Want to learn more about Push? Check out our latest ",{"data":2198,"content":2200,"nodeType":1102},{"uri":2199},"/resources/product-brochure",[2201],{"data":2202,"marks":2203,"value":2204,"nodeType":865},{},[],"product overview",{"data":2206,"marks":2207,"value":2208,"nodeType":865},{},[],", visit our ",{"data":2210,"content":2212,"nodeType":1102},{"uri":2211},"/product-demo/",[2213],{"data":2214,"marks":2215,"value":2216,"nodeType":865},{},[],"demo library",{"data":2218,"marks":2219,"value":2220,"nodeType":865},{},[],", or book some time with one of our team for a ",{"data":2222,"content":2224,"nodeType":1102},{"uri":2223},"/demo",[2225],{"data":2226,"marks":2227,"value":2228,"nodeType":865},{},[],"live demo",{"data":2230,"marks":2231,"value":1151,"nodeType":865},{},[],"document",{"entries":2234},{"inline":2235,"hyperlink":2236,"block":2300},[],[2237,2242,2246,2250,2254,2260,2265,2270,2275,2280,2285,2290,2295],{"sys":2238,"__typename":2239,"title":2240,"slug":2241},{"id":1032},"BlogPosts","Google Search malvertising campaign continues, now impersonating Ahrefs","google-search-malvertising-campaign-continues-now-impersonating-ahrefs",{"sys":2243,"__typename":2239,"title":2244,"slug":2245},{"id":1358},"Push + Network Security: The gap between seeing the packet and securing the session","push-plus-network-security",{"sys":2247,"__typename":2239,"title":2248,"slug":2249},{"id":1379},"Push + Endpoint Security: Extending detection and response to the browser","push-plus-endpoint-security",{"sys":2251,"__typename":2239,"title":2252,"slug":2253},{"id":1393},"Push + Cloud Security: What do you do when bad looks normal?","push-plus-cloud-security",{"sys":2255,"__typename":2256,"title":2257,"slug":2258,"articleId":2259},{"id":1483},"HelpArticle","Can I use Push to detect phishing tools like Evilginx, Modlishka, NakedPages, or Muraena?","can-i-use-push-to-detect-phishing-tools-like-evilnovnc-and-evilginx",10113,{"sys":2261,"__typename":2256,"title":2262,"slug":2263,"articleId":2264},{"id":1506},"How does Push detect cloned login pages?","how-does-push-detect-cloned-login-pages",10117,{"sys":2266,"__typename":2256,"title":2267,"slug":2268,"articleId":2269},{"id":1529},"How does Push detect malicious browser extensions?","how-does-push-detect-malicious-browser-extensions",10148,{"sys":2271,"__typename":2256,"title":2272,"slug":2273,"articleId":2274},{"id":1550},"How does Push detect attacks like ClickFix and FileFix?","how-does-push-detect-attacks-like-clickfix-and-filefix",10141,{"sys":2276,"__typename":2256,"title":2277,"slug":2278,"articleId":2279},{"id":1740},"How does Push protect passwords from being reused or phished?","how-does-push-detect-and-prevent-phishing-attacks",10109,{"sys":2281,"__typename":2256,"title":2282,"slug":2283,"articleId":2284},{"id":1764},"How does MFA enforcement work?","how-does-mfa-enforcement-work",10121,{"sys":2286,"__typename":2256,"title":2287,"slug":2288,"articleId":2289},{"id":1778},"How does strong password enforcement work?","how-does-strong-password-enforcement-work",10129,{"sys":2291,"__typename":2256,"title":2292,"slug":2293,"articleId":2294},{"id":1802},"What can I use the app banner for? Templates and examples","what-can-i-use-the-app-banner-for-templates-and-examples",10106,{"sys":2296,"__typename":2256,"title":2297,"slug":2298,"articleId":2299},{"id":1825},"Can Push detect and disable other installed browser extensions?","can-push-detect-other-installed-browser-extensions",10138,[2301,2339,2345,2364,2373,2398,2438,2446,2454,2462,2470,2478,2486],{"sys":2302,"__typename":2303,"content":2304,"name":2338,"title":59},{"id":903},"InsightTextBlockComponent",{"json":2305},{"nodeType":2232,"data":2306,"content":2307},{},[2308],{"nodeType":866,"data":2309,"content":2310},{},[2311,2314,2322,2326,2334],{"nodeType":865,"value":21,"marks":2312,"data":2313},[],{},{"nodeType":1102,"data":2315,"content":2317},{"uri":2316},"https://www.crowdstrike.com/explore/2026-global-threat-report?utm_medium=dir",[2318],{"nodeType":865,"value":2319,"marks":2320,"data":2321},"Crowdstrike reports",[],{},{"nodeType":865,"value":2323,"marks":2324,"data":2325}," that valid account abuse accounted for 35% of incidents in 2025, while ",[],{},{"nodeType":1102,"data":2327,"content":2329},{"uri":2328},"https://www.verizon.com/business/resources/reports/dbir/",[2330],{"nodeType":865,"value":2331,"marks":2332,"data":2333},"Verizon reports",[],{},{"nodeType":865,"value":2335,"marks":2336,"data":2337}," that identity is now the primary breach vector observed across all methods.",[],{},"Guide: Protecting Users IB 1",{"sys":2340,"__typename":2341,"title":2342,"arcadeDemoUrl":2343,"playText":2344},{"id":933},"ArcadeDemo","Custom branding for Push controls","https://demo.arcade.software/kBqjoJqArDTsUtB6HHwR?embed","2 mins",{"sys":2346,"__typename":2303,"content":2347,"name":2363,"title":59},{"id":960},{"json":2348},{"nodeType":2232,"data":2349,"content":2350},{},[2351],{"nodeType":866,"data":2352,"content":2353},{},[2354,2358],{"nodeType":865,"value":2355,"marks":2356,"data":2357},"It's harder than ever to identify malicious scenarios when browsing the web as part of your routine, daily activities — and the list of attacks to be aware of is growing every day. ",[],{},{"nodeType":865,"value":2359,"marks":2360,"data":2362},"It was hard enough to train users not to click links in emails when that was pretty much the only thing they had to watch out for.  ",[2361],{"type":946},{},"Guide: Protecting Users IB 3",{"sys":2365,"__typename":2366,"title":2367,"caption":2368,"layoutMode":59,"file":2369},{"id":966},"Image","Don't make employees the weak link image - blog - custom branding","It's harder than ever for users to identify malicious content on the web, with attackers abusing an ever-increasing list of actions that feel pretty normal to users, with a wide range of malicious payloads.",{"url":2370,"width":2371,"height":2372},"https://images.ctfassets.net/y1cdw1ablpvd/2aSm6QBWDOU6JBtOLfyp6R/d63cacab198ef9b325cbcfdbe0373b5a/Browser_Attacks_Targeting_Users__1_.png",4046,2160,{"sys":2374,"__typename":2303,"content":2375,"name":2397,"title":59},{"id":1264},{"json":2376},{"nodeType":2232,"data":2377,"content":2378},{},[2379],{"nodeType":866,"data":2380,"content":2381},{},[2382,2386,2393],{"nodeType":865,"value":2383,"marks":2384,"data":2385},"Learn more about the browser-based attack techniques driving the biggest breaches of the last year in our ",[],{},{"nodeType":1102,"data":2387,"content":2388},{"uri":152},[2389],{"nodeType":865,"value":2390,"marks":2391,"data":2392},"2026 Browser Attack Techniques",[],{},{"nodeType":865,"value":2394,"marks":2395,"data":2396}," ebook.",[],{},"Browser attack techniques ebook callout",{"sys":2399,"__typename":2303,"content":2400,"name":2437,"title":59},{"id":1407},{"json":2401},{"nodeType":2232,"data":2402,"content":2403},{},[2404],{"nodeType":866,"data":2405,"content":2406},{},[2407,2411,2421,2425,2433],{"nodeType":865,"value":2408,"marks":2409,"data":2410},"The Push research team has written extensively about how cloud-first operators like ",[],{},{"nodeType":1038,"data":2412,"content":2416},{"target":2413},{"sys":2414},{"id":2415,"type":904,"linkType":905},"2sFCww9xnI8okIxhtOaiY1",[2417],{"nodeType":865,"value":2418,"marks":2419,"data":2420},"Scattered Lapsus$ Hunters",[],{},{"nodeType":865,"value":2422,"marks":2423,"data":2424}," use a variety of methods to ",[],{},{"nodeType":1102,"data":2426,"content":2428},{"uri":2427},"https://phishing-techniques.pushsecurity.com/",[2429],{"nodeType":865,"value":2430,"marks":2431,"data":2432},"evade existing security controls",[],{},{"nodeType":865,"value":2434,"marks":2435,"data":2436},", if you’d like to dig into the details.",[],{},"Guide: Protecting Users IB 2",{"sys":2439,"__typename":2366,"title":2440,"caption":2441,"layoutMode":59,"file":2442},{"id":1607},"Sample detection - blog article - custom branding","Sample detection details in the Push admin console for a blocked phishing event",{"url":2443,"width":2444,"height":2445},"https://images.ctfassets.net/y1cdw1ablpvd/6k8qVn1iYXbBl6lcHvphIa/dd802537d883cf6ddafdd78034c3412a/sample_detection.png",1999,766,{"sys":2447,"__typename":2366,"title":2448,"caption":2449,"layoutMode":59,"file":2450},{"id":1642},"Sample ClickFix detection - blog article - custom branding","Sample screenshot captured from a malicious copy-paste attack",{"url":2451,"width":2452,"height":2453},"https://images.ctfassets.net/y1cdw1ablpvd/3xaJZGyhSbqqLZ7iyiqb40/427c9eeb7312dc1d85d57b10b2ffec11/clickfix_screenshot_example.png",947,244,{"sys":2455,"__typename":2366,"title":2456,"caption":2457,"layoutMode":59,"file":2458},{"id":1697},"Sample phishing block page - blog article - custom branding","Sample phishing block page with custom branding",{"url":2459,"width":2460,"height":2461},"https://images.ctfassets.net/y1cdw1ablpvd/2eQNuARuzPujGm1tfYxFhf/1ebce9e33cf89368d1e9ce9104382641/phishing_block_page_branded.png",1274,719,{"sys":2463,"__typename":2366,"title":2464,"caption":2465,"layoutMode":59,"file":2466},{"id":1927},"MFA enforcement banner example - blog article - custom branding","MFA enforcement banner with custom branding and dark theme option",{"url":2467,"width":2468,"height":2469},"https://images.ctfassets.net/y1cdw1ablpvd/8srMEvq3vFJQiEyIaESDw/fdff9a4f3bd0eadb5f58ff9fac4ada74/MFA_enforcement_banner_branded_sample.png",1472,756,{"sys":2471,"__typename":2366,"title":2472,"caption":2473,"layoutMode":59,"file":2474},{"id":1980},"Sample blocking banner - blog article - custom branding","Sample blocking banner",{"url":2475,"width":2476,"height":2477},"https://images.ctfassets.net/y1cdw1ablpvd/2b3bGaN3vQBXn5SL8BlbzZ/fbe21cc6e6387856e2d3a56ffb6a1e82/banner_example_branded_block.png",1304,812,{"sys":2479,"__typename":2366,"title":2480,"caption":2481,"layoutMode":59,"file":2482},{"id":2067},"Rule configuration example - blog article - custom branding","Rule configuration slideout for Phishing tool detection",{"url":2483,"width":2484,"height":2485},"https://images.ctfassets.net/y1cdw1ablpvd/2O0ptkRr7E0QPlfABl3zq9/1e2204b441b50129f543177a99c46fa6/config_rule_scope_mode_example.png",739,820,{"sys":2487,"__typename":2366,"title":2488,"caption":2489,"layoutMode":59,"file":2490},{"id":2138},"Branding settings - blog article - custom branding","Branding configuration options for banners and block pages",{"url":2491,"width":2492,"height":2493},"https://images.ctfassets.net/y1cdw1ablpvd/4EX3DqVhvOMCyNFYSBJ1rF/caabcddde02e65e363f2354aa7ab2be0/branding_settings.png",995,817,{"items":2495},[],{},"Guide: How to use Push to protect users from browser threats","guide","2026-04-08T00:00:00.000Z",{"items":2501},[],"guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks","blog/guide-how-to-use-push-controls-to-protect-your-users-from-modern-attacks",{"json":2505},{"data":2506,"content":2507,"nodeType":2232},{},[2508],{"data":2509,"content":2510,"nodeType":866},{},[2511],{"data":2512,"marks":2513,"value":2514,"nodeType":865},{},[],"If you want to protect employees working in the browser, you need to get as close to the user as possible. In this Push product guide, we’ll cover how to use in-browser controls to stop attacks before compromise can occur, and to guide users to remediate vulnerabilities — all using your custom branding to increase trust.","How to use in-browser controls to stop browser-based attacks before compromise can occur",{"id":2517,"publishedAt":2518},"wI3paLVDlEKdaRI5qMYFc","2026-08-12T11:53:00.921Z",{"items":2520},[2521,2525],{"sys":2522,"name":2524},{"id":2523},"6A5RXS31ZQx3PwryGb1IMy","Browser-based attacks",{"sys":2526,"name":342},{"id":2527},"4ksQNCFeBf8H4QIORqpRLw",{"items":2529},[2530,2532,2534,2536,2538,2540,2542,2544,2546,2548,2550,2552,2554,2556,2558,2560,2562,2564],{"sys":2531,"name":279,"slug":280,"tier":31},{"id":276},{"sys":2533,"name":297,"slug":298,"tier":31},{"id":294},{"sys":2535,"name":519,"slug":520,"tier":31},{"id":516},{"sys":2537,"name":342,"slug":343,"tier":31},{"id":339},{"sys":2539,"name":413,"slug":414,"tier":31},{"id":410},{"sys":2541,"name":261,"slug":262,"tier":45},{"id":258},{"sys":2543,"name":315,"slug":316,"tier":45},{"id":312},{"sys":2545,"name":324,"slug":325,"tier":45},{"id":321},{"sys":2547,"name":457,"slug":458,"tier":45},{"id":454},{"sys":2549,"name":466,"slug":467,"tier":45},{"id":463},{"sys":2551,"name":502,"slug":503,"tier":45},{"id":499},{"sys":2553,"name":288,"slug":289,"tier":45},{"id":285},{"sys":2555,"name":607,"slug":608,"tier":45},{"id":604},{"sys":2557,"name":448,"slug":449,"tier":45},{"id":445},{"sys":2559,"name":589,"slug":590,"tier":45},{"id":586},{"sys":2561,"name":580,"slug":581,"tier":45},{"id":577},{"sys":2563,"name":351,"slug":352,"tier":45},{"id":348},{"sys":2565,"name":598,"slug":599,"tier":45},{"id":595},"r6A4hwgdXf1AftoB3nqlkUp1HAEfQHUQeYO8ACKCPuA",{"id":2568,"title":2569,"authorsCollection":2570,"content":2578,"extension":228,"faqItemsCollection":3351,"faqTitle":59,"featured":6,"hashTags":59,"meta":3353,"metaTitle":3354,"ogImage":59,"postType":3355,"publishedDate":3356,"relatedBlogPostsCollection":3357,"slug":4405,"stem":4406,"subtitle":59,"summary":4407,"synopsis":4418,"sys":4419,"tagsCollection":4422,"topicsCollection":4426,"__hash__":4436},"blog/blog/product-release-november-2025.json","Product release: November 2025",{"items":2571},[2572],{"fullName":2573,"firstName":2574,"jobTitle":2575,"socialLinks":59,"profilePicture":2576},"Andy Waugh","Andy","VP Product",{"url":2577},"https://images.ctfassets.net/y1cdw1ablpvd/3Rf76rJn6S9inMb4dUnAIJ/0a787f8141d05b95300e2fe77c4493fa/DSC_6868.jpg",{"json":2579,"links":3286},{"data":2580,"content":2581,"nodeType":2232},{},[2582,2589,2662,2668,2675,2700,2724,2757,2763,2781,2787,2794,2801,2834,2840,2858,2864,2880,2887,2911,2918,2925,2948,2964,2970,2976,2983,2999,3006,3059,3066,3072,3090,3096,3111,3118,3141,3163,3169,3176,3280],{"data":2583,"content":2584,"nodeType":948},{},[2585],{"data":2586,"marks":2587,"value":2588,"nodeType":865},{},[],"What's new this month:",{"data":2590,"content":2591,"nodeType":891},{},[2592,2602,2612,2622,2632,2642,2652],{"data":2593,"content":2594,"nodeType":880},{},[2595],{"data":2596,"content":2597,"nodeType":866},{},[2598],{"data":2599,"marks":2600,"value":2601,"nodeType":865},{},[],"Get visibility for all installed browser extensions in your environment",{"data":2603,"content":2604,"nodeType":880},{},[2605],{"data":2606,"content":2607,"nodeType":866},{},[2608],{"data":2609,"marks":2610,"value":2611,"nodeType":865},{},[],"New detection for ClickFix-style malicious copy-paste attacks",{"data":2613,"content":2614,"nodeType":880},{},[2615],{"data":2616,"content":2617,"nodeType":866},{},[2618],{"data":2619,"marks":2620,"value":2621,"nodeType":865},{},[],"New Labs feature: Experimental detections",{"data":2623,"content":2624,"nodeType":880},{},[2625],{"data":2626,"content":2627,"nodeType":866},{},[2628],{"data":2629,"marks":2630,"value":2631,"nodeType":865},{},[],"RBAC for the Push admin console",{"data":2633,"content":2634,"nodeType":880},{},[2635],{"data":2636,"content":2637,"nodeType":866},{},[2638],{"data":2639,"marks":2640,"value":2641,"nodeType":865},{},[],"URLscan.io and domain registration enrichment for detections",{"data":2643,"content":2644,"nodeType":880},{},[2645],{"data":2646,"content":2647,"nodeType":866},{},[2648],{"data":2649,"marks":2650,"value":2651,"nodeType":865},{},[],"Filter events by entities",{"data":2653,"content":2654,"nodeType":880},{},[2655],{"data":2656,"content":2657,"nodeType":866},{},[2658],{"data":2659,"marks":2660,"value":2661,"nodeType":865},{},[],"And a few other things … ",{"data":2663,"content":2664,"nodeType":948},{},[2665],{"data":2666,"marks":2667,"value":2601,"nodeType":865},{},[],{"data":2669,"content":2670,"nodeType":866},{},[2671],{"data":2672,"marks":2673,"value":2674,"nodeType":865},{},[],"You can now use Push to see other browser extensions installed on your employees’ browsers.",{"data":2676,"content":2677,"nodeType":866},{},[2678,2682,2687,2691,2696],{"data":2679,"marks":2680,"value":2681,"nodeType":865},{},[],"You can enable this feature by going to ",{"data":2683,"marks":2684,"value":2686,"nodeType":865},{},[2685],{"type":946},"Settings > Organization",{"data":2688,"marks":2689,"value":2690,"nodeType":865},{},[]," in the Push admin console and toggling on ",{"data":2692,"marks":2693,"value":2695,"nodeType":865},{},[2694],{"type":946},"Browser extension visibility",{"data":2697,"marks":2698,"value":2699,"nodeType":865},{},[],". There is no end-user impact when you enable this feature.",{"data":2701,"content":2702,"nodeType":866},{},[2703,2707,2711,2715,2720],{"data":2704,"marks":2705,"value":2706,"nodeType":865},{},[],"You’ll see browser extension data populate a new ",{"data":2708,"marks":2709,"value":288,"nodeType":865},{},[2710],{"type":946},{"data":2712,"marks":2713,"value":2714,"nodeType":865},{},[]," page in the admin console under ",{"data":2716,"marks":2717,"value":2719,"nodeType":865},{},[2718],{"type":946},"Investigate",{"data":2721,"marks":2722,"value":2723,"nodeType":865},{},[],". With this information, you can see:",{"data":2725,"content":2726,"nodeType":891},{},[2727,2737,2747],{"data":2728,"content":2729,"nodeType":880},{},[2730],{"data":2731,"content":2732,"nodeType":866},{},[2733],{"data":2734,"marks":2735,"value":2736,"nodeType":865},{},[],"Which extensions have been installed for each employee and browser.",{"data":2738,"content":2739,"nodeType":880},{},[2740],{"data":2741,"content":2742,"nodeType":866},{},[2743],{"data":2744,"marks":2745,"value":2746,"nodeType":865},{},[],"How they were installed (e.g. by policy, manually, or sideloaded).",{"data":2748,"content":2749,"nodeType":880},{},[2750],{"data":2751,"content":2752,"nodeType":866},{},[2753],{"data":2754,"marks":2755,"value":2756,"nodeType":865},{},[],"Which permissions they have.",{"data":2758,"content":2762,"nodeType":907},{"target":2759},{"sys":2760},{"id":2761,"type":904,"linkType":905},"5J5jdmwugy7yU8GGwxe7iH",[],{"data":2764,"content":2765,"nodeType":866},{},[2766,2769,2778],{"data":2767,"marks":2768,"value":21,"nodeType":865},{},[],{"data":2770,"content":2773,"nodeType":1038},{"target":2771},{"sys":2772},{"id":1825,"type":904,"linkType":905},[2774],{"data":2775,"marks":2776,"value":2777,"nodeType":865},{},[],"Learn more",{"data":2779,"marks":2780,"value":21,"nodeType":865},{},[],{"data":2782,"content":2783,"nodeType":948},{},[2784],{"data":2785,"marks":2786,"value":2611,"nodeType":865},{},[],{"data":2788,"content":2789,"nodeType":866},{},[2790],{"data":2791,"marks":2792,"value":2793,"nodeType":865},{},[],"Push can now detect malicious copy and paste attacks like ClickFix, FileFix, and other fake CAPTCHA-style techniques.",{"data":2795,"content":2796,"nodeType":866},{},[2797],{"data":2798,"marks":2799,"value":2800,"nodeType":865},{},[],"These techniques have become one of the most prevalent attack types this year, and rely on deceiving users into manually or automatically copying malicious code and running it locally.",{"data":2802,"content":2803,"nodeType":866},{},[2804,2808,2813,2817,2822,2826,2830],{"data":2805,"marks":2806,"value":2807,"nodeType":865},{},[],"You can enable ",{"data":2809,"marks":2810,"value":2812,"nodeType":865},{},[2811],{"type":946},"Malicious copy and paste detection",{"data":2814,"marks":2815,"value":2816,"nodeType":865},{},[]," from the ",{"data":2818,"marks":2819,"value":2821,"nodeType":865},{},[2820],{"type":946},"Controls",{"data":2823,"marks":2824,"value":2825,"nodeType":865},{},[]," page of the Push admin console. Add a configuration rule to set the detection to ",{"data":2827,"marks":2828,"value":2041,"nodeType":865},{},[2829],{"type":946},{"data":2831,"marks":2832,"value":2833,"nodeType":865},{},[],". You can also add an exception for any staff who routinely handle malicious scripts, such as security team members, or add domains to the ignore list as needed.",{"data":2835,"content":2839,"nodeType":907},{"target":2836},{"sys":2837},{"id":2838,"type":904,"linkType":905},"2fPaiwRCAUd8lMvsVO03HZ",[],{"data":2841,"content":2842,"nodeType":866},{},[2843,2846,2855],{"data":2844,"marks":2845,"value":21,"nodeType":865},{},[],{"data":2847,"content":2851,"nodeType":1038},{"target":2848},{"sys":2849},{"id":2850,"type":904,"linkType":905},"1u8RJxC00HbBhCBVxcDnkK",[2852],{"data":2853,"marks":2854,"value":2777,"nodeType":865},{},[],{"data":2856,"marks":2857,"value":21,"nodeType":865},{},[],{"data":2859,"content":2860,"nodeType":948},{},[2861],{"data":2862,"marks":2863,"value":2621,"nodeType":865},{},[],{"data":2865,"content":2866,"nodeType":866},{},[2867,2871,2876],{"data":2868,"marks":2869,"value":2870,"nodeType":865},{},[],"Get early access to new detections from the Push research team by enabling ",{"data":2872,"marks":2873,"value":2875,"nodeType":865},{},[2874],{"type":946},"Experimental detections",{"data":2877,"marks":2878,"value":2879,"nodeType":865},{},[],", a Labs feature.",{"data":2881,"content":2882,"nodeType":866},{},[2883],{"data":2884,"marks":2885,"value":2886,"nodeType":865},{},[],"Labs features are new features Push is testing before releasing them. Early access detections are designed to catch emerging attacker techniques, but may also produce more false positives while we finetune them. These early access detections do not block any user actions.",{"data":2888,"content":2889,"nodeType":866},{},[2890,2894,2898,2902,2907],{"data":2891,"marks":2892,"value":2893,"nodeType":865},{},[],"Enable ",{"data":2895,"marks":2896,"value":2875,"nodeType":865},{},[2897],{"type":946},{"data":2899,"marks":2900,"value":2901,"nodeType":865},{},[]," by going to ",{"data":2903,"marks":2904,"value":2906,"nodeType":865},{},[2905],{"type":946},"Settings > Labs",{"data":2908,"marks":2909,"value":2910,"nodeType":865},{},[]," in the admin console.",{"data":2912,"content":2913,"nodeType":948},{},[2914],{"data":2915,"marks":2916,"value":2917,"nodeType":865},{},[],"RBAC for the Push platform",{"data":2919,"content":2920,"nodeType":866},{},[2921],{"data":2922,"marks":2923,"value":2924,"nodeType":865},{},[],"You can now provide read-only access to the Push admin console to facilitate investigations, review detections, check app usage by department, help with employee offboarding — or anything else you need.",{"data":2926,"content":2927,"nodeType":866},{},[2928,2932,2936,2940,2945],{"data":2929,"marks":2930,"value":2931,"nodeType":865},{},[],"To add a read-only admin, go to ",{"data":2933,"marks":2934,"value":2686,"nodeType":865},{},[2935],{"type":946},{"data":2937,"marks":2938,"value":2939,"nodeType":865},{},[]," in the admin console. Enter the email address of the admin you want to invite and set the role to ",{"data":2941,"marks":2942,"value":2944,"nodeType":865},{},[2943],{"type":946},"Read only",{"data":2946,"marks":2947,"value":1151,"nodeType":865},{},[],{"data":2949,"content":2950,"nodeType":866},{},[2951,2955,2960],{"data":2952,"marks":2953,"value":2954,"nodeType":865},{},[],"Note that existing Push admins now have the role of ",{"data":2956,"marks":2957,"value":2959,"nodeType":865},{},[2958],{"type":946},"Full access",{"data":2961,"marks":2962,"value":2963,"nodeType":865},{},[],". You can adjust that role as needed from the Organization page, too.",{"data":2965,"content":2969,"nodeType":907},{"target":2966},{"sys":2967},{"id":2968,"type":904,"linkType":905},"7kraCfSP2YwdEEwZ8FxM1t",[],{"data":2971,"content":2972,"nodeType":948},{},[2973],{"data":2974,"marks":2975,"value":2641,"nodeType":865},{},[],{"data":2977,"content":2978,"nodeType":866},{},[2979],{"data":2980,"marks":2981,"value":2982,"nodeType":865},{},[],"You can now enrich detections in Push with information from urlscan.io, and see when the domain was first registered. This information gives you domain-relevant context to support investigations.",{"data":2984,"content":2985,"nodeType":866},{},[2986,2990,2995],{"data":2987,"marks":2988,"value":2989,"nodeType":865},{},[],"To enable this feature, go to ",{"data":2991,"marks":2992,"value":2994,"nodeType":865},{},[2993],{"type":946},"Settings > Advanced > Domain enrichment",{"data":2996,"marks":2997,"value":2998,"nodeType":865},{},[]," in the Push admin console or enable it from any existing detection event.",{"data":3000,"content":3001,"nodeType":866},{},[3002],{"data":3003,"marks":3004,"value":3005,"nodeType":865},{},[],"With this enrichment, you can quickly see:",{"data":3007,"content":3008,"nodeType":891},{},[3009,3019,3029,3039,3049],{"data":3010,"content":3011,"nodeType":880},{},[3012],{"data":3013,"content":3014,"nodeType":866},{},[3015],{"data":3016,"marks":3017,"value":3018,"nodeType":865},{},[],"The timestamp for when a domain was first registered",{"data":3020,"content":3021,"nodeType":880},{},[3022],{"data":3023,"content":3024,"nodeType":866},{},[3025],{"data":3026,"marks":3027,"value":3028,"nodeType":865},{},[],"The number of times a domain was scanned on urlscan",{"data":3030,"content":3031,"nodeType":880},{},[3032],{"data":3033,"content":3034,"nodeType":866},{},[3035],{"data":3036,"marks":3037,"value":3038,"nodeType":865},{},[],"The first time a domain was scanned",{"data":3040,"content":3041,"nodeType":880},{},[3042],{"data":3043,"content":3044,"nodeType":866},{},[3045],{"data":3046,"marks":3047,"value":3048,"nodeType":865},{},[],"The last time a domain or IP was scanned",{"data":3050,"content":3051,"nodeType":880},{},[3052],{"data":3053,"content":3054,"nodeType":866},{},[3055],{"data":3056,"marks":3057,"value":3058,"nodeType":865},{},[],"A urlscan verdict (e.g. “potentially malicious”)",{"data":3060,"content":3061,"nodeType":866},{},[3062],{"data":3063,"marks":3064,"value":3065,"nodeType":865},{},[],"You’ll see the enrichment data on the details slideout for an individual detection.",{"data":3067,"content":3071,"nodeType":907},{"target":3068},{"sys":3069},{"id":3070,"type":904,"linkType":905},"563fJFSgoLDOwSXSQ9Y0MM",[],{"data":3073,"content":3074,"nodeType":866},{},[3075,3078,3087],{"data":3076,"marks":3077,"value":21,"nodeType":865},{},[],{"data":3079,"content":3083,"nodeType":1038},{"target":3080},{"sys":3081},{"id":3082,"type":904,"linkType":905},"19qsIXEG6EN9EK0VRH3pw9",[3084],{"data":3085,"marks":3086,"value":2777,"nodeType":865},{},[],{"data":3088,"marks":3089,"value":21,"nodeType":865},{},[],{"data":3091,"content":3092,"nodeType":948},{},[3093],{"data":3094,"marks":3095,"value":2651,"nodeType":865},{},[],{"data":3097,"content":3098,"nodeType":866},{},[3099,3103,3107],{"data":3100,"marks":3101,"value":3102,"nodeType":865},{},[],"You can now filter the ",{"data":3104,"marks":3105,"value":2058,"nodeType":865},{},[3106],{"type":946},{"data":3108,"marks":3109,"value":3110,"nodeType":865},{},[]," page in the Push admin console by entities such as employees and apps to make triage more efficient.",{"data":3112,"content":3113,"nodeType":866},{},[3114],{"data":3115,"marks":3116,"value":3117,"nodeType":865},{},[],"With this option, you can do quick searches such as:",{"data":3119,"content":3120,"nodeType":891},{},[3121,3131],{"data":3122,"content":3123,"nodeType":880},{},[3124],{"data":3125,"content":3126,"nodeType":866},{},[3127],{"data":3128,"marks":3129,"value":3130,"nodeType":865},{},[],"See all recent events associated with an employee",{"data":3132,"content":3133,"nodeType":880},{},[3134],{"data":3135,"content":3136,"nodeType":866},{},[3137],{"data":3138,"marks":3139,"value":3140,"nodeType":865},{},[],"See all recent logins for a given app",{"data":3142,"content":3143,"nodeType":866},{},[3144,3147,3151,3155,3160],{"data":3145,"marks":3146,"value":2124,"nodeType":865},{},[],{"data":3148,"marks":3149,"value":2058,"nodeType":865},{},[3150],{"type":946},{"data":3152,"marks":3153,"value":3154,"nodeType":865},{},[]," page, go to ",{"data":3156,"marks":3157,"value":3159,"nodeType":865},{},[3158],{"type":946},"Filters > Entity type",{"data":3161,"marks":3162,"value":1151,"nodeType":865},{},[],{"data":3164,"content":3165,"nodeType":948},{},[3166],{"data":3167,"marks":3168,"value":2661,"nodeType":865},{},[],{"data":3170,"content":3171,"nodeType":866},{},[3172],{"data":3173,"marks":3174,"value":3175,"nodeType":865},{},[],"Other new features or improvements to the platform include:",{"data":3177,"content":3178,"nodeType":891},{},[3179,3216,3238,3248,3270],{"data":3180,"content":3181,"nodeType":880},{},[3182],{"data":3183,"content":3184,"nodeType":866},{},[3185,3189,3199,3202,3212],{"data":3186,"marks":3187,"value":3188,"nodeType":865},{},[],"You can now configure exceptions for ",{"data":3190,"content":3194,"nodeType":1038},{"target":3191},{"sys":3192},{"id":3193,"type":904,"linkType":905},"4oOTN6FXPpZg9MLgQUujys",[3195],{"data":3196,"marks":3197,"value":3198,"nodeType":865},{},[],"MFA findings",{"data":3200,"marks":3201,"value":1913,"nodeType":865},{},[],{"data":3203,"content":3207,"nodeType":1038},{"target":3204},{"sys":3205},{"id":3206,"type":904,"linkType":905},"2eOzRGosD2Ghaipao7NY8W",[3208],{"data":3209,"marks":3210,"value":3211,"nodeType":865},{},[],"reused password",{"data":3213,"marks":3214,"value":3215,"nodeType":865},{},[]," findings. This is useful if you purposefully reuse passwords between systems or enforce MFA through a third-party provider.",{"data":3217,"content":3218,"nodeType":880},{},[3219],{"data":3220,"content":3221,"nodeType":866},{},[3222,3226,3235],{"data":3223,"marks":3224,"value":3225,"nodeType":865},{},[],"We’ve added several first-class SIEM integrations. ",{"data":3227,"content":3231,"nodeType":1038},{"target":3228},{"sys":3229},{"id":3230,"type":904,"linkType":905},"2M73i6A90S9MY6Pe8uVjVv",[3232],{"data":3233,"marks":3234,"value":2777,"nodeType":865},{},[],{"data":3236,"marks":3237,"value":1151,"nodeType":865},{},[],{"data":3239,"content":3240,"nodeType":880},{},[3241],{"data":3242,"content":3243,"nodeType":866},{},[3244],{"data":3245,"marks":3246,"value":3247,"nodeType":865},{},[],"We’ve expanded the limit for URLs you can block using the URL blocking control to 2,000.",{"data":3249,"content":3250,"nodeType":880},{},[3251],{"data":3252,"content":3253,"nodeType":866},{},[3254,3258,3267],{"data":3255,"marks":3256,"value":3257,"nodeType":865},{},[],"You can now set a time period after which to automatically un-license inactive employees, to make license management easier. ",{"data":3259,"content":3263,"nodeType":1038},{"target":3260},{"sys":3261},{"id":3262,"type":904,"linkType":905},"6Ad43w7Cjz2L5fZN2klIOn",[3264],{"data":3265,"marks":3266,"value":2777,"nodeType":865},{},[],{"data":3268,"marks":3269,"value":1151,"nodeType":865},{},[],{"data":3271,"content":3272,"nodeType":880},{},[3273],{"data":3274,"content":3275,"nodeType":866},{},[3276],{"data":3277,"marks":3278,"value":3279,"nodeType":865},{},[],"Push now supports Prisma Access browser.\n",{"data":3281,"content":3282,"nodeType":866},{},[3283],{"data":3284,"marks":3285,"value":21,"nodeType":865},{},[],{"entries":3287},{"inline":3288,"hyperlink":3289,"block":3322},[],[3290,3292,3296,3301,3306,3311,3317],{"sys":3291,"__typename":2256,"title":2297,"slug":2298,"articleId":2299},{"id":1825},{"sys":3293,"__typename":2239,"title":3294,"slug":3295},{"id":2850},"Introducing malicious copy and paste detection","introducing-malicious-copy-paste-detection",{"sys":3297,"__typename":2256,"title":3298,"slug":3299,"articleId":3300},{"id":3082},"How does Push enrich detections with domain analysis data?","how-does-push-enrich-detections-with-domain-analysis-data",10136,{"sys":3302,"__typename":2256,"title":3303,"slug":3304,"articleId":3305},{"id":3193},"How do I create an exception for MFA findings?","how-do-i-create-an-exception-for-mfa-findings",10140,{"sys":3307,"__typename":2256,"title":3308,"slug":3309,"articleId":3310},{"id":3206},"How do I create an exception for reused password findings?","how-do-i-create-an-exception-for-reused-password-findings",10139,{"sys":3312,"__typename":3313,"linkedFromParent":59,"title":3314,"slug":3315,"audience":3316},{"id":3230},"DocumentationPage","Connect to SIEM or SOAR","connect-to-siem-or-soar","administrators",{"sys":3318,"__typename":2256,"title":3319,"slug":3320,"articleId":3321},{"id":3262},"Can I automatically remove licenses from inactive employees?","can-i-automatically-remove-licenses-from-inactive-employees",10143,[3323,3330,3337,3344],{"sys":3324,"__typename":2366,"title":3325,"caption":59,"layoutMode":59,"file":3326},{"id":2761},"Extension enumeration - KB 10138",{"url":3327,"width":3328,"height":3329},"https://images.ctfassets.net/y1cdw1ablpvd/1dByBmqYgpC9KhPkZoUbGN/0d65ee5ce5abceed6e8538319d83d761/extension_data_table_20251216.png",1480,826,{"sys":3331,"__typename":2366,"title":3332,"caption":59,"layoutMode":59,"file":3333},{"id":2838},"Clickfix detection example - KB 10141",{"url":3334,"width":3335,"height":3336},"https://images.ctfassets.net/y1cdw1ablpvd/5oWnKQFQqPdcsh93DCXji0/14d90366c354312349e5a664e2a0821a/clickfix_example_detection_20251009.png",1940,1696,{"sys":3338,"__typename":2366,"title":3339,"caption":59,"layoutMode":59,"file":3340},{"id":2968},"My team - Settings - docs - Administering Push",{"url":3341,"width":3342,"height":3343},"https://images.ctfassets.net/y1cdw1ablpvd/6TN6jkKngLWXBSe80jte2k/05a740c839e8eae4989622f4c9c2198b/org_page_settings_20250929.png",1980,1232,{"sys":3345,"__typename":2366,"title":3346,"caption":59,"layoutMode":59,"file":3347},{"id":3070},"Detection details slideout w/ timeline etc. - KB 10136",{"url":3348,"width":3349,"height":3350},"https://images.ctfassets.net/y1cdw1ablpvd/6qMAmnkXcJpsp19n7YANTV/b89b76929cc68387121c60ee3c48b0f2/detection_enrichment_example.png",977,758,{"items":3352},[],{},"Push Security new product features for November 2025","release-notes","2025-11-04T00:00:00.000Z",{"items":3358},[3359,3920],{"__typename":2239,"sys":3360,"content":3362,"title":3906,"synopsis":3907,"hashTags":59,"publishedDate":3908,"slug":3909,"tagsCollection":3910,"authorsCollection":3916},{"id":3361},"5QZCp0CTUoF0V7yZ8WnQrr",{"json":3363},{"data":3364,"content":3365,"nodeType":2232},{},[3366,3373,3446,3452,3468,3516,3558,3564,3582,3588,3610,3638,3644,3661,3667,3674,3681,3705,3723,3730,3746,3753,3798,3804,3810,3817,3833,3851,3858,3865,3888],{"data":3367,"content":3368,"nodeType":948},{},[3369],{"data":3370,"marks":3371,"value":3372,"nodeType":865},{},[],"What’s new this month:",{"data":3374,"content":3375,"nodeType":891},{},[3376,3386,3396,3406,3416,3426,3436],{"data":3377,"content":3378,"nodeType":880},{},[3379],{"data":3380,"content":3381,"nodeType":866},{},[3382],{"data":3383,"marks":3384,"value":3385,"nodeType":865},{},[],"Attack timeline, screenshots & classifications for Detections",{"data":3387,"content":3388,"nodeType":880},{},[3389],{"data":3390,"content":3391,"nodeType":866},{},[3392],{"data":3393,"marks":3394,"value":3395,"nodeType":865},{},[],"Block cloned login pages",{"data":3397,"content":3398,"nodeType":880},{},[3399],{"data":3400,"content":3401,"nodeType":866},{},[3402],{"data":3403,"marks":3404,"value":3405,"nodeType":865},{},[],"Block URL schema obfuscation",{"data":3407,"content":3408,"nodeType":880},{},[3409],{"data":3410,"content":3411,"nodeType":866},{},[3412],{"data":3413,"marks":3414,"value":3415,"nodeType":865},{},[],"Identify browsers synced to personal profiles",{"data":3417,"content":3418,"nodeType":880},{},[3419],{"data":3420,"content":3421,"nodeType":866},{},[3422],{"data":3423,"marks":3424,"value":3425,"nodeType":865},{},[],"Enhanced dashboard",{"data":3427,"content":3428,"nodeType":880},{},[3429],{"data":3430,"content":3431,"nodeType":866},{},[3432],{"data":3433,"marks":3434,"value":3435,"nodeType":865},{},[],"Configure a custom data retention period",{"data":3437,"content":3438,"nodeType":880},{},[3439],{"data":3440,"content":3441,"nodeType":866},{},[3442],{"data":3443,"marks":3444,"value":3445,"nodeType":865},{},[],"Debug logs for SIEM & webhooks integrations",{"data":3447,"content":3448,"nodeType":948},{},[3449],{"data":3450,"marks":3451,"value":3385,"nodeType":865},{},[],{"data":3453,"content":3454,"nodeType":866},{},[3455,3459,3464],{"data":3456,"marks":3457,"value":3458,"nodeType":865},{},[],"You can now get deeper context and telemetry to investigate attacks that Push intercepts in the browser using these recently released enrichments for Push’s ",{"data":3460,"marks":3461,"value":3463,"nodeType":865},{},[3462],{"type":946},"Detections",{"data":3465,"marks":3466,"value":3467,"nodeType":865},{},[],":",{"data":3469,"content":3470,"nodeType":891},{},[3471,3486,3501],{"data":3472,"content":3473,"nodeType":880},{},[3474],{"data":3475,"content":3476,"nodeType":866},{},[3477,3482],{"data":3478,"marks":3479,"value":3481,"nodeType":865},{},[3480],{"type":946},"Timeline:",{"data":3483,"marks":3484,"value":3485,"nodeType":865},{},[]," An attack timeline of where a phishing link originated, how a user interacted with the page, and how Push responded.",{"data":3487,"content":3488,"nodeType":880},{},[3489],{"data":3490,"content":3491,"nodeType":866},{},[3492,3497],{"data":3493,"marks":3494,"value":3496,"nodeType":865},{},[3495],{"type":946},"Screenshots:",{"data":3498,"marks":3499,"value":3500,"nodeType":865},{},[]," Optional screenshots of the suspicious page, to quickly triage detections.",{"data":3502,"content":3503,"nodeType":880},{},[3504],{"data":3505,"content":3506,"nodeType":866},{},[3507,3512],{"data":3508,"marks":3509,"value":3511,"nodeType":865},{},[3510],{"type":946},"Blast radius:",{"data":3513,"marks":3514,"value":3515,"nodeType":865},{},[]," A view of the impact of this attack and whether other apps are also compromised or at risk as a result.",{"data":3517,"content":3518,"nodeType":866},{},[3519,3523,3528,3532,3537,3541,3546,3550,3555],{"data":3520,"marks":3521,"value":3522,"nodeType":865},{},[],"You can also now classify a detection to record the outcome of your investigation. Options include: ",{"data":3524,"marks":3525,"value":3527,"nodeType":865},{},[3526],{"type":946},"true positive",{"data":3529,"marks":3530,"value":3531,"nodeType":865},{},[],", ",{"data":3533,"marks":3534,"value":3536,"nodeType":865},{},[3535],{"type":946},"benign true positive",{"data":3538,"marks":3539,"value":3540,"nodeType":865},{},[]," (such as a detection triggered by a phishing simulation exercise), and ",{"data":3542,"marks":3543,"value":3545,"nodeType":865},{},[3544],{"type":946},"false positive",{"data":3547,"marks":3548,"value":3549,"nodeType":865},{},[],". The default state is ",{"data":3551,"marks":3552,"value":3554,"nodeType":865},{},[3553],{"type":946},"not classified",{"data":3556,"marks":3557,"value":1151,"nodeType":865},{},[],{"data":3559,"content":3563,"nodeType":907},{"target":3560},{"sys":3561},{"id":3562,"type":904,"linkType":905},"2IMRHDY5ShjsquyaW7hB5M",[],{"data":3565,"content":3566,"nodeType":866},{},[3567,3570,3579],{"data":3568,"marks":3569,"value":21,"nodeType":865},{},[],{"data":3571,"content":3575,"nodeType":1038},{"target":3572},{"sys":3573},{"id":3574,"type":904,"linkType":905},"6OFdfAsoPUECeRAetWvedp",[3576],{"data":3577,"marks":3578,"value":2777,"nodeType":865},{},[],{"data":3580,"marks":3581,"value":21,"nodeType":865},{},[],{"data":3583,"content":3584,"nodeType":948},{},[3585],{"data":3586,"marks":3587,"value":3395,"nodeType":865},{},[],{"data":3589,"content":3590,"nodeType":866},{},[3591,3595,3599,3602,3606],{"data":3592,"marks":3593,"value":3594,"nodeType":865},{},[],"You can now ",{"data":3596,"marks":3597,"value":2080,"nodeType":865},{},[3598],{"type":946},{"data":3600,"marks":3601,"value":1773,"nodeType":865},{},[],{"data":3603,"marks":3604,"value":2088,"nodeType":865},{},[3605],{"type":946},{"data":3607,"marks":3608,"value":3609,"nodeType":865},{},[]," employees when Push detects that they’re visiting a cloned login page.",{"data":3611,"content":3612,"nodeType":866},{},[3613,3618,3622,3626,3630,3634],{"data":3614,"marks":3615,"value":3617,"nodeType":865},{},[3616],{"type":946},"Cloned login page detection",{"data":3619,"marks":3620,"value":3621,"nodeType":865},{},[],", which you can configure on the ",{"data":3623,"marks":3624,"value":2821,"nodeType":865},{},[3625],{"type":946},{"data":3627,"marks":3628,"value":3629,"nodeType":865},{},[]," page of the Push admin console, has become a highly effective and low false-positive control. We recommend that you move to using ",{"data":3631,"marks":3632,"value":2088,"nodeType":865},{},[3633],{"type":946},{"data":3635,"marks":3636,"value":3637,"nodeType":865},{},[]," mode for your organization — if you’re not already!",{"data":3639,"content":3643,"nodeType":907},{"target":3640},{"sys":3641},{"id":3642,"type":904,"linkType":905},"4auXExHqaYtu44zTFGh47s",[],{"data":3645,"content":3646,"nodeType":866},{},[3647,3650,3658],{"data":3648,"marks":3649,"value":21,"nodeType":865},{},[],{"data":3651,"content":3654,"nodeType":1038},{"target":3652},{"sys":3653},{"id":1506,"type":904,"linkType":905},[3655],{"data":3656,"marks":3657,"value":2777,"nodeType":865},{},[],{"data":3659,"marks":3660,"value":21,"nodeType":865},{},[],{"data":3662,"content":3663,"nodeType":948},{},[3664],{"data":3665,"marks":3666,"value":3415,"nodeType":865},{},[],{"data":3668,"content":3669,"nodeType":866},{},[3670],{"data":3671,"marks":3672,"value":3673,"nodeType":865},{},[],"The Push browser extension can now identify the email address that’s used to log in to a browser, as well as whether browser sync is enabled.",{"data":3675,"content":3676,"nodeType":866},{},[3677],{"data":3678,"marks":3679,"value":3680,"nodeType":865},{},[],"Using this data, you can see whether any employees are signed in to work browsers with non-company identities and syncing their browsers, which can result in work credentials being synced to personal profiles. ",{"data":3682,"content":3683,"nodeType":866},{},[3684,3688,3693,3697,3701],{"data":3685,"marks":3686,"value":3687,"nodeType":865},{},[],"To find this data, go to the Push admin console and view the ",{"data":3689,"marks":3690,"value":3692,"nodeType":865},{},[3691],{"type":946},"Browsers",{"data":3694,"marks":3695,"value":3696,"nodeType":865},{},[]," page under ",{"data":3698,"marks":3699,"value":2719,"nodeType":865},{},[3700],{"type":946},{"data":3702,"marks":3703,"value":3704,"nodeType":865},{},[]," in the left toolbar.",{"data":3706,"content":3707,"nodeType":866},{},[3708,3711,3720],{"data":3709,"marks":3710,"value":21,"nodeType":865},{},[],{"data":3712,"content":3716,"nodeType":1038},{"target":3713},{"sys":3714},{"id":3715,"type":904,"linkType":905},"2IS6Dbz1fnJZrDfrMSTFQd",[3717],{"data":3718,"marks":3719,"value":2777,"nodeType":865},{},[],{"data":3721,"marks":3722,"value":21,"nodeType":865},{},[],{"data":3724,"content":3725,"nodeType":948},{},[3726],{"data":3727,"marks":3728,"value":3729,"nodeType":865},{},[],"Enhanced dashboard for easier monitoring",{"data":3731,"content":3732,"nodeType":866},{},[3733,3737,3742],{"data":3734,"marks":3735,"value":3736,"nodeType":865},{},[],"We’ve improved the data and design of the Push admin console ",{"data":3738,"marks":3739,"value":3741,"nodeType":865},{},[3740],{"type":946},"Dashboard",{"data":3743,"marks":3744,"value":3745,"nodeType":865},{},[]," so you can keep track of the important developments in your environment.",{"data":3747,"content":3748,"nodeType":866},{},[3749],{"data":3750,"marks":3751,"value":3752,"nodeType":865},{},[],"A few of the changes:",{"data":3754,"content":3755,"nodeType":891},{},[3756,3774,3788],{"data":3757,"content":3758,"nodeType":880},{},[3759],{"data":3760,"content":3761,"nodeType":866},{},[3762,3766,3770],{"data":3763,"marks":3764,"value":3765,"nodeType":865},{},[],"A snapshot of recent ",{"data":3767,"marks":3768,"value":3463,"nodeType":865},{},[3769],{"type":946},{"data":3771,"marks":3772,"value":3773,"nodeType":865},{},[]," activity",{"data":3775,"content":3776,"nodeType":880},{},[3777],{"data":3778,"content":3779,"nodeType":866},{},[3780,3784],{"data":3781,"marks":3782,"value":3783,"nodeType":865},{},[],"An overview of all events on the platform, including activity related to ",{"data":3785,"marks":3786,"value":2821,"nodeType":865},{},[3787],{"type":946},{"data":3789,"content":3790,"nodeType":880},{},[3791],{"data":3792,"content":3793,"nodeType":866},{},[3794],{"data":3795,"marks":3796,"value":3797,"nodeType":865},{},[],"Performance improvements so the page load is fast for even very large deployments",{"data":3799,"content":3803,"nodeType":907},{"target":3800},{"sys":3801},{"id":3802,"type":904,"linkType":905},"4kqqwOPsN7VhLeQdrV15bH",[],{"data":3805,"content":3806,"nodeType":948},{},[3807],{"data":3808,"marks":3809,"value":3435,"nodeType":865},{},[],{"data":3811,"content":3812,"nodeType":866},{},[3813],{"data":3814,"marks":3815,"value":3816,"nodeType":865},{},[],"You can now configure how long activity data will be retained in Push by configuring a data retention period. ",{"data":3818,"content":3819,"nodeType":866},{},[3820,3824,3829],{"data":3821,"marks":3822,"value":3823,"nodeType":865},{},[],"From the admin console, go to ",{"data":3825,"marks":3826,"value":3828,"nodeType":865},{},[3827],{"type":946},"Settings > Organization > Data retention",{"data":3830,"marks":3831,"value":3832,"nodeType":865},{},[]," and select the data retention period in years.",{"data":3834,"content":3835,"nodeType":866},{},[3836,3839,3848],{"data":3837,"marks":3838,"value":21,"nodeType":865},{},[],{"data":3840,"content":3844,"nodeType":1038},{"target":3841},{"sys":3842},{"id":3843,"type":904,"linkType":905},"4esJSEUrMN2hpbghIkXjDG",[3845],{"data":3846,"marks":3847,"value":2777,"nodeType":865},{},[],{"data":3849,"marks":3850,"value":21,"nodeType":865},{},[],{"data":3852,"content":3853,"nodeType":948},{},[3854],{"data":3855,"marks":3856,"value":3857,"nodeType":865},{},[],"Easier debugging for webhook or integration error messages",{"data":3859,"content":3860,"nodeType":866},{},[3861],{"data":3862,"marks":3863,"value":3864,"nodeType":865},{},[],"We’ve added a debug log to make it easier to see what’s not working when you receive an error related to your Push webhooks or SIEM integrations.",{"data":3866,"content":3867,"nodeType":866},{},[3868,3872,3877,3880,3885],{"data":3869,"marks":3870,"value":3871,"nodeType":865},{},[],"You can access the debug log by opening the details slideout in the Push admin console for the webhook or integration you’ve created. Go to ",{"data":3873,"marks":3874,"value":3876,"nodeType":865},{},[3875],{"type":946},"Settings > Webhooks",{"data":3878,"marks":3879,"value":1773,"nodeType":865},{},[],{"data":3881,"marks":3882,"value":3884,"nodeType":865},{},[3883],{"type":946},"Settings > Integrations",{"data":3886,"marks":3887,"value":1151,"nodeType":865},{},[],{"data":3889,"content":3890,"nodeType":866},{},[3891,3894,3903],{"data":3892,"marks":3893,"value":21,"nodeType":865},{},[],{"data":3895,"content":3899,"nodeType":1038},{"target":3896},{"sys":3897},{"id":3898,"type":904,"linkType":905},"2naceBODKDL3iw72wrce6E",[3900],{"data":3901,"marks":3902,"value":2777,"nodeType":865},{},[],{"data":3904,"marks":3905,"value":21,"nodeType":865},{},[],"Product release: September 2025","Here’s what’s new on the Push platform for September 2025.","2025-09-08T00:00:00.000Z","product-release-september-2025",{"items":3911},[3912],{"sys":3913,"name":3915},{"id":3914},"5jk0kqjSdSK2L0YiistQjY","Release notes",{"items":3917},[3918],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":3919},{"url":2577},{"__typename":2239,"sys":3921,"content":3923,"title":4393,"synopsis":4394,"hashTags":59,"publishedDate":4395,"slug":4396,"tagsCollection":4397,"authorsCollection":4401},{"id":3922},"20xOvhmIKW7E0e1g5q7D2h",{"json":3924},{"data":3925,"content":3926,"nodeType":2232},{},[3927,3933,4006,4012,4028,4035,4041,4059,4065,4081,4088,4095,4119,4125,4131,4145,4152,4158,4175,4181,4197,4204,4211,4217,4235,4241,4256,4263,4269,4285,4291,4322,4338,4344,4360,4366,4381,4387],{"data":3928,"content":3929,"nodeType":948},{},[3930],{"data":3931,"marks":3932,"value":2588,"nodeType":865},{},[],{"data":3934,"content":3935,"nodeType":891},{},[3936,3946,3956,3966,3976,3986,3996],{"data":3937,"content":3938,"nodeType":880},{},[3939],{"data":3940,"content":3941,"nodeType":866},{},[3942],{"data":3943,"marks":3944,"value":3945,"nodeType":865},{},[],"Streamline investigations with Detections page",{"data":3947,"content":3948,"nodeType":880},{},[3949],{"data":3950,"content":3951,"nodeType":866},{},[3952],{"data":3953,"marks":3954,"value":3955,"nodeType":865},{},[],"New Labs feature: Employee verification codes",{"data":3957,"content":3958,"nodeType":880},{},[3959],{"data":3960,"content":3961,"nodeType":866},{},[3962],{"data":3963,"marks":3964,"value":3965,"nodeType":865},{},[],"Enforce strong passwords with in-browser guardrails",{"data":3967,"content":3968,"nodeType":880},{},[3969],{"data":3970,"content":3971,"nodeType":866},{},[3972],{"data":3973,"marks":3974,"value":3975,"nodeType":865},{},[],"Merge related employee records",{"data":3977,"content":3978,"nodeType":880},{},[3979],{"data":3980,"content":3981,"nodeType":866},{},[3982],{"data":3983,"marks":3984,"value":3985,"nodeType":865},{},[],"Customize your webhook events",{"data":3987,"content":3988,"nodeType":880},{},[3989],{"data":3990,"content":3991,"nodeType":866},{},[3992],{"data":3993,"marks":3994,"value":3995,"nodeType":865},{},[],"Create rules for phishing tool detection and MFA enforcement",{"data":3997,"content":3998,"nodeType":880},{},[3999],{"data":4000,"content":4001,"nodeType":866},{},[4002],{"data":4003,"marks":4004,"value":4005,"nodeType":865},{},[],"New integration for Microsoft Sentinel",{"data":4007,"content":4008,"nodeType":948},{},[4009],{"data":4010,"marks":4011,"value":3945,"nodeType":865},{},[],{"data":4013,"content":4014,"nodeType":866},{},[4015,4019,4024],{"data":4016,"marks":4017,"value":4018,"nodeType":865},{},[],"You can now receive and triage detections in the Push admin console (or get them via the Push REST API, webhooks or ChatOps), giving you a ",{"data":4020,"marks":4021,"value":4023,"nodeType":865},{},[4022],{"type":946},"single view of all the security events that Push has detected",{"data":4025,"marks":4026,"value":4027,"nodeType":865},{},[],", such as AiTM phishing, stolen creds, or blocked URLs being visited by employees.",{"data":4029,"content":4030,"nodeType":866},{},[4031],{"data":4032,"marks":4033,"value":4034,"nodeType":865},{},[]," Use the additional telemetry about each detection, such as timestamp, detection URL, type of phishkit detected, Push response action, etc., to understand how to triage the incident. ",{"data":4036,"content":4040,"nodeType":907},{"target":4037},{"sys":4038},{"id":4039,"type":904,"linkType":905},"53BOccCQ72Yo3oCSUWVFXn",[],{"data":4042,"content":4043,"nodeType":866},{},[4044,4047,4056],{"data":4045,"marks":4046,"value":21,"nodeType":865},{},[],{"data":4048,"content":4052,"nodeType":1038},{"target":4049},{"sys":4050},{"id":4051,"type":904,"linkType":905},"6jbLw9Wi2JuddCXL6ncrCV",[4053],{"data":4054,"marks":4055,"value":2777,"nodeType":865},{},[],{"data":4057,"marks":4058,"value":21,"nodeType":865},{},[],{"data":4060,"content":4061,"nodeType":948},{},[4062],{"data":4063,"marks":4064,"value":3955,"nodeType":865},{},[],{"data":4066,"content":4067,"nodeType":866},{},[4068,4072,4077],{"data":4069,"marks":4070,"value":4071,"nodeType":865},{},[],"Employees can now get a 6-digit verification code via the Push browser extension that you can use to ",{"data":4073,"marks":4074,"value":4076,"nodeType":865},{},[4075],{"type":946},"validate that your help desk is speaking to someone from your organization",{"data":4078,"marks":4079,"value":4080,"nodeType":865},{},[],".  ",{"data":4082,"content":4083,"nodeType":866},{},[4084],{"data":4085,"marks":4086,"value":4087,"nodeType":865},{},[],"The verification code is the same for all employees at a given organization, and resets every 24 hours. If your help desk needs to verify that they’re speaking to an employee, they can ask them to open the details tray for their Push extension and verify the code.",{"data":4089,"content":4090,"nodeType":866},{},[4091],{"data":4092,"marks":4093,"value":4094,"nodeType":865},{},[],"Employee verification codes is a Labs feature, which means it’s available on an early-access basis and we're particularly interested in hearing from you if this is a problem you're interested in solving using Push. ",{"data":4096,"content":4097,"nodeType":866},{},[4098,4102,4106,4110,4115],{"data":4099,"marks":4100,"value":4101,"nodeType":865},{},[],"You can enable Labs features by going to the ",{"data":4103,"marks":4104,"value":2129,"nodeType":865},{},[4105],{"type":946},{"data":4107,"marks":4108,"value":4109,"nodeType":865},{},[]," page of the Push admin console and choosing the ",{"data":4111,"marks":4112,"value":4114,"nodeType":865},{},[4113],{"type":946},"Labs",{"data":4116,"marks":4117,"value":4118,"nodeType":865},{},[]," tab.",{"data":4120,"content":4124,"nodeType":907},{"target":4121},{"sys":4122},{"id":4123,"type":904,"linkType":905},"19Baqh5QwbonzsR0EcaDS8",[],{"data":4126,"content":4127,"nodeType":948},{},[4128],{"data":4129,"marks":4130,"value":3965,"nodeType":865},{},[],{"data":4132,"content":4133,"nodeType":866},{},[4134,4138,4142],{"data":4135,"marks":4136,"value":4137,"nodeType":865},{},[],"Prompt your employees to change an insecure password using Push’s new in-browser guardrail, ",{"data":4139,"marks":4140,"value":1918,"nodeType":865},{},[4141],{"type":946},{"data":4143,"marks":4144,"value":1677,"nodeType":865},{},[],{"data":4146,"content":4147,"nodeType":866},{},[4148],{"data":4149,"marks":4150,"value":4151,"nodeType":865},{},[],"You can select which password security issues you want to remediate, and which apps you want to target using the configuration rules for this control. Then, when Push observes a password issue, it will automatically display a banner to end-users prompting them to change their password.",{"data":4153,"content":4157,"nodeType":907},{"target":4154},{"sys":4155},{"id":4156,"type":904,"linkType":905},"6ZcsdzYPxLAE1K170mQPHE",[],{"data":4159,"content":4160,"nodeType":866},{},[4161,4164,4172],{"data":4162,"marks":4163,"value":21,"nodeType":865},{},[],{"data":4165,"content":4168,"nodeType":1038},{"target":4166},{"sys":4167},{"id":1778,"type":904,"linkType":905},[4169],{"data":4170,"marks":4171,"value":2777,"nodeType":865},{},[],{"data":4173,"marks":4174,"value":21,"nodeType":865},{},[],{"data":4176,"content":4177,"nodeType":948},{},[4178],{"data":4179,"marks":4180,"value":3975,"nodeType":865},{},[],{"data":4182,"content":4183,"nodeType":866},{},[4184,4188,4193],{"data":4185,"marks":4186,"value":4187,"nodeType":865},{},[],"If you have employees using multiple email addresses, you can ",{"data":4189,"marks":4190,"value":4192,"nodeType":865},{},[4191],{"type":946},"now merge those records in the Push platform",{"data":4194,"marks":4195,"value":4196,"nodeType":865},{},[]," so they can be treated as a single employee. ",{"data":4198,"content":4199,"nodeType":866},{},[4200],{"data":4201,"marks":4202,"value":4203,"nodeType":865},{},[],"A common use case for merging employee records is when you have employees with a user account and an administrator account. By merging records in cases like this, you can resolve incorrect shared account findings and correct your license usage so only the primary employee record consumes a license. ",{"data":4205,"content":4206,"nodeType":866},{},[4207],{"data":4208,"marks":4209,"value":4210,"nodeType":865},{},[],"You can also merge records programmatically via the Push REST API. This is helpful if you have a predictable pattern for usernames you're mapping.",{"data":4212,"content":4216,"nodeType":907},{"target":4213},{"sys":4214},{"id":4215,"type":904,"linkType":905},"3xcEqhSUZ1VmZTsgSOS4xH",[],{"data":4218,"content":4219,"nodeType":866},{},[4220,4223,4232],{"data":4221,"marks":4222,"value":21,"nodeType":865},{},[],{"data":4224,"content":4228,"nodeType":1038},{"target":4225},{"sys":4226},{"id":4227,"type":904,"linkType":905},"3RIMjhmhJcHC2V7Lkrhvj2",[4229],{"data":4230,"marks":4231,"value":2777,"nodeType":865},{},[],{"data":4233,"marks":4234,"value":21,"nodeType":865},{},[],{"data":4236,"content":4237,"nodeType":948},{},[4238],{"data":4239,"marks":4240,"value":3985,"nodeType":865},{},[],{"data":4242,"content":4243,"nodeType":866},{},[4244,4247,4252],{"data":4245,"marks":4246,"value":3594,"nodeType":865},{},[],{"data":4248,"marks":4249,"value":4251,"nodeType":865},{},[4250],{"type":946},"select which events you want when creating a webhook",{"data":4253,"marks":4254,"value":4255,"nodeType":865},{},[]," in the Push platform. For example, if you want to build an automation around specific Push events or send only Push detection alerts to your SIEM, you can elect to send just those events to your configured destinations. ",{"data":4257,"content":4258,"nodeType":866},{},[4259],{"data":4260,"marks":4261,"value":4262,"nodeType":865},{},[],"You can select which events you want to consume when configuring a new webhook via the Push admin console.",{"data":4264,"content":4268,"nodeType":907},{"target":4265},{"sys":4266},{"id":4267,"type":904,"linkType":905},"755nABuK9KGdHHwWNqDtmS",[],{"data":4270,"content":4271,"nodeType":866},{},[4272,4275,4282],{"data":4273,"marks":4274,"value":21,"nodeType":865},{},[],{"data":4276,"content":4278,"nodeType":1102},{"uri":4277},"https://pushsecurity.redoc.ly/webhooks-v1",[4279],{"data":4280,"marks":4281,"value":2777,"nodeType":865},{},[],{"data":4283,"marks":4284,"value":21,"nodeType":865},{},[],{"data":4286,"content":4287,"nodeType":948},{},[4288],{"data":4289,"marks":4290,"value":3995,"nodeType":865},{},[],{"data":4292,"content":4293,"nodeType":866},{},[4294,4298,4303,4307,4312,4315,4319],{"data":4295,"marks":4296,"value":4297,"nodeType":865},{},[],"We’re continuing to ",{"data":4299,"marks":4300,"value":4302,"nodeType":865},{},[4301],{"type":946},"add configuration rule capabilities to security controls",{"data":4304,"marks":4305,"value":4306,"nodeType":865},{},[]," in the Push platform, including for ",{"data":4308,"marks":4309,"value":4311,"nodeType":865},{},[4310],{"type":946},"phishing tool detection",{"data":4313,"marks":4314,"value":1913,"nodeType":865},{},[],{"data":4316,"marks":4317,"value":1909,"nodeType":865},{},[4318],{"type":946},{"data":4320,"marks":4321,"value":1677,"nodeType":865},{},[],{"data":4323,"content":4324,"nodeType":866},{},[4325,4329,4334],{"data":4326,"marks":4327,"value":4328,"nodeType":865},{},[],"With these config rules, you can scope a control to specific employees or employee groups, and carve out exemptions if you like. You can also set the control to apply to specific apps, or set the ",{"data":4330,"marks":4331,"value":4333,"nodeType":865},{},[4332],{"type":946},"Mode",{"data":4335,"marks":4336,"value":4337,"nodeType":865},{},[]," (e.g. Monitor, Warn, or Block), where applicable.",{"data":4339,"content":4343,"nodeType":907},{"target":4340},{"sys":4341},{"id":4342,"type":904,"linkType":905},"2eKYcSet4tkd6UEffzdaaa",[],{"data":4345,"content":4346,"nodeType":866},{},[4347,4350,4357],{"data":4348,"marks":4349,"value":21,"nodeType":865},{},[],{"data":4351,"content":4353,"nodeType":1102},{"uri":4352},"/help/10121/#how-to-create-a-configuration-rule",[4354],{"data":4355,"marks":4356,"value":2777,"nodeType":865},{},[],{"data":4358,"marks":4359,"value":21,"nodeType":865},{},[],{"data":4361,"content":4362,"nodeType":948},{},[4363],{"data":4364,"marks":4365,"value":4005,"nodeType":865},{},[],{"data":4367,"content":4368,"nodeType":866},{},[4369,4373,4377],{"data":4370,"marks":4371,"value":4372,"nodeType":865},{},[],"Push now offers a Microsoft Sentinel integration to make it easier to send Push data to your Sentinel SIEM. You can start setting up your integration by going to ",{"data":4374,"marks":4375,"value":3884,"nodeType":865},{},[4376],{"type":946},{"data":4378,"marks":4379,"value":4380,"nodeType":865},{},[]," in the Push admin console and selecting the Sentinel tile.",{"data":4382,"content":4386,"nodeType":907},{"target":4383},{"sys":4384},{"id":4385,"type":904,"linkType":905},"5l5TIPvbOoNgauV7gUj7fy",[],{"data":4388,"content":4389,"nodeType":866},{},[4390],{"data":4391,"marks":4392,"value":21,"nodeType":865},{},[],"Product release: June 2025","Here’s what’s new on the Push platform for June 2025.","2025-06-09T00:00:00.000Z","product-release-june-2025",{"items":4398},[4399],{"sys":4400,"name":3915},{"id":3914},{"items":4402},[4403],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":4404},{"url":2577},"product-release-november-2025","blog/product-release-november-2025",{"json":4408},{"data":4409,"content":4410,"nodeType":2232},{},[4411],{"data":4412,"content":4413,"nodeType":866},{},[4414],{"data":4415,"marks":4416,"value":4417,"nodeType":865},{},[],"Browser extension visibility, ClickFix detection, RBAC and more.","Here’s what’s new on the Push platform for November 2025.",{"id":4420,"publishedAt":4421},"3ygDMHnTN58Lyb3W3k969w","2026-08-13T09:34:58.995Z",{"items":4423},[4424],{"sys":4425,"name":3915},{"id":3914},{"items":4427},[4428,4430,4432,4434],{"sys":4429,"name":297,"slug":298,"tier":31},{"id":294},{"sys":4431,"name":288,"slug":289,"tier":45},{"id":285},{"sys":4433,"name":315,"slug":316,"tier":45},{"id":312},{"sys":4435,"name":598,"slug":599,"tier":45},{"id":595},"4b_JWlgpJmPkxAfNXEHJpjVo5NMVhKC04Re6Yh_q2RA",{"id":4438,"title":4439,"authorsCollection":4440,"content":4448,"extension":228,"faqItemsCollection":5057,"faqTitle":59,"featured":6,"hashTags":59,"meta":5059,"metaTitle":5060,"ogImage":59,"postType":5061,"publishedDate":5062,"relatedBlogPostsCollection":5063,"slug":7505,"stem":7506,"subtitle":59,"summary":7507,"synopsis":7518,"sys":7519,"tagsCollection":7522,"topicsCollection":7528,"__hash__":7544},"blog/blog/fixing-secops-alert-fatigue-with-browser-telemetry.json","Fixing SecOps alert fatigue with browser telemetry",{"items":4441},[4442],{"fullName":4443,"firstName":4444,"jobTitle":4445,"socialLinks":59,"profilePicture":4446},"Mark Orlando","Mark","Field CTO",{"url":4447},"https://images.ctfassets.net/y1cdw1ablpvd/592PMwIQQFaa24k5SKBEKF/a33090d0ad95d1e3081f5d16a46ba826/image__68_.png",{"json":4449,"links":4944},{"data":4450,"content":4451,"nodeType":2232},{},[4452,4459,4466,4469,4476,4510,4522,4548,4555,4558,4565,4572,4579,4585,4592,4625,4631,4638,4658,4664,4671,4677,4680,4687,4724,4731,4774,4781,4787,4794,4801,4804,4811,4818,4825,4845,4851,4858,4865,4872,4878,4885,4891,4894,4901,4908,4915],{"data":4453,"content":4454,"nodeType":866},{},[4455],{"data":4456,"marks":4457,"value":4458,"nodeType":865},{},[],"After more than two decades in cybersecurity, I’ve witnessed the evolution (and at times, devolution) of detection and response capabilities. I’ve sat in countless SOCs watching analysts drown in a sea of alerts, spent hours chasing false positives, and seen talented security professionals burn out from the relentless noise of low-fidelity detection systems. ",{"data":4460,"content":4461,"nodeType":866},{},[4462],{"data":4463,"marks":4464,"value":4465,"nodeType":865},{},[],"It’s a problem that’s reached crisis proportions, and it’s exactly why our approach to browser security represents not just a technological shift, but a philosophical one.",{"data":4467,"content":4468,"nodeType":938},{},[],{"data":4470,"content":4471,"nodeType":948},{},[4472],{"data":4473,"marks":4474,"value":4475,"nodeType":865},{},[],"The alert fatigue epidemic",{"data":4477,"content":4478,"nodeType":866},{},[4479,4483,4488,4492,4497,4501,4506],{"data":4480,"marks":4481,"value":4482,"nodeType":865},{},[],"Early in my career, getting ",{"data":4484,"marks":4485,"value":4487,"nodeType":865},{},[4486],{"type":979},"any",{"data":4489,"marks":4490,"value":4491,"nodeType":865},{},[]," alert felt like a victory. We were flying blind outside of our small windows of network traffic. But as the industry matured, something troubling happened: we began equating ",{"data":4493,"marks":4494,"value":4496,"nodeType":865},{},[4495],{"type":946},"volume",{"data":4498,"marks":4499,"value":4500,"nodeType":865},{},[]," with ",{"data":4502,"marks":4503,"value":4505,"nodeType":865},{},[4504],{"type":946},"value",{"data":4507,"marks":4508,"value":4509,"nodeType":865},{},[],". Vendors started competing on how many alerts they could generate, how much data they could collect, and how comprehensive their “visibility” could be. ",{"data":4511,"content":4512,"nodeType":866},{},[4513,4517],{"data":4514,"marks":4515,"value":4516,"nodeType":865},{},[],"Security teams followed suit with operational metrics that captured how many alerts they’d resolved, how many “attacks” they’d stopped, and how many tickets they’d opened and closed in a given work cycle. But as many teams have now realized, ",{"data":4518,"marks":4519,"value":4521,"nodeType":865},{},[4520],{"type":946},"volume is a vanity metric; fidelity is what keeps you safe.",{"data":4523,"content":4524,"nodeType":866},{},[4525,4529,4539,4543],{"data":4526,"marks":4527,"value":4528,"nodeType":865},{},[],"In my course on ",{"data":4530,"content":4532,"nodeType":1102},{"uri":4531},"https://www.sans.org/cyber-security-courses/building-leading-security-operations-centers",[4533],{"data":4534,"marks":4535,"value":4538,"nodeType":865},{},[4536],{"type":4537},"underline","Building and Leading Security Operations teams",{"data":4540,"marks":4541,"value":4542,"nodeType":865},{},[],", we discuss the importance of analytic outcomes and addressing ineffective alerts to continuously improve fidelity. My students often find it hard to believe how much time and effort it takes to audit alert quality and implement continuous improvements on a large scale. This isn’t just an operational problem — it’s an existential threat to effective security. ",{"data":4544,"marks":4545,"value":4547,"nodeType":865},{},[4546],{"type":946},"When everything is an alert, nothing is. ",{"data":4549,"content":4550,"nodeType":866},{},[4551],{"data":4552,"marks":4553,"value":4554,"nodeType":865},{},[],"And while we have been busy focusing on more (and occasionally, better) detections at the endpoint and network layers, attackers have shifted to infrastructure that isn’t as well-instrumented: SaaS and the browser.",{"data":4556,"content":4557,"nodeType":938},{},[],{"data":4559,"content":4560,"nodeType":948},{},[4561],{"data":4562,"marks":4563,"value":4564,"nodeType":865},{},[],"The browser: a new frontier in detection and response",{"data":4566,"content":4567,"nodeType":866},{},[4568],{"data":4569,"marks":4570,"value":4571,"nodeType":865},{},[],"Today, the browser is the place where most cyber attacks happen. It’s where users interact with the applications that your business runs on, handle sensitive data, and unfortunately, where they encounter sophisticated phishing campaigns, credential harvesting attacks, and malicious downloads. ",{"data":4573,"content":4574,"nodeType":866},{},[4575],{"data":4576,"marks":4577,"value":4578,"nodeType":865},{},[],"Yet for most security teams, the browser remains a black box, obscured from the view from the network and the endpoint. Even worse, attack models often applied to detection engineering for endpoint or network-centric threats don’t really apply; modern identity attacks skip entire phases of the attack chain, eliminating many detection opportunities along the way. The modern attack path doesn’t need to touch the endpoint or your network at all — it can happen entirely over the internet. ",{"data":4580,"content":4584,"nodeType":907},{"target":4581},{"sys":4582},{"id":4583,"type":904,"linkType":905},"4wYYgbKmmVAZTF7niXJEGc",[],{"data":4586,"content":4587,"nodeType":1218},{},[4588],{"data":4589,"marks":4590,"value":4591,"nodeType":865},{},[],"Attackers are exploiting the detection gap",{"data":4593,"content":4594,"nodeType":866},{},[4595,4599,4608,4612,4621],{"data":4596,"marks":4597,"value":4598,"nodeType":865},{},[],"You only need to look at in-the-wild breaches such as last year’s ",{"data":4600,"content":4602,"nodeType":1102},{"uri":4601},"https://pushsecurity.com/blog/snowflake-retro/",[4603],{"data":4604,"marks":4605,"value":4607,"nodeType":865},{},[4606],{"type":4537},"Snowflake",{"data":4609,"marks":4610,"value":4611,"nodeType":865},{},[]," attacks, or the recent ",{"data":4613,"content":4615,"nodeType":1102},{"uri":4614},"https://www.bleepingcomputer.com/news/security/shinyhunters-claims-15-billion-salesforce-records-stolen-in-drift-hacks/",[4616],{"data":4617,"marks":4618,"value":4620,"nodeType":865},{},[4619],{"type":4537},"Salesforce",{"data":4622,"marks":4623,"value":4624,"nodeType":865},{},[]," breaches to see the impact that attackers can have by executing attacks entirely over the internet, without touching traditional network devices or user endpoints. ",{"data":4626,"content":4630,"nodeType":907},{"target":4627},{"sys":4628},{"id":4629,"type":904,"linkType":905},"VfTps3SGKJDlhFcmh42d9",[],{"data":4632,"content":4633,"nodeType":866},{},[4634],{"data":4635,"marks":4636,"value":4637,"nodeType":865},{},[],"But even in the context of more “conventional” attacks (e.g. the classic route of compromising an endpoint, moving laterally through an environment, taking control of a domain, and deploying ransomware), most of the time, these attacks begin in the browser with identities and cloud apps rather than exploit-driven initial access — such as with the recent attacks on Marks & Spencer, Co-op, and Jaguar Land Rover. ",{"data":4639,"content":4640,"nodeType":866},{},[4641,4645,4654],{"data":4642,"marks":4643,"value":4644,"nodeType":865},{},[],"While the ",{"data":4646,"content":4648,"nodeType":1102},{"uri":4647},"https://cloud.google.com/security/resources/insights/targeted-attack-lifecycle",[4649],{"data":4650,"marks":4651,"value":4653,"nodeType":865},{},[4652],{"type":4537},"attack cycle",{"data":4655,"marks":4656,"value":4657,"nodeType":865},{},[]," and similar mental models are valuable for planning in-depth detections of sophisticated, multi-stage attacks, focusing too heavily on them can lead to overlooked scenarios. These high-profile incidents have demonstrated the opportunity cost of neglecting visibility into attacks that don't perfectly align with these models. ",{"data":4659,"content":4663,"nodeType":907},{"target":4660},{"sys":4661},{"id":4662,"type":904,"linkType":905},"3TsKtoWuxQMFl1xd3w1j86",[],{"data":4665,"content":4666,"nodeType":866},{},[4667],{"data":4668,"marks":4669,"value":4670,"nodeType":865},{},[],"Just as endpoint detection and response revolutionized host-based security by providing visibility and control directly at the point of attack, browser-based security platforms can do the same for web-borne threats. It’s an important addition to the detection and response stack that illuminates a “missing middle” in modern attack investigations, and intervenes in real time, much like traditional EDR did for the endpoint years ago.",{"data":4672,"content":4676,"nodeType":907},{"target":4673},{"sys":4674},{"id":4675,"type":904,"linkType":905},"1eCXGC6U6SdzHmOH1gv24O",[],{"data":4678,"content":4679,"nodeType":938},{},[],{"data":4681,"content":4682,"nodeType":948},{},[4683],{"data":4684,"marks":4685,"value":4686,"nodeType":865},{},[],"High-fidelity detection: quality over quantity",{"data":4688,"content":4689,"nodeType":866},{},[4690,4694,4702,4706,4711,4715,4720],{"data":4691,"marks":4692,"value":4693,"nodeType":865},{},[],"Our ",{"data":4695,"content":4697,"nodeType":1102},{"uri":4696},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/",[4698],{"data":4699,"marks":4700,"value":4701,"nodeType":865},{},[],"design philosophy",{"data":4703,"marks":4704,"value":4705,"nodeType":865},{},[]," centers on a principle often overlooked in the security industry: prioritizing actionable problems for security teams. This involves differentiating between \"",{"data":4707,"marks":4708,"value":4710,"nodeType":865},{},[4709],{"type":946},"events",{"data":4712,"marks":4713,"value":4714,"nodeType":865},{},[],"\" – environment data that may or may not be useful – and \"",{"data":4716,"marks":4717,"value":4719,"nodeType":865},{},[4718],{"type":946},"detections",{"data":4721,"marks":4722,"value":4723,"nodeType":865},{},[],"\" – high-fidelity, actionable signals with a negligible false positive rate. We also empower our customers with the ability to intervene in real-time when there are high-confidence indicators of an attack. We focus on detecting not atomic indicators, but on attacker tooling and behaviors.",{"data":4725,"content":4726,"nodeType":866},{},[4727],{"data":4728,"marks":4729,"value":4730,"nodeType":865},{},[],"Compare this to traditional approaches that might generate alerts for:",{"data":4732,"content":4733,"nodeType":891},{},[4734,4744,4754,4764],{"data":4735,"content":4736,"nodeType":880},{},[4737],{"data":4738,"content":4739,"nodeType":866},{},[4740],{"data":4741,"marks":4742,"value":4743,"nodeType":865},{},[],"Visiting domains with low reputation scores (but not necessarily malicious)",{"data":4745,"content":4746,"nodeType":880},{},[4747],{"data":4748,"content":4749,"nodeType":866},{},[4750],{"data":4751,"marks":4752,"value":4753,"nodeType":865},{},[],"Downloading files that match certain heuristics (but may be legitimate)",{"data":4755,"content":4756,"nodeType":880},{},[4757],{"data":4758,"content":4759,"nodeType":866},{},[4760],{"data":4761,"marks":4762,"value":4763,"nodeType":865},{},[],"Accessing new web applications (that may be approved, or tacitly allowed, shadow IT)",{"data":4765,"content":4766,"nodeType":880},{},[4767],{"data":4768,"content":4769,"nodeType":866},{},[4770],{"data":4771,"marks":4772,"value":4773,"nodeType":865},{},[],"Employee usernames, passwords, and email addresses for sale on the dark web (which may no longer be valid)",{"data":4775,"content":4776,"nodeType":866},{},[4777],{"data":4778,"marks":4779,"value":4780,"nodeType":865},{},[],"These low-fidelity alerts create work without providing solutions. They force analysts to become investigators rather than responders, spending precious time determining whether an alert represents a genuine threat rather than focusing on mitigation and recovery. ",{"data":4782,"content":4786,"nodeType":907},{"target":4783},{"sys":4784},{"id":4785,"type":904,"linkType":905},"4MydcqvHnWsziCOPUNC3YS",[],{"data":4788,"content":4789,"nodeType":866},{},[4790],{"data":4791,"marks":4792,"value":4793,"nodeType":865},{},[],"Poor quality detections also present an easy opportunity for security teams to commit a cardinal sin: disrupting users and business processes without a clear justification for doing so. User trust and support should always be treated as a finite resource, and every account locked, website blocked, and laptop reimaged chips away at that resource. ",{"data":4795,"content":4796,"nodeType":866},{},[4797],{"data":4798,"marks":4799,"value":4800,"nodeType":865},{},[],"Likewise, the more disruptive, the more likely users will look for ways around said controls. If your users are actively working against you, and feel you are preventing them from doing their jobs, they’ll always find new and unexpected ways around security blocks. ",{"data":4802,"content":4803,"nodeType":938},{},[],{"data":4805,"content":4806,"nodeType":948},{},[4807],{"data":4808,"marks":4809,"value":4810,"nodeType":865},{},[],"The SOC analyst's perspective",{"data":4812,"content":4813,"nodeType":866},{},[4814],{"data":4815,"marks":4816,"value":4817,"nodeType":865},{},[],"The most successful SOC analysts share a common trait: they’re extraordinarily good at quickly distinguishing signal from noise. But this skill shouldn’t be required! It’s a failure of our detection systems that we’re forcing human analysts to perform pattern matching that our technology should handle. ",{"data":4819,"content":4820,"nodeType":866},{},[4821],{"data":4822,"marks":4823,"value":4824,"nodeType":865},{},[],"But even for the most skilled analyst, it’s a tall order to ask your security team to also be experts in every cloud app your business relies on, making it even harder than normal to build context-driven alerts. Most of the time, the information required simply doesn't exist, with logs simply not available (generally, or at your product tier) or the work required to extract the logs and turn them into context-driven alerts hasn’t happened yet. If your team is under-resourced and drowning in low-fidelity alerts already, then realistically it might never happen. ",{"data":4826,"content":4827,"nodeType":866},{},[4828,4832,4841],{"data":4829,"marks":4830,"value":4831,"nodeType":865},{},[],"Effective browser security changes this dynamic. Instead of presenting analysts with hundreds of “suspicious web activity” alerts that require investigation, ",{"data":4833,"content":4835,"nodeType":1102},{"uri":4834},"https://pushsecurity.com/blog/detecting-and-blocking-phishing-attacks-in-the-browser/",[4836],{"data":4837,"marks":4838,"value":4840,"nodeType":865},{},[4839],{"type":4537},"our platform focuses on high-reliability indicators",{"data":4842,"marks":4843,"value":4844,"nodeType":865},{},[]," like whether a phishing kit was observed running on the page, or whether the page was cloned from a legitimate site. We even detect user behaviors that could indicate a risk in the context of a phishing attack, like when a user attempts to authenticate with credentials that have been previously used on another page — either a sign of credential reuse (bad) or a phishing attack (even worse) — at which point Push can be set to block the attack in real time. ",{"data":4846,"content":4850,"nodeType":907},{"target":4847},{"sys":4848},{"id":4849,"type":904,"linkType":905},"3998Iy2kp9MW0HFeqmo900",[],{"data":4852,"content":4853,"nodeType":1218},{},[4854],{"data":4855,"marks":4856,"value":4857,"nodeType":865},{},[],"Browser security provides a new layer of protection, reducing the risk of breach",{"data":4859,"content":4860,"nodeType":866},{},[4861],{"data":4862,"marks":4863,"value":4864,"nodeType":865},{},[],"Attack detection has always been a cat-and-mouse game. For years, attackers have grappled with endpoint and network security vendors. And sometimes, the attackers win. The fact is that a lot of attacker innovation has gone into sandbox aware malware, breaking detection signatures, disabling security tools, and so on.    ",{"data":4866,"content":4867,"nodeType":866},{},[4868],{"data":4869,"marks":4870,"value":4871,"nodeType":865},{},[],"But with so many attacks now passing through the browser, defending it enables badness to be filtered out before it reaches the endpoint or network controls that attackers are looking to consciously evade. By preventing malware being delivered, or identities from being compromised, attacks otherwise crafted to evade traditional security controls can be intercepted early — making the crucial difference in whether a breach happens or not.",{"data":4873,"content":4877,"nodeType":907},{"target":4874},{"sys":4875},{"id":4876,"type":904,"linkType":905},"4Bh7uOkeguNJFmJ1XUQ317",[],{"data":4879,"content":4880,"nodeType":866},{},[4881],{"data":4882,"marks":4883,"value":4884,"nodeType":865},{},[],"And when it comes to the cloud-centric attacks that attackers are finding so much success with today, this is in effect a net new capability. ",{"data":4886,"content":4890,"nodeType":907},{"target":4887},{"sys":4888},{"id":4889,"type":904,"linkType":905},"4JdaY8I3f6Ub2Kifc9Rsj9",[],{"data":4892,"content":4893,"nodeType":938},{},[],{"data":4895,"content":4896,"nodeType":948},{},[4897],{"data":4898,"marks":4899,"value":4900,"nodeType":865},{},[],"Learn more about Push Security",{"data":4902,"content":4903,"nodeType":866},{},[4904],{"data":4905,"marks":4906,"value":4907,"nodeType":865},{},[],"The browser represents one of the most significant opportunities in cybersecurity today. As we continue to expand our browser-based security capabilities, we remain committed to this high-fidelity approach. We’re building features that not only detect and prevent attacks but also provide security teams with the rich telemetry they need to develop custom queries and detections.",{"data":4909,"content":4910,"nodeType":866},{},[4911],{"data":4912,"marks":4913,"value":4914,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against techniques like AiTM phishing, credential stuffing, ClickFixing, malicious browser extensions, and session hijacking using stolen session tokens. You can also use Push to find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more to harden your identity attack surface.",{"data":4916,"content":4917,"nodeType":866},{},[4918,4922,4930,4933,4941],{"data":4919,"marks":4920,"value":4921,"nodeType":865},{},[],"To learn more about Push, ",{"data":4923,"content":4925,"nodeType":1102},{"uri":4924},"https://pushsecurity.com/resources/product-brochure",[4926],{"data":4927,"marks":4928,"value":4929,"nodeType":865},{},[],"check out our latest product overview",{"data":4931,"marks":4932,"value":1773,"nodeType":865},{},[],{"data":4934,"content":4936,"nodeType":1102},{"uri":4935},"https://pushsecurity.com/demo",[4937],{"data":4938,"marks":4939,"value":4940,"nodeType":865},{},[],"book some time with one of our team for a live demo",{"data":4942,"marks":4943,"value":1151,"nodeType":865},{},[],{"entries":4945},{"hyperlink":4946,"inline":4947,"block":4948},[],[],[4949,4957,4965,4971,4985,5030,5036,5043],{"sys":4950,"__typename":2366,"title":4951,"caption":4952,"layoutMode":59,"file":4953},{"id":4583},"Account takeover on third-party web app","Modern attack paths usually involve direct in-app compromise following account takeover, skipping several phases (and detection opportunities) in traditional “attack chain” models.",{"url":4954,"width":4955,"height":4956},"https://images.ctfassets.net/y1cdw1ablpvd/3DOQd2fcWYdjMSVBZZvHHU/2cd487cb316aef8acd77e14a1960c391/SaaS_attack_path.png",1362,458,{"sys":4958,"__typename":4959,"type":4960,"ctaText":4961,"buttonLabel":4962,"buttonColour":4963,"buttonUrl":4964},{"id":4629},"CtaWidget","Custom","Read about \"Scattered Lapsus$ Hunters\", the cybercrime supergroup behind the biggest breaches since 2021. ","Read More","sunny orange","https://pushsecurity.com/blog/scattered-lapsus-hunters/",{"sys":4966,"__typename":2366,"title":4967,"caption":4967,"layoutMode":59,"file":4968},{"id":4662},"Modern attacks start in the browser, and can traverse multiple environments/domains, simultaneously. Not every attack takes the same, linear route through your environment. ",{"url":4969,"width":2444,"height":4970},"https://images.ctfassets.net/y1cdw1ablpvd/5EFB28UzL8aSaZJ18pJKSa/cb7375e4e3ecc7bd7eb5b422fa9cdcd5/image5.png",1102,{"sys":4972,"__typename":2303,"content":4973,"name":4984,"title":59},{"id":4675},{"json":4974},{"nodeType":2232,"data":4975,"content":4976},{},[4977],{"nodeType":866,"data":4978,"content":4979},{},[4980],{"nodeType":865,"value":4981,"marks":4982,"data":4983},"To tackle attacks that are designed to evade traditional detection surfaces and take place mostly over the internet, we must integrate browser telemetry into our detection and response framework, and expand detection engineering and threat hunting processes to incorporate this new dataset. ",[],{},"Fixing SecOps alert fatigue insight box 1",{"sys":4986,"__typename":2303,"content":4987,"name":5029,"title":59},{"id":4785},{"json":4988},{"nodeType":2232,"data":4989,"content":4990},{},[4991],{"nodeType":866,"data":4992,"content":4993},{},[4994,4997,5006,5010,5015,5019,5025],{"nodeType":865,"value":21,"marks":4995,"data":4996},[],{},{"nodeType":1102,"data":4998,"content":5000},{"uri":4999},"https://medium.com/starting-up-security/lessons-learned-in-detection-engineering-304aec709856",[5001],{"nodeType":865,"value":5002,"marks":5003,"data":5005},"This is what Ryan McGeehan called",[5004],{"type":4537},{},{"nodeType":865,"value":5007,"marks":5008,"data":5009}," the “Law of the Lever” several years ago, and it still holds true today: The time spent creating a poor quality detection rule will likely create a significant amount of work for someone responding to the follow up alert. ",[],{},{"nodeType":865,"value":5011,"marks":5012,"data":5014},"This doesn’t mean that only high fidelity analytics have value",[5013],{"type":946},{},{"nodeType":865,"value":5016,"marks":5017,"data":5018},"; we still need general environment telemetry to test investigative hypotheses and identify new use cases. But we can’t allocate sufficient resources to those tasks while ",[],{},{"nodeType":865,"value":5020,"marks":5021,"data":5024},"also",[5022,5023],{"type":946},{"type":4537},{},{"nodeType":865,"value":5026,"marks":5027,"data":5028}," dealing with low quality alerts.",[],{},"secops article insight box 2",{"sys":5031,"__typename":2366,"title":5032,"caption":5032,"layoutMode":59,"file":5033},{"id":4849},"Being in the browser provides new opportunities to detect and block attacks like phishing.",{"url":5034,"width":2444,"height":5035},"https://images.ctfassets.net/y1cdw1ablpvd/7jo4A0IFI3Z3mLqDki64zz/fb13af5af1443e71a7d113022eda2a62/image4.png",1469,{"sys":5037,"__typename":2366,"title":5038,"caption":5039,"layoutMode":59,"file":5040},{"id":4876},"Defending the browser reduces the risk of breach","Defending the browser reduces the risk of breach by tackling the earliest indicators of attack.",{"url":5041,"width":2444,"height":5042},"https://images.ctfassets.net/y1cdw1ablpvd/2ryvgEISjcNDDvcPEptdzy/ce1bfaf82f09684515fa0e9ecd86f6c3/image1.png",1209,{"sys":5044,"__typename":2303,"content":5045,"name":5056,"title":59},{"id":4889},{"json":5046},{"nodeType":2232,"data":5047,"content":5048},{},[5049],{"nodeType":866,"data":5050,"content":5051},{},[5052],{"nodeType":865,"value":5053,"marks":5054,"data":5055},"The psychological impact of this shift cannot be overstated. When analysts know that every alert represents a genuine threat that was successfully mitigated, their job satisfaction increases, burnout decreases, and the overall security posture improves dramatically.",[],{},"secops article insight box 3",{"items":5058},[],{},"Save SOC time by using browser data to reduce alert noise","thought-leadership","2025-10-07T00:00:00.000Z",{"items":5064},[5065,6032,6835],{"__typename":2239,"sys":5066,"content":5067,"title":6014,"synopsis":6015,"hashTags":59,"publishedDate":6016,"slug":6017,"tagsCollection":6018,"authorsCollection":6024},{"id":2415},{"json":5068},{"data":5069,"content":5070,"nodeType":2232},{},[5071,5078,5085,5092,5095,5103,5110,5117,5123,5130,5136,5155,5162,5174,5177,5185,5192,5208,5215,5227,5233,5236,5244,5252,5258,5267,5287,5296,5303,5312,5331,5340,5347,5356,5388,5397,5404,5413,5431,5437,5446,5453,5462,5504,5507,5515,5524,5544,5553,5560,5569,5602,5608,5617,5624,5630,5633,5640,5649,5656,5716,5722,5725,5732,5741,5748,5754,5757,5765,5772,5779,5848,5855,5918,5925,5928,5936,5943,5950,5956,5959,5967,5974,5981,5988],{"data":5072,"content":5073,"nodeType":866},{},[5074],{"data":5075,"marks":5076,"value":5077,"nodeType":865},{},[],"The biggest cybersecurity story this year (so far) has been the emergence of “Scattered Lapsus$ Hunters” and their record-breaking worldwide hacking spree. ",{"data":5079,"content":5080,"nodeType":866},{},[5081],{"data":5082,"marks":5083,"value":5084,"nodeType":865},{},[],"Scattered Lapsus$ Hunters is part of “The Com”, the name for the broad community of English-speaking cybercriminals with international criminal connections — including with nation-state sponsored groups. They are also known to collaborate with a range of cybercrime “as-a-Service” organizations for phishing, initial access, ransomware, and more. ",{"data":5086,"content":5087,"nodeType":866},{},[5088],{"data":5089,"marks":5090,"value":5091,"nodeType":865},{},[],"It’s difficult to pin down exactly who the individuals are that make up this criminal collective. But what is known is their MO — making money through extortion by means of account takeover, mass data theft, and ransomware deployment. ",{"data":5093,"content":5094,"nodeType":938},{},[],{"data":5096,"content":5097,"nodeType":948},{},[5098],{"data":5099,"marks":5100,"value":5102,"nodeType":865},{},[5101],{"type":946},"How did we get here? ",{"data":5104,"content":5105,"nodeType":866},{},[5106],{"data":5107,"marks":5108,"value":5109,"nodeType":865},{},[],"Earlier this year, the threat group known to most analysts as Scattered Spider (also tracked as 0ktapus, Octo Tempest, Scatter Swine, Muddled Libra, and UNC3944) re-emerged after a series of arrests in late 2024. ",{"data":5111,"content":5112,"nodeType":866},{},[5113],{"data":5114,"marks":5115,"value":5116,"nodeType":865},{},[],"This group has been active in peaks and troughs over the years, but are mainly known for high-profile ransomware attacks on Caesars and MGM Resorts in 2024. ",{"data":5118,"content":5122,"nodeType":907},{"target":5119},{"sys":5120},{"id":5121,"type":904,"linkType":905},"1Vt269d7n6IGMzOrJs1FDx",[],{"data":5124,"content":5125,"nodeType":866},{},[5126],{"data":5127,"marks":5128,"value":5129,"nodeType":865},{},[],"Scattered Spider hit the headlines again in April 2025 with attacks on UK retailers Marks & Spencer and Co-op, which resulted in significant, prolonged disruption, and a serious downstream impact on the retail supply chain. ",{"data":5131,"content":5135,"nodeType":907},{"target":5132},{"sys":5133},{"id":5134,"type":904,"linkType":905},"3kvcGV2zZZUPnM8IK04Y1O",[],{"data":5137,"content":5138,"nodeType":866},{},[5139,5143,5151],{"data":5140,"marks":5141,"value":5142,"nodeType":865},{},[],"It didn’t stop there, though. What followed was a wide-scale campaign targeting Salesforce customers, with the attackers claiming to have stolen ",{"data":5144,"content":5145,"nodeType":1102},{"uri":4614},[5146],{"data":5147,"marks":5148,"value":5150,"nodeType":865},{},[5149],{"type":4537},"over 1.5 billion records from 1000+ companies",{"data":5152,"marks":5153,"value":5154,"nodeType":865},{},[]," across multiple verticals, including heavyweights like Google, Cloudflare, Workday, Adidas, FedEx, Disney, LVMH, and many more.",{"data":5156,"content":5157,"nodeType":866},{},[5158],{"data":5159,"marks":5160,"value":5161,"nodeType":865},{},[],"Around this time, the attackers began to refer to themselves as part of a wider collective, assuming the moniker “Scattered Lapsus$ Hunters” (a mash-up of names given by analysts and self-adopted by attackers — Scattered Spider, ShinyHunters, and Lapsus$).",{"data":5163,"content":5164,"nodeType":866},{},[5165,5169],{"data":5166,"marks":5167,"value":5168,"nodeType":865},{},[],"The most significant breach this year to-date impacted Jaguar Land Rover. A ransomware attack resulted in months of disruption that directly impacted the UK’s GDP, with the government underwriting a $1.5B loan to alleviate the supply chain impact. ",{"data":5170,"marks":5171,"value":5173,"nodeType":865},{},[5172],{"type":946},"In fact, this was the most economically consequential cyber attack yet recorded in a G7 economy. ",{"data":5175,"content":5176,"nodeType":938},{},[],{"data":5178,"content":5179,"nodeType":948},{},[5180],{"data":5181,"marks":5182,"value":5184,"nodeType":865},{},[5183],{"type":946},"2025 wasn’t a one-off",{"data":5186,"content":5187,"nodeType":866},{},[5188],{"data":5189,"marks":5190,"value":5191,"nodeType":865},{},[],"The developments through 2025 have presented a stronger picture than ever before that cybercriminal operations are heavily interlinked. Groups overlap considerably, and individuals freely move between different cells. ",{"data":5193,"content":5194,"nodeType":866},{},[5195,5199,5204],{"data":5196,"marks":5197,"value":5198,"nodeType":865},{},[],"When we scratch beneath the surface, this is evident in the tactics, techniques and procedures (TTPs) used by these attackers — even stretching as far back as 2021 with the initial rise of Lapsus$. This is not an accident. ",{"data":5200,"marks":5201,"value":5203,"nodeType":865},{},[5202],{"type":946},"The TTPs used show a conscious move by attackers to move away from environments that are well-protected by traditional security tools. ",{"data":5205,"marks":5206,"value":5207,"nodeType":865},{},[],"This means avoiding targeting endpoints with malware, and not relying on software-based exploits. Instead, these attackers look to take over apps and services directly over the internet. ",{"data":5209,"content":5210,"nodeType":866},{},[5211],{"data":5212,"marks":5213,"value":5214,"nodeType":865},{},[],"Most of the time, this is as simple as logging in to a SaaS app, or an enterprise SSO account (e.g. Microsoft, Okta, or Google) and dumping the data. For attackers that want to take it further, they can abuse the sprawl of interconnected apps that make up modern business IT, seeking out specific data or exploitable functionality. Or, they can leverage internet-accessible management portals to chart a path back to your on-premise assets, giving them everything they need to pivot toward more conventional methods such as ransomware deployment. ",{"data":5216,"content":5217,"nodeType":866},{},[5218,5222],{"data":5219,"marks":5220,"value":5221,"nodeType":865},{},[],"When we look at historical breaches, the pattern is clear. ",{"data":5223,"marks":5224,"value":5226,"nodeType":865},{},[5225],{"type":946},"Not one of the attacks attributed to Scattered Lapsus$ Hunters, or its predecessors, started with an endpoint or network attack — they all began with account takeover. ",{"data":5228,"content":5232,"nodeType":907},{"target":5229},{"sys":5230},{"id":5231,"type":904,"linkType":905},"6poP5VM2ARrEvwKEG42HgK",[],{"data":5234,"content":5235,"nodeType":938},{},[],{"data":5237,"content":5238,"nodeType":948},{},[5239],{"data":5240,"marks":5241,"value":5243,"nodeType":865},{},[5242],{"type":946},"TTP breakdown: Analyzing the top “Scattered Lapsus$ Hunters” breaches since 2021",{"data":5245,"content":5246,"nodeType":1218},{},[5247],{"data":5248,"marks":5249,"value":5251,"nodeType":865},{},[5250],{"type":946},"Phishing and stolen credentials",{"data":5253,"content":5257,"nodeType":907},{"target":5254},{"sys":5255},{"id":5256,"type":904,"linkType":905},"4SNOanDIdGZsvRRnMYQVSo",[],{"data":5259,"content":5260,"nodeType":866},{},[5261],{"data":5262,"marks":5263,"value":5266,"nodeType":865},{},[5264,5265],{"type":946},{"type":4537},"EA Games (2021)",{"data":5268,"content":5269,"nodeType":866},{},[5270,5274,5283],{"data":5271,"marks":5272,"value":5273,"nodeType":865},{},[],"Attackers used stolen session cookies to log into EA’s Slack instance, purchased on a criminal forum. Combined with ",{"data":5275,"content":5277,"nodeType":1102},{"uri":5276},"https://pushsecurity.com/blog/phishing-slack-persistence/",[5278],{"data":5279,"marks":5280,"value":5282,"nodeType":865},{},[5281],{"type":4537},"social engineering via Slack",{"data":5284,"marks":5285,"value":5286,"nodeType":865},{},[],", this was used to steal 750GB of data, including video game source code. ",{"data":5288,"content":5289,"nodeType":866},{},[5290],{"data":5291,"marks":5292,"value":5295,"nodeType":865},{},[5293,5294],{"type":946},{"type":4537},"Nvidia (2022)",{"data":5297,"content":5298,"nodeType":866},{},[5299],{"data":5300,"marks":5301,"value":5302,"nodeType":865},{},[],"Attackers used stolen credentials to steal 1TB of data from Nvidia’s internal shares, including a significant amount of sensitive information about the designs of Nvidia graphics cards, source code, and the usernames and passwords of more than 71,000 Nvidia employees.",{"data":5304,"content":5305,"nodeType":866},{},[5306],{"data":5307,"marks":5308,"value":5311,"nodeType":865},{},[5309,5310],{"type":946},{"type":4537},"Microsoft (2022)",{"data":5313,"content":5314,"nodeType":866},{},[5315,5319,5327],{"data":5316,"marks":5317,"value":5318,"nodeType":865},{},[],"Attackers used stolen credentials combined with SIM swapping and ",{"data":5320,"content":5322,"nodeType":1102},{"uri":5321},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_fatigue/description.md",[5323],{"data":5324,"marks":5325,"value":5326,"nodeType":865},{},[],"MFA fatigue",{"data":5328,"marks":5329,"value":5330,"nodeType":865},{},[]," attacks to steal Azure DevOps source code — leaked a 9GB archive of Microsoft source code – including ~90% of Bing and 45% of Cortana code. ",{"data":5332,"content":5333,"nodeType":866},{},[5334],{"data":5335,"marks":5336,"value":5339,"nodeType":865},{},[5337,5338],{"type":946},{"type":4537},"T-Mobile (2022)",{"data":5341,"content":5342,"nodeType":866},{},[5343],{"data":5344,"marks":5345,"value":5346,"nodeType":865},{},[],"Attackers used stolen credentials to establish initial access, coupled with social engineering T-Mobile staff into approving the attacker’s device for VPN access. This resulted in source code being stolen from over 30,000 repositories. ",{"data":5348,"content":5349,"nodeType":866},{},[5350],{"data":5351,"marks":5352,"value":5355,"nodeType":865},{},[5353,5354],{"type":946},{"type":4537},"Snowflake (165 customers) (2024)",{"data":5357,"content":5358,"nodeType":866},{},[5359,5363,5371,5375,5384],{"data":5360,"marks":5361,"value":5362,"nodeType":865},{},[],"Attackers targeted ",{"data":5364,"content":5365,"nodeType":1102},{"uri":4601},[5366],{"data":5367,"marks":5368,"value":5370,"nodeType":865},{},[5369],{"type":4537},"165 Snowflake customers",{"data":5372,"marks":5373,"value":5374,"nodeType":865},{},[]," using stolen credentials from credential breaches dating back as far as 2020. Due to widespread MFA gaps and the presence of ",{"data":5376,"content":5378,"nodeType":1102},{"uri":5377},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/ghost_logins/description.md",[5379],{"data":5380,"marks":5381,"value":5383,"nodeType":865},{},[5382],{"type":4537},"ghost logins",{"data":5385,"marks":5386,"value":5387,"nodeType":865},{},[],", attackers were able to simply log in to individual customer tenants, dump the data, and use it to extort the companies. In total, 9 public victims were named following the breach, with over 1B breached customer records. ",{"data":5389,"content":5390,"nodeType":866},{},[5391],{"data":5392,"marks":5393,"value":5396,"nodeType":865},{},[5394,5395],{"type":946},{"type":4537},"PowerSchool (2024)",{"data":5398,"content":5399,"nodeType":866},{},[5400],{"data":5401,"marks":5402,"value":5403,"nodeType":865},{},[],"Attackers gained access to a community-focused customer support portal, PowerSource, using compromised credentials and stole data using an \"export data manager\" customer support tool, stealing the data of 62.4 million students and 9.5 million teachers. PowerSchool paid an undisclosed ransom fee, but hackers returned later to extort schools and individuals separately anyway.",{"data":5405,"content":5406,"nodeType":866},{},[5407],{"data":5408,"marks":5409,"value":5412,"nodeType":865},{},[5410,5411],{"type":946},{"type":4537},"Red Hat (2025)",{"data":5414,"content":5415,"nodeType":866},{},[5416,5420,5427],{"data":5417,"marks":5418,"value":5419,"nodeType":865},{},[],"Attackers breached Red Hat’s GitLab instance via a compromised account — the result of ",{"data":5421,"content":5422,"nodeType":1102},{"uri":5377},[5423],{"data":5424,"marks":5425,"value":5383,"nodeType":865},{},[5426],{"type":4537},{"data":5428,"marks":5429,"value":5430,"nodeType":865},{},[]," providing a backdoor to access an otherwise secure, SSO-connected account. Stolen data included approximately 800 Customer Engagement Reports (CERs), authentication tokens, full database URIs, and other private information in Red Hat code and CERs, which they claimed to use to gain access to downstream customer infrastructure. ",{"data":5432,"content":5436,"nodeType":907},{"target":5433},{"sys":5434},{"id":5435,"type":904,"linkType":905},"G1V7d5Dvevmr9p0YXElPX",[],{"data":5438,"content":5439,"nodeType":866},{},[5440],{"data":5441,"marks":5442,"value":5445,"nodeType":865},{},[5443,5444],{"type":946},{"type":4537},"Discord (2025)",{"data":5447,"content":5448,"nodeType":866},{},[5449],{"data":5450,"marks":5451,"value":5452,"nodeType":865},{},[],"Attackers compromised a Zendesk customer support account, stealing 1.6TB of data. The hackers say this consisted of roughly 8.4 million tickets affecting 5.5 million unique users, and that about 580,000 users contained payment information.",{"data":5454,"content":5455,"nodeType":866},{},[5456],{"data":5457,"marks":5458,"value":5461,"nodeType":865},{},[5459,5460],{"type":946},{"type":4537},"SoundCloud, MatchGroup, Crunchbase, Betterment... (2026)",{"data":5463,"content":5464,"nodeType":866},{},[5465,5469,5477,5480,5488,5492,5500],{"data":5466,"marks":5467,"value":5468,"nodeType":865},{},[],"Scattered Lapsus$ Hunters have already claimed several public victims in 2026, with over 60 million breached records. ",{"data":5470,"content":5472,"nodeType":1102},{"uri":5471},"https://www.bleepingcomputer.com/news/security/shinyhunters-claim-to-be-behind-sso-account-data-theft-attacks/",[5473],{"data":5474,"marks":5475,"value":5476,"nodeType":865},{},[],"SoundCloud, Betterment, Crunchbase",{"data":5478,"marks":5479,"value":1913,"nodeType":865},{},[],{"data":5481,"content":5483,"nodeType":1102},{"uri":5482},"https://www.bleepingcomputer.com/news/security/match-group-breach-exposes-data-from-hinge-tinder-okcupid-and-match/",[5484],{"data":5485,"marks":5486,"value":5487,"nodeType":865},{},[],"MatchGroup",{"data":5489,"marks":5490,"value":5491,"nodeType":865},{},[]," have all reported breaches this month, powered by a brand ",{"data":5493,"content":5495,"nodeType":1102},{"uri":5494},"https://pushsecurity.com/blog/unpacking-the-latest-slh-campaign/",[5496],{"data":5497,"marks":5498,"value":5499,"nodeType":865},{},[],"new real-time-operated AiTM phishing kit",{"data":5501,"marks":5502,"value":5503,"nodeType":865},{},[]," targeting Okta, Entra, and Google SSO accounts. This is a developing situation, with more victims expected to be announced publicly soon.",{"data":5505,"content":5506,"nodeType":938},{},[],{"data":5508,"content":5509,"nodeType":1218},{},[5510],{"data":5511,"marks":5512,"value":5514,"nodeType":865},{},[5513],{"type":946},"Vishing and help desk scams",{"data":5516,"content":5517,"nodeType":866},{},[5518],{"data":5519,"marks":5520,"value":5523,"nodeType":865},{},[5521,5522],{"type":946},{"type":4537},"MGM Resorts & Caesars (2023)",{"data":5525,"content":5526,"nodeType":866},{},[5527,5531,5540],{"data":5528,"marks":5529,"value":5530,"nodeType":865},{},[],"MGM Resorts and Caesars were hit with twin breaches in 2023. Attackers socially engineered help desk personnel to take over accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":5532,"content":5534,"nodeType":1102},{"uri":5533},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/inbound_federation/description.md",[5535],{"data":5536,"marks":5537,"value":5539,"nodeType":865},{},[5538],{"type":4537},"inbound federation",{"data":5541,"marks":5542,"value":5543,"nodeType":865},{},[]," — granting comprehensive access that was used to deploy ransomware. ",{"data":5545,"content":5546,"nodeType":866},{},[5547],{"data":5548,"marks":5549,"value":5552,"nodeType":865},{},[5550,5551],{"type":946},{"type":4537},"Transport for London (2024)",{"data":5554,"content":5555,"nodeType":866},{},[5556],{"data":5557,"marks":5558,"value":5559,"nodeType":865},{},[],"Attackers socially engineered the Transport for London help desk to gain privileged access to the IT environment, resulting in prolonged disruption to key online services underpinning London’s public transport network, theft of 5,000 users bank details, and all 30,000 staff members having to reset their online credentials in person.",{"data":5561,"content":5562,"nodeType":866},{},[5563],{"data":5564,"marks":5565,"value":5568,"nodeType":865},{},[5566,5567],{"type":946},{"type":4537},"Marks & Spencer (2025)",{"data":5570,"content":5571,"nodeType":866},{},[5572,5576,5585,5589,5598],{"data":5573,"marks":5574,"value":5575,"nodeType":865},{},[],"Attackers compromised a Microsoft Entra account belonging to a privileged user via a ",{"data":5577,"content":5579,"nodeType":1102},{"uri":5578},"https://pushsecurity.com/blog/scattered-spider-defending-against-help-desk-scams/",[5580],{"data":5581,"marks":5582,"value":5584,"nodeType":865},{},[5583],{"type":4537},"help desk scam",{"data":5586,"marks":5587,"value":5588,"nodeType":865},{},[],", which enabled them to steal sensitive data from cloud environments, as well as pivot to deploy ransomware via the ",{"data":5590,"content":5592,"nodeType":1102},{"uri":5591},"https://cloud.google.com/blog/topics/threat-intelligence/vsphere-active-directory-integration-risks",[5593],{"data":5594,"marks":5595,"value":5597,"nodeType":865},{},[5596],{"type":4537},"VMware admin console",{"data":5599,"marks":5600,"value":5601,"nodeType":865},{},[],". This enabled ransomware to be deployed at the hypervisor layer, evading host-based protections like EDR. ",{"data":5603,"content":5607,"nodeType":907},{"target":5604},{"sys":5605},{"id":5606,"type":904,"linkType":905},"7hBdHG74NaA3bQfOMpYA9o",[],{"data":5609,"content":5610,"nodeType":866},{},[5611],{"data":5612,"marks":5613,"value":5616,"nodeType":865},{},[5614,5615],{"type":946},{"type":4537},"Jaguar Land Rover (2025)",{"data":5618,"content":5619,"nodeType":866},{},[5620],{"data":5621,"marks":5622,"value":5623,"nodeType":865},{},[],"Attackers compromised highly privileged admin accounts via a help desk scam, which they leveraged to access and deploy ransomware to all aspects of Jaguar’s business, from CAD and engineering software, to payments tracking, to customer car delivery, using similar techniques to the Marks & Spencer breach. ",{"data":5625,"content":5629,"nodeType":907},{"target":5626},{"sys":5627},{"id":5628,"type":904,"linkType":905},"6s1X2fo4K9EeVLBmHm4YXb",[],{"data":5631,"content":5632,"nodeType":938},{},[],{"data":5634,"content":5635,"nodeType":1218},{},[5636],{"data":5637,"marks":5638,"value":694,"nodeType":865},{},[5639],{"type":946},{"data":5641,"content":5642,"nodeType":866},{},[5643],{"data":5644,"marks":5645,"value":5648,"nodeType":865},{},[5646,5647],{"type":946},{"type":4537},"Salesforce & Salesloft (1000+ customers) (2025)",{"data":5650,"content":5651,"nodeType":866},{},[5652],{"data":5653,"marks":5654,"value":5655,"nodeType":865},{},[],"A vast campaign against Salesforce customers resulted in the compromise of 1000+ Salesforce tenants (according to the attacker) with more than 1.5 billion records stolen. This campaign can consisted of three phases:",{"data":5657,"content":5658,"nodeType":891},{},[5659,5674,5689],{"data":5660,"content":5661,"nodeType":880},{},[5662],{"data":5663,"content":5664,"nodeType":866},{},[5665,5670],{"data":5666,"marks":5667,"value":5669,"nodeType":865},{},[5668],{"type":946},"Phase 1:",{"data":5671,"marks":5672,"value":5673,"nodeType":865},{},[]," The attacker conducted a large-scale vishing campaign against Salesforce customers, calling up users and socially engineering them into connecting a malicious version of the “Data Loader” app into their tenant. This was in fact an attacker-controlled app that enabled data to be mass-exfiltrated via API. ",{"data":5675,"content":5676,"nodeType":880},{},[5677],{"data":5678,"content":5679,"nodeType":866},{},[5680,5685],{"data":5681,"marks":5682,"value":5684,"nodeType":865},{},[5683],{"type":946},"Phase 2: ",{"data":5686,"marks":5687,"value":5688,"nodeType":865},{},[],"The attacker conducted a supply-chain compromise against customers of Salesloft. Users of Salesloft’s “Drift” integration were impacted by attackers stealing access tokens from Salesloft’s AWS environment. This integration allowed the attacker to steal data from customers that had deployed Drift to connected environments — namely, Salesforce, and Google Workspace. ",{"data":5690,"content":5691,"nodeType":880},{},[5692],{"data":5693,"content":5694,"nodeType":866},{},[5695,5700,5704,5712],{"data":5696,"marks":5697,"value":5699,"nodeType":865},{},[5698],{"type":946},"Phase 3:",{"data":5701,"marks":5702,"value":5703,"nodeType":865},{},[]," The attacker then conducted a separate supply-chain compromise involving Gainsight (allegedly using OAuth tokens stolen in the Salesloft attack) which enabled them to ",{"data":5705,"content":5707,"nodeType":1102},{"uri":5706},"https://www.bleepingcomputer.com/news/security/salesforce-investigates-customer-data-theft-via-gainsight-breach/",[5708],{"data":5709,"marks":5710,"value":5711,"nodeType":865},{},[],"breach a further 285 Salesforce instances",{"data":5713,"marks":5714,"value":5715,"nodeType":865},{},[]," using stolen OAuth tokens from Gainsight's integrations. ",{"data":5717,"content":5721,"nodeType":907},{"target":5718},{"sys":5719},{"id":5720,"type":904,"linkType":905},"3TwjpVKQ42SwQRhvGFbZdn",[],{"data":5723,"content":5724,"nodeType":938},{},[],{"data":5726,"content":5727,"nodeType":1218},{},[5728],{"data":5729,"marks":5730,"value":699,"nodeType":865},{},[5731],{"type":946},{"data":5733,"content":5734,"nodeType":866},{},[5735],{"data":5736,"marks":5737,"value":5740,"nodeType":865},{},[5738,5739],{"type":946},{"type":4537},"CyberHaven (2024)",{"data":5742,"content":5743,"nodeType":866},{},[5744],{"data":5745,"marks":5746,"value":5747,"nodeType":865},{},[],"Hackers phished a CyberHaven extension developer and uploaded a malicious version of the CyberHaven extension to the Chrome Web Store, leading to customer data breaches where installed in user browsers, impacting CyberHaven’s estimated ~400 business customers. This was part of a broader campaign that targeted 35 Chrome extensions, collectively impacting over 2.5 million users.",{"data":5749,"content":5753,"nodeType":907},{"target":5750},{"sys":5751},{"id":5752,"type":904,"linkType":905},"4ErDI0xi0Vj2Zrk8Qsb2NB",[],{"data":5755,"content":5756,"nodeType":938},{},[],{"data":5758,"content":5759,"nodeType":948},{},[5760],{"data":5761,"marks":5762,"value":5764,"nodeType":865},{},[5763],{"type":946},"The bigger picture",{"data":5766,"content":5767,"nodeType":866},{},[5768],{"data":5769,"marks":5770,"value":5771,"nodeType":865},{},[],"Scattered Lapsus$ Hunters are dominating the headlines right now, but they aren’t the only attackers using these modern techniques and consciously evading established security controls. ",{"data":5773,"content":5774,"nodeType":866},{},[5775],{"data":5776,"marks":5777,"value":5778,"nodeType":865},{},[],"Threat reports agree that attackers are steering away from traditional exploit and malware-driven breaches towards identities:",{"data":5780,"content":5781,"nodeType":891},{},[5782,5805,5827],{"data":5783,"content":5784,"nodeType":880},{},[5785],{"data":5786,"content":5787,"nodeType":866},{},[5788,5792,5801],{"data":5789,"marks":5790,"value":5791,"nodeType":865},{},[],"Identity-based attacks surged 32% in the last year, while 97% of identity attacks are password-based, driven by credential leaks and infostealer malware. (",{"data":5793,"content":5795,"nodeType":1102},{"uri":5794},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1",[5796],{"data":5797,"marks":5798,"value":5800,"nodeType":865},{},[5799],{"type":4537},"Microsoft",{"data":5802,"marks":5803,"value":5804,"nodeType":865},{},[],")",{"data":5806,"content":5807,"nodeType":880},{},[5808],{"data":5809,"content":5810,"nodeType":866},{},[5811,5815,5824],{"data":5812,"marks":5813,"value":5814,"nodeType":865},{},[],"79% of detections were malware-free in the last year, up from 40% in 2019. (",{"data":5816,"content":5818,"nodeType":1102},{"uri":5817},"https://www.crowdstrike.com/en-gb/global-threat-report/",[5819],{"data":5820,"marks":5821,"value":5823,"nodeType":865},{},[5822],{"type":4537},"CrowdStrike",{"data":5825,"marks":5826,"value":5804,"nodeType":865},{},[],{"data":5828,"content":5829,"nodeType":880},{},[5830],{"data":5831,"content":5832,"nodeType":866},{},[5833,5837,5845],{"data":5834,"marks":5835,"value":5836,"nodeType":865},{},[],"Credential abuse and phishing combined accounted for 38% of breaches, making identity the primary breach vector observed. (",{"data":5838,"content":5839,"nodeType":1102},{"uri":2328},[5840],{"data":5841,"marks":5842,"value":5844,"nodeType":865},{},[5843],{"type":4537},"Verizon",{"data":5846,"marks":5847,"value":5804,"nodeType":865},{},[],{"data":5849,"content":5850,"nodeType":866},{},[5851],{"data":5852,"marks":5853,"value":5854,"nodeType":865},{},[],"And other public breaches from this year alone demonstrate similar TTPs from outside of the Scattered Lapsus$ Hunters orbit:",{"data":5856,"content":5857,"nodeType":891},{},[5858,5873,5888,5903],{"data":5859,"content":5860,"nodeType":880},{},[5861],{"data":5862,"content":5863,"nodeType":866},{},[5864,5869],{"data":5865,"marks":5866,"value":5868,"nodeType":865},{},[5867],{"type":946},"Nikkei",{"data":5870,"marks":5871,"value":5872,"nodeType":865},{},[],": Japanese publishing giant Nikkei’s Slack messaging platform was compromised using stolen credentials, leaking the names, email addresses, and chat histories for 17,368 individuals registered on Slack.",{"data":5874,"content":5875,"nodeType":880},{},[5876],{"data":5877,"content":5878,"nodeType":866},{},[5879,5884],{"data":5880,"marks":5881,"value":5883,"nodeType":865},{},[5882],{"type":946},"Evertec",{"data":5885,"marks":5886,"value":5887,"nodeType":865},{},[],": Hackers tried to steal $130 million from Evertec’s Brazilian subsidiary Sinqia S.A.after gaining unauthorized access to its environment on the central bank’s real-time payment system (Pix) using stolen credentials.",{"data":5889,"content":5890,"nodeType":880},{},[5891],{"data":5892,"content":5893,"nodeType":866},{},[5894,5899],{"data":5895,"marks":5896,"value":5898,"nodeType":865},{},[5897],{"type":946},"Hy-Vee:",{"data":5900,"marks":5901,"value":5902,"nodeType":865},{},[]," Was hit with a data breach after hackers logged in with stolen credentials, exposing 53GB of sensitive data.",{"data":5904,"content":5905,"nodeType":880},{},[5906],{"data":5907,"content":5908,"nodeType":866},{},[5909,5914],{"data":5910,"marks":5911,"value":5913,"nodeType":865},{},[5912],{"type":946},"Scania: ",{"data":5915,"marks":5916,"value":5917,"nodeType":865},{},[],"Automotive giant Scania confirmed it suffered a cybersecurity incident where threat actors used compromised credentials to breach its Financial Services systems and steal insurance claim documents.",{"data":5919,"content":5920,"nodeType":866},{},[5921],{"data":5922,"marks":5923,"value":5924,"nodeType":865},{},[],"Scattered Lapsus$ Hunters may be grabbing the headlines — but this a huge movement in a vast and flexible community of attackers. And criminals around the world are learning from their success. ",{"data":5926,"content":5927,"nodeType":938},{},[],{"data":5929,"content":5930,"nodeType":948},{},[5931],{"data":5932,"marks":5933,"value":5935,"nodeType":865},{},[5934],{"type":946},"Lessons learned",{"data":5937,"content":5938,"nodeType":866},{},[5939],{"data":5940,"marks":5941,"value":5942,"nodeType":865},{},[],"The common thread with all of these attacks is that they are evading established security controls by targeting applications directly, over the internet, via account takeover.",{"data":5944,"content":5945,"nodeType":866},{},[5946],{"data":5947,"marks":5948,"value":5949,"nodeType":865},{},[],"Clearly, the success of these attacks shows the limitations of multiple control layers. Endpoint and network layer controls have no visibility of this attack surface. Identity-focused controls are being undermined by ghost logins and shadow IT. And the limitations of cloud security controls in their ability to encompass all apps, and detect and stop malicious actions in real-time (that often blend in seamlessly with normal user activity). ",{"data":5951,"content":5955,"nodeType":907},{"target":5952},{"sys":5953},{"id":5954,"type":904,"linkType":905},"4Dg3fZEGf7ShyQJ8jlNDME",[],{"data":5957,"content":5958,"nodeType":938},{},[],{"data":5960,"content":5961,"nodeType":948},{},[5962],{"data":5963,"marks":5964,"value":5966,"nodeType":865},{},[5965],{"type":946},"How Push can help",{"data":5968,"content":5969,"nodeType":866},{},[5970],{"data":5971,"marks":5972,"value":5973,"nodeType":865},{},[],"Stopping attacks that are designed to evade established controls is in our DNA — it’s the reason Push was founded. ",{"data":5975,"content":5976,"nodeType":866},{},[5977],{"data":5978,"marks":5979,"value":5980,"nodeType":865},{},[],"The browser is the gateway to to the apps and identities that attackers are now targeting, with many attacks taking place inside the user’s browser — whether that’s entering credentials onto a phishing page, approving a malicious OAuth grant, installing a risky browser extension, or insecurely accessing an app with a weak password and no MFA. ",{"data":5982,"content":5983,"nodeType":866},{},[5984],{"data":5985,"marks":5986,"value":5987,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive detection and response capabilities against attacks like AiTM phishing, credential stuffing, malicious browser extensions, malicious OAuth grants, ClickFix, and session hijacking. You don’t need to wait until it all goes wrong either — you can use Push to proactively find and fix vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, and more to harden your attack surface.",{"data":5989,"content":5990,"nodeType":866},{},[5991,5994,6001,6004,6011],{"data":5992,"marks":5993,"value":4921,"nodeType":865},{},[],{"data":5995,"content":5996,"nodeType":1102},{"uri":4924},[5997],{"data":5998,"marks":5999,"value":4929,"nodeType":865},{},[6000],{"type":4537},{"data":6002,"marks":6003,"value":1773,"nodeType":865},{},[],{"data":6005,"content":6006,"nodeType":1102},{"uri":4935},[6007],{"data":6008,"marks":6009,"value":4940,"nodeType":865},{},[6010],{"type":4537},{"data":6012,"marks":6013,"value":1151,"nodeType":865},{},[],"\"Scattered Lapsus$ Hunters\" — how modern attackers exploit the gaps in your security stack ","How Scattered Lapsus$ Hunters breaches demonstrate the evolution of attacker TTPs, shaping the future of cyber attacks.","2025-11-13T00:00:00.000Z","scattered-lapsus-hunters",{"items":6019},[6020,6022],{"sys":6021,"name":2524},{"id":2523},{"sys":6023,"name":342},{"id":2527},{"items":6025},[6026],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":6030},"Dan Green","Dan","Threat Research",{"url":6031},"https://images.ctfassets.net/y1cdw1ablpvd/7jik1VhFgA3kgzXBXTm2Vw/fcd8c171da644903d0827eafcfbcaad0/Dan_Headshot_2025.png",{"__typename":2239,"sys":6033,"content":6035,"title":6821,"synopsis":6822,"hashTags":59,"publishedDate":6823,"slug":6824,"tagsCollection":6825,"authorsCollection":6831},{"id":6034},"31m73YMGdCyqVmjHulBwER",{"json":6036},{"data":6037,"content":6038,"nodeType":2232},{},[6039,6046,6079,6086,6092,6099,6131,6138,6144,6147,6155,6162,6169,6227,6245,6257,6264,6270,6273,6281,6297,6303,6310,6316,6323,6361,6367,6370,6378,6385,6392,6520,6526,6557,6564,6567,6575,6582,6589,6631,6659,6666,6742,6748,6751,6759,6766,6786,6789,6797,6804],{"data":6040,"content":6041,"nodeType":866},{},[6042],{"data":6043,"marks":6044,"value":6045,"nodeType":865},{},[],"Until recently, the cyber attacker methodology behind the biggest breaches of the last decade or so has been pretty consistent:",{"data":6047,"content":6048,"nodeType":891},{},[6049,6059,6069],{"data":6050,"content":6051,"nodeType":880},{},[6052],{"data":6053,"content":6054,"nodeType":866},{},[6055],{"data":6056,"marks":6057,"value":6058,"nodeType":865},{},[],"Compromise an endpoint via software exploit, or social engineering a user to run malware on their device; ",{"data":6060,"content":6061,"nodeType":880},{},[6062],{"data":6063,"content":6064,"nodeType":866},{},[6065],{"data":6066,"marks":6067,"value":6068,"nodeType":865},{},[],"Find ways to move laterally inside the network and compromise privileged identities;",{"data":6070,"content":6071,"nodeType":880},{},[6072],{"data":6073,"content":6074,"nodeType":866},{},[6075],{"data":6076,"marks":6077,"value":6078,"nodeType":865},{},[],"Repeat as needed until you can execute your desired attack — usually stealing data from file shares, deploying ransomware, or both. ",{"data":6080,"content":6081,"nodeType":866},{},[6082],{"data":6083,"marks":6084,"value":6085,"nodeType":865},{},[],"But attacks have fundamentally changed as networks have evolved. With the SaaS-ification of enterprise IT, core business systems aren’t locally deployed and centrally managed in the way they used to be. Instead, they’re logged into over the internet, via a web browser.",{"data":6087,"content":6091,"nodeType":907},{"target":6088},{"sys":6089},{"id":6090,"type":904,"linkType":905},"4h4hUYAghbZavOwjRTnBe2",[],{"data":6093,"content":6094,"nodeType":866},{},[6095],{"data":6096,"marks":6097,"value":6098,"nodeType":865},{},[],"Under the shared responsibility model, the part that’s left to the business consuming a SaaS service is mostly constrained to how they manage identities — the vehicle by which the app is accessed and used by the workforce. It’s no surprise that this has become the soft underbelly in the crosshairs of attackers. ",{"data":6100,"content":6101,"nodeType":866},{},[6102,6106,6114,6118,6127],{"data":6103,"marks":6104,"value":6105,"nodeType":865},{},[],"We’ve seen this time and again in the biggest breaches of recent years, with the highlights including the massive ",{"data":6107,"content":6108,"nodeType":1102},{"uri":4601},[6109],{"data":6110,"marks":6111,"value":6113,"nodeType":865},{},[6112],{"type":4537},"Snowflake campaign in 2024",{"data":6115,"marks":6116,"value":6117,"nodeType":865},{},[]," and the ",{"data":6119,"content":6121,"nodeType":1102},{"uri":6120},"https://pushsecurity.com/blog/key-takeaways-from-the-scattered-spider-attacks-on-insurance-firms/",[6122],{"data":6123,"marks":6124,"value":6126,"nodeType":865},{},[6125],{"type":4537},"2025 crime wave attributed to Scattered Spider",{"data":6128,"marks":6129,"value":6130,"nodeType":865},{},[],".   ",{"data":6132,"content":6133,"nodeType":866},{},[6134],{"data":6135,"marks":6136,"value":6137,"nodeType":865},{},[],"These attacks are so successful because while attackers have moved with the changes to enterprise IT, security hasn’t really kept up. ",{"data":6139,"content":6143,"nodeType":907},{"target":6140},{"sys":6141},{"id":6142,"type":904,"linkType":905},"xH0ZqgKQXCRRZGYVs6xt6",[],{"data":6145,"content":6146,"nodeType":938},{},[],{"data":6148,"content":6149,"nodeType":948},{},[6150],{"data":6151,"marks":6152,"value":6154,"nodeType":865},{},[6153],{"type":946},"The browser is the new battleground — and a security blind spot",{"data":6156,"content":6157,"nodeType":866},{},[6158],{"data":6159,"marks":6160,"value":6161,"nodeType":865},{},[],"Taking over workforce identities is the first objective for attackers looking to target an organization, and the browser is the place where the attacks against users happen. This is because it’s where these digital identities are created and used — and their credentials and sessions live. This is what the attacker wants to get their hands on. ",{"data":6163,"content":6164,"nodeType":866},{},[6165],{"data":6166,"marks":6167,"value":6168,"nodeType":865},{},[],"Stolen credentials can be used as part of targeted attacks or in broader credential stuffing (cycling known username and credential pairs against various apps and platforms), while stolen session tokens can be used to log in directly to an active session, bypassing the authentication process. ",{"data":6170,"content":6171,"nodeType":866},{},[6172,6176,6181,6184,6189,6193,6198,6201,6206,6209,6214,6218,6223],{"data":6173,"marks":6174,"value":6175,"nodeType":865},{},[],"There are a few different techniques that attackers can use to get access to these identities. Attackers harvest stolen credentials from various places — ",{"data":6177,"marks":6178,"value":6180,"nodeType":865},{},[6179],{"type":946},"data breach dumps",{"data":6182,"marks":6183,"value":3531,"nodeType":865},{},[],{"data":6185,"marks":6186,"value":6188,"nodeType":865},{},[6187],{"type":946},"mass",{"data":6190,"marks":6191,"value":6192,"nodeType":865},{},[]," ",{"data":6194,"marks":6195,"value":6197,"nodeType":865},{},[6196],{"type":946},"credential",{"data":6199,"marks":6200,"value":6192,"nodeType":865},{},[],{"data":6202,"marks":6203,"value":6205,"nodeType":865},{},[6204],{"type":946},"phishing campaigns,",{"data":6207,"marks":6208,"value":6192,"nodeType":865},{},[],{"data":6210,"marks":6211,"value":6213,"nodeType":865},{},[6212],{"type":946},"infostealer logs",{"data":6215,"marks":6216,"value":6217,"nodeType":865},{},[],", even ",{"data":6219,"marks":6220,"value":6222,"nodeType":865},{},[6221],{"type":946},"malicious browser extensions",{"data":6224,"marks":6225,"value":6226,"nodeType":865},{},[]," that they’ve tricked an employee into installing. In fact, the cyber crime ecosystem itself has shifted on its axis to cater to this, with hackers specifically taking on the role of harvesting credentials and establishing account access for others to exploit. ",{"data":6228,"content":6229,"nodeType":866},{},[6230,6234,6241],{"data":6231,"marks":6232,"value":6233,"nodeType":865},{},[],"The high-profile ",{"data":6235,"content":6236,"nodeType":1102},{"uri":4601},[6237],{"data":6238,"marks":6239,"value":4607,"nodeType":865},{},[6240],{"type":4537},{"data":6242,"marks":6243,"value":6244,"nodeType":865},{},[]," breaches in 2024 signalled a watershed moment in the shift to identity-driven breaches, where attackers logged into accounts across hundreds of customer tenants using stolen credentials. One of the primary sources of the stolen credentials used in the attacks were infostealer logs dating back to 2020 — breached passwords that hadn’t been rotated or mitigated with MFA. ",{"data":6246,"content":6247,"nodeType":866},{},[6248,6252],{"data":6249,"marks":6250,"value":6251,"nodeType":865},{},[],"Infostealers are notable because they’re an endpoint malware attack designed to harvest credentials and session tokens (often from the browser) to enable the attacker to then log into those services… through their own web browser. ",{"data":6253,"marks":6254,"value":6256,"nodeType":865},{},[6255],{"type":946},"So, even today’s endpoint attacks are seeing the attacker pivot back into the browser in order to get to identities — the key to the online apps and services where exploitable data and functionality now resides. ",{"data":6258,"content":6259,"nodeType":866},{},[6260],{"data":6261,"marks":6262,"value":6263,"nodeType":865},{},[],"The problem here is that this is a blind spot for the security tools we’re currently reliant upon — which don’t have the fine-grained visibility required. This is very similar to the challenge that the industry faced prior to the introduction of EDR in the 2010s — the main sources of data are looking from the outside-in, lacking the process-level visibility and context to be able to detect and stop attacks as they happen.",{"data":6265,"content":6269,"nodeType":907},{"target":6266},{"sys":6267},{"id":6268,"type":904,"linkType":905},"2qoMH6qCNJc7it7sTuKl4F",[],{"data":6271,"content":6272,"nodeType":938},{},[],{"data":6274,"content":6275,"nodeType":948},{},[6276],{"data":6277,"marks":6278,"value":6280,"nodeType":865},{},[6279],{"type":946},"Identity is the prize, browser is the platform — and phishing is the weapon of choice",{"data":6282,"content":6283,"nodeType":866},{},[6284,6288,6293],{"data":6285,"marks":6286,"value":6287,"nodeType":865},{},[],"But the technique that’s STILL driving the most impactful identity-driven breaches? ",{"data":6289,"marks":6290,"value":6292,"nodeType":865},{},[6291],{"type":946},"It’s phishing",{"data":6294,"marks":6295,"value":6296,"nodeType":865},{},[],". Phishing for credentials, sessions, OAuth consent, authorization codes. Phishing via email, instant messenger, social media, malicious Google ads… it all happens in, or leads to, the browser. ",{"data":6298,"content":6302,"nodeType":907},{"target":6299},{"sys":6300},{"id":6301,"type":904,"linkType":905},"6Gsd3G0sOibNxgVLimb2wV",[],{"data":6304,"content":6305,"nodeType":866},{},[6306],{"data":6307,"marks":6308,"value":6309,"nodeType":865},{},[],"And modern phishing attacks are more effective than ever. Today, phishing operates on an industrial scale, using an array of obfuscation and detection evasion techniques to block email and network security tools from intercepting them. Probably the most common example today is the use of bot protection (think CAPTCHA or Cloudflare Turnstile), using legitimate anti-spam features to block security tools. ",{"data":6311,"content":6315,"nodeType":907},{"target":6312},{"sys":6313},{"id":6314,"type":904,"linkType":905},"6M1My4lSKItu6Qdv4hO1RA",[],{"data":6317,"content":6318,"nodeType":866},{},[6319],{"data":6320,"marks":6321,"value":6322,"nodeType":865},{},[],"The latest generation of fully customized AitM phishing kits are dynamically obfuscating the code that loads the web page, implementing custom CAPTCHA, and using runtime anti-analysis features, making them increasingly difficult to detect. The ways in which links are delivered has also increased in sophistication, with more delivery channels (as we showed above) and the use of legitimate SaaS services for camouflage. ",{"data":6324,"content":6325,"nodeType":866},{},[6326,6330,6335,6339,6344,6348,6357],{"data":6327,"marks":6328,"value":6329,"nodeType":865},{},[],"And the latest trends indicate that attackers are responding to increasingly hardened IdP/SSO configuration by exploiting alternative phishing techniques that ",{"data":6331,"marks":6332,"value":6334,"nodeType":865},{},[6333],{"type":946},"circumvent MFA and passkeys",{"data":6336,"marks":6337,"value":6338,"nodeType":865},{},[],", most commonly by ",{"data":6340,"marks":6341,"value":6343,"nodeType":865},{},[6342],{"type":946},"downgrading to a phishable backup authentication method",{"data":6345,"marks":6346,"value":6347,"nodeType":865},{},[]," — which you can see in action below, and ",{"data":6349,"content":6351,"nodeType":1102},{"uri":6350},"https://pushsecurity.com/blog/mfa-downgrade-attacks/",[6352],{"data":6353,"marks":6354,"value":6356,"nodeType":865},{},[6355],{"type":4537},"read more about here",{"data":6358,"marks":6359,"value":6360,"nodeType":865},{},[],".  ",{"data":6362,"content":6366,"nodeType":907},{"target":6363},{"sys":6364},{"id":6365,"type":904,"linkType":905},"54I3YQ2gK26a8FIocQ3WYT",[],{"data":6368,"content":6369,"nodeType":938},{},[],{"data":6371,"content":6372,"nodeType":948},{},[6373],{"data":6374,"marks":6375,"value":6377,"nodeType":865},{},[6376],{"type":946},"Identities are the lowest-hanging fruit for attackers to aim for",{"data":6379,"content":6380,"nodeType":866},{},[6381],{"data":6382,"marks":6383,"value":6384,"nodeType":865},{},[],"The goal of the modern attacker, and the easiest way into your business’s digital environment, is to compromise identities. Whether you’re dealing with phishing attacks, malicious browser extensions, or infostealer malware, the objective remains the same — account takeover. ",{"data":6386,"content":6387,"nodeType":866},{},[6388],{"data":6389,"marks":6390,"value":6391,"nodeType":865},{},[],"Organizations are dealing with a vast and vulnerable attack surface consisting of:",{"data":6393,"content":6394,"nodeType":891},{},[6395,6417,6438,6460],{"data":6396,"content":6397,"nodeType":880},{},[6398],{"data":6399,"content":6400,"nodeType":866},{},[6401,6404,6413],{"data":6402,"marks":6403,"value":21,"nodeType":865},{},[],{"data":6405,"content":6407,"nodeType":1102},{"uri":6406},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/",[6408],{"data":6409,"marks":6410,"value":6412,"nodeType":865},{},[6411],{"type":4537},"Hundreds of applications, with thousands of accounts",{"data":6414,"marks":6415,"value":6416,"nodeType":865},{},[]," spread across the app estate.",{"data":6418,"content":6419,"nodeType":880},{},[6420],{"data":6421,"content":6422,"nodeType":866},{},[6423,6427,6435],{"data":6424,"marks":6425,"value":6426,"nodeType":865},{},[],"Accounts vulnerable to MFA-bypass phishing kits, because they are using a login method that is not phishing-resistant, or because ",{"data":6428,"content":6429,"nodeType":1102},{"uri":6350},[6430],{"data":6431,"marks":6432,"value":6434,"nodeType":865},{},[6433],{"type":4537},"the login method can be downgraded",{"data":6436,"marks":6437,"value":1151,"nodeType":865},{},[],{"data":6439,"content":6440,"nodeType":880},{},[6441],{"data":6442,"content":6443,"nodeType":866},{},[6444,6448,6456],{"data":6445,"marks":6446,"value":6447,"nodeType":865},{},[],"Accounts with a weak, reused, or breached password and no MFA altogether (usually the result of a forgotten-about ",{"data":6449,"content":6450,"nodeType":1102},{"uri":5377},[6451],{"data":6452,"marks":6453,"value":6455,"nodeType":865},{},[6454],{"type":4537},"ghost login",{"data":6457,"marks":6458,"value":6459,"nodeType":865},{},[],").",{"data":6461,"content":6462,"nodeType":880},{},[6463],{"data":6464,"content":6465,"nodeType":866},{},[6466,6470,6479,6482,6491,6495,6504,6507,6516],{"data":6467,"marks":6468,"value":6469,"nodeType":865},{},[],"Bypassing the authentication process entirely to evade otherwise phishing-resistant authentication methods, by abusing features like ",{"data":6471,"content":6473,"nodeType":1102},{"uri":6472},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_keys/description.md",[6474],{"data":6475,"marks":6476,"value":6478,"nodeType":865},{},[6477],{"type":4537},"API key creation",{"data":6480,"marks":6481,"value":3531,"nodeType":865},{},[],{"data":6483,"content":6485,"nodeType":1102},{"uri":6484},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_specific_password_phishing/description.md",[6486],{"data":6487,"marks":6488,"value":6490,"nodeType":865},{},[6489],{"type":4537},"app-specific passwords",{"data":6492,"marks":6493,"value":6494,"nodeType":865},{},[],", OAuth ",{"data":6496,"content":6498,"nodeType":1102},{"uri":6497},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/consent_phishing/description.md",[6499],{"data":6500,"marks":6501,"value":6503,"nodeType":865},{},[6502],{"type":4537},"consent phishing",{"data":6505,"marks":6506,"value":3531,"nodeType":865},{},[],{"data":6508,"content":6510,"nodeType":1102},{"uri":6509},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/cross-idp_impersonation/description.md",[6511],{"data":6512,"marks":6513,"value":6515,"nodeType":865},{},[6514],{"type":4537},"cross-IdP impersonation",{"data":6517,"marks":6518,"value":6519,"nodeType":865},{},[],", and more.  ",{"data":6521,"content":6525,"nodeType":907},{"target":6522},{"sys":6523},{"id":6524,"type":904,"linkType":905},"3WFzina1t5j6bDlTlGQA0l",[],{"data":6527,"content":6528,"nodeType":866},{},[6529,6533,6542,6546,6553],{"data":6530,"marks":6531,"value":6532,"nodeType":865},{},[],"A key driver of identity vulnerability is the ",{"data":6534,"content":6536,"nodeType":1102},{"uri":6535},"https://pushsecurity.com/blog/minimum-viable-identity-security/",[6537],{"data":6538,"marks":6539,"value":6541,"nodeType":865},{},[6540],{"type":4537},"huge variance in the configurability of accounts per application",{"data":6543,"marks":6544,"value":6545,"nodeType":865},{},[],", with different levels of centralized visibility and security control of identities provided — for example, while one app can be locked down to only accept SSO logins via SAML and automatically remove any unused passwords, another provides no control or visibility of login method or MFA status (another big driver of the ",{"data":6547,"content":6548,"nodeType":1102},{"uri":4601},[6549],{"data":6550,"marks":6551,"value":4607,"nodeType":865},{},[6552],{"type":4537},{"data":6554,"marks":6555,"value":6556,"nodeType":865},{},[]," breaches last year). Unfortunately, as a by-product of product-led growth and something that is compounded by every new SaaS startup that hits the market, this situation doesn’t look like it’s going to change anytime soon. ",{"data":6558,"content":6559,"nodeType":866},{},[6560],{"data":6561,"marks":6562,"value":6563,"nodeType":865},{},[],"The end result is that identities are misconfigured, invisible to the security team, and routinely exploited by commodity attacker tooling. It’s no surprise that they’re the primary target for attackers today. ",{"data":6565,"content":6566,"nodeType":938},{},[],{"data":6568,"content":6569,"nodeType":948},{},[6570],{"data":6571,"marks":6572,"value":6574,"nodeType":865},{},[6573],{"type":946},"The solution: The browser as a telemetry source and control point",{"data":6576,"content":6577,"nodeType":866},{},[6578],{"data":6579,"marks":6580,"value":6581,"nodeType":865},{},[],"Because identity attacks play out in the browser, it’s the perfect place for security teams to observe, intercept, and shut down these attacks. ",{"data":6583,"content":6584,"nodeType":866},{},[6585],{"data":6586,"marks":6587,"value":6588,"nodeType":865},{},[],"The browser has a number of advantages over the different places where identity can be observed and protected, because:",{"data":6590,"content":6591,"nodeType":891},{},[6592,6602,6612],{"data":6593,"content":6594,"nodeType":880},{},[6595],{"data":6596,"content":6597,"nodeType":866},{},[6598],{"data":6599,"marks":6600,"value":6601,"nodeType":865},{},[],"You aren’t limited to the apps and identities directly connected to your IdP (a fraction of your workforce identity sprawl). ",{"data":6603,"content":6604,"nodeType":880},{},[6605],{"data":6606,"content":6607,"nodeType":866},{},[6608],{"data":6609,"marks":6610,"value":6611,"nodeType":865},{},[],"You aren’t limited to the apps that you know about and manage centrally — you can observe every login that passes through the browser.",{"data":6613,"content":6614,"nodeType":880},{},[6615],{"data":6616,"content":6617,"nodeType":866},{},[6618,6622,6627],{"data":6619,"marks":6620,"value":6621,"nodeType":865},{},[],"You can observe all the properties of a login, including the login method, MFA method, etc. You’d otherwise need API access to ",{"data":6623,"marks":6624,"value":6626,"nodeType":865},{},[6625],{"type":979},"maybe",{"data":6628,"marks":6629,"value":6630,"nodeType":865},{},[]," get this information (depending on whether an API is provided and whether this specific data can be interrogated, also not standard for many apps). ",{"data":6632,"content":6633,"nodeType":866},{},[6634,6638,6643,6647,6655],{"data":6635,"marks":6636,"value":6637,"nodeType":865},{},[],"It’s obvious with all that we’ve covered so far that fixing every identity vulnerability is an ominous task — the SaaS ecosystem itself is working against you. ",{"data":6639,"marks":6640,"value":6642,"nodeType":865},{},[6641],{"type":946},"This is why detecting and responding to identity attacks is essential. ",{"data":6644,"marks":6645,"value":6646,"nodeType":865},{},[],"Because identity compromise almost always involves phishing or social engineering a user to perform an action in their browser (with some exceptions — like the ",{"data":6648,"content":6649,"nodeType":1102},{"uri":5578},[6650],{"data":6651,"marks":6652,"value":6654,"nodeType":865},{},[6653],{"type":4537},"Scattered Spider-related help desk attacks",{"data":6656,"marks":6657,"value":6658,"nodeType":865},{},[]," seen recently), it’s also the perfect place to monitor for and intercept attacks. ",{"data":6660,"content":6661,"nodeType":866},{},[6662],{"data":6663,"marks":6664,"value":6665,"nodeType":865},{},[],"In the browser, you gather deep, contextualized information about page behavior and user inputs that can be used to detect and shut down risky scenarios in real time. Take the example of phishing pages. Because Push operates in the browser, it sees everything:",{"data":6667,"content":6668,"nodeType":891},{},[6669,6679,6689,6699,6722,6732],{"data":6670,"content":6671,"nodeType":880},{},[6672],{"data":6673,"content":6674,"nodeType":866},{},[6675],{"data":6676,"marks":6677,"value":6678,"nodeType":865},{},[],"The page layout.",{"data":6680,"content":6681,"nodeType":880},{},[6682],{"data":6683,"content":6684,"nodeType":866},{},[6685],{"data":6686,"marks":6687,"value":6688,"nodeType":865},{},[],"Where the user came from (through the whole redirect chain).",{"data":6690,"content":6691,"nodeType":880},{},[6692],{"data":6693,"content":6694,"nodeType":866},{},[6695],{"data":6696,"marks":6697,"value":6698,"nodeType":865},{},[],"Page interaction events — e.g. tabs opened and closed, popup windows, forms submitted, etc.",{"data":6700,"content":6701,"nodeType":880},{},[6702],{"data":6703,"content":6704,"nodeType":866},{},[6705,6709,6718],{"data":6706,"marks":6707,"value":6708,"nodeType":865},{},[],"The password they enter ",{"data":6710,"content":6712,"nodeType":1102},{"uri":6711},"https://pushsecurity.com/help/10043/#how-push-securely-analyzes-passwords",[6713],{"data":6714,"marks":6715,"value":6717,"nodeType":865},{},[6716],{"type":4537},"(as a salted, abbreviated hash)",{"data":6719,"marks":6720,"value":6721,"nodeType":865},{},[],", and whether a password was typed or copied, and where from.",{"data":6723,"content":6724,"nodeType":880},{},[6725],{"data":6726,"content":6727,"nodeType":866},{},[6728],{"data":6729,"marks":6730,"value":6731,"nodeType":865},{},[],"What scripts are running on the page and whether they are potentially malicious.",{"data":6733,"content":6734,"nodeType":880},{},[6735],{"data":6736,"content":6737,"nodeType":866},{},[6738],{"data":6739,"marks":6740,"value":6741,"nodeType":865},{},[],"Where credentials are being sent.",{"data":6743,"content":6747,"nodeType":907},{"target":6744},{"sys":6745},{"id":6746,"type":904,"linkType":905},"6kQejVS63FQ6Oy8nIm6UlV",[],{"data":6749,"content":6750,"nodeType":938},{},[],{"data":6752,"content":6753,"nodeType":948},{},[6754],{"data":6755,"marks":6756,"value":6758,"nodeType":865},{},[6757],{"type":946},"Conclusion",{"data":6760,"content":6761,"nodeType":866},{},[6762],{"data":6763,"marks":6764,"value":6765,"nodeType":865},{},[],"Identity attacks are the biggest unsolved problem facing security teams today and the leading cause of security breaches. At the same time, the browser presents security teams with all the tools they need to prevent, detect, and respond to identity-based attacks — proactively by finding and fixing identity vulnerabilities, and reactively by detecting and blocking attacks against users in real time. ",{"data":6767,"content":6768,"nodeType":866},{},[6769,6773,6782],{"data":6770,"marks":6771,"value":6772,"nodeType":865},{},[],"Organizations need to move past the old ways of doing identity security — relying on MFA attestations, identity management dashboards, and ",{"data":6774,"content":6776,"nodeType":1102},{"uri":6775},"https://pushsecurity.com/blog/three-reasons-why-browser-is-best-for-stopping-phishing-attacks/",[6777],{"data":6778,"marks":6779,"value":6781,"nodeType":865},{},[6780],{"type":4537},"legacy email and network anti-phishing tools",{"data":6783,"marks":6784,"value":6785,"nodeType":865},{},[],". And there’s no better place to stop these attacks than in the browser. ",{"data":6787,"content":6788,"nodeType":938},{},[],{"data":6790,"content":6791,"nodeType":948},{},[6792],{"data":6793,"marks":6794,"value":6796,"nodeType":865},{},[6795],{"type":946},"Find out more",{"data":6798,"content":6799,"nodeType":866},{},[6800],{"data":6801,"marks":6802,"value":6803,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive detection and response capabilities against the leading cause of breaches. Push blocks identity attacks like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across the apps that your employees use, like ghost logins, SSO coverage gaps, MFA gaps, vulnerable passwords, risky OAuth integrations, and more.",{"data":6805,"content":6806,"nodeType":866},{},[6807,6811,6818],{"data":6808,"marks":6809,"value":6810,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and stop attacks in the browser, ",{"data":6812,"content":6813,"nodeType":1102},{"uri":4935},[6814],{"data":6815,"marks":6816,"value":4940,"nodeType":865},{},[6817],{"type":4537},{"data":6819,"marks":6820,"value":1151,"nodeType":865},{},[],"How the browser became the main cyber battleground","How attacks have moved away from endpoints and internal networks to the browser — a blind spot for traditional security tools.","2025-08-15T00:00:00.000Z","how-the-browser-became-the-main-cyber-battleground",{"items":6826},[6827,6829],{"sys":6828,"name":342},{"id":2527},{"sys":6830,"name":2524},{"id":2523},{"items":6832},[6833],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":6834},{"url":6031},{"__typename":2239,"sys":6836,"content":6838,"title":7491,"synopsis":7492,"hashTags":59,"publishedDate":7493,"slug":7494,"tagsCollection":7495,"authorsCollection":7501},{"id":6837},"1qegIy4rMdm5XZXnIEoKpE",{"json":6839},{"data":6840,"content":6841,"nodeType":2232},{},[6842,6849,6856,6881,6887,6894,6901,6904,6911,6931,6937,6944,6987,6994,7001,7008,7015,7022,7029,7048,7056,7059,7066,7073,7080,7087,7094,7101,7108,7156,7163,7170,7177,7197,7204,7211,7218,7225,7232,7239,7246,7264,7281,7324,7331,7338,7404,7411,7414,7421,7437,7456,7463,7469,7475,7478,7484],{"data":6843,"content":6844,"nodeType":866},{},[6845],{"data":6846,"marks":6847,"value":6848,"nodeType":865},{},[],"The field of threat detection and security monitoring has changed significantly over the last decade. Security tools and product categories have been added and replaced, specialist disciplines established, and methodologies created. ",{"data":6850,"content":6851,"nodeType":866},{},[6852],{"data":6853,"marks":6854,"value":6855,"nodeType":865},{},[],"Naturally, defenders have had to mature their approach because of the changing nature of the threat facing organizations. Attackers have always looked for new ways to target their victims, and naturally, defenders have had to adapt, forcing attackers to change things up… it’s a cat and mouse game. ",{"data":6857,"content":6858,"nodeType":866},{},[6859,6863,6872,6876],{"data":6860,"marks":6861,"value":6862,"nodeType":865},{},[],"Blue teamers have used the concept of the ",{"data":6864,"content":6866,"nodeType":1102},{"uri":6865},"https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html",[6867],{"data":6868,"marks":6869,"value":6871,"nodeType":865},{},[6870],{"type":4537},"Pyramid of Pain",{"data":6873,"marks":6874,"value":6875,"nodeType":865},{},[]," for over a decade. The logic is simple: ",{"data":6877,"marks":6878,"value":6880,"nodeType":865},{},[6879],{"type":946},"Focus on detecting and responding to indicators that are hard for attackers to change. ",{"data":6882,"content":6886,"nodeType":907},{"target":6883},{"sys":6884},{"id":6885,"type":904,"linkType":905},"6cG2fx3AikwptyEyXKrYCK",[],{"data":6888,"content":6889,"nodeType":866},{},[6890],{"data":6891,"marks":6892,"value":6893,"nodeType":865},{},[],"If an attacker only has to tweak a variable to get around your detection rule, like adding a space to change a hash value, it’s probably not a very good detection. It’s not going to remain effective for long and you’re always going to be one step behind the attacker – waiting for them to make their next move so you can react. This usually ends up meaning that attackers enjoy at least some success before they can be shut out again. ",{"data":6895,"content":6896,"nodeType":866},{},[6897],{"data":6898,"marks":6899,"value":6900,"nodeType":865},{},[],"The Pyramid of Pain – and the goal of implementing hard-to-bypass detections that hit attackers where it hurts – is central to our design philosophy. But before we get into how we apply this approach, and the types of controls we’ve created as a result, it’s useful to look at how IT and security have changed since the Pyramid was created more than a decade ago. ",{"data":6902,"content":6903,"nodeType":938},{},[],{"data":6905,"content":6906,"nodeType":948},{},[6907],{"data":6908,"marks":6909,"value":6910,"nodeType":865},{},[],"A new era for cyber security",{"data":6912,"content":6913,"nodeType":866},{},[6914,6918,6927],{"data":6915,"marks":6916,"value":6917,"nodeType":865},{},[],"We’ve spoken a lot about how we’re in the midst of a new era in cybersecurity, in which identity is now the outermost digital perimeter for security teams to defend. (",{"data":6919,"content":6921,"nodeType":1102},{"uri":6920},"https://pushsecurity.com/resources/video/the-new-saas-cyber-kill-chain-so-con-2024/",[6922],{"data":6923,"marks":6924,"value":6926,"nodeType":865},{},[6925],{"type":4537},"You’ll be familiar with this if you’ve seen any of Luke’s talks on the New SaaS Cyber Kill Chain.",{"data":6928,"marks":6929,"value":6930,"nodeType":865},{},[],") ",{"data":6932,"content":6936,"nodeType":907},{"target":6933},{"sys":6934},{"id":6935,"type":904,"linkType":905},"6nYSZAYpsbj78jKm0q75zs",[],{"data":6938,"content":6939,"nodeType":866},{},[6940],{"data":6941,"marks":6942,"value":6943,"nodeType":865},{},[],"This is primarily because modern working is no longer contained to a heavily centralized corporate network, and instead happens primarily in applications accessed over the internet via web browser.",{"data":6945,"content":6946,"nodeType":866},{},[6947,6951,6959,6963,6971,6975,6983],{"data":6948,"marks":6949,"value":6950,"nodeType":865},{},[],"In this new world, attacks don’t even have to touch the old perimeters, because all the data and functionality they could want exists on the public internet. As a result, we’re seeing more and more ",{"data":6952,"content":6954,"nodeType":1102},{"uri":6953},"https://pushsecurity.com/blog/saas-attack-techniques/",[6955],{"data":6956,"marks":6957,"value":6958,"nodeType":865},{},[],"attacks targeting SaaS apps",{"data":6960,"marks":6961,"value":6962,"nodeType":865},{},[],", with the entire attack chain being concluded outside customer networks, not touching any traditional endpoints or networks. The ",{"data":6964,"content":6966,"nodeType":1102},{"uri":6965},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024",[6967],{"data":6968,"marks":6969,"value":6970,"nodeType":865},{},[],"recent attacks on Snowflake customers",{"data":6972,"marks":6973,"value":6974,"nodeType":865},{},[],", hailed ",{"data":6976,"content":6978,"nodeType":1102},{"uri":6977},"https://www.wired.com/story/snowflake-breach-advanced-auto-parts-lendingtree/",[6979],{"data":6980,"marks":6981,"value":6982,"nodeType":865},{},[],"one of the biggest breaches in history",{"data":6984,"marks":6985,"value":6986,"nodeType":865},{},[],", demonstrate this risk all too well. ",{"data":6988,"content":6989,"nodeType":866},{},[6990],{"data":6991,"marks":6992,"value":6993,"nodeType":865},{},[],"This creates a problem for security teams looking to detect and respond to these attacks. ",{"data":6995,"content":6996,"nodeType":1218},{},[6997],{"data":6998,"marks":6999,"value":7000,"nodeType":865},{},[],"Attacks today are shorter and faster, but just as dangerous",{"data":7002,"content":7003,"nodeType":866},{},[7004],{"data":7005,"marks":7006,"value":7007,"nodeType":865},{},[],"Detecting and responding to identity attacks – phishing, credential stuffing, etc. – used to be just one possible method of initial access in quite a lengthy Kill Chain that stretched from the compromise of the user device, pivoting to internal network resources, escalating privileges, moving laterally, and finally achieving their objectives.",{"data":7009,"content":7010,"nodeType":866},{},[7011],{"data":7012,"marks":7013,"value":7014,"nodeType":865},{},[],"This meant that defenders could adopt an assumed compromise mentality and build layered detections, as well as proactively hunting for threats across these various stages and layers of the network. The more actions an attacker has to perform, the more opportunities for detection, and the higher the likelihood that they’ll be caught in the act before any real, lasting damage can be caused. ",{"data":7016,"content":7017,"nodeType":866},{},[7018],{"data":7019,"marks":7020,"value":7021,"nodeType":865},{},[],"Today, attackers have a lot of opportunities to cause significant damage for much less effort than before. For example, if the goal is to compromise an app like Snowflake and dump the data from it, the Kill Chain is way shorter than a traditional network-based attack. And all the great tools and security products you have, like EDR, don’t come into play. ",{"data":7023,"content":7024,"nodeType":866},{},[7025],{"data":7026,"marks":7027,"value":7028,"nodeType":865},{},[],"This means that the initial layer of anti-account takeover controls are much more important in this context. But, the historical detections in this space – email gateway security products, analyzing web pages for malicious content, and URL blocklisting – are either less relevant, or built upon easy to bypass detections toward the bottom of the Pyramid of Pain. ",{"data":7030,"content":7031,"nodeType":866},{},[7032,7036,7044],{"data":7033,"marks":7034,"value":7035,"nodeType":865},{},[],"As an example, ",{"data":7037,"content":7039,"nodeType":1102},{"uri":7038},"https://pushsecurity.com/blog/how-aitm-phishing-kits-evade-detection/",[7040],{"data":7041,"marks":7042,"value":7043,"nodeType":865},{},[],"we recently published an article on all the ways that AitM phishing sites are evading detection",{"data":7045,"marks":7046,"value":7047,"nodeType":865},{},[],". TL;DR – there are a lot, and they seem to be quite effective. But this is partly because the majority of the detections they're trying to avoid are built on shaky ground.   ",{"data":7049,"content":7050,"nodeType":866},{},[7051],{"data":7052,"marks":7053,"value":7055,"nodeType":865},{},[7054],{"type":946},"So what? Well, it’s clear that the controls that the industry has relied on in the past to stop identity attacks are too easy to bypass, and are no longer sufficient. ",{"data":7057,"content":7058,"nodeType":938},{},[],{"data":7060,"content":7061,"nodeType":948},{},[7062],{"data":7063,"marks":7064,"value":7065,"nodeType":865},{},[],"Building effective identity threat detection controls",{"data":7067,"content":7068,"nodeType":866},{},[7069],{"data":7070,"marks":7071,"value":7072,"nodeType":865},{},[],"Now we’ve covered the problem that we set out to solve, let’s look at what we’re doing differently. ",{"data":7074,"content":7075,"nodeType":866},{},[7076],{"data":7077,"marks":7078,"value":7079,"nodeType":865},{},[],"In order to climb the Pyramid toward the apex, you need to find ways to detect increasingly generic parts of an attack technique. So you want to avoid things like what a specific malware’s code looks like, or where it connects back to. But what the malware does, or what happens when it runs, is more generic, and therefore more interesting to us.  ",{"data":7081,"content":7082,"nodeType":866},{},[7083],{"data":7084,"marks":7085,"value":7086,"nodeType":865},{},[],"The shift from static code signatures and fuzzy hashes to dynamic analysis of what code does on a live system is at the heart of why EDR killed antivirus a decade ago. It proved at-scale the value of moving detections up the pyramid.",{"data":7088,"content":7089,"nodeType":866},{},[7090],{"data":7091,"marks":7092,"value":7093,"nodeType":865},{},[],"We’re always on the lookout for ways to move our detections up the pyramid as well. It’s easiest to explain how we’ve applied this by looking at an example. ",{"data":7095,"content":7096,"nodeType":1218},{},[7097],{"data":7098,"marks":7099,"value":7100,"nodeType":865},{},[],"Scenario: Detecting a web-based phishing attack",{"data":7102,"content":7103,"nodeType":866},{},[7104],{"data":7105,"marks":7106,"value":7107,"nodeType":865},{},[],"Let’s break down the stages of a web-based phishing attack as an example. For a user to be successfully phished:",{"data":7109,"content":7110,"nodeType":891},{},[7111,7126,7141],{"data":7112,"content":7113,"nodeType":880},{},[7114],{"data":7115,"content":7116,"nodeType":866},{},[7117,7122],{"data":7118,"marks":7119,"value":7121,"nodeType":865},{},[7120],{"type":946},"Stage 1:",{"data":7123,"marks":7124,"value":7125,"nodeType":865},{},[]," The victim must be lured to visit a website.",{"data":7127,"content":7128,"nodeType":880},{},[7129],{"data":7130,"content":7131,"nodeType":866},{},[7132,7137],{"data":7133,"marks":7134,"value":7136,"nodeType":865},{},[7135],{"type":946},"Stage 2:",{"data":7138,"marks":7139,"value":7140,"nodeType":865},{},[]," The website must somehow trick or convince the user that it’s legitimate and trustworthy, for example by mimicking a legitimate site.",{"data":7142,"content":7143,"nodeType":880},{},[7144],{"data":7145,"content":7146,"nodeType":866},{},[7147,7152],{"data":7148,"marks":7149,"value":7151,"nodeType":865},{},[7150],{"type":946},"Stage 3:",{"data":7153,"marks":7154,"value":7155,"nodeType":865},{},[]," The user must enter their actual credentials into that website.",{"data":7157,"content":7158,"nodeType":866},{},[7159],{"data":7160,"marks":7161,"value":7162,"nodeType":865},{},[],"So, how might you go about detecting this attack? Let’s start from the bottom of the pyramid and work our way up.",{"data":7164,"content":7165,"nodeType":1218},{},[7166],{"data":7167,"marks":7168,"value":7169,"nodeType":865},{},[],"Stage 1: Determining if a URL, IP, or domain is bad",{"data":7171,"content":7172,"nodeType":866},{},[7173],{"data":7174,"marks":7175,"value":7176,"nodeType":865},{},[],"You might start by looking for the lure – historically an email. You could look for links in emails, or links in attachments in an email and then check if they are bad (which is essentially what email security products do). You could look for known-bad URLs in emails, but these change for every phishing campaign. In modern attacks, every target can receive a unique email and link. Even just using a URL shortener can bypass this. It’s equivalent to a malware hash – trivial to change, and therefore not a great thing to pin your detections on. ",{"data":7178,"content":7179,"nodeType":866},{},[7180,7184,7193],{"data":7181,"marks":7182,"value":7183,"nodeType":865},{},[],"You could look at which IP address the user connects to, but these days it’s very simple for attackers to add a new IP to their cloud-hosted server. If a domain is flagged as known-bad, the attacker only has to register a new domain, or compromise a WordPress server on an already trusted domain. Both of these things are ",{"data":7185,"content":7187,"nodeType":1102},{"uri":7186},"https://www.bleepingcomputer.com/news/security/revolver-rabbit-gang-registers-500-000-domains-for-malware-campaigns/",[7188],{"data":7189,"marks":7190,"value":7192,"nodeType":865},{},[7191],{"type":4537},"happening on a massive scale",{"data":7194,"marks":7195,"value":7196,"nodeType":865},{},[]," as attackers pre-plan for the fact that their domains will be burned at some point. Attackers are more than happy to spend $10-$20 per new domain in the grand scheme of the potential proceeds of crime. ",{"data":7198,"content":7199,"nodeType":866},{},[7200],{"data":7201,"marks":7202,"value":7203,"nodeType":865},{},[],"But there’s a more fundamental flaw here – for defenders to know that a URL, IP, or domain name is bad, it needs to be reported first. When are things reported? Typically after being used in an attack – so unfortunately, someone always gets hurt.  ",{"data":7205,"content":7206,"nodeType":1218},{},[7207],{"data":7208,"marks":7209,"value":7210,"nodeType":865},{},[],"Stage 2: Determining if a site is legitimate",{"data":7212,"content":7213,"nodeType":866},{},[7214],{"data":7215,"marks":7216,"value":7217,"nodeType":865},{},[],"So how can we detect a phishing website, on day-zero, the first time anyone runs into it? Well we can look at the second step – does the URL resemble a real website, does the HTML code for a page look similar to a legitimate login page for a known website, is it loading the same image files? This is not trivial to detect, but with the right fuzzy matches and image analysis it can be automated.",{"data":7219,"content":7220,"nodeType":866},{},[7221],{"data":7222,"marks":7223,"value":7224,"nodeType":865},{},[],"We’ve now moved up a level on the Pyramid – we’re detecting website artifacts. If we see a legitimate looking website on an unknown domain, it’s likely to be a malicious clone.",{"data":7226,"content":7227,"nodeType":866},{},[7228],{"data":7229,"marks":7230,"value":7231,"nodeType":865},{},[],"Unfortunately, the attacker’s website doesn’t need to send each visitor to the same website. It can change dynamically based on where the visitor is coming from – or even randomly, so that not all visitors are served the phishing page. This means that tools which resolve where the links in emails go to be able to analyze them (such as email security appliances) don’t necessarily see the same site the user is actually visiting – a fact that is commonly abused by attackers to bypass detection. It’s critical that detection happens on the actual web page that the victim sees.",{"data":7233,"content":7234,"nodeType":1218},{},[7235],{"data":7236,"marks":7237,"value":7238,"nodeType":865},{},[],"Stage 3: Detecting the user entering their credentials",{"data":7240,"content":7241,"nodeType":866},{},[7242],{"data":7243,"marks":7244,"value":7245,"nodeType":865},{},[],"For a phishing attack to succeed, the victim must enter their actual credentials into the webpage. If you can stop the user entering their real password, there’s no attack. There’s no getting around it. ",{"data":7247,"content":7248,"nodeType":866},{},[7249,7253,7261],{"data":7250,"marks":7251,"value":7252,"nodeType":865},{},[],"So, this is exactly what we did: Earlier this year, we released a control which ",{"data":7254,"content":7256,"nodeType":1102},{"uri":7255},"https://pushsecurity.com/blog/introducing-sso-password-protection/",[7257],{"data":7258,"marks":7259,"value":7260,"nodeType":865},{},[],"stops users from entering their password belonging to a particular login page anywhere else",{"data":7262,"marks":7263,"value":1151,"nodeType":865},{},[],{"data":7265,"content":7266,"nodeType":866},{},[7267,7271,7278],{"data":7268,"marks":7269,"value":7270,"nodeType":865},{},[],"Seems simple, right? By focusing on this generic action, that always has to happen, you can essentially stop your users being phished altogether. This means, it doesn’t matter ",{"data":7272,"content":7273,"nodeType":1102},{"uri":7038},[7274],{"data":7275,"marks":7276,"value":7277,"nodeType":865},{},[],"what the attacker does before that point",{"data":7279,"marks":7280,"value":3467,"nodeType":865},{},[],{"data":7282,"content":7283,"nodeType":891},{},[7284,7294,7304,7314],{"data":7285,"content":7286,"nodeType":880},{},[7287],{"data":7288,"content":7289,"nodeType":866},{},[7290],{"data":7291,"marks":7292,"value":7293,"nodeType":865},{},[],"It doesn't matter if they run the site using Cloudflare Workers to block automatic analysis.",{"data":7295,"content":7296,"nodeType":880},{},[7297],{"data":7298,"content":7299,"nodeType":866},{},[7300],{"data":7301,"marks":7302,"value":7303,"nodeType":865},{},[],"It doesn’t matter if they hack a WordPress blog to get a reputable domain.",{"data":7305,"content":7306,"nodeType":880},{},[7307],{"data":7308,"content":7309,"nodeType":866},{},[7310],{"data":7311,"marks":7312,"value":7313,"nodeType":865},{},[],"It doesn’t matter if they use clever redirects and rotate the URLs delivered to the user.",{"data":7315,"content":7316,"nodeType":880},{},[7317],{"data":7318,"content":7319,"nodeType":866},{},[7320],{"data":7321,"marks":7322,"value":7323,"nodeType":865},{},[],"It doesn’t matter if they randomize the HTML title for the web page. ",{"data":7325,"content":7326,"nodeType":866},{},[7327],{"data":7328,"marks":7329,"value":7330,"nodeType":865},{},[],"They can’t avoid the fact that a user is required to enter their credentials on the page for the attack to succeed. ",{"data":7332,"content":7333,"nodeType":866},{},[7334],{"data":7335,"marks":7336,"value":7337,"nodeType":865},{},[],"So, when you apply the Pyramid of Pain to some of the controls we’ve shipped this year, we get a clear feel for the value, from highest to lowest:",{"data":7339,"content":7340,"nodeType":891},{},[7341,7362,7383],{"data":7342,"content":7343,"nodeType":880},{},[7344],{"data":7345,"content":7346,"nodeType":866},{},[7347,7351,7358],{"data":7348,"marks":7349,"value":7350,"nodeType":865},{},[],"User Behavior: ",{"data":7352,"content":7353,"nodeType":1102},{"uri":7255},[7354],{"data":7355,"marks":7356,"value":7357,"nodeType":865},{},[],"Detecting and blocking the user behavior of entering their password into any site that the password doesn’t belong to",{"data":7359,"marks":7360,"value":7361,"nodeType":865},{},[],". ",{"data":7363,"content":7364,"nodeType":880},{},[7365],{"data":7366,"content":7367,"nodeType":866},{},[7368,7372,7380],{"data":7369,"marks":7370,"value":7371,"nodeType":865},{},[],"Tool Behavior: ",{"data":7373,"content":7375,"nodeType":1102},{"uri":7374},"https://pushsecurity.com/blog/introducing-cloned-login-page-detection/",[7376],{"data":7377,"marks":7378,"value":7379,"nodeType":865},{},[],"Detecting when a login page that you access is cloned from a legitimate page.",{"data":7381,"marks":7382,"value":21,"nodeType":865},{},[],{"data":7384,"content":7385,"nodeType":880},{},[7386],{"data":7387,"content":7388,"nodeType":866},{},[7389,7393,7401],{"data":7390,"marks":7391,"value":7392,"nodeType":865},{},[],"Tool Signature: ",{"data":7394,"content":7396,"nodeType":1102},{"uri":7395},"https://pushsecurity.com/blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser/",[7397],{"data":7398,"marks":7399,"value":7400,"nodeType":865},{},[],"Detecting and blocking access to a page with a known phishing kit signature present on the page",{"data":7402,"marks":7403,"value":7361,"nodeType":865},{},[],{"data":7405,"content":7406,"nodeType":866},{},[7407],{"data":7408,"marks":7409,"value":7410,"nodeType":865},{},[],"Naturally, we want to continue focusing on the apex of the Pyramid – at TTPs and Tools – to ensure that the controls we build are as robust as possible, and can’t be bypassed by attackers. ",{"data":7412,"content":7413,"nodeType":938},{},[],{"data":7415,"content":7416,"nodeType":948},{},[7417],{"data":7418,"marks":7419,"value":7420,"nodeType":865},{},[],"The power of the Push browser agent",{"data":7422,"content":7423,"nodeType":866},{},[7424,7428,7433],{"data":7425,"marks":7426,"value":7427,"nodeType":865},{},[],"You might ask: ",{"data":7429,"marks":7430,"value":7432,"nodeType":865},{},[7431],{"type":946},"If it’s so simple, why hasn’t this been done yet?",{"data":7434,"marks":7435,"value":7436,"nodeType":865},{},[]," Well, before now, there was no good way of doing it! Teams simply didn’t have tools in the right place to be able to capture the level of data needed, or respond effectively (i.e. automatically, at the point of impact). ",{"data":7438,"content":7439,"nodeType":866},{},[7440,7444,7452],{"data":7441,"marks":7442,"value":7443,"nodeType":865},{},[],"This is where being in the browser comes into play. The browser is a great place to observe the behavior of a page in real time, without needing to reconstruct decrypted HTTP data post-TLS termination and try to guess what the rendered page in all its Javascript-infused glory actually does, ",{"data":7445,"content":7447,"nodeType":1102},{"uri":7446},"https://pushsecurity.com/blog/the-web-proxy-is-dead-long-live-the-browser-extension/",[7448],{"data":7449,"marks":7450,"value":7451,"nodeType":865},{},[],"as we’ve blogged about previously",{"data":7453,"marks":7454,"value":7455,"nodeType":865},{},[],". As we’ve seen through the ability to not only detect but prevent phishing attacks, it’s also a great control enforcement point, as you’re able to intercept the user at the point of impact, and you sit as closely as possible to where their work typically happens – in the browser. ",{"data":7457,"content":7458,"nodeType":866},{},[7459],{"data":7460,"marks":7461,"value":7462,"nodeType":865},{},[],"To illustrate how crucial the browser is to implementing controls that sit at the apex of the Pyramid of Pain, we created a modified version designed specifically for identity attacks. ",{"data":7464,"content":7468,"nodeType":907},{"target":7465},{"sys":7466},{"id":7467,"type":904,"linkType":905},"HrK2xQak6KfjInDbeSgv8",[],{"data":7470,"content":7474,"nodeType":907},{"target":7471},{"sys":7472},{"id":7473,"type":904,"linkType":905},"7kLilJ8Y08smUI9ttM3BSO",[],{"data":7476,"content":7477,"nodeType":938},{},[],{"data":7479,"content":7480,"nodeType":948},{},[7481],{"data":7482,"marks":7483,"value":6758,"nodeType":865},{},[],{"data":7485,"content":7486,"nodeType":866},{},[7487],{"data":7488,"marks":7489,"value":7490,"nodeType":865},{},[],"Hopefully, this blog post has shone a light on why we do things the way we do here at Push. The goal of building generic detections that are difficult, painful, and costly for attackers to bypass is a key part of our design strategy, and we look forward to sharing many more controls with you that demonstrate this in the future.","Our design philosophy: Detecting what matters","This is the first blog in a short series we’re putting together about the ‘why’ behind the ‘what’ at Push. This entry is focused on threat detection. ","2024-08-05T00:00:00.000Z","our-design-philosophy-detecting-what-matters",{"items":7496},[7497,7499],{"sys":7498,"name":342},{"id":2527},{"sys":7500,"name":2524},{"id":2523},{"items":7502},[7503],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":7504},{"url":6031},"fixing-secops-alert-fatigue-with-browser-telemetry","blog/fixing-secops-alert-fatigue-with-browser-telemetry",{"json":7508},{"data":7509,"content":7510,"nodeType":2232},{},[7511],{"data":7512,"content":7513,"nodeType":866},{},[7514],{"data":7515,"marks":7516,"value":7517,"nodeType":865},{},[],"The alert fatigue epidemic has reached crisis proportions, fueled by an expanding attack surface and telemetry gaps. But it's not all doom and gloom: the browser presents security teams with a net-new data source that is objectively better at detecting early-stage indicators of attack. Here's what you need to know. ","How browser data can improve detection fidelity and reduce alert fatigue, enabling SecOps teams to save time and detect more attacks.",{"id":7520,"publishedAt":7521},"6jYmU1ROpwI41mmzk7ioKd","2026-08-12T11:53:44.512Z",{"items":7523},[7524,7526],{"sys":7525,"name":342},{"id":2527},{"sys":7527,"name":2524},{"id":2523},{"items":7529},[7530,7532,7534,7536,7538,7540,7542],{"sys":7531,"name":279,"slug":280,"tier":31},{"id":276},{"sys":7533,"name":413,"slug":414,"tier":31},{"id":410},{"sys":7535,"name":297,"slug":298,"tier":31},{"id":294},{"sys":7537,"name":342,"slug":343,"tier":31},{"id":339},{"sys":7539,"name":598,"slug":599,"tier":45},{"id":595},{"sys":7541,"name":351,"slug":352,"tier":45},{"id":348},{"sys":7543,"name":528,"slug":529,"tier":45},{"id":525},"yfc0SxSoysArtF5K36vxYXsCYNkIPrASZ4F71yfuHZs",{"id":7546,"title":3906,"authorsCollection":7547,"content":7551,"extension":228,"faqItemsCollection":8079,"faqTitle":59,"featured":6,"hashTags":59,"meta":8081,"metaTitle":8082,"ogImage":59,"postType":3355,"publishedDate":3908,"relatedBlogPostsCollection":8083,"slug":3909,"stem":9017,"subtitle":59,"summary":9018,"synopsis":3907,"sys":9029,"tagsCollection":9031,"topicsCollection":9035,"__hash__":9045},"blog/blog/product-release-september-2025.json",{"items":7548},[7549],{"fullName":2573,"firstName":2574,"jobTitle":2575,"socialLinks":59,"profilePicture":7550},{"url":2577},{"json":7552,"links":8033},{"data":7553,"content":7554,"nodeType":2232},{},[7555,7561,7627,7633,7646,7688,7722,7727,7744,7750,7770,7794,7799,7816,7822,7828,7834,7854,7871,7877,7890,7896,7937,7942,7948,7954,7967,7984,7990,7996,8016],{"data":7556,"content":7557,"nodeType":948},{},[7558],{"data":7559,"marks":7560,"value":3372,"nodeType":865},{},[],{"data":7562,"content":7563,"nodeType":891},{},[7564,7573,7582,7591,7600,7609,7618],{"data":7565,"content":7566,"nodeType":880},{},[7567],{"data":7568,"content":7569,"nodeType":866},{},[7570],{"data":7571,"marks":7572,"value":3385,"nodeType":865},{},[],{"data":7574,"content":7575,"nodeType":880},{},[7576],{"data":7577,"content":7578,"nodeType":866},{},[7579],{"data":7580,"marks":7581,"value":3395,"nodeType":865},{},[],{"data":7583,"content":7584,"nodeType":880},{},[7585],{"data":7586,"content":7587,"nodeType":866},{},[7588],{"data":7589,"marks":7590,"value":3405,"nodeType":865},{},[],{"data":7592,"content":7593,"nodeType":880},{},[7594],{"data":7595,"content":7596,"nodeType":866},{},[7597],{"data":7598,"marks":7599,"value":3415,"nodeType":865},{},[],{"data":7601,"content":7602,"nodeType":880},{},[7603],{"data":7604,"content":7605,"nodeType":866},{},[7606],{"data":7607,"marks":7608,"value":3425,"nodeType":865},{},[],{"data":7610,"content":7611,"nodeType":880},{},[7612],{"data":7613,"content":7614,"nodeType":866},{},[7615],{"data":7616,"marks":7617,"value":3435,"nodeType":865},{},[],{"data":7619,"content":7620,"nodeType":880},{},[7621],{"data":7622,"content":7623,"nodeType":866},{},[7624],{"data":7625,"marks":7626,"value":3445,"nodeType":865},{},[],{"data":7628,"content":7629,"nodeType":948},{},[7630],{"data":7631,"marks":7632,"value":3385,"nodeType":865},{},[],{"data":7634,"content":7635,"nodeType":866},{},[7636,7639,7643],{"data":7637,"marks":7638,"value":3458,"nodeType":865},{},[],{"data":7640,"marks":7641,"value":3463,"nodeType":865},{},[7642],{"type":946},{"data":7644,"marks":7645,"value":3467,"nodeType":865},{},[],{"data":7647,"content":7648,"nodeType":891},{},[7649,7662,7675],{"data":7650,"content":7651,"nodeType":880},{},[7652],{"data":7653,"content":7654,"nodeType":866},{},[7655,7659],{"data":7656,"marks":7657,"value":3481,"nodeType":865},{},[7658],{"type":946},{"data":7660,"marks":7661,"value":3485,"nodeType":865},{},[],{"data":7663,"content":7664,"nodeType":880},{},[7665],{"data":7666,"content":7667,"nodeType":866},{},[7668,7672],{"data":7669,"marks":7670,"value":3496,"nodeType":865},{},[7671],{"type":946},{"data":7673,"marks":7674,"value":3500,"nodeType":865},{},[],{"data":7676,"content":7677,"nodeType":880},{},[7678],{"data":7679,"content":7680,"nodeType":866},{},[7681,7685],{"data":7682,"marks":7683,"value":3511,"nodeType":865},{},[7684],{"type":946},{"data":7686,"marks":7687,"value":3515,"nodeType":865},{},[],{"data":7689,"content":7690,"nodeType":866},{},[7691,7694,7698,7701,7705,7708,7712,7715,7719],{"data":7692,"marks":7693,"value":3522,"nodeType":865},{},[],{"data":7695,"marks":7696,"value":3527,"nodeType":865},{},[7697],{"type":946},{"data":7699,"marks":7700,"value":3531,"nodeType":865},{},[],{"data":7702,"marks":7703,"value":3536,"nodeType":865},{},[7704],{"type":946},{"data":7706,"marks":7707,"value":3540,"nodeType":865},{},[],{"data":7709,"marks":7710,"value":3545,"nodeType":865},{},[7711],{"type":946},{"data":7713,"marks":7714,"value":3549,"nodeType":865},{},[],{"data":7716,"marks":7717,"value":3554,"nodeType":865},{},[7718],{"type":946},{"data":7720,"marks":7721,"value":1151,"nodeType":865},{},[],{"data":7723,"content":7726,"nodeType":907},{"target":7724},{"sys":7725},{"id":3562,"type":904,"linkType":905},[],{"data":7728,"content":7729,"nodeType":866},{},[7730,7733,7741],{"data":7731,"marks":7732,"value":21,"nodeType":865},{},[],{"data":7734,"content":7737,"nodeType":1038},{"target":7735},{"sys":7736},{"id":3574,"type":904,"linkType":905},[7738],{"data":7739,"marks":7740,"value":2777,"nodeType":865},{},[],{"data":7742,"marks":7743,"value":21,"nodeType":865},{},[],{"data":7745,"content":7746,"nodeType":948},{},[7747],{"data":7748,"marks":7749,"value":3395,"nodeType":865},{},[],{"data":7751,"content":7752,"nodeType":866},{},[7753,7756,7760,7763,7767],{"data":7754,"marks":7755,"value":3594,"nodeType":865},{},[],{"data":7757,"marks":7758,"value":2080,"nodeType":865},{},[7759],{"type":946},{"data":7761,"marks":7762,"value":1773,"nodeType":865},{},[],{"data":7764,"marks":7765,"value":2088,"nodeType":865},{},[7766],{"type":946},{"data":7768,"marks":7769,"value":3609,"nodeType":865},{},[],{"data":7771,"content":7772,"nodeType":866},{},[7773,7777,7780,7784,7787,7791],{"data":7774,"marks":7775,"value":3617,"nodeType":865},{},[7776],{"type":946},{"data":7778,"marks":7779,"value":3621,"nodeType":865},{},[],{"data":7781,"marks":7782,"value":2821,"nodeType":865},{},[7783],{"type":946},{"data":7785,"marks":7786,"value":3629,"nodeType":865},{},[],{"data":7788,"marks":7789,"value":2088,"nodeType":865},{},[7790],{"type":946},{"data":7792,"marks":7793,"value":3637,"nodeType":865},{},[],{"data":7795,"content":7798,"nodeType":907},{"target":7796},{"sys":7797},{"id":3642,"type":904,"linkType":905},[],{"data":7800,"content":7801,"nodeType":866},{},[7802,7805,7813],{"data":7803,"marks":7804,"value":21,"nodeType":865},{},[],{"data":7806,"content":7809,"nodeType":1038},{"target":7807},{"sys":7808},{"id":1506,"type":904,"linkType":905},[7810],{"data":7811,"marks":7812,"value":2777,"nodeType":865},{},[],{"data":7814,"marks":7815,"value":21,"nodeType":865},{},[],{"data":7817,"content":7818,"nodeType":948},{},[7819],{"data":7820,"marks":7821,"value":3415,"nodeType":865},{},[],{"data":7823,"content":7824,"nodeType":866},{},[7825],{"data":7826,"marks":7827,"value":3673,"nodeType":865},{},[],{"data":7829,"content":7830,"nodeType":866},{},[7831],{"data":7832,"marks":7833,"value":3680,"nodeType":865},{},[],{"data":7835,"content":7836,"nodeType":866},{},[7837,7840,7844,7847,7851],{"data":7838,"marks":7839,"value":3687,"nodeType":865},{},[],{"data":7841,"marks":7842,"value":3692,"nodeType":865},{},[7843],{"type":946},{"data":7845,"marks":7846,"value":3696,"nodeType":865},{},[],{"data":7848,"marks":7849,"value":2719,"nodeType":865},{},[7850],{"type":946},{"data":7852,"marks":7853,"value":3704,"nodeType":865},{},[],{"data":7855,"content":7856,"nodeType":866},{},[7857,7860,7868],{"data":7858,"marks":7859,"value":21,"nodeType":865},{},[],{"data":7861,"content":7864,"nodeType":1038},{"target":7862},{"sys":7863},{"id":3715,"type":904,"linkType":905},[7865],{"data":7866,"marks":7867,"value":2777,"nodeType":865},{},[],{"data":7869,"marks":7870,"value":21,"nodeType":865},{},[],{"data":7872,"content":7873,"nodeType":948},{},[7874],{"data":7875,"marks":7876,"value":3729,"nodeType":865},{},[],{"data":7878,"content":7879,"nodeType":866},{},[7880,7883,7887],{"data":7881,"marks":7882,"value":3736,"nodeType":865},{},[],{"data":7884,"marks":7885,"value":3741,"nodeType":865},{},[7886],{"type":946},{"data":7888,"marks":7889,"value":3745,"nodeType":865},{},[],{"data":7891,"content":7892,"nodeType":866},{},[7893],{"data":7894,"marks":7895,"value":3752,"nodeType":865},{},[],{"data":7897,"content":7898,"nodeType":891},{},[7899,7915,7928],{"data":7900,"content":7901,"nodeType":880},{},[7902],{"data":7903,"content":7904,"nodeType":866},{},[7905,7908,7912],{"data":7906,"marks":7907,"value":3765,"nodeType":865},{},[],{"data":7909,"marks":7910,"value":3463,"nodeType":865},{},[7911],{"type":946},{"data":7913,"marks":7914,"value":3773,"nodeType":865},{},[],{"data":7916,"content":7917,"nodeType":880},{},[7918],{"data":7919,"content":7920,"nodeType":866},{},[7921,7924],{"data":7922,"marks":7923,"value":3783,"nodeType":865},{},[],{"data":7925,"marks":7926,"value":2821,"nodeType":865},{},[7927],{"type":946},{"data":7929,"content":7930,"nodeType":880},{},[7931],{"data":7932,"content":7933,"nodeType":866},{},[7934],{"data":7935,"marks":7936,"value":3797,"nodeType":865},{},[],{"data":7938,"content":7941,"nodeType":907},{"target":7939},{"sys":7940},{"id":3802,"type":904,"linkType":905},[],{"data":7943,"content":7944,"nodeType":948},{},[7945],{"data":7946,"marks":7947,"value":3435,"nodeType":865},{},[],{"data":7949,"content":7950,"nodeType":866},{},[7951],{"data":7952,"marks":7953,"value":3816,"nodeType":865},{},[],{"data":7955,"content":7956,"nodeType":866},{},[7957,7960,7964],{"data":7958,"marks":7959,"value":3823,"nodeType":865},{},[],{"data":7961,"marks":7962,"value":3828,"nodeType":865},{},[7963],{"type":946},{"data":7965,"marks":7966,"value":3832,"nodeType":865},{},[],{"data":7968,"content":7969,"nodeType":866},{},[7970,7973,7981],{"data":7971,"marks":7972,"value":21,"nodeType":865},{},[],{"data":7974,"content":7977,"nodeType":1038},{"target":7975},{"sys":7976},{"id":3843,"type":904,"linkType":905},[7978],{"data":7979,"marks":7980,"value":2777,"nodeType":865},{},[],{"data":7982,"marks":7983,"value":21,"nodeType":865},{},[],{"data":7985,"content":7986,"nodeType":948},{},[7987],{"data":7988,"marks":7989,"value":3857,"nodeType":865},{},[],{"data":7991,"content":7992,"nodeType":866},{},[7993],{"data":7994,"marks":7995,"value":3864,"nodeType":865},{},[],{"data":7997,"content":7998,"nodeType":866},{},[7999,8002,8006,8009,8013],{"data":8000,"marks":8001,"value":3871,"nodeType":865},{},[],{"data":8003,"marks":8004,"value":3876,"nodeType":865},{},[8005],{"type":946},{"data":8007,"marks":8008,"value":1773,"nodeType":865},{},[],{"data":8010,"marks":8011,"value":3884,"nodeType":865},{},[8012],{"type":946},{"data":8014,"marks":8015,"value":1151,"nodeType":865},{},[],{"data":8017,"content":8018,"nodeType":866},{},[8019,8022,8030],{"data":8020,"marks":8021,"value":21,"nodeType":865},{},[],{"data":8023,"content":8026,"nodeType":1038},{"target":8024},{"sys":8025},{"id":3898,"type":904,"linkType":905},[8027],{"data":8028,"marks":8029,"value":2777,"nodeType":865},{},[],{"data":8031,"marks":8032,"value":21,"nodeType":865},{},[],{"entries":8034},{"inline":8035,"hyperlink":8036,"block":8058},[],[8037,8041,8043,8048,8053],{"sys":8038,"__typename":2239,"title":8039,"slug":8040},{"id":3574},"Introducing Push Detections: Equipping SecOps and IR teams to stop browser-based attacks","introducing-push-detections",{"sys":8042,"__typename":2256,"title":2262,"slug":2263,"articleId":2264},{"id":1506},{"sys":8044,"__typename":2256,"title":8045,"slug":8046,"articleId":8047},{"id":3715},"Can Push identify when employees are syncing browser profile data?","can-push-identify-when-employees-are-syncing-browser-profile-data",10134,{"sys":8049,"__typename":2256,"title":8050,"slug":8051,"articleId":8052},{"id":3843},"What is the data retention period for employee activity in the Push platform?","what-is-the-data-retention-period-for-employee-activity-in-the-push-platform",10132,{"sys":8054,"__typename":2256,"title":8055,"slug":8056,"articleId":8057},{"id":3898},"How do I fix a webhook that was disabled?","how-do-i-fix-a-webhook-that-was-disabled",10101,[8059,8065,8072],{"sys":8060,"__typename":2366,"title":8061,"caption":59,"layoutMode":59,"file":8062},{"id":3562},"Detections page - timeline - for release notes - Sept. 2025",{"url":8063,"width":3349,"height":8064},"https://images.ctfassets.net/y1cdw1ablpvd/32lmGPXFmhpt8ULInS2zjx/b542d8844172c9f11b29e6b98f6dbef7/detection_enrichment_example.png",878,{"sys":8066,"__typename":2366,"title":8067,"caption":59,"layoutMode":59,"file":8068},{"id":3642},"Cloned login block page - for release notes - Sept. 2025",{"url":8069,"width":8070,"height":8071},"https://images.ctfassets.net/y1cdw1ablpvd/625lJ4LCfSYHDJJSsjJIhf/8f9cf4e950c9e274e2002dcf9e1c07ff/cloned_login_block_page_example.png",2450,732,{"sys":8073,"__typename":2366,"title":8074,"caption":59,"layoutMode":59,"file":8075},{"id":3802},"Dashboard - for release notes - Sept. 2025",{"url":8076,"width":8077,"height":8078},"https://images.ctfassets.net/y1cdw1ablpvd/2Ma6lXVOoWM2SJt4EkJZon/640f9587bb8529fe7c2cf4255c29d876/push_dashboard_20250827.png",1523,853,{"items":8080},[],{},"Push Security new product features for September 2025",{"items":8084},[8085,8515],{"__typename":2239,"sys":8086,"content":8087,"title":4393,"synopsis":4394,"hashTags":59,"publishedDate":4395,"slug":4396,"tagsCollection":8507,"authorsCollection":8511},{"id":3922},{"json":8088},{"data":8089,"content":8090,"nodeType":2232},{},[8091,8097,8163,8169,8182,8188,8193,8210,8216,8229,8235,8241,8261,8266,8272,8285,8291,8296,8313,8319,8332,8338,8344,8349,8366,8372,8385,8391,8396,8411,8417,8444,8457,8462,8477,8483,8496,8501],{"data":8092,"content":8093,"nodeType":948},{},[8094],{"data":8095,"marks":8096,"value":2588,"nodeType":865},{},[],{"data":8098,"content":8099,"nodeType":891},{},[8100,8109,8118,8127,8136,8145,8154],{"data":8101,"content":8102,"nodeType":880},{},[8103],{"data":8104,"content":8105,"nodeType":866},{},[8106],{"data":8107,"marks":8108,"value":3945,"nodeType":865},{},[],{"data":8110,"content":8111,"nodeType":880},{},[8112],{"data":8113,"content":8114,"nodeType":866},{},[8115],{"data":8116,"marks":8117,"value":3955,"nodeType":865},{},[],{"data":8119,"content":8120,"nodeType":880},{},[8121],{"data":8122,"content":8123,"nodeType":866},{},[8124],{"data":8125,"marks":8126,"value":3965,"nodeType":865},{},[],{"data":8128,"content":8129,"nodeType":880},{},[8130],{"data":8131,"content":8132,"nodeType":866},{},[8133],{"data":8134,"marks":8135,"value":3975,"nodeType":865},{},[],{"data":8137,"content":8138,"nodeType":880},{},[8139],{"data":8140,"content":8141,"nodeType":866},{},[8142],{"data":8143,"marks":8144,"value":3985,"nodeType":865},{},[],{"data":8146,"content":8147,"nodeType":880},{},[8148],{"data":8149,"content":8150,"nodeType":866},{},[8151],{"data":8152,"marks":8153,"value":3995,"nodeType":865},{},[],{"data":8155,"content":8156,"nodeType":880},{},[8157],{"data":8158,"content":8159,"nodeType":866},{},[8160],{"data":8161,"marks":8162,"value":4005,"nodeType":865},{},[],{"data":8164,"content":8165,"nodeType":948},{},[8166],{"data":8167,"marks":8168,"value":3945,"nodeType":865},{},[],{"data":8170,"content":8171,"nodeType":866},{},[8172,8175,8179],{"data":8173,"marks":8174,"value":4018,"nodeType":865},{},[],{"data":8176,"marks":8177,"value":4023,"nodeType":865},{},[8178],{"type":946},{"data":8180,"marks":8181,"value":4027,"nodeType":865},{},[],{"data":8183,"content":8184,"nodeType":866},{},[8185],{"data":8186,"marks":8187,"value":4034,"nodeType":865},{},[],{"data":8189,"content":8192,"nodeType":907},{"target":8190},{"sys":8191},{"id":4039,"type":904,"linkType":905},[],{"data":8194,"content":8195,"nodeType":866},{},[8196,8199,8207],{"data":8197,"marks":8198,"value":21,"nodeType":865},{},[],{"data":8200,"content":8203,"nodeType":1038},{"target":8201},{"sys":8202},{"id":4051,"type":904,"linkType":905},[8204],{"data":8205,"marks":8206,"value":2777,"nodeType":865},{},[],{"data":8208,"marks":8209,"value":21,"nodeType":865},{},[],{"data":8211,"content":8212,"nodeType":948},{},[8213],{"data":8214,"marks":8215,"value":3955,"nodeType":865},{},[],{"data":8217,"content":8218,"nodeType":866},{},[8219,8222,8226],{"data":8220,"marks":8221,"value":4071,"nodeType":865},{},[],{"data":8223,"marks":8224,"value":4076,"nodeType":865},{},[8225],{"type":946},{"data":8227,"marks":8228,"value":4080,"nodeType":865},{},[],{"data":8230,"content":8231,"nodeType":866},{},[8232],{"data":8233,"marks":8234,"value":4087,"nodeType":865},{},[],{"data":8236,"content":8237,"nodeType":866},{},[8238],{"data":8239,"marks":8240,"value":4094,"nodeType":865},{},[],{"data":8242,"content":8243,"nodeType":866},{},[8244,8247,8251,8254,8258],{"data":8245,"marks":8246,"value":4101,"nodeType":865},{},[],{"data":8248,"marks":8249,"value":2129,"nodeType":865},{},[8250],{"type":946},{"data":8252,"marks":8253,"value":4109,"nodeType":865},{},[],{"data":8255,"marks":8256,"value":4114,"nodeType":865},{},[8257],{"type":946},{"data":8259,"marks":8260,"value":4118,"nodeType":865},{},[],{"data":8262,"content":8265,"nodeType":907},{"target":8263},{"sys":8264},{"id":4123,"type":904,"linkType":905},[],{"data":8267,"content":8268,"nodeType":948},{},[8269],{"data":8270,"marks":8271,"value":3965,"nodeType":865},{},[],{"data":8273,"content":8274,"nodeType":866},{},[8275,8278,8282],{"data":8276,"marks":8277,"value":4137,"nodeType":865},{},[],{"data":8279,"marks":8280,"value":1918,"nodeType":865},{},[8281],{"type":946},{"data":8283,"marks":8284,"value":1677,"nodeType":865},{},[],{"data":8286,"content":8287,"nodeType":866},{},[8288],{"data":8289,"marks":8290,"value":4151,"nodeType":865},{},[],{"data":8292,"content":8295,"nodeType":907},{"target":8293},{"sys":8294},{"id":4156,"type":904,"linkType":905},[],{"data":8297,"content":8298,"nodeType":866},{},[8299,8302,8310],{"data":8300,"marks":8301,"value":21,"nodeType":865},{},[],{"data":8303,"content":8306,"nodeType":1038},{"target":8304},{"sys":8305},{"id":1778,"type":904,"linkType":905},[8307],{"data":8308,"marks":8309,"value":2777,"nodeType":865},{},[],{"data":8311,"marks":8312,"value":21,"nodeType":865},{},[],{"data":8314,"content":8315,"nodeType":948},{},[8316],{"data":8317,"marks":8318,"value":3975,"nodeType":865},{},[],{"data":8320,"content":8321,"nodeType":866},{},[8322,8325,8329],{"data":8323,"marks":8324,"value":4187,"nodeType":865},{},[],{"data":8326,"marks":8327,"value":4192,"nodeType":865},{},[8328],{"type":946},{"data":8330,"marks":8331,"value":4196,"nodeType":865},{},[],{"data":8333,"content":8334,"nodeType":866},{},[8335],{"data":8336,"marks":8337,"value":4203,"nodeType":865},{},[],{"data":8339,"content":8340,"nodeType":866},{},[8341],{"data":8342,"marks":8343,"value":4210,"nodeType":865},{},[],{"data":8345,"content":8348,"nodeType":907},{"target":8346},{"sys":8347},{"id":4215,"type":904,"linkType":905},[],{"data":8350,"content":8351,"nodeType":866},{},[8352,8355,8363],{"data":8353,"marks":8354,"value":21,"nodeType":865},{},[],{"data":8356,"content":8359,"nodeType":1038},{"target":8357},{"sys":8358},{"id":4227,"type":904,"linkType":905},[8360],{"data":8361,"marks":8362,"value":2777,"nodeType":865},{},[],{"data":8364,"marks":8365,"value":21,"nodeType":865},{},[],{"data":8367,"content":8368,"nodeType":948},{},[8369],{"data":8370,"marks":8371,"value":3985,"nodeType":865},{},[],{"data":8373,"content":8374,"nodeType":866},{},[8375,8378,8382],{"data":8376,"marks":8377,"value":3594,"nodeType":865},{},[],{"data":8379,"marks":8380,"value":4251,"nodeType":865},{},[8381],{"type":946},{"data":8383,"marks":8384,"value":4255,"nodeType":865},{},[],{"data":8386,"content":8387,"nodeType":866},{},[8388],{"data":8389,"marks":8390,"value":4262,"nodeType":865},{},[],{"data":8392,"content":8395,"nodeType":907},{"target":8393},{"sys":8394},{"id":4267,"type":904,"linkType":905},[],{"data":8397,"content":8398,"nodeType":866},{},[8399,8402,8408],{"data":8400,"marks":8401,"value":21,"nodeType":865},{},[],{"data":8403,"content":8404,"nodeType":1102},{"uri":4277},[8405],{"data":8406,"marks":8407,"value":2777,"nodeType":865},{},[],{"data":8409,"marks":8410,"value":21,"nodeType":865},{},[],{"data":8412,"content":8413,"nodeType":948},{},[8414],{"data":8415,"marks":8416,"value":3995,"nodeType":865},{},[],{"data":8418,"content":8419,"nodeType":866},{},[8420,8423,8427,8430,8434,8437,8441],{"data":8421,"marks":8422,"value":4297,"nodeType":865},{},[],{"data":8424,"marks":8425,"value":4302,"nodeType":865},{},[8426],{"type":946},{"data":8428,"marks":8429,"value":4306,"nodeType":865},{},[],{"data":8431,"marks":8432,"value":4311,"nodeType":865},{},[8433],{"type":946},{"data":8435,"marks":8436,"value":1913,"nodeType":865},{},[],{"data":8438,"marks":8439,"value":1909,"nodeType":865},{},[8440],{"type":946},{"data":8442,"marks":8443,"value":1677,"nodeType":865},{},[],{"data":8445,"content":8446,"nodeType":866},{},[8447,8450,8454],{"data":8448,"marks":8449,"value":4328,"nodeType":865},{},[],{"data":8451,"marks":8452,"value":4333,"nodeType":865},{},[8453],{"type":946},{"data":8455,"marks":8456,"value":4337,"nodeType":865},{},[],{"data":8458,"content":8461,"nodeType":907},{"target":8459},{"sys":8460},{"id":4342,"type":904,"linkType":905},[],{"data":8463,"content":8464,"nodeType":866},{},[8465,8468,8474],{"data":8466,"marks":8467,"value":21,"nodeType":865},{},[],{"data":8469,"content":8470,"nodeType":1102},{"uri":4352},[8471],{"data":8472,"marks":8473,"value":2777,"nodeType":865},{},[],{"data":8475,"marks":8476,"value":21,"nodeType":865},{},[],{"data":8478,"content":8479,"nodeType":948},{},[8480],{"data":8481,"marks":8482,"value":4005,"nodeType":865},{},[],{"data":8484,"content":8485,"nodeType":866},{},[8486,8489,8493],{"data":8487,"marks":8488,"value":4372,"nodeType":865},{},[],{"data":8490,"marks":8491,"value":3884,"nodeType":865},{},[8492],{"type":946},{"data":8494,"marks":8495,"value":4380,"nodeType":865},{},[],{"data":8497,"content":8500,"nodeType":907},{"target":8498},{"sys":8499},{"id":4385,"type":904,"linkType":905},[],{"data":8502,"content":8503,"nodeType":866},{},[8504],{"data":8505,"marks":8506,"value":21,"nodeType":865},{},[],{"items":8508},[8509],{"sys":8510,"name":3915},{"id":3914},{"items":8512},[8513],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":8514},{"url":2577},{"__typename":2239,"sys":8516,"content":8518,"title":9005,"synopsis":9006,"hashTags":59,"publishedDate":9007,"slug":9008,"tagsCollection":9009,"authorsCollection":9013},{"id":8517},"4Aln4tyCmoffCEg6yiUO4J",{"json":8519},{"data":8520,"content":8521,"nodeType":2232},{},[8522,8528,8581,8587,8602,8609,8678,8684,8702,8709,8725,8740,8746,8753,8771,8778,8793,8808,8815,8833,8840,8864,8871,8887,8893,8909,8950,8993,8999],{"data":8523,"content":8524,"nodeType":948},{},[8525],{"data":8526,"marks":8527,"value":2588,"nodeType":865},{},[],{"data":8529,"content":8530,"nodeType":891},{},[8531,8541,8551,8561,8571],{"data":8532,"content":8533,"nodeType":880},{},[8534],{"data":8535,"content":8536,"nodeType":866},{},[8537],{"data":8538,"marks":8539,"value":8540,"nodeType":865},{},[],"Add app banners to custom URLs",{"data":8542,"content":8543,"nodeType":880},{},[8544],{"data":8545,"content":8546,"nodeType":866},{},[8547],{"data":8548,"marks":8549,"value":8550,"nodeType":865},{},[],"Self-service SAML for the Push platform",{"data":8552,"content":8553,"nodeType":880},{},[8554],{"data":8555,"content":8556,"nodeType":866},{},[8557],{"data":8558,"marks":8559,"value":8560,"nodeType":865},{},[],"Support for Island enterprise browser",{"data":8562,"content":8563,"nodeType":880},{},[8564],{"data":8565,"content":8566,"nodeType":866},{},[8567],{"data":8568,"marks":8569,"value":8570,"nodeType":865},{},[],"Landing page browser enrollment option",{"data":8572,"content":8573,"nodeType":880},{},[8574],{"data":8575,"content":8576,"nodeType":866},{},[8577],{"data":8578,"marks":8579,"value":8580,"nodeType":865},{},[],"Improved filters for apps, accounts, and more",{"data":8582,"content":8583,"nodeType":948},{},[8584],{"data":8585,"marks":8586,"value":8540,"nodeType":865},{},[],{"data":8588,"content":8589,"nodeType":866},{},[8590,8593,8598],{"data":8591,"marks":8592,"value":3594,"nodeType":865},{},[],{"data":8594,"marks":8595,"value":8597,"nodeType":865},{},[8596],{"type":946},"add app banners to a custom-defined URL or URL pattern",{"data":8599,"marks":8600,"value":8601,"nodeType":865},{},[],". Previously, app banners displayed only on login and signup pages for configured apps. With this update, you can put them on any page you like. ",{"data":8603,"content":8604,"nodeType":866},{},[8605],{"data":8606,"marks":8607,"value":8608,"nodeType":865},{},[],"That means you can:",{"data":8610,"content":8611,"nodeType":891},{},[8612,8631,8649,8668],{"data":8613,"content":8614,"nodeType":880},{},[8615],{"data":8616,"content":8617,"nodeType":866},{},[8618,8622,8627],{"data":8619,"marks":8620,"value":8621,"nodeType":865},{},[],"Remind employees ",{"data":8623,"marks":8624,"value":8626,"nodeType":865},{},[8625],{"type":946},"not to store credentials",{"data":8628,"marks":8629,"value":8630,"nodeType":865},{},[]," or sensitive information on internal wikis.",{"data":8632,"content":8633,"nodeType":880},{},[8634],{"data":8635,"content":8636,"nodeType":866},{},[8637,8641,8646],{"data":8638,"marks":8639,"value":8640,"nodeType":865},{},[],"Require acknowledgement of your security policies when using ",{"data":8642,"marks":8643,"value":8645,"nodeType":865},{},[8644],{"type":946},"high-value GitHub repos",{"data":8647,"marks":8648,"value":1151,"nodeType":865},{},[],{"data":8650,"content":8651,"nodeType":880},{},[8652],{"data":8653,"content":8654,"nodeType":866},{},[8655,8659,8664],{"data":8656,"marks":8657,"value":8658,"nodeType":865},{},[],"Ask employees not to share sensitive information when using ",{"data":8660,"marks":8661,"value":8663,"nodeType":865},{},[8662],{"type":946},"GenAI tools",{"data":8665,"marks":8666,"value":8667,"nodeType":865},{},[]," during an unauthenticated session.",{"data":8669,"content":8670,"nodeType":880},{},[8671],{"data":8672,"content":8673,"nodeType":866},{},[8674],{"data":8675,"marks":8676,"value":8677,"nodeType":865},{},[],"Or anything else you can think of!",{"data":8679,"content":8683,"nodeType":907},{"target":8680},{"sys":8681},{"id":8682,"type":904,"linkType":905},"6Jq3wMNCf1ns8zH6Z8tvGX",[],{"data":8685,"content":8686,"nodeType":866},{},[8687,8690,8699],{"data":8688,"marks":8689,"value":21,"nodeType":865},{},[],{"data":8691,"content":8695,"nodeType":1038},{"target":8692},{"sys":8693},{"id":8694,"type":904,"linkType":905},"2ti5f4Eh4teqnVkKDgztcm",[8696],{"data":8697,"marks":8698,"value":2777,"nodeType":865},{},[],{"data":8700,"marks":8701,"value":21,"nodeType":865},{},[],{"data":8703,"content":8704,"nodeType":948},{},[8705],{"data":8706,"marks":8707,"value":8708,"nodeType":865},{},[],"Self-service SAML for the Push admin console",{"data":8710,"content":8711,"nodeType":866},{},[8712,8716,8721],{"data":8713,"marks":8714,"value":8715,"nodeType":865},{},[],"It’s now ",{"data":8717,"marks":8718,"value":8720,"nodeType":865},{},[8719],{"type":946},"easier to set up SAML for the Push admin console",{"data":8722,"marks":8723,"value":8724,"nodeType":865},{},[]," so your Push admins can log in using your SSO provider, such as Okta or Microsoft Entra ID. Once you’ve created the Push app in your identity provider, you can manage admin access via your IdP.",{"data":8726,"content":8727,"nodeType":866},{},[8728,8732,8736],{"data":8729,"marks":8730,"value":8731,"nodeType":865},{},[],"You can set up SAML yourself from the admin console by going to the ",{"data":8733,"marks":8734,"value":2129,"nodeType":865},{},[8735],{"type":946},{"data":8737,"marks":8738,"value":8739,"nodeType":865},{},[]," page and following the steps in the setup wizard.",{"data":8741,"content":8745,"nodeType":907},{"target":8742},{"sys":8743},{"id":8744,"type":904,"linkType":905},"23nEc3hEVCjENod1xpLW97",[],{"data":8747,"content":8748,"nodeType":866},{},[8749],{"data":8750,"marks":8751,"value":8752,"nodeType":865},{},[],"SAML for the Push platform is available at no additional cost.",{"data":8754,"content":8755,"nodeType":866},{},[8756,8759,8768],{"data":8757,"marks":8758,"value":21,"nodeType":865},{},[],{"data":8760,"content":8764,"nodeType":1038},{"target":8761},{"sys":8762},{"id":8763,"type":904,"linkType":905},"2SRHVwdI7xMYdyrMifgqog",[8765],{"data":8766,"marks":8767,"value":2777,"nodeType":865},{},[],{"data":8769,"marks":8770,"value":21,"nodeType":865},{},[],{"data":8772,"content":8773,"nodeType":948},{},[8774],{"data":8775,"marks":8776,"value":8777,"nodeType":865},{},[],"Push now supports Island enterprise browser",{"data":8779,"content":8780,"nodeType":866},{},[8781,8784,8789],{"data":8782,"marks":8783,"value":3594,"nodeType":865},{},[],{"data":8785,"marks":8786,"value":8788,"nodeType":865},{},[8787],{"type":946},"install the Push browser agent on Island",{"data":8790,"marks":8791,"value":8792,"nodeType":865},{},[],", adding a powerful, complementary set of identity security controls to the enterprise browser.",{"data":8794,"content":8795,"nodeType":866},{},[8796,8800,8805],{"data":8797,"marks":8798,"value":8799,"nodeType":865},{},[],"With Island, you can deploy and activate the Push agent seamlessly ",{"data":8801,"marks":8802,"value":8804,"nodeType":865},{},[8803],{"type":946},"without any end-user interaction",{"data":8806,"marks":8807,"value":1151,"nodeType":865},{},[],{"data":8809,"content":8810,"nodeType":866},{},[8811],{"data":8812,"marks":8813,"value":8814,"nodeType":865},{},[],"Push already provides managed deployment support for other major browsers, including Chrome, Edge, Firefox, Brave, Safari, and Arc. ",{"data":8816,"content":8817,"nodeType":866},{},[8818,8821,8830],{"data":8819,"marks":8820,"value":21,"nodeType":865},{},[],{"data":8822,"content":8826,"nodeType":1038},{"target":8823},{"sys":8824},{"id":8825,"type":904,"linkType":905},"3mUYngymmVLnXaRZSmii5Q",[8827],{"data":8828,"marks":8829,"value":2777,"nodeType":865},{},[],{"data":8831,"marks":8832,"value":21,"nodeType":865},{},[],{"data":8834,"content":8835,"nodeType":948},{},[8836],{"data":8837,"marks":8838,"value":8839,"nodeType":865},{},[],"New landing page browser enrollment option",{"data":8841,"content":8842,"nodeType":866},{},[8843,8847,8852,8856,8861],{"data":8844,"marks":8845,"value":8846,"nodeType":865},{},[],"As an alternative to Push’s email self-enrollment option for end-users, you can now invite employees to ",{"data":8848,"marks":8849,"value":8851,"nodeType":865},{},[8850],{"type":946},"self-enroll and install the Push browser extension",{"data":8853,"marks":8854,"value":8855,"nodeType":865},{},[]," themselves by directing them to a ",{"data":8857,"marks":8858,"value":8860,"nodeType":865},{},[8859],{"type":946},"landing page",{"data":8862,"marks":8863,"value":1677,"nodeType":865},{},[],{"data":8865,"content":8866,"nodeType":866},{},[8867],{"data":8868,"marks":8869,"value":8870,"nodeType":865},{},[],"Once employees visit the page, they’ll be prompted to verify their identity via OIDC login using your identity provider. Once confirmed, they’ll be prompted to install the Push extension and enrolled in Push.",{"data":8872,"content":8873,"nodeType":866},{},[8874,8877,8884],{"data":8875,"marks":8876,"value":21,"nodeType":865},{},[],{"data":8878,"content":8880,"nodeType":1102},{"uri":8879},"/help/audience/administrators/docs/install-the-browser-extension/#self-enrollment-via-landing-page",[8881],{"data":8882,"marks":8883,"value":2777,"nodeType":865},{},[],{"data":8885,"marks":8886,"value":21,"nodeType":865},{},[],{"data":8888,"content":8889,"nodeType":948},{},[8890],{"data":8891,"marks":8892,"value":8580,"nodeType":865},{},[],{"data":8894,"content":8895,"nodeType":866},{},[8896,8900,8905],{"data":8897,"marks":8898,"value":8899,"nodeType":865},{},[],"We’ve improved the ",{"data":8901,"marks":8902,"value":8904,"nodeType":865},{},[8903],{"type":946},"visibility and function of filters",{"data":8906,"marks":8907,"value":8908,"nodeType":865},{},[]," on pages in the Push admin console that help you explore and manage employees, apps, and accounts. You can also pin the filters you use the most and Push will remember your selection.",{"data":8910,"content":8911,"nodeType":866},{},[8912,8916,8921,8924,8929,8932,8937,8941,8946],{"data":8913,"marks":8914,"value":8915,"nodeType":865},{},[],"You’ll find the new filters under the keyword search on all the data tables in Push, including the ",{"data":8917,"marks":8918,"value":8920,"nodeType":865},{},[8919],{"type":946},"Employees",{"data":8922,"marks":8923,"value":3531,"nodeType":865},{},[],{"data":8925,"marks":8926,"value":8928,"nodeType":865},{},[8927],{"type":946},"Apps",{"data":8930,"marks":8931,"value":3531,"nodeType":865},{},[],{"data":8933,"marks":8934,"value":8936,"nodeType":865},{},[8935],{"type":946},"Accounts",{"data":8938,"marks":8939,"value":8940,"nodeType":865},{},[],", and ",{"data":8942,"marks":8943,"value":8945,"nodeType":865},{},[8944],{"type":946},"OAuth apps",{"data":8947,"marks":8948,"value":8949,"nodeType":865},{},[]," pages. Combine multiple filters to pinpoint useful data trends, such as:",{"data":8951,"content":8952,"nodeType":891},{},[8953,8963,8973,8983],{"data":8954,"content":8955,"nodeType":880},{},[8956],{"data":8957,"content":8958,"nodeType":866},{},[8959],{"data":8960,"marks":8961,"value":8962,"nodeType":865},{},[],"Which accounts are accessing SAML apps using passwords.",{"data":8964,"content":8965,"nodeType":880},{},[8966],{"data":8967,"content":8968,"nodeType":866},{},[8969],{"data":8970,"marks":8971,"value":8972,"nodeType":865},{},[],"Which accounts are using verified stolen credentials.",{"data":8974,"content":8975,"nodeType":880},{},[8976],{"data":8977,"content":8978,"nodeType":866},{},[8979],{"data":8980,"marks":8981,"value":8982,"nodeType":865},{},[],"Which employees do not have the Push browser extension.",{"data":8984,"content":8985,"nodeType":880},{},[8986],{"data":8987,"content":8988,"nodeType":866},{},[8989],{"data":8990,"marks":8991,"value":8992,"nodeType":865},{},[],"And many more.",{"data":8994,"content":8998,"nodeType":907},{"target":8995},{"sys":8996},{"id":8997,"type":904,"linkType":905},"OAXAnXKt4TcLOlUpdQP3X",[],{"data":9000,"content":9001,"nodeType":866},{},[9002],{"data":9003,"marks":9004,"value":21,"nodeType":865},{},[],"Product release: March 2025","Here’s what’s new on the Push platform for March 2025.","2025-03-11T00:00:00.000Z","product-release-march-2025",{"items":9010},[9011],{"sys":9012,"name":3915},{"id":3914},{"items":9014},[9015],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":9016},{"url":2577},"blog/product-release-september-2025",{"json":9019},{"data":9020,"content":9021,"nodeType":2232},{},[9022],{"data":9023,"content":9024,"nodeType":866},{},[9025],{"data":9026,"marks":9027,"value":9028,"nodeType":865},{},[],"Attack timeline, screenshots & classifications for Detections, blog cloned login pages, and more.",{"id":3361,"publishedAt":9030},"2026-08-13T09:34:57.041Z",{"items":9032},[9033],{"sys":9034,"name":3915},{"id":3914},{"items":9036},[9037,9039,9041,9043],{"sys":9038,"name":297,"slug":298,"tier":31},{"id":294},{"sys":9040,"name":324,"slug":325,"tier":45},{"id":321},{"sys":9042,"name":598,"slug":599,"tier":45},{"id":595},{"sys":9044,"name":502,"slug":503,"tier":45},{"id":499},"3yV-CKU9TJfUwkobuctqlnY6to1-LYtMZLw11xBDq7g",{"id":9047,"title":8039,"authorsCollection":9048,"content":9052,"extension":228,"faqItemsCollection":10135,"faqTitle":59,"featured":6,"hashTags":59,"meta":10137,"metaTitle":10138,"ogImage":59,"postType":10139,"publishedDate":10140,"relatedBlogPostsCollection":10141,"slug":8040,"stem":11813,"subtitle":59,"summary":11814,"synopsis":11825,"sys":11826,"tagsCollection":11828,"topicsCollection":11834,"__hash__":11876},"blog/blog/introducing-push-detections.json",{"items":9049},[9050],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":9051},{"url":853},{"json":9053,"links":10038},{"data":9054,"content":9055,"nodeType":2232},{},[9056,9063,9075,9087,9099,9111,9117,9137,9144,9159,9166,9172,9175,9183,9190,9197,9204,9210,9213,9221,9228,9248,9255,9262,9269,9276,9282,9289,9296,9303,9332,9339,9358,9365,9372,9392,9412,9431,9437,9444,9460,9467,9474,9481,9500,9508,9515,9522,9525,9533,9540,9547,9554,9597,9603,9610,9625,9714,9720,9727,9734,9797,9804,9811,9818,9824,9831,9838,9845,9851,9858,9865,9872,9878,9897,9904,9911,9954,9960,9963,9971,9995,9998,10005,10012,10019],{"data":9057,"content":9058,"nodeType":866},{},[9059],{"data":9060,"marks":9061,"value":9062,"nodeType":865},{},[],"Oh, look! A time capsule from 2010. Wonder what’s inside … ",{"data":9064,"content":9065,"nodeType":866},{},[9066,9071],{"data":9067,"marks":9068,"value":9070,"nodeType":865},{},[9069],{"type":946},"Listening to:",{"data":9072,"marks":9073,"value":9074,"nodeType":865},{},[]," “Like a G6” by Far East Movement (on a Nokia C7 — hey, it even had a touchscreen).",{"data":9076,"content":9077,"nodeType":866},{},[9078,9083],{"data":9079,"marks":9080,"value":9082,"nodeType":865},{},[9081],{"type":946},"Major news event:",{"data":9084,"marks":9085,"value":9086,"nodeType":865},{},[]," Eyjafjallajökull volcano erupts in Iceland, disrupting air travel.",{"data":9088,"content":9089,"nodeType":866},{},[9090,9095],{"data":9091,"marks":9092,"value":9094,"nodeType":865},{},[9093],{"type":946},"Worried about:",{"data":9096,"marks":9097,"value":9098,"nodeType":865},{},[]," Exploitable Flash browser plugins and static HTML phishing sites.",{"data":9100,"content":9101,"nodeType":866},{},[9102,9107],{"data":9103,"marks":9104,"value":9106,"nodeType":865},{},[9105],{"type":946},"How to be a hero?",{"data":9108,"marks":9109,"value":9110,"nodeType":865},{},[]," Roll out the latest AV, implement a web proxy, and add a “report phishing” button to your email solution.",{"data":9112,"content":9116,"nodeType":907},{"target":9113},{"sys":9114},{"id":9115,"type":904,"linkType":905},"54xYbMs0ii96xb2jgQVX9m",[],{"data":9118,"content":9119,"nodeType":866},{},[9120,9124,9133],{"data":9121,"marks":9122,"value":9123,"nodeType":865},{},[],"We’re halfway through 2025, and the time capsule for this year may need to be an XL when it comes to ",{"data":9125,"content":9127,"nodeType":1102},{"uri":9126},"https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/",[9128],{"data":9129,"marks":9130,"value":9132,"nodeType":865},{},[9131],{"type":4537},"how much has happened",{"data":9134,"marks":9135,"value":9136,"nodeType":865},{},[]," in the world of browser-based attacks. (Yet fittingly, Drake’s “Nokia” is a pop hit.)",{"data":9138,"content":9139,"nodeType":866},{},[9140],{"data":9141,"marks":9142,"value":9143,"nodeType":865},{},[],"While at least we don’t have to worry about Flash anymore, the browser is now the new battleground, and workforce identities are the most common target. Security teams are struggling with approaches and tools that attackers have outpaced.",{"data":9145,"content":9146,"nodeType":866},{},[9147,9151,9155],{"data":9148,"marks":9149,"value":9150,"nodeType":865},{},[],"In this article, we’ll cover how browser-based attacks have evolved, and how Push is taking a new approach with the release of our ",{"data":9152,"marks":9153,"value":3463,"nodeType":865},{},[9154],{"type":946},{"data":9156,"marks":9157,"value":9158,"nodeType":865},{},[]," capabilities, now generally available to all customers.",{"data":9160,"content":9161,"nodeType":866},{},[9162],{"data":9163,"marks":9164,"value":9165,"nodeType":865},{},[],"Push Detections use real-time telemetry to help you understand context, user behavior, and attacker techniques, and then respond — a modern tool for modern browser-based attacks.",{"data":9167,"content":9171,"nodeType":907},{"target":9168},{"sys":9169},{"id":9170,"type":904,"linkType":905},"2ULDSj85bXtT2OgpXKBHtB",[],{"data":9173,"content":9174,"nodeType":938},{},[],{"data":9176,"content":9177,"nodeType":948},{},[9178],{"data":9179,"marks":9180,"value":9182,"nodeType":865},{},[9181],{"type":946},"The old world vs. the new world",{"data":9184,"content":9185,"nodeType":866},{},[9186],{"data":9187,"marks":9188,"value":9189,"nodeType":865},{},[],"In the early 2010s, the typical attack path involved sending a user an email with a link to a static HTML webpage (most commonly a generic Exchange Web Access clone) that tricked them into giving you Active Directory creds. These could be used to log in to an exposed remote desktop service or the victim’s mailbox, giving the attacker a foothold to install malware. Anyone who’s done “red teaming 101” will recognize this scenario. ",{"data":9191,"content":9192,"nodeType":866},{},[9193],{"data":9194,"marks":9195,"value":9196,"nodeType":865},{},[],"A compromised identity was once just part of a system compromise. That meant the scope of detection and response was focused on the organization’s Active Directory domain, correlated with endpoint and network logs. ",{"data":9198,"content":9199,"nodeType":866},{},[9200],{"data":9201,"marks":9202,"value":9203,"nodeType":865},{},[],"But now, identity attacks happen beyond traditional on-premises networks, impacting cloud identities that are created, used, and attacked in the browser. What was once the familiar backbone of business IT — internal apps and thick clients — has been replaced with a sprawling cloud and SaaS ecosystem that can be targeted directly via identity, without touching the endpoint. ",{"data":9205,"content":9209,"nodeType":907},{"target":9206},{"sys":9207},{"id":9208,"type":904,"linkType":905},"2F2p4eTMCHo3LfNQJZeGWB",[],{"data":9211,"content":9212,"nodeType":938},{},[],{"data":9214,"content":9215,"nodeType":948},{},[9216],{"data":9217,"marks":9218,"value":9220,"nodeType":865},{},[9219],{"type":946},"Why detection and response hasn’t kept up with threat evolution",{"data":9222,"content":9223,"nodeType":866},{},[9224],{"data":9225,"marks":9226,"value":9227,"nodeType":865},{},[],"This shift in attacker TTPs is forcing a change in how we handle detection and response. ",{"data":9229,"content":9230,"nodeType":866},{},[9231,9235,9244],{"data":9232,"marks":9233,"value":9234,"nodeType":865},{},[],"But a lot of organizations are still applying the same old playbooks to this new world where identity attacks are the ",{"data":9236,"content":9238,"nodeType":1102},{"uri":9237},"https://pushsecurity.com/resources/2024-identity-attacks",[9239],{"data":9240,"marks":9241,"value":9243,"nodeType":865},{},[9242],{"type":4537},"leading cause of breaches",{"data":9245,"marks":9246,"value":9247,"nodeType":865},{},[],", with uneven outcomes. ",{"data":9249,"content":9250,"nodeType":866},{},[9251],{"data":9252,"marks":9253,"value":9254,"nodeType":865},{},[],"This isn’t because of a lack of effort or skill on the part of security teams. It’s a reflection of the tools that have been available. ",{"data":9256,"content":9257,"nodeType":866},{},[9258],{"data":9259,"marks":9260,"value":9261,"nodeType":865},{},[],"Let’s look at some of the ways detection and response hasn’t kept up with the evolution of browser-borne threats in this new landscape.",{"data":9263,"content":9264,"nodeType":1218},{},[9265],{"data":9266,"marks":9267,"value":9268,"nodeType":865},{},[],"Incomplete identity visibility ",{"data":9270,"content":9271,"nodeType":866},{},[9272],{"data":9273,"marks":9274,"value":9275,"nodeType":865},{},[],"Today’s cloud identity providers see a fraction of the overall logins your users make to online apps, compared to the comprehensive visibility of Active Directory in the old world. You don’t know where users are logging in, how they’re logging in, or whether these logins are securely using phishing-resistant methods.",{"data":9277,"content":9281,"nodeType":907},{"target":9278},{"sys":9279},{"id":9280,"type":904,"linkType":905},"1SUYueQct7dtWwLh3AaAtA",[],{"data":9283,"content":9284,"nodeType":866},{},[9285],{"data":9286,"marks":9287,"value":9288,"nodeType":865},{},[],"This means that identity attacks are routinely bypassing preventative, account hygiene-based controls, putting the strain on detection and response. ",{"data":9290,"content":9291,"nodeType":1218},{},[9292],{"data":9293,"marks":9294,"value":9295,"nodeType":865},{},[],"Limited detection coverage ",{"data":9297,"content":9298,"nodeType":866},{},[9299],{"data":9300,"marks":9301,"value":9302,"nodeType":865},{},[],"Email and network security tools got pretty good at intercepting old-school phishing attacks like the ones from our proverbial time capsule: static HTML pages delivered over email that could be intercepted and analyzed when entering the mailbox or being loaded by the user. ",{"data":9304,"content":9305,"nodeType":866},{},[9306,9310,9320,9324,9328],{"data":9307,"marks":9308,"value":9309,"nodeType":865},{},[],"But with modern phishing attacks dynamically obfuscating the code that loads the web page, implementing custom bot protection, and using runtime anti-analysis features, they’re ",{"data":9311,"content":9313,"nodeType":1102},{"uri":9312},"https://pushsecurity.com/blog/why-most-phishing-attacks-feel-like-a-zero-day/",[9314],{"data":9315,"marks":9316,"value":9319,"nodeType":865},{},[9317,9318],{"type":4537},{"type":946},"increasingly difficult to detect",{"data":9321,"marks":9322,"value":6192,"nodeType":865},{},[9323],{"type":946},{"data":9325,"marks":9326,"value":9327,"nodeType":865},{},[],"using conventional tools",{"data":9329,"marks":9330,"value":6130,"nodeType":865},{},[9331],{"type":946},{"data":9333,"content":9334,"nodeType":866},{},[9335],{"data":9336,"marks":9337,"value":9338,"nodeType":865},{},[],"Of course, email-based detections aren’t much use if attackers are using legitimate services to camouflage their links, or bypassing email altogether by switching to alternative delivery channels like messaging apps (such as Slack and Teams), as well as public services like LinkedIn and Reddit. ",{"data":9340,"content":9341,"nodeType":866},{},[9342,9346,9354],{"data":9343,"marks":9344,"value":9345,"nodeType":865},{},[],"More recently, groups like ",{"data":9347,"content":9348,"nodeType":1102},{"uri":9126},[9349],{"data":9350,"marks":9351,"value":9353,"nodeType":865},{},[9352],{"type":4537},"Scattered Spider",{"data":9355,"marks":9356,"value":9357,"nodeType":865},{},[]," have even been seen using malvertising techniques, delivering phishing links masquerading as paid Google ads.",{"data":9359,"content":9360,"nodeType":1218},{},[9361],{"data":9362,"marks":9363,"value":9364,"nodeType":865},{},[],"Inadequate security logs",{"data":9366,"content":9367,"nodeType":866},{},[9368],{"data":9369,"marks":9370,"value":9371,"nodeType":865},{},[],"If you fail to spot the attack pre-account takeover, you’re reliant on being able to detect and investigate suspicious or malicious activity resulting from the compromise. ",{"data":9373,"content":9374,"nodeType":866},{},[9375,9379,9388],{"data":9376,"marks":9377,"value":9378,"nodeType":865},{},[],"This was more straightforward (if not easy) when you had the luxury of a ",{"data":9380,"content":9382,"nodeType":1102},{"uri":9381},"https://pushsecurity.com/blog/shifting-detection-left-for-more-effective-itdr/",[9383],{"data":9384,"marks":9385,"value":9387,"nodeType":865},{},[9386],{"type":4537},"typical on-prem network to fall back",{"data":9389,"marks":9390,"value":9391,"nodeType":865},{},[]," on. But with cloud exploitation taking place in a matter of minutes, you don’t get much warning — and your endpoint and network-based alarms can’t help you. ",{"data":9393,"content":9394,"nodeType":866},{},[9395,9399,9408],{"data":9396,"marks":9397,"value":9398,"nodeType":865},{},[],"The situation is further complicated by the fact that you simply don’t have the logs you need because of the huge variability in how cloud and SaaS services provide logs (with many ",{"data":9400,"content":9402,"nodeType":1102},{"uri":9401},"https://pushsecurity.com/blog/minimum-viable-identity-security/#id-enable-security-teams-to-detect-and-respond-to-identity-attacks",[9403],{"data":9404,"marks":9405,"value":9407,"nodeType":865},{},[9406],{"type":4537},"failing to provide security logs",{"data":9409,"marks":9410,"value":9411,"nodeType":865},{},[]," with relevant data points at all). So chances are you’re flying blind when it comes to large chunks of your business app suite. ",{"data":9413,"content":9414,"nodeType":866},{},[9415,9419,9427],{"data":9416,"marks":9417,"value":9418,"nodeType":865},{},[],"Ultimately, you’re stuck with what you can observe — typically network traffic. But ",{"data":9420,"content":9421,"nodeType":1102},{"uri":7446},[9422],{"data":9423,"marks":9424,"value":9426,"nodeType":865},{},[9425],{"type":4537},"even with a TLS-terminating proxy",{"data":9428,"marks":9429,"value":9430,"nodeType":865},{},[],", extracting fine-grained identity data points isn’t really achievable. You’re looking from the outside-in at malicious activity that’s happening in the user’s browser and trying to infer what happened.  ",{"data":9432,"content":9436,"nodeType":907},{"target":9433},{"sys":9434},{"id":9435,"type":904,"linkType":905},"7FMdHtbE63GMCavObETf3O",[],{"data":9438,"content":9439,"nodeType":1218},{},[9440],{"data":9441,"marks":9442,"value":9443,"nodeType":865},{},[],"Spotty control enforcement",{"data":9445,"content":9446,"nodeType":866},{},[9447,9451,9456],{"data":9448,"marks":9449,"value":9450,"nodeType":865},{},[],"And in the case that you do identify that a user clicked a malicious link and ",{"data":9452,"marks":9453,"value":9455,"nodeType":865},{},[9454],{"type":979},"maybe ",{"data":9457,"marks":9458,"value":9459,"nodeType":865},{},[],"entered their credentials into the page — now what? ",{"data":9461,"content":9462,"nodeType":866},{},[9463],{"data":9464,"marks":9465,"value":9466,"nodeType":865},{},[],"You can reset the account in the affected app, ideally terminating active sessions — which may or may not be possible, depending on the app. This might take a while if you don’t centrally manage the app, and involve some painful emergency phone calls to employees. ",{"data":9468,"content":9469,"nodeType":866},{},[9470],{"data":9471,"marks":9472,"value":9473,"nodeType":865},{},[],"What about apps where the same password is reused? ",{"data":9475,"content":9476,"nodeType":866},{},[9477],{"data":9478,"marks":9479,"value":9480,"nodeType":865},{},[],"Or if it’s an IdP account used for SSO, what about the other apps that might be accessible now? ",{"data":9482,"content":9483,"nodeType":866},{},[9484,9488,9496],{"data":9485,"marks":9486,"value":9487,"nodeType":865},{},[],"If the attacker has created stealthy backdoors that persist through credential changes (like ",{"data":9489,"content":9490,"nodeType":1102},{"uri":5377},[9491],{"data":9492,"marks":9493,"value":9495,"nodeType":865},{},[9494],{"type":4537},"creating an API key or a malicious OAuth integration",{"data":9497,"marks":9498,"value":9499,"nodeType":865},{},[],") they could still be lurking in your environment.",{"data":9501,"content":9502,"nodeType":866},{},[9503],{"data":9504,"marks":9505,"value":9507,"nodeType":865},{},[9506],{"type":946},"Suddenly, you’re not dealing with one possible control point, you’re dealing with several. ",{"data":9509,"content":9510,"nodeType":866},{},[9511],{"data":9512,"marks":9513,"value":9514,"nodeType":865},{},[],"And if you can’t trace the attack back to a source — because your email solution missed it, or it didn’t come via email, how can you triage the impact to other users? ",{"data":9516,"content":9517,"nodeType":866},{},[9518],{"data":9519,"marks":9520,"value":9521,"nodeType":865},{},[],"It’s no wonder that security teams are struggling to adapt. ",{"data":9523,"content":9524,"nodeType":938},{},[],{"data":9526,"content":9527,"nodeType":948},{},[9528],{"data":9529,"marks":9530,"value":9532,"nodeType":865},{},[9531],{"type":946},"How Push is solving modern identity investigations in the browser",{"data":9534,"content":9535,"nodeType":866},{},[9536],{"data":9537,"marks":9538,"value":9539,"nodeType":865},{},[],"The good news? We’ve seen this phenomenon play out before: In the early 2010s, in fact, when AV evolved into EDR. What was the big innovation then? Getting inside the data stream, in real time, and detecting and responding from a much higher-fidelity source of telemetry.",{"data":9541,"content":9542,"nodeType":866},{},[9543],{"data":9544,"marks":9545,"value":9546,"nodeType":865},{},[],"This time around, security teams need tools that take them inside the browser layer.",{"data":9548,"content":9549,"nodeType":866},{},[9550],{"data":9551,"marks":9552,"value":9553,"nodeType":865},{},[],"This approach gives you the right vantage point to defend against and investigate browser-based identity attacks, providing access to:",{"data":9555,"content":9556,"nodeType":891},{},[9557,9567,9577,9587],{"data":9558,"content":9559,"nodeType":880},{},[9560],{"data":9561,"content":9562,"nodeType":866},{},[9563],{"data":9564,"marks":9565,"value":9566,"nodeType":865},{},[],"Full decrypted HTTP traffic — not just DNS and TCP/IP metadata",{"data":9568,"content":9569,"nodeType":880},{},[9570],{"data":9571,"content":9572,"nodeType":866},{},[9573],{"data":9574,"marks":9575,"value":9576,"nodeType":865},{},[],"Full user interaction tracing — every click, keystroke, or DOM change",{"data":9578,"content":9579,"nodeType":880},{},[9580],{"data":9581,"content":9582,"nodeType":866},{},[9583],{"data":9584,"marks":9585,"value":9586,"nodeType":865},{},[],"Full inspection at every layer of execution, not just the initial HTML served",{"data":9588,"content":9589,"nodeType":880},{},[9590],{"data":9591,"content":9592,"nodeType":866},{},[9593],{"data":9594,"marks":9595,"value":9596,"nodeType":865},{},[],"Full access to browser APIs, to correlate with browser history, local storage, cookies, etc.",{"data":9598,"content":9602,"nodeType":907},{"target":9599},{"sys":9600},{"id":9601,"type":904,"linkType":905},"5qt0s8e1TIEUxhU1GzFO63",[],{"data":9604,"content":9605,"nodeType":866},{},[9606],{"data":9607,"marks":9608,"value":9609,"nodeType":865},{},[],"With this data, teams have the information they need to respond to and investigate browser-based attacks. But to become valuable, this data needs a translation layer that turns it from raw logs into actionable information.",{"data":9611,"content":9612,"nodeType":866},{},[9613,9617,9621],{"data":9614,"marks":9615,"value":9616,"nodeType":865},{},[],"That’s where Push’s ",{"data":9618,"marks":9619,"value":3463,"nodeType":865},{},[9620],{"type":946},{"data":9622,"marks":9623,"value":9624,"nodeType":865},{},[]," capability comes in. With it, you can:",{"data":9626,"content":9627,"nodeType":891},{},[9628,9664,9674,9684,9694,9704],{"data":9629,"content":9630,"nodeType":880},{},[9631],{"data":9632,"content":9633,"nodeType":866},{},[9634,9638,9647,9651,9660],{"data":9635,"marks":9636,"value":9637,"nodeType":865},{},[],"Get alerted in your platform of choice (via the Push admin console, ",{"data":9639,"content":9641,"nodeType":1102},{"uri":9640},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/send-webhook-events-to-slack/",[9642],{"data":9643,"marks":9644,"value":9646,"nodeType":865},{},[9645],{"type":4537},"Slack integration",{"data":9648,"marks":9649,"value":9650,"nodeType":865},{},[],", or your ",{"data":9652,"content":9654,"nodeType":1102},{"uri":9653},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/",[9655],{"data":9656,"marks":9657,"value":9659,"nodeType":865},{},[9658],{"type":4537},"SIEM/SOAR",{"data":9661,"marks":9662,"value":9663,"nodeType":865},{},[]," of choice) whenever Push detects a browser-based attack, such as AiTM phishing or a cloned login page.",{"data":9665,"content":9666,"nodeType":880},{},[9667],{"data":9668,"content":9669,"nodeType":866},{},[9670],{"data":9671,"marks":9672,"value":9673,"nodeType":865},{},[],"Review a curated timeline of the incident: Where a phishing link originated; whether a user entered their credentials on the page; what kind of phishkit was used; and whether the attack was blocked by Push.",{"data":9675,"content":9676,"nodeType":880},{},[9677],{"data":9678,"content":9679,"nodeType":866},{},[9680],{"data":9681,"marks":9682,"value":9683,"nodeType":865},{},[],"See all the other impacted accounts and apps that shared a password with the phished account so you can remediate them.",{"data":9685,"content":9686,"nodeType":880},{},[9687],{"data":9688,"content":9689,"nodeType":866},{},[9690],{"data":9691,"marks":9692,"value":9693,"nodeType":865},{},[],"See a screenshot captured by the Push browser extension of the phishing page, so you can see exactly what the user saw before the page disappears.",{"data":9695,"content":9696,"nodeType":880},{},[9697],{"data":9698,"content":9699,"nodeType":866},{},[9700],{"data":9701,"marks":9702,"value":9703,"nodeType":865},{},[],"Get additional context from urlscan.io about the domains connected to the incident, helping you understand whether a domain has been reported as malicious by other users, when it was registered, and how many times it’s been scanned.",{"data":9705,"content":9706,"nodeType":880},{},[9707],{"data":9708,"content":9709,"nodeType":866},{},[9710],{"data":9711,"marks":9712,"value":9713,"nodeType":865},{},[],"Interrogate and send this telemetry to your SIEM for you to operationalize it as part of SecOps workflows and hunt across events for similar incident characteristics.",{"data":9715,"content":9719,"nodeType":907},{"target":9716},{"sys":9717},{"id":9718,"type":904,"linkType":905},"5iPYWpPx4IZ2M1DykQiWsN",[],{"data":9721,"content":9722,"nodeType":1218},{},[9723],{"data":9724,"marks":9725,"value":9726,"nodeType":865},{},[],"Browser context",{"data":9728,"content":9729,"nodeType":866},{},[9730],{"data":9731,"marks":9732,"value":9733,"nodeType":865},{},[],"With Push, there’s no more: ",{"data":9735,"content":9736,"nodeType":891},{},[9737,9747,9757,9767,9777,9787],{"data":9738,"content":9739,"nodeType":880},{},[9740],{"data":9741,"content":9742,"nodeType":866},{},[9743],{"data":9744,"marks":9745,"value":9746,"nodeType":865},{},[],"Waiting (and hoping) that a browser-based attack gets recognized and reported by a user.",{"data":9748,"content":9749,"nodeType":880},{},[9750],{"data":9751,"content":9752,"nodeType":866},{},[9753],{"data":9754,"marks":9755,"value":9756,"nodeType":865},{},[],"Guesswork as to exactly what happened on the phishing page. ",{"data":9758,"content":9759,"nodeType":880},{},[9760],{"data":9761,"content":9762,"nodeType":866},{},[9763],{"data":9764,"marks":9765,"value":9766,"nodeType":865},{},[],"Struggling to get your hands on a live version of the page to see if it was actually malicious and getting thwarted because the attacker used a one-time phishing link. ",{"data":9768,"content":9769,"nodeType":880},{},[9770],{"data":9771,"content":9772,"nodeType":866},{},[9773],{"data":9774,"marks":9775,"value":9776,"nodeType":865},{},[],"Manually tracing the attack to see if it arrived by email so you can quarantine the messages. ",{"data":9778,"content":9779,"nodeType":880},{},[9780],{"data":9781,"content":9782,"nodeType":866},{},[9783],{"data":9784,"marks":9785,"value":9786,"nodeType":865},{},[],"Trawling through voluminous proxy logs for scraps of information (who else visited the link; where did it originate; etc.).",{"data":9788,"content":9789,"nodeType":880},{},[9790],{"data":9791,"content":9792,"nodeType":866},{},[9793],{"data":9794,"marks":9795,"value":9796,"nodeType":865},{},[],"Spending precious time on urlscan or VirusTotal to get basic context on a domain or IP address. ",{"data":9798,"content":9799,"nodeType":866},{},[9800],{"data":9801,"marks":9802,"value":9803,"nodeType":865},{},[],"Instead, Push gives you all the information you need in one place to investigate and respond. ",{"data":9805,"content":9806,"nodeType":866},{},[9807],{"data":9808,"marks":9809,"value":9810,"nodeType":865},{},[],"The foundation for these detections is the Push browser agent, which can be silently installed in all major browsers in your environment to begin streaming information about a user’s entire identity footprint. ",{"data":9812,"content":9813,"nodeType":866},{},[9814],{"data":9815,"marks":9816,"value":9817,"nodeType":865},{},[],"This valuable telemetry, combined with Push’s out-of-the-box controls and detections, gives you a seat on the user’s side of the equation, capturing reliable information about network requests, scripts loaded by a malicious website, and what a user clicked and navigated to: the ingredients for showing you how a browser-based attack unfolded, start to finish.",{"data":9819,"content":9823,"nodeType":907},{"target":9820},{"sys":9821},{"id":9822,"type":904,"linkType":905},"7ylgcaNDrxYhw7bULixM1C",[],{"data":9825,"content":9826,"nodeType":866},{},[9827],{"data":9828,"marks":9829,"value":9830,"nodeType":865},{},[],"Push raises a detection when it observes a phishing attack or when a user attempts to visit a blocked URL. You can view detections in the Push admin console, or send them to your SIEM or SOAR for correlation and analysis.",{"data":9832,"content":9833,"nodeType":1218},{},[9834],{"data":9835,"marks":9836,"value":9837,"nodeType":865},{},[],"Screenshot capture",{"data":9839,"content":9840,"nodeType":866},{},[9841],{"data":9842,"marks":9843,"value":9844,"nodeType":865},{},[],"The Push extension can also capture a screenshot at the time of a detection firing. This means security teams can see the visual characteristics of the page even if it’s since been taken down (and no more looking at bot protection screens like Cloudflare Turnstile on urlscan). ",{"data":9846,"content":9850,"nodeType":907},{"target":9847},{"sys":9848},{"id":9849,"type":904,"linkType":905},"58HPrc7wImm3mLxPK0yJOG",[],{"data":9852,"content":9853,"nodeType":1218},{},[9854],{"data":9855,"marks":9856,"value":9857,"nodeType":865},{},[],"Blast radius analysis for all impacted accounts & apps",{"data":9859,"content":9860,"nodeType":866},{},[9861],{"data":9862,"marks":9863,"value":9864,"nodeType":865},{},[],"With Push’s knowledge of your workforce identities — based on observing logins in the browser that use corporate credentials — the platform can also provide an analysis of the blast radius of an attack by showing you where other accounts and apps are impacted or at risk.",{"data":9866,"content":9867,"nodeType":866},{},[9868],{"data":9869,"marks":9870,"value":9871,"nodeType":865},{},[],"This information helps you understand the true impact of an incident so you can remediate all affected accounts.",{"data":9873,"content":9877,"nodeType":907},{"target":9874},{"sys":9875},{"id":9876,"type":904,"linkType":905},"77e8XMl2Rb0p7ZrG2wmURO",[],{"data":9879,"content":9880,"nodeType":866},{},[9881,9885,9893],{"data":9882,"marks":9883,"value":9884,"nodeType":865},{},[],"Push is able to provide this blast radius analysis by ",{"data":9886,"content":9887,"nodeType":1102},{"uri":6711},[9888],{"data":9889,"marks":9890,"value":9892,"nodeType":865},{},[9891],{"type":4537},"securely fingerprinting users’ passwords",{"data":9894,"marks":9895,"value":9896,"nodeType":865},{},[]," when a login is observed; analyzing them for security posture issues such as missing MFA, or stolen, weak, or reused passwords; and then raising that relevant context for a given detection.",{"data":9898,"content":9899,"nodeType":1218},{},[9900],{"data":9901,"marks":9902,"value":9903,"nodeType":865},{},[],"Correlated context from urlscan.io",{"data":9905,"content":9906,"nodeType":866},{},[9907],{"data":9908,"marks":9909,"value":9910,"nodeType":865},{},[],"Finally, through an integration with urlscan.io, Push is able to provide additional context about the domains involved in a detection event, including:",{"data":9912,"content":9913,"nodeType":891},{},[9914,9924,9934,9944],{"data":9915,"content":9916,"nodeType":880},{},[9917],{"data":9918,"content":9919,"nodeType":866},{},[9920],{"data":9921,"marks":9922,"value":9923,"nodeType":865},{},[],"When they were created",{"data":9925,"content":9926,"nodeType":880},{},[9927],{"data":9928,"content":9929,"nodeType":866},{},[9930],{"data":9931,"marks":9932,"value":9933,"nodeType":865},{},[],"How many times they have previously been scanned",{"data":9935,"content":9936,"nodeType":880},{},[9937],{"data":9938,"content":9939,"nodeType":866},{},[9940],{"data":9941,"marks":9942,"value":9943,"nodeType":865},{},[],"When they were last scanned",{"data":9945,"content":9946,"nodeType":880},{},[9947],{"data":9948,"content":9949,"nodeType":866},{},[9950],{"data":9951,"marks":9952,"value":9953,"nodeType":865},{},[],"If urlscan has marked them as suspicious",{"data":9955,"content":9959,"nodeType":907},{"target":9956},{"sys":9957},{"id":9958,"type":904,"linkType":905},"2AKpAk65XdmaGBfe2V4qZ5",[],{"data":9961,"content":9962,"nodeType":938},{},[],{"data":9964,"content":9965,"nodeType":948},{},[9966],{"data":9967,"marks":9968,"value":9970,"nodeType":865},{},[9969],{"type":946},"Check out our latest webinar for practical guidance in real-world scenarios",{"data":9972,"content":9973,"nodeType":866},{},[9974,9978,9987,9990],{"data":9975,"marks":9976,"value":9977,"nodeType":865},{},[],"For practical advice and applied examples of how to use Push data in incident response — as well as some bonus examples of automated response and remediation use cases — ",{"data":9979,"content":9981,"nodeType":1102},{"uri":9980},"https://pushsecurity.com/webinar/identity-detection-response",[9982],{"data":9983,"marks":9984,"value":9986,"nodeType":865},{},[9985],{"type":4537},"join us live on August 13 for our webinar",{"data":9988,"marks":9989,"value":3531,"nodeType":865},{},[],{"data":9991,"marks":9992,"value":9994,"nodeType":865},{},[9993],{"type":946},"“Identity attacks have changed — have your IR playbooks?”",{"data":9996,"content":9997,"nodeType":938},{},[],{"data":9999,"content":10000,"nodeType":948},{},[10001],{"data":10002,"marks":10003,"value":2164,"nodeType":865},{},[10004],{"type":946},{"data":10006,"content":10007,"nodeType":866},{},[10008],{"data":10009,"marks":10010,"value":10011,"nodeType":865},{},[],"Push’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying, and session hijacking using stolen session tokens. ",{"data":10013,"content":10014,"nodeType":866},{},[10015],{"data":10016,"marks":10017,"value":10018,"nodeType":865},{},[],"You can also use Push to find and fix identity vulnerabilities across every app that your employees use, including ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":10020,"content":10021,"nodeType":866},{},[10022,10026,10035],{"data":10023,"marks":10024,"value":10025,"nodeType":865},{},[],"If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":10027,"content":10029,"nodeType":1102},{"uri":10028},"https://pushsecurity.com/demo/",[10030],{"data":10031,"marks":10032,"value":10034,"nodeType":865},{},[10033],{"type":4537},"request a demo.",{"data":10036,"marks":10037,"value":21,"nodeType":865},{},[],{"entries":10039},{"hyperlink":10040,"inline":10041,"block":10042},[],[],[10043,10051,10055,10062,10088,10096,10104,10110,10117,10123,10129],{"sys":10044,"__typename":2366,"title":10045,"caption":10046,"layoutMode":59,"file":10047},{"id":9115},"Detections feature blog image 1","A version of NOW that sadly does not exist in the wild.",{"url":10048,"width":10049,"height":10050},"https://images.ctfassets.net/y1cdw1ablpvd/2jy8iOjUaE3L329TI67enQ/c47f600f8dc32c6358565791f4898443/image3.png",916,594,{"sys":10052,"__typename":2341,"title":10053,"arcadeDemoUrl":10054,"playText":2344},{"id":9170},"Detection walk-through 2","https://demo.arcade.software/gnOatHxEHaDs9SFRiDHY?embed",{"sys":10056,"__typename":2366,"title":10057,"caption":10058,"layoutMode":59,"file":10059},{"id":9208},"Detections Feature Blog: Attack Evolution","Attacks have shifted from targeting local networks to SaaS services, accessed through employee web browsers.",{"url":10060,"width":2444,"height":10061},"https://images.ctfassets.net/y1cdw1ablpvd/HzZeEBTpsqO575ni4j8oX/ccbc8ecf1b7dadfd9f2ec15f20399760/image4.png",815,{"sys":10063,"__typename":2303,"content":10064,"name":10087,"title":59},{"id":9280},{"json":10065},{"data":10066,"content":10067,"nodeType":2232},{},[10068],{"data":10069,"content":10070,"nodeType":866},{},[10071,10075,10083],{"data":10072,"marks":10073,"value":10074,"nodeType":865},{},[],"And even if your users are using phishing-resistant login methods, attackers are routinely using ",{"data":10076,"content":10077,"nodeType":1102},{"uri":6350},[10078],{"data":10079,"marks":10080,"value":10082,"nodeType":865},{},[10081],{"type":4537},"downgrade attacks",{"data":10084,"marks":10085,"value":10086,"nodeType":865},{},[]," to take advantage of less secure backup login methods — which they’re achieving using Adversary-in-the-Middle phishing kits that are the standard choice for attackers today.","Detection blog: insight box",{"sys":10089,"__typename":2366,"title":10090,"caption":10091,"layoutMode":59,"file":10092},{"id":9435},"Detections blog: Email and network layer identity tools are looking from the outside-in at attacks that happen in the victim’s web browser.","Email and network layer identity tools are looking from the outside-in at attacks that happen in the victim’s web browser.",{"url":10093,"width":10094,"height":10095},"https://images.ctfassets.net/y1cdw1ablpvd/1488clWVU9FbuCVLfK4kcW/c014d62cdba4a6bc9312a7b1ff36b469/image9.png",1694,884,{"sys":10097,"__typename":2366,"title":10098,"caption":10099,"layoutMode":59,"file":10100},{"id":9601},"Detections blog: Being in the browser gives you unrivalled visibility of phishing page activity and user behavior.","Being in the browser gives you unrivalled visibility of phishing page activity and user behavior.",{"url":10101,"width":10102,"height":10103},"https://images.ctfassets.net/y1cdw1ablpvd/4ogsAA3hGcMII18MwTYn6T/6fdf3ef0e6e59ecf412fd0748ba24145/Screenshot_2025-04-29_at_11.35.47.png",1942,924,{"sys":10105,"__typename":2366,"title":10106,"caption":10106,"layoutMode":59,"file":10107},{"id":9718},"Using Push, you can get a detailed timeline of what occurred in the browser during a security incident, including a screenshot of the phishing site and a view into all the impacted accounts.",{"url":10108,"width":10109,"height":2444},"https://images.ctfassets.net/y1cdw1ablpvd/aRWXKrYsTBsWNyLZD6xnq/19da00363042e2ec3b065cce711022da/image6.png",1504,{"sys":10111,"__typename":2366,"title":10112,"caption":10112,"layoutMode":59,"file":10113},{"id":9822},"Timeline detail from a detection, from link source to whether credentials were entered and a session was successfully created.",{"url":10114,"width":10115,"height":10116},"https://images.ctfassets.net/y1cdw1ablpvd/b7EMaJoZDdrMnbUYpNJYt/3f18f47eec73f3bb82fd453694179215/image1.png",1442,1562,{"sys":10118,"__typename":2366,"title":10119,"caption":10119,"layoutMode":59,"file":10120},{"id":9849},"Screenshot detail from a detection.",{"url":10121,"width":2444,"height":10122},"https://images.ctfassets.net/y1cdw1ablpvd/16pqmMfgYn5t66uCSAN4U9/f1c9ff29c31a14c2ea302455876776bf/image7.png",551,{"sys":10124,"__typename":2366,"title":10125,"caption":10125,"layoutMode":59,"file":10126},{"id":9876},"Blast radius detail from a detection showing login methods, compromised apps and at-risk accounts. ",{"url":10127,"width":2444,"height":10128},"https://images.ctfassets.net/y1cdw1ablpvd/78sUsmdsMFzElZjekjcn1R/31f9c1b5d9d04e94236d7f9888924609/image2.png",639,{"sys":10130,"__typename":2366,"title":10131,"caption":10131,"layoutMode":59,"file":10132},{"id":9958},"urlscan.io enrichment on a detection",{"url":10133,"width":2444,"height":10134},"https://images.ctfassets.net/y1cdw1ablpvd/32AfP4MM4lIuS8rTsuEXjj/65582616381c6f3f522101e1fb81f726/image5.png",1354,{"items":10136},[],{},"Introducing Push Detections: Equipping SecOps and IR teams","product-feature","2025-07-29T00:00:00.000Z",{"items":10142},[10143,10777,11137],{"__typename":2239,"sys":10144,"content":10146,"title":10760,"synopsis":10761,"hashTags":59,"publishedDate":10762,"slug":10763,"tagsCollection":10764,"authorsCollection":10770},{"id":10145},"XQHcBu5kiSBd6MMwICYI4",{"json":10147},{"data":10148,"content":10149,"nodeType":2232},{},[10150,10157,10164,10172,10201,10208,10214,10217,10225,10232,10239,10282,10289,10296,10299,10307,10314,10321,10328,10348,10355,10361,10369,10376,10383,10390,10396,10399,10407,10415,10422,10430,10437,10499,10506,10514,10521,10554,10562,10569,10577,10584,10592,10599,10652,10659,10662,10670,10677,10694,10727,10748,10754],{"data":10151,"content":10152,"nodeType":866},{},[10153],{"data":10154,"marks":10155,"value":10156,"nodeType":865},{},[],"Phishing has undergone a radical transformation. The laughably bad emails and fake PayPal logins of the past have given way to sophisticated campaigns engineered to slip through even the most hardened security stacks. ",{"data":10158,"content":10159,"nodeType":866},{},[10160],{"data":10161,"marks":10162,"value":10163,"nodeType":865},{},[],"Today’s phishing attacks are faster, more adaptable, and harder to catch with traditional tools. Email filters and threat intel still play an important role, but they’re often reacting to threats that are already in motion, and by the time a phishing link is flagged and blocklisted, someone has probably already clicked — and the attacker has moved onto their next set of links.",{"data":10165,"content":10166,"nodeType":866},{},[10167],{"data":10168,"marks":10169,"value":10171,"nodeType":865},{},[10170],{"type":946},"The problem isn’t that phishing has evolved. It’s that our defenses haven’t.",{"data":10173,"content":10174,"nodeType":866},{},[10175,10179,10188,10192,10197],{"data":10176,"marks":10177,"value":10178,"nodeType":865},{},[],"That’s where ",{"data":10180,"content":10182,"nodeType":1102},{"uri":10181},"https://pushsecurity.com/uc/zero-day-phishing-protection",[10183],{"data":10184,"marks":10185,"value":10187,"nodeType":865},{},[10186],{"type":4537},"Push Security",{"data":10189,"marks":10190,"value":10191,"nodeType":865},{},[]," comes in. By embedding real-time detection directly into the browser, the very place where phishing attacks unfold, Push offers a fundamentally new way to stop phishing: ",{"data":10193,"marks":10194,"value":10196,"nodeType":865},{},[10195],{"type":979},"as it happens",{"data":10198,"marks":10199,"value":10200,"nodeType":865},{},[],", regardless of whether or not the exact attack has ever been seen before. ",{"data":10202,"content":10203,"nodeType":866},{},[10204],{"data":10205,"marks":10206,"value":10207,"nodeType":865},{},[],"Check out the video to see how it works. ",{"data":10209,"content":10213,"nodeType":907},{"target":10210},{"sys":10211},{"id":10212,"type":904,"linkType":905},"4LaKobadjp19jjocLXcW4E",[],{"data":10215,"content":10216,"nodeType":938},{},[],{"data":10218,"content":10219,"nodeType":948},{},[10220],{"data":10221,"marks":10222,"value":10224,"nodeType":865},{},[10223],{"type":946},"The modern phishing playground",{"data":10226,"content":10227,"nodeType":866},{},[10228],{"data":10229,"marks":10230,"value":10231,"nodeType":865},{},[],"Phishing attacks today look nothing like the blunt instruments of a few years ago. These are fast, customized, and often completely ephemeral. A phishing domain might go live at 9 a.m., compromise scores of credentials, and be gone before lunch, long before it ever hits a threat intel feed.",{"data":10233,"content":10234,"nodeType":866},{},[10235],{"data":10236,"marks":10237,"value":10238,"nodeType":865},{},[],"Modern attackers use:",{"data":10240,"content":10241,"nodeType":891},{},[10242,10252,10262,10272],{"data":10243,"content":10244,"nodeType":880},{},[10245],{"data":10246,"content":10247,"nodeType":866},{},[10248],{"data":10249,"marks":10250,"value":10251,"nodeType":865},{},[],"Dynamic content and user-adaptive emails that can be easily changed based on the target’s identity and environment.",{"data":10253,"content":10254,"nodeType":880},{},[10255],{"data":10256,"content":10257,"nodeType":866},{},[10258],{"data":10259,"marks":10260,"value":10261,"nodeType":865},{},[],"Obfuscated URLs hidden behind trusted services (like Google Sites), making reputation analysis less than reliable.",{"data":10263,"content":10264,"nodeType":880},{},[10265],{"data":10266,"content":10267,"nodeType":866},{},[10268],{"data":10269,"marks":10270,"value":10271,"nodeType":865},{},[],"Real-time proxying tools to clone login flows and harvest credentials.",{"data":10273,"content":10274,"nodeType":880},{},[10275],{"data":10276,"content":10277,"nodeType":866},{},[10278],{"data":10279,"marks":10280,"value":10281,"nodeType":865},{},[],"Rapid-fire infrastructure rotation, making the attack’s infrastructure almost impossible to track in time.",{"data":10283,"content":10284,"nodeType":866},{},[10285],{"data":10286,"marks":10287,"value":10288,"nodeType":865},{},[],"These attacks often bypass traditional defenses entirely, not because the tools are broken, but because they were designed for a different era, one where phishing pages lived for days or weeks, not minutes.",{"data":10290,"content":10291,"nodeType":866},{},[10292],{"data":10293,"marks":10294,"value":10295,"nodeType":865},{},[],"It’s not enough to know what was bad yesterday. You need to know what’s happening now.",{"data":10297,"content":10298,"nodeType":938},{},[],{"data":10300,"content":10301,"nodeType":948},{},[10302],{"data":10303,"marks":10304,"value":10306,"nodeType":865},{},[10305],{"type":946},"Why blocklists and perimeter defenses are falling behind",{"data":10308,"content":10309,"nodeType":866},{},[10310],{"data":10311,"marks":10312,"value":10313,"nodeType":865},{},[],"The security ecosystem has long depended on reputation-based systems: block the known bad, allow the rest. That worked when attackers reused infrastructure and relied on mass campaigns. Today’s adversaries have adapted.",{"data":10315,"content":10316,"nodeType":866},{},[10317],{"data":10318,"marks":10319,"value":10320,"nodeType":865},{},[],"Consider a scenario similar to the one from our video:",{"data":10322,"content":10323,"nodeType":866},{},[10324],{"data":10325,"marks":10326,"value":10327,"nodeType":865},{},[],"A staff member receives an email appearing to be from Microsoft Teams. It includes dynamic content that mirrors their actual environment, including their username, company logo, and real collaboration data. The embedded link takes them to a cloned Microsoft login page hosted on a benign-looking subdomain. The site is brand new. It’s not on any blocklist. Your email filter passes it. The employee logs in. Credentials and session tokens? Gone.",{"data":10329,"content":10330,"nodeType":866},{},[10331,10335,10344],{"data":10332,"marks":10333,"value":10334,"nodeType":865},{},[],"And that’s just step one. The attacker now pivots to connected apps like ",{"data":10336,"content":10338,"nodeType":1102},{"uri":10337},"https://pushsecurity.com/blog/why-attackers-are-targeting-jira-with-stolen-credentials/",[10339],{"data":10340,"marks":10341,"value":10343,"nodeType":865},{},[10342],{"type":4537},"Jira",{"data":10345,"marks":10346,"value":10347,"nodeType":865},{},[],", Confluence, or AWS, moving laterally through your cloud environment using the compromised credentials.",{"data":10349,"content":10350,"nodeType":866},{},[10351],{"data":10352,"marks":10353,"value":10354,"nodeType":865},{},[],"Traditional tools often miss these threats not due to a lack of sophistication, but because they’re looking from the outside in. The browser is where the attack actually unfolds. Without visibility there, key indicators of compromise go undetected.",{"data":10356,"content":10360,"nodeType":907},{"target":10357},{"sys":10358},{"id":10359,"type":904,"linkType":905},"1UGu43QxCiYofkeGtOMp5J",[],{"data":10362,"content":10363,"nodeType":948},{},[10364],{"data":10365,"marks":10366,"value":10368,"nodeType":865},{},[10367],{"type":946},"Rethinking where phishing defense happens",{"data":10370,"content":10371,"nodeType":866},{},[10372],{"data":10373,"marks":10374,"value":10375,"nodeType":865},{},[],"Push changes where phishing protection happens, from upstream detection to point-of-interaction control. Instead of chasing malicious links through email gateways or external threat feeds, Push embeds lightweight, always-on protection directly, as users go about their work in the browser.",{"data":10377,"content":10378,"nodeType":866},{},[10379],{"data":10380,"marks":10381,"value":10382,"nodeType":865},{},[],"Push monitors what’s happening in each session: how pages are built, how they behave, and how users interact with them. That means it can recognize when a login prompt doesn’t match your identity provider or when a script behaves like part of a phishing toolkit.",{"data":10384,"content":10385,"nodeType":866},{},[10386],{"data":10387,"marks":10388,"value":10389,"nodeType":865},{},[],"When Push identifies something suspicious, it takes action right away. Logins are interrupted before any data is exposed. Users get clear guidance in-browser. And security teams receive detailed telemetry that shows exactly what happened, who was targeted, and how the threat was stopped.",{"data":10391,"content":10395,"nodeType":907},{"target":10392},{"sys":10393},{"id":10394,"type":904,"linkType":905},"7Hu3kypFWwJAGOuQp0kYmU",[],{"data":10397,"content":10398,"nodeType":938},{},[],{"data":10400,"content":10401,"nodeType":948},{},[10402],{"data":10403,"marks":10404,"value":10406,"nodeType":865},{},[10405],{"type":946},"The benefits of browser-native phishing defense",{"data":10408,"content":10409,"nodeType":1218},{},[10410],{"data":10411,"marks":10412,"value":10414,"nodeType":865},{},[10413],{"type":946},"True zero-day protection",{"data":10416,"content":10417,"nodeType":866},{},[10418],{"data":10419,"marks":10420,"value":10421,"nodeType":865},{},[],"Push doesn’t rely on known indicators of compromise. It evaluates the actual behavior and context of every session in real-time. Whether the phishing site was created 5 months ago or 5 minutes ago is irrelevant — Push detects it and shuts it down.",{"data":10423,"content":10424,"nodeType":1218},{},[10425],{"data":10426,"marks":10427,"value":10429,"nodeType":865},{},[10428],{"type":946},"Contextual threat detection",{"data":10431,"content":10432,"nodeType":866},{},[10433],{"data":10434,"marks":10435,"value":10436,"nodeType":865},{},[],"Because Push operates in the browser, it sees everything:",{"data":10438,"content":10439,"nodeType":891},{},[10440,10450,10460,10479,10489],{"data":10441,"content":10442,"nodeType":880},{},[10443],{"data":10444,"content":10445,"nodeType":866},{},[10446],{"data":10447,"marks":10448,"value":10449,"nodeType":865},{},[],"The page layout",{"data":10451,"content":10452,"nodeType":880},{},[10453],{"data":10454,"content":10455,"nodeType":866},{},[10456],{"data":10457,"marks":10458,"value":10459,"nodeType":865},{},[],"Where the user came from",{"data":10461,"content":10462,"nodeType":880},{},[10463],{"data":10464,"content":10465,"nodeType":866},{},[10466,10469,10476],{"data":10467,"marks":10468,"value":6708,"nodeType":865},{},[],{"data":10470,"content":10471,"nodeType":1102},{"uri":6711},[10472],{"data":10473,"marks":10474,"value":6717,"nodeType":865},{},[10475],{"type":4537},{"data":10477,"marks":10478,"value":21,"nodeType":865},{},[],{"data":10480,"content":10481,"nodeType":880},{},[10482],{"data":10483,"content":10484,"nodeType":866},{},[10485],{"data":10486,"marks":10487,"value":10488,"nodeType":865},{},[],"What scripts are running",{"data":10490,"content":10491,"nodeType":880},{},[10492],{"data":10493,"content":10494,"nodeType":866},{},[10495],{"data":10496,"marks":10497,"value":10498,"nodeType":865},{},[],"And where credentials are being sent",{"data":10500,"content":10501,"nodeType":866},{},[10502],{"data":10503,"marks":10504,"value":10505,"nodeType":865},{},[],"This context enables Push to stop even well-camouflaged phishing attempts, including AitM attacks that bypass MFA.",{"data":10507,"content":10508,"nodeType":1218},{},[10509],{"data":10510,"marks":10511,"value":10513,"nodeType":865},{},[10512],{"type":946},"Real-time interception of malicious activity",{"data":10515,"content":10516,"nodeType":866},{},[10517],{"data":10518,"marks":10519,"value":10520,"nodeType":865},{},[],"As soon as a phishing attempt is confirmed, the response is immediate:",{"data":10522,"content":10523,"nodeType":891},{},[10524,10534,10544],{"data":10525,"content":10526,"nodeType":880},{},[10527],{"data":10528,"content":10529,"nodeType":866},{},[10530],{"data":10531,"marks":10532,"value":10533,"nodeType":865},{},[],"Credential entry is halted.",{"data":10535,"content":10536,"nodeType":880},{},[10537],{"data":10538,"content":10539,"nodeType":866},{},[10540],{"data":10541,"marks":10542,"value":10543,"nodeType":865},{},[],"Sessions are revoked.",{"data":10545,"content":10546,"nodeType":880},{},[10547],{"data":10548,"content":10549,"nodeType":866},{},[10550],{"data":10551,"marks":10552,"value":10553,"nodeType":865},{},[],"The user is protected without delay.",{"data":10555,"content":10556,"nodeType":1218},{},[10557],{"data":10558,"marks":10559,"value":10561,"nodeType":865},{},[10560],{"type":946},"Reduced incident response overhead",{"data":10563,"content":10564,"nodeType":866},{},[10565],{"data":10566,"marks":10567,"value":10568,"nodeType":865},{},[],"Most phishing attacks end in hours of IR and expensive cleanup. With Push, attacks don’t escalate beyond the initial click. That means fewer compromised accounts, fewer escalations, and less fatigue on your security team.",{"data":10570,"content":10571,"nodeType":1218},{},[10572],{"data":10573,"marks":10574,"value":10576,"nodeType":865},{},[10575],{"type":946},"Empowered, educated users",{"data":10578,"content":10579,"nodeType":866},{},[10580],{"data":10581,"marks":10582,"value":10583,"nodeType":865},{},[],"Push doesn’t just block phishing; it helps users learn from it. When someone interacts with a suspicious page, they get clear, actionable feedback right in the browser. Over time, these in-the-moment cues help build stronger phishing awareness across your workforce. Employee-facing messages are fully customizable to match the tone and style of your organization.",{"data":10585,"content":10586,"nodeType":1218},{},[10587],{"data":10588,"marks":10589,"value":10591,"nodeType":865},{},[10590],{"type":946},"A new paradigm for identity security",{"data":10593,"content":10594,"nodeType":866},{},[10595],{"data":10596,"marks":10597,"value":10598,"nodeType":865},{},[],"While phishing detection is core, Push also helps you defend your entire browser-based identity attack surface. That means protecting against other common forms of account compromise, like:",{"data":10600,"content":10601,"nodeType":891},{},[10602,10612,10622,10632,10642],{"data":10603,"content":10604,"nodeType":880},{},[10605],{"data":10606,"content":10607,"nodeType":866},{},[10608],{"data":10609,"marks":10610,"value":10611,"nodeType":865},{},[],"Employees using breached or reused passwords",{"data":10613,"content":10614,"nodeType":880},{},[10615],{"data":10616,"content":10617,"nodeType":866},{},[10618],{"data":10619,"marks":10620,"value":10621,"nodeType":865},{},[],"Missing or misconfigured MFA",{"data":10623,"content":10624,"nodeType":880},{},[10625],{"data":10626,"content":10627,"nodeType":866},{},[10628],{"data":10629,"marks":10630,"value":10631,"nodeType":865},{},[],"Ghost logins that bypass your identity provider",{"data":10633,"content":10634,"nodeType":880},{},[10635],{"data":10636,"content":10637,"nodeType":866},{},[10638],{"data":10639,"marks":10640,"value":10641,"nodeType":865},{},[],"Token-based session hijacking",{"data":10643,"content":10644,"nodeType":880},{},[10645],{"data":10646,"content":10647,"nodeType":866},{},[10648],{"data":10649,"marks":10650,"value":10651,"nodeType":865},{},[],"Shadow SaaS usage",{"data":10653,"content":10654,"nodeType":866},{},[10655],{"data":10656,"marks":10657,"value":10658,"nodeType":865},{},[],"Because Push runs directly in the browser, it gives you visibility across every app your employees access, whether it’s officially managed or not. And it doesn’t just alert, it actively helps you fix the issues, guiding users to take action when risks are found.",{"data":10660,"content":10661,"nodeType":938},{},[],{"data":10663,"content":10664,"nodeType":948},{},[10665],{"data":10666,"marks":10667,"value":10669,"nodeType":865},{},[10668],{"type":946},"Modern phishing requires a modern defense",{"data":10671,"content":10672,"nodeType":866},{},[10673],{"data":10674,"marks":10675,"value":10676,"nodeType":865},{},[],"Phishing is no longer an email problem. It’s not even just a domain reputation problem. It’s an identity attack problem, and the only place you can see those attacks in action is inside the browser.",{"data":10678,"content":10679,"nodeType":866},{},[10680,10684,10691],{"data":10681,"marks":10682,"value":10683,"nodeType":865},{},[],"Push Security gives you a new advantage: proactive, in-browser protection against modern phishing campaigns — ",{"data":10685,"content":10686,"nodeType":1102},{"uri":10181},[10687],{"data":10688,"marks":10689,"value":10690,"nodeType":865},{},[],"even those with never-before-seen phishing sites",{"data":10692,"marks":10693,"value":1151,"nodeType":865},{},[],{"data":10695,"content":10696,"nodeType":891},{},[10697,10707,10717],{"data":10698,"content":10699,"nodeType":880},{},[10700],{"data":10701,"content":10702,"nodeType":866},{},[10703],{"data":10704,"marks":10705,"value":10706,"nodeType":865},{},[],"See the phish happen.",{"data":10708,"content":10709,"nodeType":880},{},[10710],{"data":10711,"content":10712,"nodeType":866},{},[10713],{"data":10714,"marks":10715,"value":10716,"nodeType":865},{},[],"Stop it in real time.",{"data":10718,"content":10719,"nodeType":880},{},[10720],{"data":10721,"content":10722,"nodeType":866},{},[10723],{"data":10724,"marks":10725,"value":10726,"nodeType":865},{},[],"Keep your workforce identities safe.",{"data":10728,"content":10729,"nodeType":866},{},[10730,10735,10743],{"data":10731,"marks":10732,"value":10734,"nodeType":865},{},[10733],{"type":946},"Want to see Push in action? ",{"data":10736,"content":10737,"nodeType":1102},{"uri":10028},[10738],{"data":10739,"marks":10740,"value":10742,"nodeType":865},{},[10741],{"type":946},"Book a demo",{"data":10744,"marks":10745,"value":10747,"nodeType":865},{},[10746],{"type":946}," and watch a real-time phishing attack get stopped mid-flow.",{"data":10749,"content":10753,"nodeType":907},{"target":10750},{"sys":10751},{"id":10752,"type":904,"linkType":905},"7eSsPjEj178j3ViloaChbQ",[],{"data":10755,"content":10756,"nodeType":866},{},[10757],{"data":10758,"marks":10759,"value":21,"nodeType":865},{},[],"How browser-level controls change the fight against phishing","Attackers are routinely defeating conventional email, network, and endpoint-based security controls. Here's how browser controls can level the playing field.","2025-06-26T00:00:00.000Z","how-browser-level-controls-change-the-fight-against-phishing",{"items":10765},[10766,10768],{"sys":10767,"name":2524},{"id":2523},{"sys":10769,"name":342},{"id":2527},{"items":10771},[10772],{"fullName":10773,"firstName":10774,"jobTitle":851,"profilePicture":10775},"Peyton Padfield","Peyton",{"url":10776},"https://images.ctfassets.net/y1cdw1ablpvd/1GU01HXElmc07nwi89qP3b/3188050420106c62e9df2ed4e4893b7f/1677005177901__1_.jpeg",{"__typename":2239,"sys":10778,"content":10780,"title":11121,"synopsis":11122,"hashTags":59,"publishedDate":11123,"slug":11124,"tagsCollection":11125,"authorsCollection":11130},{"id":10779},"4rLP8wr6HnvBG2OzqYYKpF",{"json":10781},{"data":10782,"content":10783,"nodeType":2232},{},[10784,10791,10798,10805,10811,10818,10851,10858,10865,10872,10878,10885,10892,10910,10916,10923,10943,10961,10968,10975,10982,10989,10996,11003,11010,11030,11037,11044,11050,11057,11064,11084,11090,11109,11115],{"data":10785,"content":10786,"nodeType":866},{},[10787],{"data":10788,"marks":10789,"value":10790,"nodeType":865},{},[],"Scattered Spider has shown the world the devastating effects attackers can achieve by socially engineering IT help desks into performing MFA resets so they can take over accounts on sensitive corporate apps. ",{"data":10792,"content":10793,"nodeType":866},{},[10794],{"data":10795,"marks":10796,"value":10797,"nodeType":865},{},[],"That’s why we’re introducing Employee Identity Verification Codes — a simple, browser-based identity check that gives your help desk a reliable way to confirm they’re talking to someone from your organization.",{"data":10799,"content":10800,"nodeType":866},{},[10801],{"data":10802,"marks":10803,"value":10804,"nodeType":865},{},[],"Push now provides your employees with a rotating 6-digit verification code in their browser via the Push Security extension. When an employee contacts your IT help desk to request an MFA reset or access recovery, the help desk can ask for this code to verify their identity — ensuring it’s really them, and not an attacker.",{"data":10806,"content":10810,"nodeType":907},{"target":10807},{"sys":10808},{"id":10809,"type":904,"linkType":905},"3PkiGgzwSt9Nb5rsGRiQVZ",[],{"data":10812,"content":10813,"nodeType":866},{},[10814],{"data":10815,"marks":10816,"value":10817,"nodeType":865},{},[],"The employee identity verification codes are:",{"data":10819,"content":10820,"nodeType":891},{},[10821,10831,10841],{"data":10822,"content":10823,"nodeType":880},{},[10824],{"data":10825,"content":10826,"nodeType":866},{},[10827],{"data":10828,"marks":10829,"value":10830,"nodeType":865},{},[],"Session-aware - generated in users’ browsers and only visible to them when they click on the Push Security extension icon in their browser toolbar.",{"data":10832,"content":10833,"nodeType":880},{},[10834],{"data":10835,"content":10836,"nodeType":866},{},[10837],{"data":10838,"marks":10839,"value":10840,"nodeType":865},{},[],"Rotating: they change every 24 hours",{"data":10842,"content":10843,"nodeType":880},{},[10844],{"data":10845,"content":10846,"nodeType":866},{},[10847],{"data":10848,"marks":10849,"value":10850,"nodeType":865},{},[],"Lightweight: no additional apps or devices required",{"data":10852,"content":10853,"nodeType":866},{},[10854],{"data":10855,"marks":10856,"value":10857,"nodeType":865},{},[],"It’s a fast, simple verification method — directly in the employee’s browser — that addresses a real-world threat.",{"data":10859,"content":10860,"nodeType":948},{},[10861],{"data":10862,"marks":10863,"value":10864,"nodeType":865},{},[],"We think it’s swell, but don’t just take our word for it …",{"data":10866,"content":10867,"nodeType":866},{},[10868],{"data":10869,"marks":10870,"value":10871,"nodeType":865},{},[],"Eric Rubin — a Senior Manager in GitLab’s Corporate Security team — has already rolled out Employee Identity Verification Codes across his workforce. Here’s what he had to say about it:",{"data":10873,"content":10877,"nodeType":907},{"target":10874},{"sys":10875},{"id":10876,"type":904,"linkType":905},"5ZLaA869NXpMjVwkswEyOB",[],{"data":10879,"content":10880,"nodeType":866},{},[10881],{"data":10882,"marks":10883,"value":10884,"nodeType":865},{},[],"Thank you, Eric!",{"data":10886,"content":10887,"nodeType":948},{},[10888],{"data":10889,"marks":10890,"value":10891,"nodeType":865},{},[],"Why are help desk identity verification methods so hot right now?",{"data":10893,"content":10894,"nodeType":866},{},[10895,10899,10906],{"data":10896,"marks":10897,"value":10898,"nodeType":865},{},[],"A number of the high-profile incidents attributed to the ",{"data":10900,"content":10901,"nodeType":1102},{"uri":9126},[10902],{"data":10903,"marks":10904,"value":10905,"nodeType":865},{},[],"Scattered Spider cybercriminal group",{"data":10907,"marks":10908,"value":10909,"nodeType":865},{},[]," saw them socially engineer IT help desks into resetting MFA on employee accounts that they had already acquired valid credentials for. These compromised accounts were typically on IdP systems like Okta providing SSO access to large numbers of downstream applications.",{"data":10911,"content":10915,"nodeType":907},{"target":10912},{"sys":10913},{"id":10914,"type":904,"linkType":905},"2F2dpOkyXWnrKgFC3dSl67",[],{"data":10917,"content":10918,"nodeType":1218},{},[10919],{"data":10920,"marks":10921,"value":10922,"nodeType":865},{},[],"Case study: The MGM Resorts breach",{"data":10924,"content":10925,"nodeType":866},{},[10926,10930,10939],{"data":10927,"marks":10928,"value":10929,"nodeType":865},{},[],"One of Scattered Spider’s most notorious and well-documented attacks was against ",{"data":10931,"content":10933,"nodeType":1102},{"uri":10932},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-mgm-resorts-september-2023",[10934],{"data":10935,"marks":10936,"value":10938,"nodeType":865},{},[10937],{"type":4537},"MGM Resorts",{"data":10940,"marks":10941,"value":10942,"nodeType":865},{},[],". Scattered Spider socially engineered MGM Resorts’ help desk personnel to bypass MFA and log in to accounts for which they had acquired valid login credentials via credential phishing and historical infostealer compromises. ",{"data":10944,"content":10945,"nodeType":866},{},[10946,10950,10957],{"data":10947,"marks":10948,"value":10949,"nodeType":865},{},[],"They specifically targeted accounts with Super Administrator privileges within MGM Resorts’ Okta tenant, which they then used to register a second, attacker-controlled IdP via ",{"data":10951,"content":10952,"nodeType":1102},{"uri":5533},[10953],{"data":10954,"marks":10955,"value":5539,"nodeType":865},{},[10956],{"type":4537},{"data":10958,"marks":10959,"value":10960,"nodeType":865},{},[],". This then enabled them to impersonate any user within the Okta tenant. ",{"data":10962,"content":10963,"nodeType":866},{},[10964],{"data":10965,"marks":10966,"value":10967,"nodeType":865},{},[],"The attackers were then able to abuse SSO access to downstream apps and platforms from various accounts, culminating in deployment of ransomware to around 100 ESXi servers and data exfiltration. ",{"data":10969,"content":10970,"nodeType":866},{},[10971],{"data":10972,"marks":10973,"value":10974,"nodeType":865},{},[],"The breach resulted in a 36-hour outage, a $100M hit to its Q3 results, one-time cyber consulting fees in the region of $10M, and a class-action lawsuit later settled for $45M. ",{"data":10976,"content":10977,"nodeType":1218},{},[10978],{"data":10979,"marks":10980,"value":10981,"nodeType":865},{},[],"Reassessing help desk verification processes",{"data":10983,"content":10984,"nodeType":866},{},[10985],{"data":10986,"marks":10987,"value":10988,"nodeType":865},{},[],"Scattered Spider’s high-profile attacks — including its most recent against UK retailers Marks & Spencer’s and the Co-op — has prompted many security teams to reassess the verification processes used by their IT help desks when an employee requests an MFA reset or access to sensitive applications. ",{"data":10990,"content":10991,"nodeType":866},{},[10992],{"data":10993,"marks":10994,"value":10995,"nodeType":865},{},[],"Initial guidance from across the industry included the use of call-back verification for any MFA or credential changes requested by an employee. However, Scattered Spider are also known to use SIM-swapping to trick mobile carriers into transferring a victim’s phone number to a SIM card controlled by the attacker - thereby allowing them to intercept verification calls. ",{"data":10997,"content":10998,"nodeType":948},{},[10999],{"data":11000,"marks":11001,"value":11002,"nodeType":865},{},[],"Simple verification using your employees’ browsers",{"data":11004,"content":11005,"nodeType":866},{},[11006],{"data":11007,"marks":11008,"value":11009,"nodeType":865},{},[],"Push already provides several controls that directly align to the other TTPs used by Scattered Spider. They include detecting stolen credentials, cloned login pages, AitM toolkits and compromised IdP sessions. ",{"data":11011,"content":11012,"nodeType":866},{},[11013,11017,11026],{"data":11014,"marks":11015,"value":11016,"nodeType":865},{},[],"(BTW, if this piques your interest, you can ",{"data":11018,"content":11020,"nodeType":1102},{"uri":11019},"https://pushsecurity.com/resources?type=webinar#content",[11021],{"data":11022,"marks":11023,"value":11025,"nodeType":865},{},[11024],{"type":4537},"stream our latest webinar",{"data":11027,"marks":11028,"value":11029,"nodeType":865},{},[]," where we deep-dive into Scattered Spider, how their TTPs are evolving in 2025, and what Push is doing to protect organizations against them.) ",{"data":11031,"content":11032,"nodeType":866},{},[11033],{"data":11034,"marks":11035,"value":11036,"nodeType":865},{},[],"But to provide our customers with an additional layer of defense against the Scattered Spider attack chain, we wanted to see how we could make it harder for attackers to socially engineer IT help desks into gaining access to IdP systems and sensitive apps.",{"data":11038,"content":11039,"nodeType":866},{},[11040],{"data":11041,"marks":11042,"value":11043,"nodeType":865},{},[],"As so often is the case, the answer was staring us right in the face - we can use our browser extension. By placing a verification code in the details tray of every employees’ Push extension, they can use that to verify their identity with their help desk team.",{"data":11045,"content":11049,"nodeType":907},{"target":11046},{"sys":11047},{"id":11048,"type":904,"linkType":905},"4hRJVGqKGyOHJ8NSsQYWGP",[],{"data":11051,"content":11052,"nodeType":948},{},[11053],{"data":11054,"marks":11055,"value":11056,"nodeType":865},{},[],"Get started today!",{"data":11058,"content":11059,"nodeType":866},{},[11060],{"data":11061,"marks":11062,"value":11063,"nodeType":865},{},[],"Employee verification codes is a Labs feature, which means it’s available on an early-access basis. We're particularly interested in hearing your feedback on how to develop this feature further.",{"data":11065,"content":11066,"nodeType":866},{},[11067,11070,11074,11077,11081],{"data":11068,"marks":11069,"value":4101,"nodeType":865},{},[],{"data":11071,"marks":11072,"value":2129,"nodeType":865},{},[11073],{"type":946},{"data":11075,"marks":11076,"value":4109,"nodeType":865},{},[],{"data":11078,"marks":11079,"value":4114,"nodeType":865},{},[11080],{"type":946},{"data":11082,"marks":11083,"value":4118,"nodeType":865},{},[],{"data":11085,"content":11089,"nodeType":907},{"target":11086},{"sys":11087},{"id":11088,"type":904,"linkType":905},"6TyqP2eOmalIF6RRoe476Y",[],{"data":11091,"content":11092,"nodeType":866},{},[11093,11097,11105],{"data":11094,"marks":11095,"value":11096,"nodeType":865},{},[],"If you’d like to find out more about this feature, and the other ways Push is stopping identity attacks in the browser, ",{"data":11098,"content":11099,"nodeType":1102},{"uri":10028},[11100],{"data":11101,"marks":11102,"value":11104,"nodeType":865},{},[11103],{"type":4537},"book a demo",{"data":11106,"marks":11107,"value":11108,"nodeType":865},{},[]," with one of our team. ",{"data":11110,"content":11114,"nodeType":907},{"target":11111},{"sys":11112},{"id":11113,"type":904,"linkType":905},"7xBE9MrnMy3hfwIkhLhNhQ",[],{"data":11116,"content":11117,"nodeType":866},{},[11118],{"data":11119,"marks":11120,"value":21,"nodeType":865},{},[],"A simple, browser-based way to protect your help desk against social engineering","Push's new Employee Identity Verification Codes feature is a simple way for your help desk to confirm they’re talking to someone from your organization.\n","2025-06-19T00:00:00.000Z","employee-identity-verification-codes-release",{"items":11126},[11127],{"sys":11128,"name":297},{"id":11129},"3pjES4THCIfSAwhGdNwBcy",{"items":11131},[11132],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":11135},"Alex Henshall","Alex",{"url":11136},"https://images.ctfassets.net/y1cdw1ablpvd/2rz3Pre3b1MexPIQ4hzPUe/0ef8a092b7e7df00fbce3f7d1ccb96d1/Alex_Henshall.jpeg",{"__typename":2239,"sys":11138,"content":11140,"title":11795,"synopsis":11796,"hashTags":59,"publishedDate":11797,"slug":11798,"tagsCollection":11799,"authorsCollection":11805},{"id":11139},"7dqGkFzSMA00bIJ94rW4na",{"json":11141},{"data":11142,"content":11143,"nodeType":2232},{},[11144,11151,11158,11164,11189,11209,11212,11220,11227,11234,11242,11262,11265,11273,11280,11285,11292,11298,11301,11309,11316,11323,11346,11353,11386,11393,11401,11420,11427,11433,11459,11491,11499,11506,11513,11546,11549,11557,11576,11583,11606,11613,11619,11622,11630,11637,11762,11765,11772,11779],{"data":11145,"content":11146,"nodeType":866},{},[11147],{"data":11148,"marks":11149,"value":11150,"nodeType":865},{},[],"As awareness grows around many MFA methods being “phishable” (i.e. not phishing resistant), passwordless authentication methods are being increasingly advocated. ",{"data":11152,"content":11153,"nodeType":866},{},[11154],{"data":11155,"marks":11156,"value":11157,"nodeType":865},{},[],"This is a good thing. The most commonly used MFA factors (like SMS codes, push notifications, and app-based OTP) are routinely bypassed, with modern reverse-proxy phishing kits the most common method. ",{"data":11159,"content":11163,"nodeType":907},{"target":11160},{"sys":11161},{"id":11162,"type":904,"linkType":905},"ImwzE2R9qaHaqlWn0GqIa",[],{"data":11165,"content":11166,"nodeType":866},{},[11167,11171,11176,11180,11185],{"data":11168,"marks":11169,"value":11170,"nodeType":865},{},[],"Often referred to as a “passkey”, passwordless authentication typically consists of a hardware security device that is built-into your laptop (e.g. the fingerprint sensor on a laptop) or something you plug into your device (e.g. a Yubikey). Because passkey-based logins are domain-bound, trying to use a passkey for ",{"data":11172,"marks":11173,"value":11175,"nodeType":865},{},[11174],{"type":4537},"microsoft.com",{"data":11177,"marks":11178,"value":11179,"nodeType":865},{},[]," on ",{"data":11181,"marks":11182,"value":11184,"nodeType":865},{},[11183],{"type":4537},"phishing.com",{"data":11186,"marks":11187,"value":11188,"nodeType":865},{},[]," simply won’t generate the correct value to pass the authentication check, even when proxied using an AitM kit. ",{"data":11190,"content":11191,"nodeType":866},{},[11192,11196,11206],{"data":11193,"marks":11194,"value":11195,"nodeType":865},{},[],"However, attackers have realized that even as these new phishing-resistant methods are starting to become used, most users still have alternative MFA methods active. The attacker can then do what’s called a ",{"data":11197,"content":11199,"nodeType":1102},{"uri":11198},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/mfa_downgrade/description.md",[11200],{"data":11201,"marks":11202,"value":11205,"nodeType":865},{},[11203,11204],{"type":4537},{"type":946},"downgrade attack",{"data":11207,"marks":11208,"value":1151,"nodeType":865},{},[],{"data":11210,"content":11211,"nodeType":938},{},[],{"data":11213,"content":11214,"nodeType":948},{},[11215],{"data":11216,"marks":11217,"value":11219,"nodeType":865},{},[11218],{"type":946},"Downgrade attacks 101",{"data":11221,"content":11222,"nodeType":866},{},[11223],{"data":11224,"marks":11225,"value":11226,"nodeType":865},{},[],"When conducting an Attacker-in-the-Middle phishing attack, the attacker doesn’t need to relay 100% of the messages accurately. Instead, they can alter some of them. The app might ask the user “You need to MFA — do you want to use your passkey, or your backup authenticator code?”, but the phishing website might modify this page to say “You need to MFA — use your backup authenticator code” not giving you the option to use your secure passkey. This is called a downgrade attack.",{"data":11228,"content":11229,"nodeType":866},{},[11230],{"data":11231,"marks":11232,"value":11233,"nodeType":865},{},[],"This can also be applied to accounts that use SSO as the default login method. In this scenario, the phish kit can select a backup username and password option to allow the phishing attack to proceed.  ",{"data":11235,"content":11236,"nodeType":866},{},[11237],{"data":11238,"marks":11239,"value":11241,"nodeType":865},{},[11240],{"type":946},"So, you have a situation where even if a phishing-resistant login method exists, the presence of a less secure backup method means the account is still vulnerable to phishing attacks. ",{"data":11243,"content":11244,"nodeType":866},{},[11245,11249,11258],{"data":11246,"marks":11247,"value":11248,"nodeType":865},{},[],"These attacks are effective across a number of sites and login methods that support passkey-based logins, for example, Windows Hello, Okta FastPass, and Google Workspace. As an example, here’s a link to a ",{"data":11250,"content":11252,"nodeType":1102},{"uri":11251},"https://github.com/yudasm/WHfB-o365-Phishlet",[11253],{"data":11254,"marks":11255,"value":11257,"nodeType":865},{},[11256],{"type":4537},"custom phishlet for Evilginx",{"data":11259,"marks":11260,"value":11261,"nodeType":865},{},[]," targeting Windows Hello for Business. A small caveat is that changes made by Microsoft have since broken this plugin, but we were able to write our own custom phishlet to achieve the same outcome. ",{"data":11263,"content":11264,"nodeType":938},{},[],{"data":11266,"content":11267,"nodeType":948},{},[11268],{"data":11269,"marks":11270,"value":11272,"nodeType":865},{},[11271],{"type":946},"MFA downgrade in action",{"data":11274,"content":11275,"nodeType":866},{},[11276],{"data":11277,"marks":11278,"value":11279,"nodeType":865},{},[],"Check out the video below to see an example of using Evilginx with a custom phishlet to downgrade authentication for a Microsoft account using Windows Hello. ",{"data":11281,"content":11284,"nodeType":907},{"target":11282},{"sys":11283},{"id":6365,"type":904,"linkType":905},[],{"data":11286,"content":11287,"nodeType":866},{},[11288],{"data":11289,"marks":11290,"value":11291,"nodeType":865},{},[],"We’ve encountered similar functionality in criminal phishing platforms we’ve investigated such as Tycoon — in this case, targeting Google accounts. This snippet is notable in that it includes JavaScript to abuse UI features to bypass passkeys.",{"data":11293,"content":11297,"nodeType":907},{"target":11294},{"sys":11295},{"id":11296,"type":904,"linkType":905},"5Vya1VApSisr0000HuTLY2",[],{"data":11299,"content":11300,"nodeType":938},{},[],{"data":11302,"content":11303,"nodeType":948},{},[11304],{"data":11305,"marks":11306,"value":11308,"nodeType":865},{},[11307],{"type":946},"Mitigations (and challenges)",{"data":11310,"content":11311,"nodeType":866},{},[11312],{"data":11313,"marks":11314,"value":11315,"nodeType":865},{},[],"MFA downgrade is made possible by the existence of backup authentication methods. So the obvious solution is to remove backup/unused login and MFA methods from your accounts, ensuring you’re accessing apps using SSO from a hardened Identity Provider (IdP) account (e.g. Okta, Entra, Google Workspace). ",{"data":11317,"content":11318,"nodeType":866},{},[11319],{"data":11320,"marks":11321,"value":11322,"nodeType":865},{},[],"In the ideal world, you’d be:",{"data":11324,"content":11325,"nodeType":891},{},[11326,11336],{"data":11327,"content":11328,"nodeType":880},{},[11329],{"data":11330,"content":11331,"nodeType":866},{},[11332],{"data":11333,"marks":11334,"value":11335,"nodeType":865},{},[],"Using only one IdP account, which you access via passkey, with no backup methods.",{"data":11337,"content":11338,"nodeType":880},{},[11339],{"data":11340,"content":11341,"nodeType":866},{},[11342],{"data":11343,"marks":11344,"value":11345,"nodeType":865},{},[],"Accessing all business apps using SSO from your locked-down IdP account. ",{"data":11347,"content":11348,"nodeType":866},{},[11349],{"data":11350,"marks":11351,"value":11352,"nodeType":865},{},[],"The reality is way different, though. Because going totally passwordless is hard. It requires a large investment of time, money, and training for end-users. You’ll find many cautionary tales of companies starting on their passkey adoption journey and ultimately failing to make it a reality. This is largely because:",{"data":11354,"content":11355,"nodeType":891},{},[11356,11366,11376],{"data":11357,"content":11358,"nodeType":880},{},[11359],{"data":11360,"content":11361,"nodeType":866},{},[11362],{"data":11363,"marks":11364,"value":11365,"nodeType":865},{},[],"In environments with a mix of older and newer infrastructure, it can be challenging to get complete coverage. ",{"data":11367,"content":11368,"nodeType":880},{},[11369],{"data":11370,"content":11371,"nodeType":866},{},[11372],{"data":11373,"marks":11374,"value":11375,"nodeType":865},{},[],"Not every device comes with an in-built biometric identification method, so you need to use a second device — which employees may struggle with (especially when they lose it and aren’t familiar with how to regain account access).",{"data":11377,"content":11378,"nodeType":880},{},[11379],{"data":11380,"content":11381,"nodeType":866},{},[11382],{"data":11383,"marks":11384,"value":11385,"nodeType":865},{},[],"Most apps don’t allow you to log in directly with a passkey, meaning you need to SSO from your IdP account. But many apps don’t support every preferred SSO provider, and fail to provide SAML support, so there can be gaps.  ",{"data":11387,"content":11388,"nodeType":866},{},[11389],{"data":11390,"marks":11391,"value":11392,"nodeType":865},{},[],"And ultimately, because of the self-service, product-led growth fuelled nature of most online services today, it’s easy for users to slip back into using passwords — and hard for security teams to find and remove them (particularly if an app isn’t centrally managed). And the level of support that different apps provide users and administrators to secure how they access their services varies significantly. ",{"data":11394,"content":11395,"nodeType":1218},{},[11396],{"data":11397,"marks":11398,"value":11400,"nodeType":865},{},[11399],{"type":946},"Most apps make removing phishable authentication hard",{"data":11402,"content":11403,"nodeType":866},{},[11404,11408,11416],{"data":11405,"marks":11406,"value":11407,"nodeType":865},{},[],"While some providers are taking steps to go passwordless by default, which makes it easier to remove passwords (e.g. ",{"data":11409,"content":11411,"nodeType":1102},{"uri":11410},"https://techcommunity.microsoft.com/blog/microsoft-entra-blog/introducing-password-removal-for-microsoft-accounts/2747280",[11412],{"data":11413,"marks":11414,"value":5800,"nodeType":865},{},[11415],{"type":4537},{"data":11417,"marks":11418,"value":11419,"nodeType":865},{},[]," recently made a big deal of its desire to get rid of passwords), the quality of identity security management functionality varies significantly from app to app. ",{"data":11421,"content":11422,"nodeType":866},{},[11423],{"data":11424,"marks":11425,"value":11426,"nodeType":865},{},[],"Many apps default to the most recently used or strongest login method, but very few automatically lock you in to using the strongest method available. Most of the time, these kinds of controls also need to be configured in the app — which can be challenging if your security team doesn’t manage it (or simply isn’t aware of it). ",{"data":11428,"content":11432,"nodeType":907},{"target":11429},{"sys":11430},{"id":11431,"type":904,"linkType":905},"4X9MR0CbSMltOmw767XNOm",[],{"data":11434,"content":11435,"nodeType":866},{},[11436,11440,11444,11448,11455],{"data":11437,"marks":11438,"value":11439,"nodeType":865},{},[],"Finally, configuring MFA is often an additive process — you start by adding a phone number, then you add an authenticator app or a passkey. Just like we find that most accounts with SSO ",{"data":11441,"marks":11442,"value":5020,"nodeType":865},{},[11443],{"type":946},{"data":11445,"marks":11446,"value":11447,"nodeType":865},{},[]," have a password login configured (also known as ",{"data":11449,"content":11450,"nodeType":1102},{"uri":5377},[11451],{"data":11452,"marks":11453,"value":5383,"nodeType":865},{},[11454],{"type":4537},{"data":11456,"marks":11457,"value":11458,"nodeType":865},{},[],"), most accounts with MFA typically have multiple methods attached to their account. ",{"data":11460,"content":11461,"nodeType":866},{},[11462,11466,11475,11478,11487],{"data":11463,"marks":11464,"value":11465,"nodeType":865},{},[],"The result is that even if you can successfully lock down a handful of apps, many more will continue to be susceptible to phishing attacks using commonly available downgrade functionality. And as attackers diversify the apps they target (such as these recent examples targeting ",{"data":11467,"content":11469,"nodeType":1102},{"uri":11468},"https://pushsecurity.com/blog/investigating-a-recent-malvertising-campaign-targeting-onfido-customers/",[11470],{"data":11471,"marks":11472,"value":11474,"nodeType":865},{},[11473],{"type":4537},"Onfido",{"data":11476,"marks":11477,"value":1913,"nodeType":865},{},[],{"data":11479,"content":11481,"nodeType":1102},{"uri":11480},"https://pushsecurity.com/blog/dissecting-a-recent-mailchimp-phishing-attack/",[11482],{"data":11483,"marks":11484,"value":11486,"nodeType":865},{},[11485],{"type":4537},"MailChimp",{"data":11488,"marks":11489,"value":11490,"nodeType":865},{},[],"), this becomes increasingly likely. ",{"data":11492,"content":11493,"nodeType":1218},{},[11494],{"data":11495,"marks":11496,"value":11498,"nodeType":865},{},[11497],{"type":946},"Conditional access is a useful mitigation if configured properly, but only on apps which support it",{"data":11500,"content":11501,"nodeType":866},{},[11502],{"data":11503,"marks":11504,"value":11505,"nodeType":865},{},[],"Conditional access policies are a useful last line of defense against account takeover attacks by denying logins that don't meet certain criteria, even if they user is able to authenticate. In larger IdP platforms that typically support more granular conditional access policies, this is a useful addition when configured correctly. However, many apps simply don't support conditional access, so will be vulnerable to attackers targeting them directly (as opposed to first logging into e.g. Microsoft or Google, and then accessing downstream apps via SSO). ",{"data":11507,"content":11508,"nodeType":866},{},[11509],{"data":11510,"marks":11511,"value":11512,"nodeType":865},{},[],"That said, locking down your core IdP platforms with robust conditional access should be a top priority for security teams. Useful policies that should be configured include:",{"data":11514,"content":11515,"nodeType":891},{},[11516,11526,11536],{"data":11517,"content":11518,"nodeType":880},{},[11519],{"data":11520,"content":11521,"nodeType":866},{},[11522],{"data":11523,"marks":11524,"value":11525,"nodeType":865},{},[],"Limiting logins to domain-joined devices.",{"data":11527,"content":11528,"nodeType":880},{},[11529],{"data":11530,"content":11531,"nodeType":866},{},[11532],{"data":11533,"marks":11534,"value":11535,"nodeType":865},{},[],"Set phishing-resistant MFA as required. ",{"data":11537,"content":11538,"nodeType":880},{},[11539],{"data":11540,"content":11541,"nodeType":866},{},[11542],{"data":11543,"marks":11544,"value":11545,"nodeType":865},{},[],"(Where possible) limit logins to trusted IP ranges. ",{"data":11547,"content":11548,"nodeType":938},{},[],{"data":11550,"content":11551,"nodeType":948},{},[11552],{"data":11553,"marks":11554,"value":11556,"nodeType":865},{},[11555],{"type":946},"Tackling MFA downgrade with Push Security",{"data":11558,"content":11559,"nodeType":866},{},[11560,11564,11572],{"data":11561,"marks":11562,"value":11563,"nodeType":865},{},[],"Phishing-resistant authentication methods like passkeys are key to the future of enterprise identity security, but organizations need to recognize that adopting passkeys isn’t a silver bullet. Ensuring that passkeys are the only authentication method supported by your business apps is no mean feat, considering ",{"data":11565,"content":11566,"nodeType":1102},{"uri":6406},[11567],{"data":11568,"marks":11569,"value":11571,"nodeType":865},{},[11570],{"type":4537},"most organizations are using hundreds of them",{"data":11573,"marks":11574,"value":11575,"nodeType":865},{},[]," — all with their own specific ways of handling and administering identities. ",{"data":11577,"content":11578,"nodeType":866},{},[11579],{"data":11580,"marks":11581,"value":11582,"nodeType":865},{},[],"That’s why we support a layered defense, providing last-mile protection by:",{"data":11584,"content":11585,"nodeType":891},{},[11586,11596],{"data":11587,"content":11588,"nodeType":880},{},[11589],{"data":11590,"content":11591,"nodeType":866},{},[11592],{"data":11593,"marks":11594,"value":11595,"nodeType":865},{},[],"Intercepting and blocking phishing attacks in the browser to prevent AiTM attacks using downgrade techniques.",{"data":11597,"content":11598,"nodeType":880},{},[11599],{"data":11600,"content":11601,"nodeType":866},{},[11602],{"data":11603,"marks":11604,"value":11605,"nodeType":865},{},[],"Identifying backup MFA and login methods across the business apps your employees use, so they can be removed (individually or through app-level configuration changes).",{"data":11607,"content":11608,"nodeType":866},{},[11609],{"data":11610,"marks":11611,"value":11612,"nodeType":865},{},[],"Here’s how it works.",{"data":11614,"content":11618,"nodeType":907},{"target":11615},{"sys":11616},{"id":11617,"type":904,"linkType":905},"2uvItnfaOQZHa4a9BIIhRn",[],{"data":11620,"content":11621,"nodeType":938},{},[],{"data":11623,"content":11624,"nodeType":948},{},[11625],{"data":11626,"marks":11627,"value":11629,"nodeType":865},{},[11628],{"type":946},"Further reading",{"data":11631,"content":11632,"nodeType":866},{},[11633],{"data":11634,"marks":11635,"value":11636,"nodeType":865},{},[],"MFA downgrade is just one method of getting into an otherwise locked-down account. Attackers are also finding ways to bypass the standard authentication process entirely, through: ",{"data":11638,"content":11639,"nodeType":891},{},[11640,11673,11707,11728],{"data":11641,"content":11642,"nodeType":880},{},[11643],{"data":11644,"content":11645,"nodeType":866},{},[11646,11649,11657,11661,11670],{"data":11647,"marks":11648,"value":21,"nodeType":865},{},[],{"data":11650,"content":11651,"nodeType":1102},{"uri":6484},[11652],{"data":11653,"marks":11654,"value":11656,"nodeType":865},{},[11655],{"type":4537},"App-specific password phishing",{"data":11658,"marks":11659,"value":11660,"nodeType":865},{},[],", where attackers can abuse functionality designed to enable users to log into apps that don’t support modern authentication. (",{"data":11662,"content":11664,"nodeType":1102},{"uri":11663},"https://pushsecurity.com/blog/app-specific-password-phishing/",[11665],{"data":11666,"marks":11667,"value":11669,"nodeType":865},{},[11668],{"type":4537},"Read the article for more information here",{"data":11671,"marks":11672,"value":6459,"nodeType":865},{},[],{"data":11674,"content":11675,"nodeType":880},{},[11676],{"data":11677,"content":11678,"nodeType":866},{},[11679,11682,11690,11694,11703],{"data":11680,"marks":11681,"value":21,"nodeType":865},{},[],{"data":11683,"content":11684,"nodeType":1102},{"uri":6497},[11685],{"data":11686,"marks":11687,"value":11689,"nodeType":865},{},[11688],{"type":4537},"Consent phishing",{"data":11691,"marks":11692,"value":11693,"nodeType":865},{},[],", which sees the victim accept OAuth scopes for an attacker-controlled app integration granting access to the account without needing to directly compromise it. (",{"data":11695,"content":11697,"nodeType":1102},{"uri":11696},"https://pushsecurity.com/blog/how-consent-phishing-is-evolving/",[11698],{"data":11699,"marks":11700,"value":11702,"nodeType":865},{},[11701],{"type":4537},"You can read more about recent examples here",{"data":11704,"marks":11705,"value":11706,"nodeType":865},{},[],".) ",{"data":11708,"content":11709,"nodeType":880},{},[11710],{"data":11711,"content":11712,"nodeType":866},{},[11713,11716,11724],{"data":11714,"marks":11715,"value":21,"nodeType":865},{},[],{"data":11717,"content":11719,"nodeType":1102},{"uri":11718},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_code_phishing/description.md",[11720],{"data":11721,"marks":11722,"value":360,"nodeType":865},{},[11723],{"type":4537},{"data":11725,"marks":11726,"value":11727,"nodeType":865},{},[],", functionally very similar to consent phishing but involving the victim entering a code for authorization. ",{"data":11729,"content":11730,"nodeType":880},{},[11731],{"data":11732,"content":11733,"nodeType":866},{},[11734,11737,11745,11749,11758],{"data":11735,"marks":11736,"value":21,"nodeType":865},{},[],{"data":11738,"content":11739,"nodeType":1102},{"uri":6509},[11740],{"data":11741,"marks":11742,"value":11744,"nodeType":865},{},[11743],{"type":4537},"Cross-IdP impersonation",{"data":11746,"marks":11747,"value":11748,"nodeType":865},{},[],", which sees the attacker register a new IdP connected to the victim’s email account that can be used to access connected apps via SSO without directly compromising the primary IdP. (",{"data":11750,"content":11752,"nodeType":1102},{"uri":11751},"https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/",[11753],{"data":11754,"marks":11755,"value":11757,"nodeType":865},{},[11756],{"type":4537},"You can read more about this here",{"data":11759,"marks":11760,"value":11761,"nodeType":865},{},[],".)",{"data":11763,"content":11764,"nodeType":938},{},[],{"data":11766,"content":11767,"nodeType":948},{},[11768],{"data":11769,"marks":11770,"value":2777,"nodeType":865},{},[11771],{"type":946},{"data":11773,"content":11774,"nodeType":866},{},[11775],{"data":11776,"marks":11777,"value":11778,"nodeType":865},{},[],"Push Security’s browser-based security platform provides comprehensive identity attack detection and response capabilities against techniques like AiTM phishing, credential stuffing, password spraying and session hijacking using stolen session tokens. You can also use Push to find and fix identity vulnerabilities across every app that your employees use, like: ghost logins; SSO coverage gaps; MFA gaps; weak, breached and reused passwords; risky OAuth integrations; and more.",{"data":11780,"content":11781,"nodeType":866},{},[11782,11785,11792],{"data":11783,"marks":11784,"value":10025,"nodeType":865},{},[],{"data":11786,"content":11787,"nodeType":1102},{"uri":10028},[11788],{"data":11789,"marks":11790,"value":4940,"nodeType":865},{},[11791],{"type":4537},{"data":11793,"marks":11794,"value":1151,"nodeType":865},{},[],"MFA downgrade: How attackers are getting around phishing-resistant authentication","MFA downgrade attacks are an increasingly common technique used by attackers to bypass phishing-resistant authentication methods registered to an account.","2025-07-21T00:00:00.000Z","mfa-downgrade-attacks",{"items":11800},[11801,11803],{"sys":11802,"name":342},{"id":2527},{"sys":11804,"name":2524},{"id":2523},{"items":11806},[11807],{"fullName":11808,"firstName":11809,"jobTitle":11810,"profilePicture":11811},"Luke Jennings","Luke","Vice President, R&D",{"url":11812},"https://images.ctfassets.net/y1cdw1ablpvd/4Hosb4zKi1dA0PUyDLMe1h/27e09d894861f2196ba794037986fb08/T016S22KZ96-U02NVQM7ZD4-57761d542d83-512.jpeg","blog/introducing-push-detections",{"json":11815},{"data":11816,"content":11817,"nodeType":2232},{},[11818],{"data":11819,"content":11820,"nodeType":866},{},[11821],{"data":11822,"marks":11823,"value":11824,"nodeType":865},{},[],"We’re launching a new Detections capability to provide deeper context and fine-grained data points on attacks that Push intercepts in the browser — enabling security teams to more effectively investigate and triage alerts, and build more effective workflows. ","We’re launching a new Detections capability, enabling security teams to more effectively investigate and triage alerts, and build more effective workflows. ",{"id":3574,"publishedAt":11827},"2026-08-12T11:57:07.160Z",{"items":11829},[11830,11832],{"sys":11831,"name":342},{"id":2527},{"sys":11833,"name":2524},{"id":2523},{"items":11835},[11836,11838,11840,11842,11844,11846,11848,11850,11852,11854,11856,11858,11860,11862,11864,11866,11868,11870,11872,11874],{"sys":11837,"name":342,"slug":343,"tier":31},{"id":339},{"sys":11839,"name":297,"slug":298,"tier":31},{"id":294},{"sys":11841,"name":279,"slug":280,"tier":31},{"id":276},{"sys":11843,"name":413,"slug":414,"tier":31},{"id":410},{"sys":11845,"name":519,"slug":520,"tier":31},{"id":516},{"sys":11847,"name":642,"slug":643,"tier":31},{"id":639},{"sys":11849,"name":598,"slug":599,"tier":45},{"id":595},{"sys":11851,"name":351,"slug":352,"tier":45},{"id":348},{"sys":11853,"name":261,"slug":262,"tier":45},{"id":258},{"sys":11855,"name":466,"slug":467,"tier":45},{"id":463},{"sys":11857,"name":324,"slug":325,"tier":45},{"id":321},{"sys":11859,"name":571,"slug":572,"tier":45},{"id":568},{"sys":11861,"name":475,"slug":476,"tier":45},{"id":472},{"sys":11863,"name":440,"slug":441,"tier":45},{"id":437},{"sys":11865,"name":395,"slug":396,"tier":45},{"id":392},{"sys":11867,"name":484,"slug":485,"tier":45},{"id":481},{"sys":11869,"name":404,"slug":405,"tier":45},{"id":401},{"sys":11871,"name":502,"slug":503,"tier":45},{"id":499},{"sys":11873,"name":333,"slug":334,"tier":45},{"id":330},{"sys":11875,"name":377,"slug":378,"tier":45},{"id":374},"OT40_IRQG6rt0Aw2rPIT9BdVFUpnaaEb-tDlia6pFD4",{"id":11878,"title":4393,"authorsCollection":11879,"content":11883,"extension":228,"faqItemsCollection":12368,"faqTitle":59,"featured":6,"hashTags":59,"meta":12370,"metaTitle":12371,"ogImage":59,"postType":3355,"publishedDate":4395,"relatedBlogPostsCollection":12372,"slug":4396,"stem":12814,"subtitle":59,"summary":12815,"synopsis":4394,"sys":12826,"tagsCollection":12828,"topicsCollection":12832,"__hash__":12848},"blog/blog/product-release-june-2025.json",{"items":11880},[11881],{"fullName":2573,"firstName":2574,"jobTitle":2575,"socialLinks":59,"profilePicture":11882},{"url":2577},{"json":11884,"links":12303},{"data":11885,"content":11886,"nodeType":2232},{},[11887,11893,11959,11965,11978,11984,11989,12006,12012,12025,12031,12037,12057,12062,12068,12081,12087,12092,12109,12115,12128,12134,12140,12145,12162,12168,12181,12187,12192,12207,12213,12240,12253,12258,12273,12279,12292,12297],{"data":11888,"content":11889,"nodeType":948},{},[11890],{"data":11891,"marks":11892,"value":2588,"nodeType":865},{},[],{"data":11894,"content":11895,"nodeType":891},{},[11896,11905,11914,11923,11932,11941,11950],{"data":11897,"content":11898,"nodeType":880},{},[11899],{"data":11900,"content":11901,"nodeType":866},{},[11902],{"data":11903,"marks":11904,"value":3945,"nodeType":865},{},[],{"data":11906,"content":11907,"nodeType":880},{},[11908],{"data":11909,"content":11910,"nodeType":866},{},[11911],{"data":11912,"marks":11913,"value":3955,"nodeType":865},{},[],{"data":11915,"content":11916,"nodeType":880},{},[11917],{"data":11918,"content":11919,"nodeType":866},{},[11920],{"data":11921,"marks":11922,"value":3965,"nodeType":865},{},[],{"data":11924,"content":11925,"nodeType":880},{},[11926],{"data":11927,"content":11928,"nodeType":866},{},[11929],{"data":11930,"marks":11931,"value":3975,"nodeType":865},{},[],{"data":11933,"content":11934,"nodeType":880},{},[11935],{"data":11936,"content":11937,"nodeType":866},{},[11938],{"data":11939,"marks":11940,"value":3985,"nodeType":865},{},[],{"data":11942,"content":11943,"nodeType":880},{},[11944],{"data":11945,"content":11946,"nodeType":866},{},[11947],{"data":11948,"marks":11949,"value":3995,"nodeType":865},{},[],{"data":11951,"content":11952,"nodeType":880},{},[11953],{"data":11954,"content":11955,"nodeType":866},{},[11956],{"data":11957,"marks":11958,"value":4005,"nodeType":865},{},[],{"data":11960,"content":11961,"nodeType":948},{},[11962],{"data":11963,"marks":11964,"value":3945,"nodeType":865},{},[],{"data":11966,"content":11967,"nodeType":866},{},[11968,11971,11975],{"data":11969,"marks":11970,"value":4018,"nodeType":865},{},[],{"data":11972,"marks":11973,"value":4023,"nodeType":865},{},[11974],{"type":946},{"data":11976,"marks":11977,"value":4027,"nodeType":865},{},[],{"data":11979,"content":11980,"nodeType":866},{},[11981],{"data":11982,"marks":11983,"value":4034,"nodeType":865},{},[],{"data":11985,"content":11988,"nodeType":907},{"target":11986},{"sys":11987},{"id":4039,"type":904,"linkType":905},[],{"data":11990,"content":11991,"nodeType":866},{},[11992,11995,12003],{"data":11993,"marks":11994,"value":21,"nodeType":865},{},[],{"data":11996,"content":11999,"nodeType":1038},{"target":11997},{"sys":11998},{"id":4051,"type":904,"linkType":905},[12000],{"data":12001,"marks":12002,"value":2777,"nodeType":865},{},[],{"data":12004,"marks":12005,"value":21,"nodeType":865},{},[],{"data":12007,"content":12008,"nodeType":948},{},[12009],{"data":12010,"marks":12011,"value":3955,"nodeType":865},{},[],{"data":12013,"content":12014,"nodeType":866},{},[12015,12018,12022],{"data":12016,"marks":12017,"value":4071,"nodeType":865},{},[],{"data":12019,"marks":12020,"value":4076,"nodeType":865},{},[12021],{"type":946},{"data":12023,"marks":12024,"value":4080,"nodeType":865},{},[],{"data":12026,"content":12027,"nodeType":866},{},[12028],{"data":12029,"marks":12030,"value":4087,"nodeType":865},{},[],{"data":12032,"content":12033,"nodeType":866},{},[12034],{"data":12035,"marks":12036,"value":4094,"nodeType":865},{},[],{"data":12038,"content":12039,"nodeType":866},{},[12040,12043,12047,12050,12054],{"data":12041,"marks":12042,"value":4101,"nodeType":865},{},[],{"data":12044,"marks":12045,"value":2129,"nodeType":865},{},[12046],{"type":946},{"data":12048,"marks":12049,"value":4109,"nodeType":865},{},[],{"data":12051,"marks":12052,"value":4114,"nodeType":865},{},[12053],{"type":946},{"data":12055,"marks":12056,"value":4118,"nodeType":865},{},[],{"data":12058,"content":12061,"nodeType":907},{"target":12059},{"sys":12060},{"id":4123,"type":904,"linkType":905},[],{"data":12063,"content":12064,"nodeType":948},{},[12065],{"data":12066,"marks":12067,"value":3965,"nodeType":865},{},[],{"data":12069,"content":12070,"nodeType":866},{},[12071,12074,12078],{"data":12072,"marks":12073,"value":4137,"nodeType":865},{},[],{"data":12075,"marks":12076,"value":1918,"nodeType":865},{},[12077],{"type":946},{"data":12079,"marks":12080,"value":1677,"nodeType":865},{},[],{"data":12082,"content":12083,"nodeType":866},{},[12084],{"data":12085,"marks":12086,"value":4151,"nodeType":865},{},[],{"data":12088,"content":12091,"nodeType":907},{"target":12089},{"sys":12090},{"id":4156,"type":904,"linkType":905},[],{"data":12093,"content":12094,"nodeType":866},{},[12095,12098,12106],{"data":12096,"marks":12097,"value":21,"nodeType":865},{},[],{"data":12099,"content":12102,"nodeType":1038},{"target":12100},{"sys":12101},{"id":1778,"type":904,"linkType":905},[12103],{"data":12104,"marks":12105,"value":2777,"nodeType":865},{},[],{"data":12107,"marks":12108,"value":21,"nodeType":865},{},[],{"data":12110,"content":12111,"nodeType":948},{},[12112],{"data":12113,"marks":12114,"value":3975,"nodeType":865},{},[],{"data":12116,"content":12117,"nodeType":866},{},[12118,12121,12125],{"data":12119,"marks":12120,"value":4187,"nodeType":865},{},[],{"data":12122,"marks":12123,"value":4192,"nodeType":865},{},[12124],{"type":946},{"data":12126,"marks":12127,"value":4196,"nodeType":865},{},[],{"data":12129,"content":12130,"nodeType":866},{},[12131],{"data":12132,"marks":12133,"value":4203,"nodeType":865},{},[],{"data":12135,"content":12136,"nodeType":866},{},[12137],{"data":12138,"marks":12139,"value":4210,"nodeType":865},{},[],{"data":12141,"content":12144,"nodeType":907},{"target":12142},{"sys":12143},{"id":4215,"type":904,"linkType":905},[],{"data":12146,"content":12147,"nodeType":866},{},[12148,12151,12159],{"data":12149,"marks":12150,"value":21,"nodeType":865},{},[],{"data":12152,"content":12155,"nodeType":1038},{"target":12153},{"sys":12154},{"id":4227,"type":904,"linkType":905},[12156],{"data":12157,"marks":12158,"value":2777,"nodeType":865},{},[],{"data":12160,"marks":12161,"value":21,"nodeType":865},{},[],{"data":12163,"content":12164,"nodeType":948},{},[12165],{"data":12166,"marks":12167,"value":3985,"nodeType":865},{},[],{"data":12169,"content":12170,"nodeType":866},{},[12171,12174,12178],{"data":12172,"marks":12173,"value":3594,"nodeType":865},{},[],{"data":12175,"marks":12176,"value":4251,"nodeType":865},{},[12177],{"type":946},{"data":12179,"marks":12180,"value":4255,"nodeType":865},{},[],{"data":12182,"content":12183,"nodeType":866},{},[12184],{"data":12185,"marks":12186,"value":4262,"nodeType":865},{},[],{"data":12188,"content":12191,"nodeType":907},{"target":12189},{"sys":12190},{"id":4267,"type":904,"linkType":905},[],{"data":12193,"content":12194,"nodeType":866},{},[12195,12198,12204],{"data":12196,"marks":12197,"value":21,"nodeType":865},{},[],{"data":12199,"content":12200,"nodeType":1102},{"uri":4277},[12201],{"data":12202,"marks":12203,"value":2777,"nodeType":865},{},[],{"data":12205,"marks":12206,"value":21,"nodeType":865},{},[],{"data":12208,"content":12209,"nodeType":948},{},[12210],{"data":12211,"marks":12212,"value":3995,"nodeType":865},{},[],{"data":12214,"content":12215,"nodeType":866},{},[12216,12219,12223,12226,12230,12233,12237],{"data":12217,"marks":12218,"value":4297,"nodeType":865},{},[],{"data":12220,"marks":12221,"value":4302,"nodeType":865},{},[12222],{"type":946},{"data":12224,"marks":12225,"value":4306,"nodeType":865},{},[],{"data":12227,"marks":12228,"value":4311,"nodeType":865},{},[12229],{"type":946},{"data":12231,"marks":12232,"value":1913,"nodeType":865},{},[],{"data":12234,"marks":12235,"value":1909,"nodeType":865},{},[12236],{"type":946},{"data":12238,"marks":12239,"value":1677,"nodeType":865},{},[],{"data":12241,"content":12242,"nodeType":866},{},[12243,12246,12250],{"data":12244,"marks":12245,"value":4328,"nodeType":865},{},[],{"data":12247,"marks":12248,"value":4333,"nodeType":865},{},[12249],{"type":946},{"data":12251,"marks":12252,"value":4337,"nodeType":865},{},[],{"data":12254,"content":12257,"nodeType":907},{"target":12255},{"sys":12256},{"id":4342,"type":904,"linkType":905},[],{"data":12259,"content":12260,"nodeType":866},{},[12261,12264,12270],{"data":12262,"marks":12263,"value":21,"nodeType":865},{},[],{"data":12265,"content":12266,"nodeType":1102},{"uri":4352},[12267],{"data":12268,"marks":12269,"value":2777,"nodeType":865},{},[],{"data":12271,"marks":12272,"value":21,"nodeType":865},{},[],{"data":12274,"content":12275,"nodeType":948},{},[12276],{"data":12277,"marks":12278,"value":4005,"nodeType":865},{},[],{"data":12280,"content":12281,"nodeType":866},{},[12282,12285,12289],{"data":12283,"marks":12284,"value":4372,"nodeType":865},{},[],{"data":12286,"marks":12287,"value":3884,"nodeType":865},{},[12288],{"type":946},{"data":12290,"marks":12291,"value":4380,"nodeType":865},{},[],{"data":12293,"content":12296,"nodeType":907},{"target":12294},{"sys":12295},{"id":4385,"type":904,"linkType":905},[],{"data":12298,"content":12299,"nodeType":866},{},[12300],{"data":12301,"marks":12302,"value":21,"nodeType":865},{},[],{"entries":12304},{"inline":12305,"hyperlink":12306,"block":12318},[],[12307,12311,12313],{"sys":12308,"__typename":3313,"linkedFromParent":59,"title":12309,"slug":12310,"audience":3316},{"id":4051},"Administering Push","administering-push",{"sys":12312,"__typename":2256,"title":2287,"slug":2288,"articleId":2289},{"id":1778},{"sys":12314,"__typename":2256,"title":12315,"slug":12316,"articleId":12317},{"id":4227},"What happens when I merge employee records?","what-happens-when-i-merge-employee-records",10127,[12319,12326,12333,12340,12347,12354,12361],{"sys":12320,"__typename":2366,"title":12321,"caption":59,"layoutMode":59,"file":12322},{"id":4039},"Detections page overview - docs - Administering Push",{"url":12323,"width":12324,"height":12325},"https://images.ctfassets.net/y1cdw1ablpvd/2FcQEiNpkohhhv631S3QK/bf8a9d96cf6c4db9193c7e1c07cb31dd/detections_page_20250505.png",3014,1714,{"sys":12327,"__typename":2366,"title":12328,"caption":59,"layoutMode":59,"file":12329},{"id":4123},"Employee verification codes - Labs - for June 2025 release notes",{"url":12330,"width":12331,"height":12332},"https://images.ctfassets.net/y1cdw1ablpvd/4es73ojyk572RJHuSrAahL/91be55af18fbcfb5f2fc3067497c9746/employee_verification_code_annotated.png",472,241,{"sys":12334,"__typename":2366,"title":12335,"caption":59,"layoutMode":59,"file":12336},{"id":4156},"Password enforcement banner - KB 10129",{"url":12337,"width":12338,"height":12339},"https://images.ctfassets.net/y1cdw1ablpvd/3UDPMdxBrIOj6Uw3iDJxEF/bf3233e24a93e7bca9138bdb21a7ecc5/password_enforcement_banner.png",1440,809,{"sys":12341,"__typename":2366,"title":12342,"caption":59,"layoutMode":59,"file":12343},{"id":4215},"Merge employees - select primary - KB 10127",{"url":12344,"width":12345,"height":12346},"https://images.ctfassets.net/y1cdw1ablpvd/6UnGOsbhaHaORo0ltzEWiv/6e37edf71db832d6c61671cfbdb8afeb/merge_employees_primary_20250402.png",539,346,{"sys":12348,"__typename":2366,"title":12349,"caption":59,"layoutMode":59,"file":12350},{"id":4267},"Webhook event selection config screen - for June 2025 release notes",{"url":12351,"width":12352,"height":12353},"https://images.ctfassets.net/y1cdw1ablpvd/3IfutfvORDc67NnRcPE6Jk/4544e0c12224fddde9ae734564c5faac/webhook_select_events_20250528.png",1396,1708,{"sys":12355,"__typename":2366,"title":12356,"caption":59,"layoutMode":59,"file":12357},{"id":4342},"Phishing tool detection config rule slideout - for June 2025 release notes",{"url":12358,"width":12359,"height":12360},"https://images.ctfassets.net/y1cdw1ablpvd/1lSBIFFHjN7wJmoZIsTPwS/83e30221f36160b52c1f29720d03f012/config_rule_example_20250528.png",1468,1704,{"sys":12362,"__typename":2366,"title":12363,"caption":59,"layoutMode":59,"file":12364},{"id":4385},"Microsoft Sentinel tile on Settings - for release notes",{"url":12365,"width":12366,"height":12367},"https://images.ctfassets.net/y1cdw1ablpvd/2r29uCFauPYNnz2Jbs75Kc/4e180eea6c79ecc253919a651a63851a/sentinel_integration_tile_20250528.png",2498,1364,{"items":12369},[],{},"Push Security new product features for June 2025",{"items":12373},[12374],{"__typename":2239,"sys":12375,"content":12376,"title":9005,"synopsis":9006,"hashTags":59,"publishedDate":9007,"slug":9008,"tagsCollection":12806,"authorsCollection":12810},{"id":8517},{"json":12377},{"data":12378,"content":12379,"nodeType":2232},{},[12380,12386,12434,12440,12453,12459,12519,12524,12541,12547,12560,12573,12578,12584,12601,12607,12620,12633,12639,12656,12662,12682,12688,12703,12709,12722,12756,12795,12800],{"data":12381,"content":12382,"nodeType":948},{},[12383],{"data":12384,"marks":12385,"value":2588,"nodeType":865},{},[],{"data":12387,"content":12388,"nodeType":891},{},[12389,12398,12407,12416,12425],{"data":12390,"content":12391,"nodeType":880},{},[12392],{"data":12393,"content":12394,"nodeType":866},{},[12395],{"data":12396,"marks":12397,"value":8540,"nodeType":865},{},[],{"data":12399,"content":12400,"nodeType":880},{},[12401],{"data":12402,"content":12403,"nodeType":866},{},[12404],{"data":12405,"marks":12406,"value":8550,"nodeType":865},{},[],{"data":12408,"content":12409,"nodeType":880},{},[12410],{"data":12411,"content":12412,"nodeType":866},{},[12413],{"data":12414,"marks":12415,"value":8560,"nodeType":865},{},[],{"data":12417,"content":12418,"nodeType":880},{},[12419],{"data":12420,"content":12421,"nodeType":866},{},[12422],{"data":12423,"marks":12424,"value":8570,"nodeType":865},{},[],{"data":12426,"content":12427,"nodeType":880},{},[12428],{"data":12429,"content":12430,"nodeType":866},{},[12431],{"data":12432,"marks":12433,"value":8580,"nodeType":865},{},[],{"data":12435,"content":12436,"nodeType":948},{},[12437],{"data":12438,"marks":12439,"value":8540,"nodeType":865},{},[],{"data":12441,"content":12442,"nodeType":866},{},[12443,12446,12450],{"data":12444,"marks":12445,"value":3594,"nodeType":865},{},[],{"data":12447,"marks":12448,"value":8597,"nodeType":865},{},[12449],{"type":946},{"data":12451,"marks":12452,"value":8601,"nodeType":865},{},[],{"data":12454,"content":12455,"nodeType":866},{},[12456],{"data":12457,"marks":12458,"value":8608,"nodeType":865},{},[],{"data":12460,"content":12461,"nodeType":891},{},[12462,12478,12494,12510],{"data":12463,"content":12464,"nodeType":880},{},[12465],{"data":12466,"content":12467,"nodeType":866},{},[12468,12471,12475],{"data":12469,"marks":12470,"value":8621,"nodeType":865},{},[],{"data":12472,"marks":12473,"value":8626,"nodeType":865},{},[12474],{"type":946},{"data":12476,"marks":12477,"value":8630,"nodeType":865},{},[],{"data":12479,"content":12480,"nodeType":880},{},[12481],{"data":12482,"content":12483,"nodeType":866},{},[12484,12487,12491],{"data":12485,"marks":12486,"value":8640,"nodeType":865},{},[],{"data":12488,"marks":12489,"value":8645,"nodeType":865},{},[12490],{"type":946},{"data":12492,"marks":12493,"value":1151,"nodeType":865},{},[],{"data":12495,"content":12496,"nodeType":880},{},[12497],{"data":12498,"content":12499,"nodeType":866},{},[12500,12503,12507],{"data":12501,"marks":12502,"value":8658,"nodeType":865},{},[],{"data":12504,"marks":12505,"value":8663,"nodeType":865},{},[12506],{"type":946},{"data":12508,"marks":12509,"value":8667,"nodeType":865},{},[],{"data":12511,"content":12512,"nodeType":880},{},[12513],{"data":12514,"content":12515,"nodeType":866},{},[12516],{"data":12517,"marks":12518,"value":8677,"nodeType":865},{},[],{"data":12520,"content":12523,"nodeType":907},{"target":12521},{"sys":12522},{"id":8682,"type":904,"linkType":905},[],{"data":12525,"content":12526,"nodeType":866},{},[12527,12530,12538],{"data":12528,"marks":12529,"value":21,"nodeType":865},{},[],{"data":12531,"content":12534,"nodeType":1038},{"target":12532},{"sys":12533},{"id":8694,"type":904,"linkType":905},[12535],{"data":12536,"marks":12537,"value":2777,"nodeType":865},{},[],{"data":12539,"marks":12540,"value":21,"nodeType":865},{},[],{"data":12542,"content":12543,"nodeType":948},{},[12544],{"data":12545,"marks":12546,"value":8708,"nodeType":865},{},[],{"data":12548,"content":12549,"nodeType":866},{},[12550,12553,12557],{"data":12551,"marks":12552,"value":8715,"nodeType":865},{},[],{"data":12554,"marks":12555,"value":8720,"nodeType":865},{},[12556],{"type":946},{"data":12558,"marks":12559,"value":8724,"nodeType":865},{},[],{"data":12561,"content":12562,"nodeType":866},{},[12563,12566,12570],{"data":12564,"marks":12565,"value":8731,"nodeType":865},{},[],{"data":12567,"marks":12568,"value":2129,"nodeType":865},{},[12569],{"type":946},{"data":12571,"marks":12572,"value":8739,"nodeType":865},{},[],{"data":12574,"content":12577,"nodeType":907},{"target":12575},{"sys":12576},{"id":8744,"type":904,"linkType":905},[],{"data":12579,"content":12580,"nodeType":866},{},[12581],{"data":12582,"marks":12583,"value":8752,"nodeType":865},{},[],{"data":12585,"content":12586,"nodeType":866},{},[12587,12590,12598],{"data":12588,"marks":12589,"value":21,"nodeType":865},{},[],{"data":12591,"content":12594,"nodeType":1038},{"target":12592},{"sys":12593},{"id":8763,"type":904,"linkType":905},[12595],{"data":12596,"marks":12597,"value":2777,"nodeType":865},{},[],{"data":12599,"marks":12600,"value":21,"nodeType":865},{},[],{"data":12602,"content":12603,"nodeType":948},{},[12604],{"data":12605,"marks":12606,"value":8777,"nodeType":865},{},[],{"data":12608,"content":12609,"nodeType":866},{},[12610,12613,12617],{"data":12611,"marks":12612,"value":3594,"nodeType":865},{},[],{"data":12614,"marks":12615,"value":8788,"nodeType":865},{},[12616],{"type":946},{"data":12618,"marks":12619,"value":8792,"nodeType":865},{},[],{"data":12621,"content":12622,"nodeType":866},{},[12623,12626,12630],{"data":12624,"marks":12625,"value":8799,"nodeType":865},{},[],{"data":12627,"marks":12628,"value":8804,"nodeType":865},{},[12629],{"type":946},{"data":12631,"marks":12632,"value":1151,"nodeType":865},{},[],{"data":12634,"content":12635,"nodeType":866},{},[12636],{"data":12637,"marks":12638,"value":8814,"nodeType":865},{},[],{"data":12640,"content":12641,"nodeType":866},{},[12642,12645,12653],{"data":12643,"marks":12644,"value":21,"nodeType":865},{},[],{"data":12646,"content":12649,"nodeType":1038},{"target":12647},{"sys":12648},{"id":8825,"type":904,"linkType":905},[12650],{"data":12651,"marks":12652,"value":2777,"nodeType":865},{},[],{"data":12654,"marks":12655,"value":21,"nodeType":865},{},[],{"data":12657,"content":12658,"nodeType":948},{},[12659],{"data":12660,"marks":12661,"value":8839,"nodeType":865},{},[],{"data":12663,"content":12664,"nodeType":866},{},[12665,12668,12672,12675,12679],{"data":12666,"marks":12667,"value":8846,"nodeType":865},{},[],{"data":12669,"marks":12670,"value":8851,"nodeType":865},{},[12671],{"type":946},{"data":12673,"marks":12674,"value":8855,"nodeType":865},{},[],{"data":12676,"marks":12677,"value":8860,"nodeType":865},{},[12678],{"type":946},{"data":12680,"marks":12681,"value":1677,"nodeType":865},{},[],{"data":12683,"content":12684,"nodeType":866},{},[12685],{"data":12686,"marks":12687,"value":8870,"nodeType":865},{},[],{"data":12689,"content":12690,"nodeType":866},{},[12691,12694,12700],{"data":12692,"marks":12693,"value":21,"nodeType":865},{},[],{"data":12695,"content":12696,"nodeType":1102},{"uri":8879},[12697],{"data":12698,"marks":12699,"value":2777,"nodeType":865},{},[],{"data":12701,"marks":12702,"value":21,"nodeType":865},{},[],{"data":12704,"content":12705,"nodeType":948},{},[12706],{"data":12707,"marks":12708,"value":8580,"nodeType":865},{},[],{"data":12710,"content":12711,"nodeType":866},{},[12712,12715,12719],{"data":12713,"marks":12714,"value":8899,"nodeType":865},{},[],{"data":12716,"marks":12717,"value":8904,"nodeType":865},{},[12718],{"type":946},{"data":12720,"marks":12721,"value":8908,"nodeType":865},{},[],{"data":12723,"content":12724,"nodeType":866},{},[12725,12728,12732,12735,12739,12742,12746,12749,12753],{"data":12726,"marks":12727,"value":8915,"nodeType":865},{},[],{"data":12729,"marks":12730,"value":8920,"nodeType":865},{},[12731],{"type":946},{"data":12733,"marks":12734,"value":3531,"nodeType":865},{},[],{"data":12736,"marks":12737,"value":8928,"nodeType":865},{},[12738],{"type":946},{"data":12740,"marks":12741,"value":3531,"nodeType":865},{},[],{"data":12743,"marks":12744,"value":8936,"nodeType":865},{},[12745],{"type":946},{"data":12747,"marks":12748,"value":8940,"nodeType":865},{},[],{"data":12750,"marks":12751,"value":8945,"nodeType":865},{},[12752],{"type":946},{"data":12754,"marks":12755,"value":8949,"nodeType":865},{},[],{"data":12757,"content":12758,"nodeType":891},{},[12759,12768,12777,12786],{"data":12760,"content":12761,"nodeType":880},{},[12762],{"data":12763,"content":12764,"nodeType":866},{},[12765],{"data":12766,"marks":12767,"value":8962,"nodeType":865},{},[],{"data":12769,"content":12770,"nodeType":880},{},[12771],{"data":12772,"content":12773,"nodeType":866},{},[12774],{"data":12775,"marks":12776,"value":8972,"nodeType":865},{},[],{"data":12778,"content":12779,"nodeType":880},{},[12780],{"data":12781,"content":12782,"nodeType":866},{},[12783],{"data":12784,"marks":12785,"value":8982,"nodeType":865},{},[],{"data":12787,"content":12788,"nodeType":880},{},[12789],{"data":12790,"content":12791,"nodeType":866},{},[12792],{"data":12793,"marks":12794,"value":8992,"nodeType":865},{},[],{"data":12796,"content":12799,"nodeType":907},{"target":12797},{"sys":12798},{"id":8997,"type":904,"linkType":905},[],{"data":12801,"content":12802,"nodeType":866},{},[12803],{"data":12804,"marks":12805,"value":21,"nodeType":865},{},[],{"items":12807},[12808],{"sys":12809,"name":3915},{"id":3914},{"items":12811},[12812],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":12813},{"url":2577},"blog/product-release-june-2025",{"json":12816},{"data":12817,"content":12818,"nodeType":2232},{},[12819],{"data":12820,"content":12821,"nodeType":866},{},[12822],{"data":12823,"marks":12824,"value":12825,"nodeType":865},{},[],"Streamline investigations with our new Detections page, enforce strong passwords in the browser, and more",{"id":3922,"publishedAt":12827},"2026-08-13T09:34:55.198Z",{"items":12829},[12830],{"sys":12831,"name":3915},{"id":3914},{"items":12833},[12834,12836,12838,12840,12842,12844,12846],{"sys":12835,"name":297,"slug":298,"tier":31},{"id":294},{"sys":12837,"name":502,"slug":503,"tier":45},{"id":499},{"sys":12839,"name":650,"slug":651,"tier":45},{"id":647},{"sys":12841,"name":607,"slug":608,"tier":45},{"id":604},{"sys":12843,"name":457,"slug":458,"tier":45},{"id":454},{"sys":12845,"name":598,"slug":599,"tier":45},{"id":595},{"sys":12847,"name":261,"slug":262,"tier":45},{"id":258},"W-f08Qh1XP8pZC3uSHuDuastmdH4_uFvRNEb3aoOxAg",{"id":12850,"title":12851,"authorsCollection":12852,"content":12856,"extension":228,"faqItemsCollection":13328,"faqTitle":59,"featured":6,"hashTags":59,"meta":13330,"metaTitle":13331,"ogImage":59,"postType":13332,"publishedDate":13333,"relatedBlogPostsCollection":13334,"slug":13747,"stem":13748,"subtitle":59,"summary":13749,"synopsis":13760,"sys":13761,"tagsCollection":13764,"topicsCollection":13768,"__hash__":13788},"blog/blog/better-together-identity-telemetry-from-push-smart-storage-and-searches-from.json","Better together: Identity telemetry from Push + smart storage and searches from Cribl",{"items":12853},[12854],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":12855},{"url":853},{"json":12857,"links":13315},{"data":12858,"content":12859,"nodeType":2232},{},[12860,12867,12910,12917,12924,12959,12966,12973,13026,13033,13040,13047,13054,13061,13068,13075,13082,13089,13122,13129,13147,13154,13161,13168,13201,13208,13225,13232,13239,13269,13298],{"data":12861,"content":12862,"nodeType":866},{},[12863],{"data":12864,"marks":12865,"value":12866,"nodeType":865},{},[],"In the midst of an identity security investigation when every minute counts, there are few sentences more painful to say than:",{"data":12868,"content":12869,"nodeType":891},{},[12870,12880,12890,12900],{"data":12871,"content":12872,"nodeType":880},{},[12873],{"data":12874,"content":12875,"nodeType":866},{},[12876],{"data":12877,"marks":12878,"value":12879,"nodeType":865},{},[],"“We didn’t snapshot that data, so we didn’t have the right time period.”",{"data":12881,"content":12882,"nodeType":880},{},[12883],{"data":12884,"content":12885,"nodeType":866},{},[12886],{"data":12887,"marks":12888,"value":12889,"nodeType":865},{},[],"“We didn’t send those logs to the SIEM, so we couldn’t do the correlation we needed to rule out [bad thing].”",{"data":12891,"content":12892,"nodeType":880},{},[12893],{"data":12894,"content":12895,"nodeType":866},{},[12896],{"data":12897,"marks":12898,"value":12899,"nodeType":865},{},[],"“We didn’t have any user behavior telemetry in the browser, so we didn’t know if they entered their password on the phishing page or not.”",{"data":12901,"content":12902,"nodeType":880},{},[12903],{"data":12904,"content":12905,"nodeType":866},{},[12906],{"data":12907,"marks":12908,"value":12909,"nodeType":865},{},[],"“We had no way of determining what other accounts they were using that compromised password on.”",{"data":12911,"content":12912,"nodeType":866},{},[12913],{"data":12914,"marks":12915,"value":12916,"nodeType":865},{},[],"Security teams use Push and Cribl so they never have to utter those words. So we’re especially thrilled to announce our partnership with Cribl to make it much easier to snapshot, transform, and query Push telemetry using Cribl’s data management solutions.",{"data":12918,"content":12919,"nodeType":866},{},[12920],{"data":12921,"marks":12922,"value":12923,"nodeType":865},{},[],"Push uses a browser agent deployed across all your workforce browsers to do real-time detection and response for identity-based attacks like credential phishing, account takeover, and session token theft. ",{"data":12925,"content":12926,"nodeType":866},{},[12927,12931,12941,12945,12955],{"data":12928,"marks":12929,"value":12930,"nodeType":865},{},[],"As the Push browser agent learns your environment, it also automatically inventories all the apps that your employees log in to, their authentication methods and MFA usage, and the security posture of their accounts. We call this an organization’s ",{"data":12932,"content":12936,"nodeType":1038},{"target":12933},{"sys":12934},{"id":12935,"type":904,"linkType":905},"1pJdOGN0dOd3BKVqO4CxHh",[12937],{"data":12938,"marks":12939,"value":12940,"nodeType":865},{},[],"identity attack surface",{"data":12942,"marks":12943,"value":12944,"nodeType":865},{},[]," because it represents the risks posed by insecure accounts and apps — even the ones you didn’t know about — that are ",{"data":12946,"content":12950,"nodeType":1038},{"target":12947},{"sys":12948},{"id":12949,"type":904,"linkType":905},"wgpdyHDn9NcpIJNr7jnFp",[12951],{"data":12952,"marks":12953,"value":12954,"nodeType":865},{},[],"increasingly targeted",{"data":12956,"marks":12957,"value":12958,"nodeType":865},{},[]," by attackers.",{"data":12960,"content":12961,"nodeType":866},{},[12962],{"data":12963,"marks":12964,"value":12965,"nodeType":865},{},[],"From this unique vantage point in the browser, Push can block identity attacks like credential phishing while also generating telemetry that security teams rely on for knowing what happened during an incident, such as what the user saw and did, and how big the blast radius is in terms of other compromised accounts.",{"data":12967,"content":12968,"nodeType":866},{},[12969],{"data":12970,"marks":12971,"value":12972,"nodeType":865},{},[],"By integrating with Cribl, Push customers can now:",{"data":12974,"content":12975,"nodeType":891},{},[12976,12986,12996,13006,13016],{"data":12977,"content":12978,"nodeType":880},{},[12979],{"data":12980,"content":12981,"nodeType":866},{},[12982],{"data":12983,"marks":12984,"value":12985,"nodeType":865},{},[],"Quickly ingest and transform Push data into Cribl in order to route it to their SIEM, SOAR, or other third-party system — without overwhelming their pipeline or running up costs on log volume.",{"data":12987,"content":12988,"nodeType":880},{},[12989],{"data":12990,"content":12991,"nodeType":866},{},[12992],{"data":12993,"marks":12994,"value":12995,"nodeType":865},{},[],"Get immediate insights into identity security threats and posture across their environment by using Cribl’s out-of-the-box dashboards for Push telemetry.",{"data":12997,"content":12998,"nodeType":880},{},[12999],{"data":13000,"content":13001,"nodeType":866},{},[13002],{"data":13003,"marks":13004,"value":13005,"nodeType":865},{},[],"Easily create a snapshot of Push data to allow for historical comparisons and queries.",{"data":13007,"content":13008,"nodeType":880},{},[13009],{"data":13010,"content":13011,"nodeType":866},{},[13012],{"data":13013,"marks":13014,"value":13015,"nodeType":865},{},[],"Correlate Push data with other log sources such as their EDR and identity provider to get a fuller picture of identity security risks and incidents. ",{"data":13017,"content":13018,"nodeType":880},{},[13019],{"data":13020,"content":13021,"nodeType":866},{},[13022],{"data":13023,"marks":13024,"value":13025,"nodeType":865},{},[],"Hunt across their data for risky user behaviors like suspicious login methods, signs of credential phishing or stolen sessions, and credential reuse.",{"data":13027,"content":13028,"nodeType":866},{},[13029],{"data":13030,"marks":13031,"value":13032,"nodeType":865},{},[],"Here’s a closer look at what we built together and how you can use it.",{"data":13034,"content":13035,"nodeType":948},{},[13036],{"data":13037,"marks":13038,"value":13039,"nodeType":865},{},[],"Tooling built by the teams that actually use it",{"data":13041,"content":13042,"nodeType":866},{},[13043],{"data":13044,"marks":13045,"value":13046,"nodeType":865},{},[],"The truth is, we selfishly had the idea to build this integration because we use Cribl at Push — and they use Push at Cribl. ",{"data":13048,"content":13049,"nodeType":866},{},[13050],{"data":13051,"marks":13052,"value":13053,"nodeType":865},{},[],"As mutual users (and fans!) of each other’s products, our security teams had firsthand experience with the use cases, data, and possibilities that combining our capabilities presented.",{"data":13055,"content":13056,"nodeType":866},{},[13057],{"data":13058,"marks":13059,"value":13060,"nodeType":865},{},[],"“Our team had been using Push for a while, and I was already a big fan of their approach,” explains Alex Crusco, staff security engineer at Cribl. “So when we decided to build out-of-the-box security packs in Cribl, they were the first partner that came to mind. Identity is a top attack vector, and defending it isn’t easy. The combined power of Cribl and Push gives security teams the clarity and control to turn identity from a blind spot into a defensible asset.”",{"data":13062,"content":13063,"nodeType":866},{},[13064],{"data":13065,"marks":13066,"value":13067,"nodeType":865},{},[],"So here’s what we built:",{"data":13069,"content":13070,"nodeType":1218},{},[13071],{"data":13072,"marks":13073,"value":13074,"nodeType":865},{},[],"Cribl Stream pack for Push",{"data":13076,"content":13077,"nodeType":866},{},[13078],{"data":13079,"marks":13080,"value":13081,"nodeType":865},{},[],"Using the Cribl Stream pack for Push, you get a preconfigured parser for individual Push events that automatically cleans and formats them for your exact use case so you can query the data directly in Cribl or route it somewhere else. ",{"data":13083,"content":13084,"nodeType":866},{},[13085],{"data":13086,"marks":13087,"value":13088,"nodeType":865},{},[],"By sending Push data to Cribl, you can enable your security team to:",{"data":13090,"content":13091,"nodeType":891},{},[13092,13102,13112],{"data":13093,"content":13094,"nodeType":880},{},[13095],{"data":13096,"content":13097,"nodeType":866},{},[13098],{"data":13099,"marks":13100,"value":13101,"nodeType":865},{},[],"Ingest and normalize telemetry on the employees, accounts, browsers, security findings, and detections observed by Push across your environment.",{"data":13103,"content":13104,"nodeType":880},{},[13105],{"data":13106,"content":13107,"nodeType":866},{},[13108],{"data":13109,"marks":13110,"value":13111,"nodeType":865},{},[],"Route specific alerts and events to your SIEM or other tool.",{"data":13113,"content":13114,"nodeType":880},{},[13115],{"data":13116,"content":13117,"nodeType":866},{},[13118],{"data":13119,"marks":13120,"value":13121,"nodeType":865},{},[],"Enrich Push data with other sources to expand the context for understanding events, or look for wider patterns.",{"data":13123,"content":13124,"nodeType":866},{},[13125],{"data":13126,"marks":13127,"value":13128,"nodeType":865},{},[],"Push logs are pretty lightweight out of the box, but the Stream pack streamlines them further. By transforming or dropping some of the event fields (such as event headers), you can reduce your event size by 50%. This gives security teams the opportunity and flexibility to save on costs when sending events to systems that charge by log volume while also getting the data that security teams need where they need it.",{"data":13130,"content":13131,"nodeType":866},{},[13132,13136,13144],{"data":13133,"marks":13134,"value":13135,"nodeType":865},{},[],"You can get the Cribl Stream pack for Push via the ",{"data":13137,"content":13139,"nodeType":1102},{"uri":13138},"https://packs.cribl.io/packs/cc-push-security",[13140],{"data":13141,"marks":13142,"value":13143,"nodeType":865},{},[],"Cribl Dispensary",{"data":13145,"marks":13146,"value":1677,"nodeType":865},{},[],{"data":13148,"content":13149,"nodeType":1218},{},[13150],{"data":13151,"marks":13152,"value":13153,"nodeType":865},{},[],"Cribl Search pack for Push",{"data":13155,"content":13156,"nodeType":866},{},[13157],{"data":13158,"marks":13159,"value":13160,"nodeType":865},{},[],"The other half of the equation is the Cribl Search pack for Push. Once you’ve got your Push data into Cribl, you can use it to populate pre-built dashboards provided by the Search pack.",{"data":13162,"content":13163,"nodeType":866},{},[13164],{"data":13165,"marks":13166,"value":13167,"nodeType":865},{},[],"Using the Cribl Search pack dashboards, you can:",{"data":13169,"content":13170,"nodeType":891},{},[13171,13181,13191],{"data":13172,"content":13173,"nodeType":880},{},[13174],{"data":13175,"content":13176,"nodeType":866},{},[13177],{"data":13178,"marks":13179,"value":13180,"nodeType":865},{},[],"Monitor the state of your Push Security deployment and identify any gaps in browser extension coverage.",{"data":13182,"content":13183,"nodeType":880},{},[13184],{"data":13185,"content":13186,"nodeType":866},{},[13187],{"data":13188,"marks":13189,"value":13190,"nodeType":865},{},[],"Get a snapshot of security issues such as suspicious or unapproved login methods (e.g. local password logins on SSO apps); credential reuse; or signs of adversary-in-the-middle phishing incidents or stolen sessions.",{"data":13192,"content":13193,"nodeType":880},{},[13194],{"data":13195,"content":13196,"nodeType":866},{},[13197],{"data":13198,"marks":13199,"value":13200,"nodeType":865},{},[],"Deep dive into behavior data for a specific employee, to assist threat hunters and analysts with investigations or incident response.",{"data":13202,"content":13203,"nodeType":866},{},[13204],{"data":13205,"marks":13206,"value":13207,"nodeType":865},{},[],"With the Search pack, you can also take a daily snapshot of your Push data to see trends across time when searching, or to conduct historical investigations.",{"data":13209,"content":13210,"nodeType":866},{},[13211,13215,13222],{"data":13212,"marks":13213,"value":13214,"nodeType":865},{},[],"You can get the Cribl Search pack for Push via the ",{"data":13216,"content":13218,"nodeType":1102},{"uri":13217},"https://packs.cribl.io/packs/cc-search-push-security",[13219],{"data":13220,"marks":13221,"value":13143,"nodeType":865},{},[],{"data":13223,"marks":13224,"value":1677,"nodeType":865},{},[],{"data":13226,"content":13227,"nodeType":948},{},[13228],{"data":13229,"marks":13230,"value":13231,"nodeType":865},{},[],"Get started",{"data":13233,"content":13234,"nodeType":866},{},[13235],{"data":13236,"marks":13237,"value":13238,"nodeType":865},{},[],"To get started, you’ll need to be using both Cribl and Push. ",{"data":13240,"content":13241,"nodeType":866},{},[13242,13246,13254,13258,13265],{"data":13243,"marks":13244,"value":13245,"nodeType":865},{},[],"To get started using the Stream pack, you’ll need to configure a Stream source to receive data over HTTPS, then create a ",{"data":13247,"content":13249,"nodeType":1102},{"uri":13248},"https://pushsecurity.redoc.ly/webhooks-v1/",[13250],{"data":13251,"marks":13252,"value":13253,"nodeType":865},{},[],"webhook",{"data":13255,"marks":13256,"value":13257,"nodeType":865},{},[]," in the Push admin console that points to your Cribl Stream source and download and install the Cribl Stream pack for Push. Follow the instructions in the ",{"data":13259,"content":13260,"nodeType":1102},{"uri":13138},[13261],{"data":13262,"marks":13263,"value":13264,"nodeType":865},{},[],"Stream pack description",{"data":13266,"marks":13267,"value":13268,"nodeType":865},{},[]," for guidance.",{"data":13270,"content":13271,"nodeType":866},{},[13272,13276,13284,13288,13295],{"data":13273,"marks":13274,"value":13275,"nodeType":865},{},[],"To get started using the Search pack, you’ll need to also set up the ",{"data":13277,"content":13279,"nodeType":1102},{"uri":13278},"https://github.com/criblio/collector-templates/tree/main/collectors/rest/pushsecurity",[13280],{"data":13281,"marks":13282,"value":13283,"nodeType":865},{},[],"Push REST collectors",{"data":13285,"marks":13286,"value":13287,"nodeType":865},{},[]," in Cribl Stream to ingest your Push data. Then import the Search pack into your Cribl instance. Follow the instructions in the ",{"data":13289,"content":13290,"nodeType":1102},{"uri":13217},[13291],{"data":13292,"marks":13293,"value":13294,"nodeType":865},{},[],"Search pack description",{"data":13296,"marks":13297,"value":13268,"nodeType":865},{},[],{"data":13299,"content":13300,"nodeType":866},{},[13301,13305,13311],{"data":13302,"marks":13303,"value":13304,"nodeType":865},{},[],"Not yet a user of Push yet, but want to learn more about how our data enables detection, response, and security investigations? ",{"data":13306,"content":13307,"nodeType":1102},{"uri":2223},[13308],{"data":13309,"marks":13310,"value":10742,"nodeType":865},{},[],{"data":13312,"marks":13313,"value":13314,"nodeType":865},{},[]," with our team to chat.",{"entries":13316},{"block":13317,"inline":13318,"hyperlink":13319},[],[],[13320,13324],{"sys":13321,"__typename":2239,"title":13322,"slug":13323},{"id":12935},"Looking back on identity-based breaches in 2024","2024-identity-breaches",{"sys":13325,"__typename":2239,"title":13326,"slug":13327},{"id":12949},"Scattered Spider: TTP evolution in 2025","scattered-spider-ttp-evolution-in-2025",{"items":13329},[],{},"Integrate Cribl and Push Security","partnership","2025-06-03T00:00:00.000Z",{"items":13335},[13336],{"__typename":2239,"sys":13337,"content":13339,"title":13733,"synopsis":13734,"hashTags":59,"publishedDate":13735,"slug":13736,"tagsCollection":13737,"authorsCollection":13743},{"id":13338},"7qYHyqnkvqQRbYn3nTi5br",{"json":13340},{"data":13341,"content":13342,"nodeType":2232},{},[13343,13350,13357,13405,13412,13419,13426,13432,13451,13458,13480,13487,13494,13516,13522,13560,13567,13574,13580,13587,13594,13601,13608,13615,13692,13698,13716],{"data":13344,"content":13345,"nodeType":866},{},[13346],{"data":13347,"marks":13348,"value":13349,"nodeType":865},{},[],"While Push’s official mission is to stop identity attacks, our unofficial motto might be described as “don’t make security teams log into another tool if they don’t have to.”",{"data":13351,"content":13352,"nodeType":866},{},[13353],{"data":13354,"marks":13355,"value":13356,"nodeType":865},{},[],"To that end, we’re thrilled to announce a new integration with Panther that makes it possible in a few clicks to:",{"data":13358,"content":13359,"nodeType":891},{},[13360,13375,13390],{"data":13361,"content":13362,"nodeType":880},{},[13363],{"data":13364,"content":13365,"nodeType":866},{},[13366,13371],{"data":13367,"marks":13368,"value":13370,"nodeType":865},{},[13369],{"type":946},"Ingest Push logs",{"data":13372,"marks":13373,"value":13374,"nodeType":865},{},[]," into your Panther SIEM.",{"data":13376,"content":13377,"nodeType":880},{},[13378],{"data":13379,"content":13380,"nodeType":866},{},[13381,13386],{"data":13382,"marks":13383,"value":13385,"nodeType":865},{},[13384],{"type":946},"Use preconfigured data schemas",{"data":13387,"marks":13388,"value":13389,"nodeType":865},{},[]," for these logs without having to create your own.",{"data":13391,"content":13392,"nodeType":880},{},[13393],{"data":13394,"content":13395,"nodeType":866},{},[13396,13401],{"data":13397,"marks":13398,"value":13400,"nodeType":865},{},[13399],{"type":946},"Enable ready-made detections",{"data":13402,"marks":13403,"value":13404,"nodeType":865},{},[]," for Push webhook events, including session token theft and adversary-in-the-middle (AitM) phishing toolkits.",{"data":13406,"content":13407,"nodeType":866},{},[13408],{"data":13409,"marks":13410,"value":13411,"nodeType":865},{},[],"The combination of Push’s unique telemetry, powered by the Push browser agent, and Panther’s correlation and log normalization capabilities was a perfect match, explains Panther’s Head of Partnerships, Andrew Dooley.",{"data":13413,"content":13414,"nodeType":866},{},[13415],{"data":13416,"marks":13417,"value":13418,"nodeType":865},{},[],"“As a SIEM, we’re looking for where we can find the most impactful security information in our customers’ environments to bring into Panther,” Dooley says. ",{"data":13420,"content":13421,"nodeType":866},{},[13422],{"data":13423,"marks":13424,"value":13425,"nodeType":865},{},[],"“With identity-based attacks being so common and impactful, identity telemetry data directly from users' browsers is exactly the kind of high-impact logs we want to support our customers’ threat detection and investigation workflows.”",{"data":13427,"content":13431,"nodeType":907},{"target":13428},{"sys":13429},{"id":13430,"type":904,"linkType":905},"77bCOg5nPKjyKdhH77dUox",[],{"data":13433,"content":13434,"nodeType":866},{},[13435,13439,13447],{"data":13436,"marks":13437,"value":13438,"nodeType":865},{},[],"In this article, we’ll highlight some of the use cases you can achieve with the Push-Panther integration. Or, if you prefer, you can ",{"data":13440,"content":13442,"nodeType":1102},{"uri":13441},"https://docs.panther.com/data-onboarding/supported-logs/push-security",[13443],{"data":13444,"marks":13445,"value":13446,"nodeType":865},{},[],"dive into the docs",{"data":13448,"marks":13449,"value":13450,"nodeType":865},{},[]," right away.",{"data":13452,"content":13453,"nodeType":948},{},[13454],{"data":13455,"marks":13456,"value":13457,"nodeType":865},{},[],"How to detect session token theft with Push and Panther",{"data":13459,"content":13460,"nodeType":866},{},[13461,13465,13476],{"data":13462,"marks":13463,"value":13464,"nodeType":865},{},[],"A key use case we set out to solve with the Push-Panther integration is detecting ",{"data":13466,"content":13470,"nodeType":1038},{"target":13467},{"sys":13468},{"id":13469,"type":904,"linkType":905},"6Uvqu6LcWzOVfA9mxtu841",[13471],{"data":13472,"marks":13473,"value":13475,"nodeType":865},{},[13474],{"type":946},"session token theft",{"data":13477,"marks":13478,"value":13479,"nodeType":865},{},[],", a session hijacking technique where endpoint malware such as an infostealer is used to extract sessions and other valuable data from a device.",{"data":13481,"content":13482,"nodeType":866},{},[13483],{"data":13484,"marks":13485,"value":13486,"nodeType":865},{},[],"Using stolen tokens, attackers don’t even need to bypass MFA; they can just log in by importing the session cookie into their browser.",{"data":13488,"content":13489,"nodeType":866},{},[13490],{"data":13491,"marks":13492,"value":13493,"nodeType":865},{},[],"In the past, writing high-fidelity detections for session token theft has been extremely challenging because there was only squishy ground to stand on: IP-based or geo-based signals are noisy and frequently inaccurate.",{"data":13495,"content":13496,"nodeType":866},{},[13497,13501,13512],{"data":13498,"marks":13499,"value":13500,"nodeType":865},{},[],"Push recently released our ",{"data":13502,"content":13506,"nodeType":1038},{"target":13503},{"sys":13504},{"id":13505,"type":904,"linkType":905},"1UMZdjyNQt4Y7NBb2wuK4L",[13507],{"data":13508,"marks":13509,"value":13511,"nodeType":865},{},[13510],{"type":946},"session token theft detection",{"data":13513,"marks":13514,"value":13515,"nodeType":865},{},[]," feature, which uses the Push browser agent to inject a unique marker into the user agent string of sessions that occur in browsers enrolled in Push.",{"data":13517,"content":13521,"nodeType":907},{"target":13518},{"sys":13519},{"id":13520,"type":904,"linkType":905},"3zQamWSaZFIbMUhQZtM2II",[],{"data":13523,"content":13524,"nodeType":866},{},[13525,13529,13538,13542,13547,13551,13556],{"data":13526,"marks":13527,"value":13528,"nodeType":865},{},[],"Things get interesting when you plug Push telemetry into Panther’s new ",{"data":13530,"content":13532,"nodeType":1102},{"uri":13531},"https://docs.panther.com/detections/correlation-rules",[13533],{"data":13534,"marks":13535,"value":13537,"nodeType":865},{},[13536],{"type":946},"Correlation Rules",{"data":13539,"marks":13540,"value":13541,"nodeType":865},{},[]," feature (or perform a correlation in your other SIEM of choice). By analyzing logs from your IdP, you can identify activity from the same session that both ",{"data":13543,"marks":13544,"value":13546,"nodeType":865},{},[13545],{"type":979},"has",{"data":13548,"marks":13549,"value":13550,"nodeType":865},{},[]," and that ",{"data":13552,"marks":13553,"value":13555,"nodeType":865},{},[13554],{"type":979},"lacks",{"data":13557,"marks":13558,"value":13559,"nodeType":865},{},[]," the Push marker, a high-fidelity signal that a stolen session token is being used by an adversary.",{"data":13561,"content":13562,"nodeType":866},{},[13563],{"data":13564,"marks":13565,"value":13566,"nodeType":865},{},[],"“Being able to correlate high-fidelity browser telemetry data with IdP logs and even more traditional endpoint logs is a powerful enabler for our users in catching bad actor behavior fast and early,” says Dooley, Panther’s Head of Partnerships.",{"data":13568,"content":13569,"nodeType":866},{},[13570],{"data":13571,"marks":13572,"value":13573,"nodeType":865},{},[],"Check out this video demo from Joe Stanulis, solutions engineer team lead at Push, and Nicholas Hakmiller, senior engineering manager at Panther, to see how Push and Panther combine their powers to detect session token theft.",{"data":13575,"content":13579,"nodeType":907},{"target":13576},{"sys":13577},{"id":13578,"type":904,"linkType":905},"2hUt3IqTFlCMgC0jHTau58",[],{"data":13581,"content":13582,"nodeType":866},{},[13583],{"data":13584,"marks":13585,"value":13586,"nodeType":865},{},[],"As Dooley explains, “Push’s approach of generating visibility as well as security findings aligns well with Panther’s approach of centralizing customers’ security alerts but also combining multiple signals from different sources into one finding. For example, the Push agent can block phishing attacks when in Block mode, but when in Monitor mode, those findings can be sent to Panther to be correlated with other activity like unusual Okta logins to create a single alert that tells a more complete story of a user being compromised. ",{"data":13588,"content":13589,"nodeType":866},{},[13590],{"data":13591,"marks":13592,"value":13593,"nodeType":865},{},[],"“Similarly, the Push user agent string marker leaves a very visible fingerprint in logs from other systems, making it easy to incorporate this Push feature into Panther detections across a variety of log sources and use cases.”",{"data":13595,"content":13596,"nodeType":948},{},[13597],{"data":13598,"marks":13599,"value":13600,"nodeType":865},{},[],"What else can you do with Push and your SIEM?",{"data":13602,"content":13603,"nodeType":866},{},[13604],{"data":13605,"marks":13606,"value":13607,"nodeType":865},{},[],"As a browser agent, Push is uniquely positioned to provide telemetry on your identity infrastructure that you can’t easily get elsewhere. This data is a key element to stopping identity attacks and account takeover by providing the context security teams need to write detections and to perform correlations with existing log sources, such as an identity provider.",{"data":13609,"content":13610,"nodeType":866},{},[13611],{"data":13612,"marks":13613,"value":13614,"nodeType":865},{},[],"General use cases for ingesting Push data into your SIEM include:",{"data":13616,"content":13617,"nodeType":891},{},[13618,13647,13662,13677],{"data":13619,"content":13620,"nodeType":880},{},[13621],{"data":13622,"content":13623,"nodeType":866},{},[13624,13629,13633,13643],{"data":13625,"marks":13626,"value":13628,"nodeType":865},{},[13627],{"type":946},"Detecting phishing attempts",{"data":13630,"marks":13631,"value":13632,"nodeType":865},{},[]," from ",{"data":13634,"content":13638,"nodeType":1038},{"target":13635},{"sys":13636},{"id":13637,"type":904,"linkType":905},"4EfGLsD4qOkE4AoTUoL83m",[13639],{"data":13640,"marks":13641,"value":13642,"nodeType":865},{},[],"AitM phishing tools",{"data":13644,"marks":13645,"value":13646,"nodeType":865},{},[]," like Evilginx or EvilNoVNC.",{"data":13648,"content":13649,"nodeType":880},{},[13650],{"data":13651,"content":13652,"nodeType":866},{},[13653,13658],{"data":13654,"marks":13655,"value":13657,"nodeType":865},{},[13656],{"type":946},"Monitoring for suspicious activity or high-risk changes",{"data":13659,"marks":13660,"value":13661,"nodeType":865},{},[]," such as MFA method changes or reuse of corporate SSO passwords on other apps.",{"data":13663,"content":13664,"nodeType":880},{},[13665],{"data":13666,"content":13667,"nodeType":866},{},[13668,13673],{"data":13669,"marks":13670,"value":13672,"nodeType":865},{},[13671],{"type":946},"Hardening identities and flagging poor hygiene behaviors",{"data":13674,"marks":13675,"value":13676,"nodeType":865},{},[],", such as logging into SSO-protected apps with local accounts or reusing passwords across business applications.",{"data":13678,"content":13679,"nodeType":880},{},[13680],{"data":13681,"content":13682,"nodeType":866},{},[13683,13688],{"data":13684,"marks":13685,"value":13687,"nodeType":865},{},[13686],{"type":946},"Detecting the use of stolen session tokens",{"data":13689,"marks":13690,"value":13691,"nodeType":865},{},[],", indicating a compromised identity and device, as discussed earlier.",{"data":13693,"content":13694,"nodeType":948},{},[13695],{"data":13696,"marks":13697,"value":6796,"nodeType":865},{},[],{"data":13699,"content":13700,"nodeType":866},{},[13701,13705,13712],{"data":13702,"marks":13703,"value":13704,"nodeType":865},{},[],"To see Push in action, ",{"data":13706,"content":13708,"nodeType":1102},{"uri":13707},"/demo/",[13709],{"data":13710,"marks":13711,"value":11104,"nodeType":865},{},[],{"data":13713,"marks":13714,"value":13715,"nodeType":865},{},[],". We’ll be happy to show you our session theft detection feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.",{"data":13717,"content":13718,"nodeType":866},{},[13719,13723,13730],{"data":13720,"marks":13721,"value":13722,"nodeType":865},{},[],"For technical setup details on the Push-Panther integration, refer to the ",{"data":13724,"content":13725,"nodeType":1102},{"uri":13441},[13726],{"data":13727,"marks":13728,"value":13729,"nodeType":865},{},[],"Panther documentation",{"data":13731,"marks":13732,"value":1151,"nodeType":865},{},[],"Combining the powers of Push and Panther to stop identity attacks","Push is excited to partner with Panther, bringing our unique browser telemetry to your SIEM.","2024-06-25T00:00:00.000Z","combining-the-powers-of-push-and-panther-to-stop-identity-attacks",{"items":13738},[13739,13741],{"sys":13740,"name":342},{"id":2527},{"sys":13742,"name":3915},{"id":3914},{"items":13744},[13745],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":13746},{"url":853},"better-together-identity-telemetry-from-push-smart-storage-and-searches-from","blog/better-together-identity-telemetry-from-push-smart-storage-and-searches-from",{"json":13750},{"data":13751,"content":13752,"nodeType":2232},{},[13753],{"data":13754,"content":13755,"nodeType":866},{},[13756],{"data":13757,"marks":13758,"value":13759,"nodeType":865},{},[],"We’re thrilled to announce our partnership with Cribl to make it much easier to snapshot, transform, and query Push telemetry using Cribl’s data management solutions.\n","We’re thrilled to announce our partnership with Cribl to make it much easier to snapshot, transform, and query Push telemetry.",{"id":13762,"publishedAt":13763},"1sQvkmXRQaFGRpuE01KeF1","2026-08-12T11:54:09.517Z",{"items":13765},[13766],{"sys":13767,"name":2524},{"id":2523},{"items":13769},[13770,13772,13774,13776,13778,13780,13782,13784,13786],{"sys":13771,"name":342,"slug":343,"tier":31},{"id":339},{"sys":13773,"name":297,"slug":298,"tier":31},{"id":294},{"sys":13775,"name":413,"slug":414,"tier":31},{"id":410},{"sys":13777,"name":279,"slug":280,"tier":31},{"id":276},{"sys":13779,"name":598,"slug":599,"tier":45},{"id":595},{"sys":13781,"name":324,"slug":325,"tier":45},{"id":321},{"sys":13783,"name":571,"slug":572,"tier":45},{"id":568},{"sys":13785,"name":404,"slug":405,"tier":45},{"id":401},{"sys":13787,"name":351,"slug":352,"tier":45},{"id":348},"uZXz04NhobF_wEUTD8_eR_i2okOi_u_u_ikmCJI6pFA",{"id":13790,"title":13791,"authorsCollection":13792,"content":13798,"extension":228,"faqItemsCollection":14854,"faqTitle":59,"featured":6,"hashTags":59,"meta":14856,"metaTitle":14857,"ogImage":14858,"postType":5061,"publishedDate":14860,"relatedBlogPostsCollection":14861,"slug":17322,"stem":17323,"subtitle":17324,"summary":17325,"synopsis":17336,"sys":17337,"tagsCollection":17340,"topicsCollection":17346,"__hash__":17378},"blog/blog/minimum-viable-identity-security.json","Minimum Viable Identity Security",{"items":13793},[13794],{"fullName":6027,"firstName":6028,"jobTitle":6029,"socialLinks":13795,"profilePicture":13797},[13796],"https://www.linkedin.com/in/daniel-g-/",{"url":6031},{"json":13799,"links":14682},{"data":13800,"content":13801,"nodeType":2232},{},[13802,13809,13816,13823,13829,13832,13840,13860,13867,13874,13881,13904,13912,13915,13923,13930,13937,13944,13951,13957,13964,13971,14004,14011,14019,14025,14032,14050,14069,14075,14081,14089,14109,14115,14122,14129,14162,14170,14177,14183,14190,14197,14226,14234,14254,14262,14282,14290,14297,14303,14310,14313,14321,14341,14397,14404,14411,14419,14426,14449,14456,14475,14481,14488,14494,14501,14564,14572,14592,14599,14622,14625,14633,14640,14646,14653,14670,14676],{"data":13803,"content":13804,"nodeType":866},{},[13805],{"data":13806,"marks":13807,"value":13808,"nodeType":865},{},[],"A lot happened last year in the world of identity security — particularly in terms of the attacks we’ve experienced targeting internet applications and services. With this trend certain to continue in 2025, it’s more important than ever that product vendors build products with a secure baseline of fundamental controls and safeguards.",{"data":13810,"content":13811,"nodeType":866},{},[13812],{"data":13813,"marks":13814,"value":13815,"nodeType":865},{},[],"The vast majority of the identity vulnerabilities we observe in the wild are the result of multiple auth mechanisms being attached to a single account. The more methods that are configured (or are configurable), the greater the risk that insecure identities will be created — and exploited by attackers. ",{"data":13817,"content":13818,"nodeType":866},{},[13819],{"data":13820,"marks":13821,"value":13822,"nodeType":865},{},[],"The good news is that with a coordinated response from app vendors, this surface can be significantly reduced. The bad news is that right now, we’re very far from a universal standard when it comes to how apps handle authentication and identities. ",{"data":13824,"content":13828,"nodeType":907},{"target":13825},{"sys":13826},{"id":13827,"type":904,"linkType":905},"4QoPUiP5q6Mwj1eWUZT15Q",[],{"data":13830,"content":13831,"nodeType":938},{},[],{"data":13833,"content":13834,"nodeType":948},{},[13835],{"data":13836,"marks":13837,"value":13839,"nodeType":865},{},[13838],{"type":946},"Where to start?",{"data":13841,"content":13842,"nodeType":866},{},[13843,13847,13856],{"data":13844,"marks":13845,"value":13846,"nodeType":865},{},[],"The ",{"data":13848,"content":13850,"nodeType":1102},{"uri":13849},"https://mvsp.dev/mvsp.en/",[13851],{"data":13852,"marks":13853,"value":13855,"nodeType":865},{},[13854],{"type":4537},"Minimum Viable Secure Product (MVSP)",{"data":13857,"marks":13858,"value":13859,"nodeType":865},{},[]," initiative is a great resource for product and engineering teams that sets out essential controls that should be implemented in enterprise-ready products and services. MVSP does a fantastic job of getting to the heart of what’s important for vendor products, as compared to more general frameworks and standards like ISO and NIST that cover wider controls that should be implemented across the enterprise. ",{"data":13861,"content":13862,"nodeType":866},{},[13863],{"data":13864,"marks":13865,"value":13866,"nodeType":865},{},[],"We don’t want to reinvent the wheel, so we won’t be redoing the fundamentals already covered in MVSP. But MVSP inspired us to think – what are the vendor controls that would make a meaningful difference against the identity attacks we’re seeing in the wild? ",{"data":13868,"content":13869,"nodeType":866},{},[13870],{"data":13871,"marks":13872,"value":13873,"nodeType":865},{},[],"With better, consistent security standards, SaaS developers can close off a number of ATO techniques and generally make life much more difficult for attackers. ",{"data":13875,"content":13876,"nodeType":866},{},[13877],{"data":13878,"marks":13879,"value":13880,"nodeType":865},{},[],"We’ve identified two key areas of potential improvement which would make a material difference to ATO resilience:",{"data":13882,"content":13883,"nodeType":891},{},[13884,13894],{"data":13885,"content":13886,"nodeType":880},{},[13887],{"data":13888,"content":13889,"nodeType":866},{},[13890],{"data":13891,"marks":13892,"value":13893,"nodeType":865},{},[],"Many of the emerging TTPs could be seriously impaired (or prevented entirely) with improved authentication and identity management controls. ",{"data":13895,"content":13896,"nodeType":880},{},[13897],{"data":13898,"content":13899,"nodeType":866},{},[13900],{"data":13901,"marks":13902,"value":13903,"nodeType":865},{},[],"Detecting attacks and responding to identity breaches on third-party apps is a nightmare due to the availability of log data (or lack thereof). ",{"data":13905,"content":13906,"nodeType":866},{},[13907],{"data":13908,"marks":13909,"value":13911,"nodeType":865},{},[13910],{"type":946},"Let’s look at the changes that app vendors can make to improve the situation. ",{"data":13913,"content":13914,"nodeType":938},{},[],{"data":13916,"content":13917,"nodeType":948},{},[13918],{"data":13919,"marks":13920,"value":13922,"nodeType":865},{},[13921],{"type":946},"Provide the visibility and control to manage and harden identities",{"data":13924,"content":13925,"nodeType":866},{},[13926],{"data":13927,"marks":13928,"value":13929,"nodeType":865},{},[],"In the context of SaaS, identity security controls are your best (and in many cases, your last) defense against cyber attacks. ",{"data":13931,"content":13932,"nodeType":866},{},[13933],{"data":13934,"marks":13935,"value":13936,"nodeType":865},{},[],"Pretty much every SaaS attack involves ATO through identity-based techniques, such as phishing, credential stuffing, or session hijacking using stolen cookies. In contrast, very few involve classic vulnerability exploitation (e.g. injection vulns, cross-site scripting, etc.). ",{"data":13938,"content":13939,"nodeType":866},{},[13940],{"data":13941,"marks":13942,"value":13943,"nodeType":865},{},[],"When all an attacker needs to do is log into an app and dump the data to succeed, there isn’t much in the way of post-ATO activity to detect and respond to (even if you had the logs you need, more on this later) — which is why robust authentication controls to prevent unauthorized access are so important. ",{"data":13945,"content":13946,"nodeType":866},{},[13947],{"data":13948,"marks":13949,"value":13950,"nodeType":865},{},[],"If post-ATO activity does occur, it is often to compromise additional accounts with in-app administrative privileges as opposed to pivoting to other environments. ",{"data":13952,"content":13956,"nodeType":907},{"target":13953},{"sys":13954},{"id":13955,"type":904,"linkType":905},"3l9SxYjTtls6URgbI0NiU3",[],{"data":13958,"content":13959,"nodeType":866},{},[13960],{"data":13961,"marks":13962,"value":13963,"nodeType":865},{},[],"As you’d expect, many apps prioritize a frictionless user experience over security. This is one of the main drivers of insecure authentication implementation. Consistent implementation of identity and authentication controls would go a long way to reducing the susceptibility of apps to the majority of identity attack techniques. ",{"data":13965,"content":13966,"nodeType":866},{},[13967],{"data":13968,"marks":13969,"value":13970,"nodeType":865},{},[],"In terms of authentication and identity management, MVSP focuses on:",{"data":13972,"content":13973,"nodeType":891},{},[13974,13984,13994],{"data":13975,"content":13976,"nodeType":880},{},[13977],{"data":13978,"content":13979,"nodeType":866},{},[13980],{"data":13981,"marks":13982,"value":13983,"nodeType":865},{},[],"Providing an SSO mechanism, ",{"data":13985,"content":13986,"nodeType":880},{},[13987],{"data":13988,"content":13989,"nodeType":866},{},[13990],{"data":13991,"marks":13992,"value":13993,"nodeType":865},{},[],"Implementing a robust password policy, and ",{"data":13995,"content":13996,"nodeType":880},{},[13997],{"data":13998,"content":13999,"nodeType":866},{},[14000],{"data":14001,"marks":14002,"value":14003,"nodeType":865},{},[],"Logically separating data/functions based on the needs of a user type/group. ",{"data":14005,"content":14006,"nodeType":866},{},[14007],{"data":14008,"marks":14009,"value":14010,"nodeType":865},{},[],"We can go beyond these basic auth controls to prevent identity attacks by providing better default security configurations, and giving admins more visibility and control over identities. ",{"data":14012,"content":14013,"nodeType":1218},{},[14014],{"data":14015,"marks":14016,"value":14018,"nodeType":865},{},[14017],{"type":946},"1. Allow one active login method (and require external re-verification to change to another).",{"data":14020,"content":14024,"nodeType":907},{"target":14021},{"sys":14022},{"id":14023,"type":904,"linkType":905},"65YwkaNS3LjB1vZsYQtXQH",[],{"data":14026,"content":14027,"nodeType":866},{},[14028],{"data":14029,"marks":14030,"value":14031,"nodeType":865},{},[],"There is very rarely a need for multiple authentication methods to be active for the same account at the same time. Perhaps you upgrade from a local password to OIDC or SAML — but there’s no need to have multiple SSO logins from different providers at once, and there’s no need to continue using a local password after adding an SSO method. One exception is Administrators retaining local password access to access the tenant in case SAML configuration breaks (commonly because certificates expire) but in all other cases it’s an anti-pattern to allow any user more than one auth method. ",{"data":14033,"content":14034,"nodeType":866},{},[14035,14039,14046],{"data":14036,"marks":14037,"value":14038,"nodeType":865},{},[],"We call these alternative login methods (especially when they are in addition to SAML — so e.g. local password or OIDC logins using Google or Microsoft) ",{"data":14040,"content":14041,"nodeType":1102},{"uri":5377},[14042],{"data":14043,"marks":14044,"value":5383,"nodeType":865},{},[14045],{"type":4537},{"data":14047,"marks":14048,"value":14049,"nodeType":865},{},[]," because they provide attackers with a way around a company’s chosen enterprise SSO option. ",{"data":14051,"content":14052,"nodeType":866},{},[14053,14057,14065],{"data":14054,"marks":14055,"value":14056,"nodeType":865},{},[],"This situation most commonly arises because apps automatically merge login methods. So for example, if a user normally logs in with a password, but then attempts to login using an OIDC of social login — many apps automatically merge that new login method with the existing account. This is particularly problematic when it’s done without further verification steps — leading to ",{"data":14058,"content":14059,"nodeType":1102},{"uri":11751},[14060],{"data":14061,"marks":14062,"value":14064,"nodeType":865},{},[14063],{"type":4537},"cross-IdP attacks",{"data":14066,"marks":14067,"value":14068,"nodeType":865},{},[],". Ideally, apps should disable the old log method when a new one is enabled, but at the very least, external verification of the change should be required (e.g. via email). ",{"data":14070,"content":14074,"nodeType":907},{"target":14071},{"sys":14072},{"id":14073,"type":904,"linkType":905},"4rcDwo3EmNtkjOLQmf1A7V",[],{"data":14076,"content":14080,"nodeType":907},{"target":14077},{"sys":14078},{"id":14079,"type":904,"linkType":905},"19iDG0ARpziXraEx2Ca7xp",[],{"data":14082,"content":14083,"nodeType":1218},{},[14084],{"data":14085,"marks":14086,"value":14088,"nodeType":865},{},[14087],{"type":946},"2. Require external verification of changes to IdP configuration settings.",{"data":14090,"content":14091,"nodeType":866},{},[14092,14096,14105],{"data":14093,"marks":14094,"value":14095,"nodeType":865},{},[],"Attackers that are able to compromise one account with the level of privilege required to change the SAML settings in-app (typically an app admin), even on an app that is otherwise uninteresting or low risk – can perform an attack technique known as ",{"data":14097,"content":14099,"nodeType":1102},{"uri":14098},"https://pushsecurity.com/blog/samljacking-a-poisoned-tenant/",[14100],{"data":14101,"marks":14102,"value":14104,"nodeType":865},{},[14103],{"type":4537},"SAMLjacking",{"data":14106,"marks":14107,"value":14108,"nodeType":865},{},[],". This can be used to direct users to authenticate to the app via an attacker-controlled IdP tenant (so e.g. an attacker’s own Okta instance or phishing page that looks like Okta/MS/Google) to capture additional credentials and facilitate further compromise of accounts. ",{"data":14110,"content":14114,"nodeType":907},{"target":14111},{"sys":14112},{"id":14113,"type":904,"linkType":905},"4YfQDIY2hhE77h2xDr9Ja",[],{"data":14116,"content":14117,"nodeType":866},{},[14118],{"data":14119,"marks":14120,"value":14121,"nodeType":865},{},[],"To mitigate this, any SAML changes should require external verification, ideally through an out-of-band method like DNS Verification. If this can’t be achieved and you need to rely on email, the request should be sent to all app admins (to increase awareness of the risky change) and come with a cooldown period before the change takes effect. This improves the chance that an attacker’s SAMLjacking attack can be intercepted before half of the victim’s workforce gets keylogged — not after!",{"data":14123,"content":14124,"nodeType":866},{},[14125],{"data":14126,"marks":14127,"value":14128,"nodeType":865},{},[],"Other viable control options include:",{"data":14130,"content":14131,"nodeType":891},{},[14132,14142,14152],{"data":14133,"content":14134,"nodeType":880},{},[14135],{"data":14136,"content":14137,"nodeType":866},{},[14138],{"data":14139,"marks":14140,"value":14141,"nodeType":865},{},[],"Once SAML is configured, ensure it can't be edited without contacting the app developer",{"data":14143,"content":14144,"nodeType":880},{},[14145],{"data":14146,"content":14147,"nodeType":866},{},[14148],{"data":14149,"marks":14150,"value":14151,"nodeType":865},{},[],"Service Provider initiated flows not enabled by default to stop attackers from hijacking logins using Home Realm Discovery for domains they don't own",{"data":14153,"content":14154,"nodeType":880},{},[14155],{"data":14156,"content":14157,"nodeType":866},{},[14158],{"data":14159,"marks":14160,"value":14161,"nodeType":865},{},[],"Disallow new signups using password or OIDC logins when a domain is connected via SAML",{"data":14163,"content":14164,"nodeType":1218},{},[14165],{"data":14166,"marks":14167,"value":14169,"nodeType":865},{},[14168],{"type":946},"3. Provide admins with visibility of account authentication (login methods, MFA methods, IdPs used) and allow them to be restricted or removed. ",{"data":14171,"content":14172,"nodeType":866},{},[14173],{"data":14174,"marks":14175,"value":14176,"nodeType":865},{},[],"Many apps provide very limited information to admins about the configuration of identities within their tenant, and fewer still provide any mechanism for admins to take action if gaps or potential weak points are discovered. Some don’t even provide information about which accounts have access to the tenant at all. As a security team member this is maddening. ",{"data":14178,"content":14182,"nodeType":907},{"target":14179},{"sys":14180},{"id":14181,"type":904,"linkType":905},"5z3zNE7z9TWUJsYCmwew1S",[],{"data":14184,"content":14185,"nodeType":866},{},[14186],{"data":14187,"marks":14188,"value":14189,"nodeType":865},{},[],"It’s vital that, at the bare minimum, admins can access information (ideally in a dashboard) with the accounts, all login methods configured, MFA factors set, and the SSO methods used (specifying the IdP and protocol). All login methods should be visible to security admins, including secondary email addresses, social login connections, and so on. ",{"data":14191,"content":14192,"nodeType":866},{},[14193],{"data":14194,"marks":14195,"value":14196,"nodeType":865},{},[],"It should then also be possible to set a preferred method (e.g. only SAML from Microsoft, or OIDC from Google) and delete or disable ones that pose a risk. ",{"data":14198,"content":14199,"nodeType":866},{},[14200,14204,14211,14214,14222],{"data":14201,"marks":14202,"value":14203,"nodeType":865},{},[],"For security teams to be able to clean up insecure identities, they need to be able to make changes inside the app without requiring an action from the user. This means removing phishable MFA factors to prevent ",{"data":14205,"content":14206,"nodeType":1102},{"uri":5321},[14207],{"data":14208,"marks":14209,"value":5326,"nodeType":865},{},[14210],{"type":4537},{"data":14212,"marks":14213,"value":1913,"nodeType":865},{},[],{"data":14215,"content":14216,"nodeType":1102},{"uri":11198},[14217],{"data":14218,"marks":14219,"value":14221,"nodeType":865},{},[14220],{"type":4537},"MFA downgrade",{"data":14223,"marks":14224,"value":14225,"nodeType":865},{},[]," attacks.  ",{"data":14227,"content":14228,"nodeType":1218},{},[14229],{"data":14230,"marks":14231,"value":14233,"nodeType":865},{},[14232],{"type":946},"4. Support the use of domain-bound credentials (whether in the form of a passkey or MFA method) that are phishing resistant (FIDO key).",{"data":14235,"content":14236,"nodeType":866},{},[14237,14241,14250],{"data":14238,"marks":14239,"value":14240,"nodeType":865},{},[],"It’s no longer the case that simply having MFA is enough to stop identity attacks. The vast majority of phishing campaigns now make use of ",{"data":14242,"content":14244,"nodeType":1102},{"uri":14243},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/aitm_phishing/description.md",[14245],{"data":14246,"marks":14247,"value":14249,"nodeType":865},{},[14248],{"type":4537},"AitM toolkits designed to bypass MFA",{"data":14251,"marks":14252,"value":14253,"nodeType":865},{},[],". The only MFA methods considered to be phishing resistant are those using device-bound authentication methods such as passkeys/WebAuthn. However, only a handful of apps actually support these authentication methods. While the majority of SSO apps do support them, apps should provide support locally as well, particularly for B2C use-cases where enterprise SSO isn’t being used. ",{"data":14255,"content":14256,"nodeType":1218},{},[14257],{"data":14258,"marks":14259,"value":14261,"nodeType":865},{},[14260],{"type":946},"5. Allow active sessions to be viewed and remotely terminated by administrators.",{"data":14263,"content":14264,"nodeType":866},{},[14265,14269,14278],{"data":14266,"marks":14267,"value":14268,"nodeType":865},{},[],"Most apps have no way of viewing valid sessions and session activity, even as an administrator. With session hijacking attacks using ",{"data":14270,"content":14272,"nodeType":1102},{"uri":14271},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/session_cookie_theft/description.md",[14273],{"data":14274,"marks":14275,"value":14277,"nodeType":865},{},[14276],{"type":4537},"stolen session cookies",{"data":14279,"marks":14280,"value":14281,"nodeType":865},{},[]," on the rise, being able to (at the very least) terminate sessions that are suspected to have been compromised is key to effective incident response. In an ideal world, you would be able to view the properties of the session (such as the browser, IP, location that the session is being accessed from) to identify unusual or suspicious activity, which could in turn be leveraged by SecOps teams for their detection workflows. ",{"data":14283,"content":14284,"nodeType":1218},{},[14285],{"data":14286,"marks":14287,"value":14289,"nodeType":865},{},[14288],{"type":946},"6. Allow admins to prevent users with a matching domain from auto-joining a company tenant without being invited or approved by an admin, and notify when they do. ",{"data":14291,"content":14292,"nodeType":866},{},[14293],{"data":14294,"marks":14295,"value":14296,"nodeType":865},{},[],"Many apps do not provide the level of granular permissions that we’ve come to associate with enterprise cloud platforms — often because it simply isn’t necessary. This means that a lot of the time, the average user can access most, if not all of the data stored within an app. This is problematic if any user with a matching domain can join a company’s app tenant. This creates insider risk, as well as increasing the blast radius of ATO of an IdP account in terms of affected apps — it’s not just the apps they’re actively using, but any they can sign up to as well. ",{"data":14298,"content":14302,"nodeType":907},{"target":14299},{"sys":14300},{"id":14301,"type":904,"linkType":905},"SKchIQFHSWumQsORBYNs5",[],{"data":14304,"content":14305,"nodeType":866},{},[14306],{"data":14307,"marks":14308,"value":14309,"nodeType":865},{},[],"To address this, apps should allow admins to lock down their app tenant to be invite-only should they desire (and enable it by default), and at least issue email notifications to admins whenever a new user joins the company’s app tenant — prompting the admin to check that the event is expected. ",{"data":14311,"content":14312,"nodeType":938},{},[],{"data":14314,"content":14315,"nodeType":948},{},[14316],{"data":14317,"marks":14318,"value":14320,"nodeType":865},{},[14319],{"type":946},"Enable security teams to detect and respond to identity attacks",{"data":14322,"content":14323,"nodeType":866},{},[14324,14328,14337],{"data":14325,"marks":14326,"value":14327,"nodeType":865},{},[],"Security teams required to respond to incidents affecting SaaS apps are ",{"data":14329,"content":14331,"nodeType":1102},{"uri":14330},"https://mayakaczorowski.com/blogs/what-sucks-in-security",[14332],{"data":14333,"marks":14334,"value":14336,"nodeType":865},{},[14335],{"type":4537},"united in how painful it is",{"data":14338,"marks":14339,"value":14340,"nodeType":865},{},[],": ",{"data":14342,"content":14343,"nodeType":891},{},[14344,14367,14377,14387],{"data":14345,"content":14346,"nodeType":880},{},[14347],{"data":14348,"content":14349,"nodeType":866},{},[14350,14354,14363],{"data":14351,"marks":14352,"value":14353,"nodeType":865},{},[],"Many SaaS providers don’t offer audit logs at all (",{"data":14355,"content":14357,"nodeType":1102},{"uri":14356},"https://audit-logs.tax/",[14358],{"data":14359,"marks":14360,"value":14362,"nodeType":865},{},[14361],{"type":4537},"or charge extra for the privilege",{"data":14364,"marks":14365,"value":14366,"nodeType":865},{},[],"). ",{"data":14368,"content":14369,"nodeType":880},{},[14370],{"data":14371,"content":14372,"nodeType":866},{},[14373],{"data":14374,"marks":14375,"value":14376,"nodeType":865},{},[],"Even when logs are available, they might be incomplete, like missing login events, or critical pieces of information in the event needed to decide whether it’s malicious or not.",{"data":14378,"content":14379,"nodeType":880},{},[14380],{"data":14381,"content":14382,"nodeType":866},{},[14383],{"data":14384,"marks":14385,"value":14386,"nodeType":865},{},[],"The lack of standardization across tools creates ingestion challenges, with each app requiring custom development work.",{"data":14388,"content":14389,"nodeType":880},{},[14390],{"data":14391,"content":14392,"nodeType":866},{},[14393],{"data":14394,"marks":14395,"value":14396,"nodeType":865},{},[],"The logs you really need can’t always be accessed programmatically. The provider might have them, but you’ll need to put in a request – that could take hours or days to respond to. ",{"data":14398,"content":14399,"nodeType":866},{},[14400],{"data":14401,"marks":14402,"value":14403,"nodeType":865},{},[],"All of this makes it very challenging to ingest meaningful security log data from SaaS and harness it for detection and response. Hours or days is an eternity when you’re in the midst of a live incident, and is inevitably going to result in a worse outcome for the business. ",{"data":14405,"content":14406,"nodeType":866},{},[14407],{"data":14408,"marks":14409,"value":14410,"nodeType":865},{},[],"MVSP specifies that authentication events should be logged (and for how long they should be stored), but practically there is little consistency in the types of event and the fields captured. App vendors should make sure that the data points they provide (and the format that logs are provided in) can be practically used by security teams. ",{"data":14412,"content":14413,"nodeType":1218},{},[14414],{"data":14415,"marks":14416,"value":14418,"nodeType":865},{},[14417],{"type":946},"7. Log detailed authentication/login information.",{"data":14420,"content":14421,"nodeType":866},{},[14422],{"data":14423,"marks":14424,"value":14425,"nodeType":865},{},[],"Authentication information is arguably the most important log source in the context of SaaS services which lack granular permissions management, because: ",{"data":14427,"content":14428,"nodeType":891},{},[14429,14439],{"data":14430,"content":14431,"nodeType":880},{},[14432],{"data":14433,"content":14434,"nodeType":866},{},[14435],{"data":14436,"marks":14437,"value":14438,"nodeType":865},{},[],"If you know a malicious user accessed the app, you can infer/assume the likely impact, and respond accordingly. ",{"data":14440,"content":14441,"nodeType":880},{},[14442],{"data":14443,"content":14444,"nodeType":866},{},[14445],{"data":14446,"marks":14447,"value":14448,"nodeType":865},{},[],"Attacker behavior in-app is often indistinguishable from typical user behavior.",{"data":14450,"content":14451,"nodeType":866},{},[14452],{"data":14453,"marks":14454,"value":14455,"nodeType":865},{},[],"This means it’s vital to understand who accessed the app, at what time, and from where.",{"data":14457,"content":14458,"nodeType":866},{},[14459,14462,14471],{"data":14460,"marks":14461,"value":13846,"nodeType":865},{},[],{"data":14463,"content":14465,"nodeType":1102},{"uri":14464},"https://eventmaturitymatrix.com/#salesforce-real-time-event-monitoring-urieventstream",[14466],{"data":14467,"marks":14468,"value":14470,"nodeType":865},{},[14469],{"type":4537},"SaaS Event Maturity Matrix",{"data":14472,"marks":14473,"value":14474,"nodeType":865},{},[]," provides a great starting point when looking at the availability of authentication logs across different platforms. ",{"data":14476,"content":14480,"nodeType":907},{"target":14477},{"sys":14478},{"id":14479,"type":904,"linkType":905},"4NppB8YnmXHIQjvLwx79JW",[],{"data":14482,"content":14483,"nodeType":866},{},[14484],{"data":14485,"marks":14486,"value":14487,"nodeType":865},{},[],"We recommend that all providers include the following Authentication and MFA Verification log fields:",{"data":14489,"content":14493,"nodeType":907},{"target":14490},{"sys":14491},{"id":14492,"type":904,"linkType":905},"67uAYr6RA3DIr7mUCBgzyn",[],{"data":14495,"content":14496,"nodeType":866},{},[14497],{"data":14498,"marks":14499,"value":14500,"nodeType":865},{},[],"With this level of granular information it will be much easier for security teams to reliably differentiate malicious from legitimate access, independently or when combined with other data points:",{"data":14502,"content":14503,"nodeType":891},{},[14504,14514,14524,14534,14544,14554],{"data":14505,"content":14506,"nodeType":880},{},[14507],{"data":14508,"content":14509,"nodeType":866},{},[14510],{"data":14511,"marks":14512,"value":14513,"nodeType":865},{},[],"Identify suspicious logins due to location/impossible travel",{"data":14515,"content":14516,"nodeType":880},{},[14517],{"data":14518,"content":14519,"nodeType":866},{},[14520],{"data":14521,"marks":14522,"value":14523,"nodeType":865},{},[],"Identify failed login attempts due to either credential or MFA failures, indicating possible credential stuffing attacks",{"data":14525,"content":14526,"nodeType":880},{},[14527],{"data":14528,"content":14529,"nodeType":866},{},[14530],{"data":14531,"marks":14532,"value":14533,"nodeType":865},{},[],"Identify the IdP used to login to detect unapproved or unusual IdP logins (a possible indicator of cross-IdP impersonation)",{"data":14535,"content":14536,"nodeType":880},{},[14537],{"data":14538,"content":14539,"nodeType":866},{},[14540],{"data":14541,"marks":14542,"value":14543,"nodeType":865},{},[],"Identify where an unexpected (less secure) MFA method is used, indicating a potential MFA downgrade attack",{"data":14545,"content":14546,"nodeType":880},{},[14547],{"data":14548,"content":14549,"nodeType":866},{},[14550],{"data":14551,"marks":14552,"value":14553,"nodeType":865},{},[],"Detect risky changes to authentication such as initiating SAML configuration changes, tracking which user initiated it and when it completed",{"data":14555,"content":14556,"nodeType":880},{},[14557],{"data":14558,"content":14559,"nodeType":866},{},[14560],{"data":14561,"marks":14562,"value":14563,"nodeType":865},{},[],"Differentiate active session location from the device/client/location of the original session (to detect session hijacking attacks)",{"data":14565,"content":14566,"nodeType":1218},{},[14567],{"data":14568,"marks":14569,"value":14571,"nodeType":865},{},[14570],{"type":946},"8. Make audit logs available in a format and using a mechanism that is easy to ingest into common security tools. ",{"data":14573,"content":14574,"nodeType":866},{},[14575,14579,14588],{"data":14576,"marks":14577,"value":14578,"nodeType":865},{},[],"Even where logs are available, security teams often have to wrestle with the format they are provided in to be able to make use of them. While JSON is pretty much the de facto standard nowadays, the absence of a common schema and field names is often the tricky part — complicated by the fact that there are multiple competing standards. At the very least, complying with at least one of the more established schemas (e.g. the ",{"data":14580,"content":14582,"nodeType":1102},{"uri":14581},"https://www.elastic.co/guide/en/ecs/current/ecs-reference.html",[14583],{"data":14584,"marks":14585,"value":14587,"nodeType":865},{},[14586],{"type":4537},"Elastic Common Schema",{"data":14589,"marks":14590,"value":14591,"nodeType":865},{},[],") will provide a level of standardisation to make things easier for security teams.",{"data":14593,"content":14594,"nodeType":866},{},[14595],{"data":14596,"marks":14597,"value":14598,"nodeType":865},{},[],"Arguably an even bigger challenge is pulling the events you actually need from the data — so making it possible to stream logs or access them programmatically to minimize collection delays is a key change that app developers can implement regardless of the schema used, that will make life easier for SecOps teams. With that in mind: ",{"data":14600,"content":14601,"nodeType":891},{},[14602,14612],{"data":14603,"content":14604,"nodeType":880},{},[14605],{"data":14606,"content":14607,"nodeType":866},{},[14608],{"data":14609,"marks":14610,"value":14611,"nodeType":865},{},[],"Login events indicating a potential identity attack should emit preconfigured webhook events to enable security teams to better detect and respond, (such as in the context of the use cases above). ",{"data":14613,"content":14614,"nodeType":880},{},[14615],{"data":14616,"content":14617,"nodeType":866},{},[14618],{"data":14619,"marks":14620,"value":14621,"nodeType":865},{},[],"API access should also be provided to ensure that logs can be extracted to inform point-in-time investigations in the event of a suspected incident. (It’s no good if you have to request that certain logs be sent to you during a time-sensitive security incident.) ",{"data":14623,"content":14624,"nodeType":938},{},[],{"data":14626,"content":14627,"nodeType":948},{},[14628],{"data":14629,"marks":14630,"value":14632,"nodeType":865},{},[14631],{"type":946},"Final thoughts",{"data":14634,"content":14635,"nodeType":866},{},[14636],{"data":14637,"marks":14638,"value":14639,"nodeType":865},{},[],"The key takeaway here is that the scope for identity attacks and abuse could be significantly mitigated with a better standard of app-level controls. If you’re familiar with Push, you’ll recognize that many of our features compensate for these gaps in visibility and control — made necessary by the fact that so many apps don’t provide basic information about the accounts within your tenant, or give you any controls to manage authentication in accordance with your risk profile.",{"data":14641,"content":14645,"nodeType":907},{"target":14642},{"sys":14643},{"id":14644,"type":904,"linkType":905},"2skTQlf4ssC083ilExzKPW",[],{"data":14647,"content":14648,"nodeType":866},{},[14649],{"data":14650,"marks":14651,"value":14652,"nodeType":865},{},[],"If you agree with us and think that stronger identity controls around authentication and security logging are needed, then consider adding these suggestions to your procurement requirements when on-boarding new apps and services. ",{"data":14654,"content":14655,"nodeType":866},{},[14656,14659,14666],{"data":14657,"marks":14658,"value":21,"nodeType":865},{},[],{"data":14660,"content":14661,"nodeType":1102},{"uri":10028},[14662],{"data":14663,"marks":14664,"value":10742,"nodeType":865},{},[14665],{"type":4537},{"data":14667,"marks":14668,"value":14669,"nodeType":865},{},[]," to find out how Push can mitigate widespread application security gaps and secure your identity attack surface. ",{"data":14671,"content":14675,"nodeType":907},{"target":14672},{"sys":14673},{"id":14674,"type":904,"linkType":905},"34OTFgwuW60VWzW4FAqwXi",[],{"data":14677,"content":14678,"nodeType":866},{},[14679],{"data":14680,"marks":14681,"value":21,"nodeType":865},{},[],{"entries":14683},{"hyperlink":14684,"inline":14685,"block":14686},[],[],[14687,14692,14696,14711,14740,14747,14761,14795,14820,14828,14835,14849],{"sys":14688,"__typename":4959,"type":4960,"ctaText":14689,"buttonLabel":14690,"buttonColour":14691,"buttonUrl":9237},{"id":13827},"Get our latest ebook to learn about the evolution of identity attacks in 2024 and their role in public breaches. ","Download Now","sea blue",{"sys":14693,"__typename":4959,"type":4960,"ctaText":14694,"buttonLabel":14695,"buttonColour":4963,"buttonUrl":9381},{"id":13955},"Learn how Push provides defense in depth against identity attacks before account takeover.","Read the Blog",{"sys":14697,"__typename":2303,"content":14698,"name":14710,"title":59},{"id":14023},{"json":14699},{"data":14700,"content":14701,"nodeType":2232},{},[14702],{"data":14703,"content":14704,"nodeType":866},{},[14705],{"data":14706,"marks":14707,"value":14709,"nodeType":865},{},[14708],{"type":946},"If you don’t take anything else away from this piece, this control alone will get rid of 80% of the complexity and room for vulnerabilities to creep in. ","MVSI insight box",{"sys":14712,"__typename":2303,"content":14713,"name":14739,"title":59},{"id":14073},{"json":14714},{"nodeType":2232,"data":14715,"content":14716},{},[14717,14732],{"nodeType":866,"data":14718,"content":14719},{},[14720,14724,14729],{"nodeType":865,"value":14721,"marks":14722,"data":14723},"We recently saw a great example of a practical solution to this problem — HubSpot have introduced a feature where any user that is no longer using a password to log in ",[],{},{"nodeType":865,"value":14725,"marks":14726,"data":14728},"will have their password removed automatically",[14727],{"type":946},{},{"nodeType":865,"value":1677,"marks":14730,"data":14731},[],{},{"nodeType":866,"data":14733,"content":14734},{},[14735],{"nodeType":865,"value":14736,"marks":14737,"data":14738},"This means that users consciously opting for more secure SSO-based logins will get the added benefit of the app automatically cleaning up unused login methods. This is an excellent QOL feature and demonstrates a real understanding of the security risk posed by ghost logins. ",[],{},"MVSP insight box",{"sys":14741,"__typename":2366,"title":14742,"caption":59,"layoutMode":59,"file":14743},{"id":14079},"HubSpot automatic password removal",{"url":14744,"width":14745,"height":14746},"https://images.ctfassets.net/y1cdw1ablpvd/1noqvZD8IxO8DLcYLu6uPb/b84a0e8bf80f009895d59d0e16454786/Group_542.png",1470,2078,{"sys":14748,"__typename":2303,"content":14749,"name":14760,"title":59},{"id":14113},{"json":14750},{"nodeType":2232,"data":14751,"content":14752},{},[14753],{"nodeType":866,"data":14754,"content":14755},{},[14756],{"nodeType":865,"value":14757,"marks":14758,"data":14759},"Using SAMLjacking, an attacker can turn the compromise of a low risk app/identity into a much more serious one by using it to capture SSO credentials for other users of the app. ",[],{},"MVSI Insight box 2",{"sys":14762,"__typename":2303,"content":14763,"name":14794,"title":59},{"id":14181},{"json":14764},{"nodeType":2232,"data":14765,"content":14766},{},[14767],{"nodeType":866,"data":14768,"content":14769},{},[14770,14774,14781,14785,14790],{"nodeType":865,"value":14771,"marks":14772,"data":14773},"One of the leading causes of identity breaches is when ",[],{},{"nodeType":1102,"data":14775,"content":14776},{"uri":5377},[14777],{"nodeType":865,"value":5383,"marks":14778,"data":14780},[14779],{"type":4537},{},{"nodeType":865,"value":14782,"marks":14783,"data":14784}," (usually a weak, breached or reused password) exist alongside a more secure login method (e.g. SAML SSO). These ghost logins can be exploitable either as a single factor, or with a weak/phishable MFA method. It doesn’t matter if your employees ",[],{},{"nodeType":865,"value":14786,"marks":14787,"data":14789},"typically",[14788],{"type":979},{},{"nodeType":865,"value":14791,"marks":14792,"data":14793}," log in with SAML, if insecure local logins exist alongside it — because attackers can take advantage of this. ",[],{},"MVSI insight box 3",{"sys":14796,"__typename":2303,"content":14797,"name":14819,"title":59},{"id":14301},{"json":14798},{"nodeType":2232,"data":14799,"content":14800},{},[14801],{"nodeType":866,"data":14802,"content":14803},{},[14804,14808,14815],{"nodeType":865,"value":14805,"marks":14806,"data":14807},"You might assume that a user with access to an IdP account also has access to the email connected to that account, but as we’ve seen with ",[],{},{"nodeType":1102,"data":14809,"content":14810},{"uri":11751},[14811],{"nodeType":865,"value":6515,"marks":14812,"data":14814},[14813],{"type":4537},{},{"nodeType":865,"value":14816,"marks":14817,"data":14818},", this isn’t necessarily the case. ",[],{},"MVSI insight box 4",{"sys":14821,"__typename":2366,"title":14822,"caption":14823,"layoutMode":59,"file":14824},{"id":14479},"MVSI: Example Okta login history logs","Example of Okta login history logs",{"url":14825,"width":14826,"height":14827},"https://images.ctfassets.net/y1cdw1ablpvd/2oRCAyYH72TfB2EsGxQDFK/325fceea5222e1404141e7ed89ba4b53/image1.png",1578,1418,{"sys":14829,"__typename":2366,"title":14830,"caption":59,"layoutMode":59,"file":14831},{"id":14492},"MVSI Recommended Logs",{"url":14832,"width":14833,"height":14834},"https://images.ctfassets.net/y1cdw1ablpvd/GWJoQawV0uYCn4vdVxcXy/00bae170edfc839c7e1f37427eb309c7/Screenshot_2025-02-10_at_12.00.14.png",1264,526,{"sys":14836,"__typename":2303,"content":14837,"name":14848,"title":59},{"id":14644},{"json":14838},{"nodeType":2232,"data":14839,"content":14840},{},[14841],{"nodeType":866,"data":14842,"content":14843},{},[14844],{"nodeType":865,"value":14845,"marks":14846,"data":14847},"This is certainly not intended as a definitive standard or exhaustive list of identity controls — but hopefully provides any app developers or standards authors with food for thought! We speak for other potential customers when we say that including these controls would make your app much more attractive to the security and compliance teams of prospective buyers. ",[],{},"MVSI insight box 5",{"sys":14850,"__typename":4959,"type":4960,"ctaText":14851,"buttonLabel":14852,"buttonColour":14853,"buttonUrl":10028},{"id":14674},"Book a demo to see how Push prevents and detects identity attacks across all apps your employees use. ","Book a Demo","orange",{"items":14855},[],{},"8 ways app developers can mitigate identity-based attacks",{"url":14859},"https://images.ctfassets.net/y1cdw1ablpvd/5EErNKIkhkUn2Y9OCLlDjR/2e5c107747f8d881d87484577bfd895c/Dan_Blog_Thumbnail.jpg","2025-02-10T00:00:00.000Z",{"items":14862},[14863,16054,16685],{"__typename":2239,"sys":14864,"content":14866,"title":16040,"synopsis":16041,"hashTags":59,"publishedDate":16042,"slug":16043,"tagsCollection":16044,"authorsCollection":16050},{"id":14865},"5KqYY7p174lSpuinfTfEZU",{"json":14867},{"data":14868,"content":14869,"nodeType":2232},{},[14870,14877,14932,14939,14942,14949,14956,14989,15001,15004,15011,15022,15029,15049,15055,15075,15082,15093,15113,15133,15140,15159,15165,15185,15188,15195,15202,15209,15229,15247,15254,15273,15280,15287,15311,15318,15337,15357,15363,15370,15389,15392,15399,15417,15436,15443,15496,15503,15506,15513,15520,15539,15559,15566,15573,15580,15601,15608,15615,15621,15627,15630,15637,15644,15651,15671,15682,15701,15708,15715,15725,15732,15739,15760,15766,15769,15776,15783,15790,15862,15869,15876,15883,15891,15912,15919,15925,15936,15957,15964,15972,15992,15999,16006,16012,16015,16022],{"data":14871,"content":14872,"nodeType":866},{},[14873],{"data":14874,"marks":14875,"value":14876,"nodeType":865},{},[],"From massive breaches like the Snowflake incident to novel phishing techniques documented by Push researchers, 2024 was the year that identity attacks left their mark. Looking back over what we saw in the wild and what we found through Push’s own research, three key themes stand out:",{"data":14878,"content":14879,"nodeType":891},{},[14880,14899,14909],{"data":14881,"content":14882,"nodeType":880},{},[14883],{"data":14884,"content":14885,"nodeType":866},{},[14886,14890,14895],{"data":14887,"marks":14888,"value":14889,"nodeType":865},{},[],"Account takeover techniques on cloud apps are fundamentally different from traditional network-based attacks. To have the best chance of preventing account takeover, defenders need to  disrupt attacks ",{"data":14891,"marks":14892,"value":14894,"nodeType":865},{},[14893],{"type":979},"before",{"data":14896,"marks":14897,"value":14898,"nodeType":865},{},[]," they’re successful.",{"data":14900,"content":14901,"nodeType":880},{},[14902],{"data":14903,"content":14904,"nodeType":866},{},[14905],{"data":14906,"marks":14907,"value":14908,"nodeType":865},{},[],"It’s not easy or practical to maintain 100 percent compliance on identity posture standards in a world where employees are using and signing up to apps outside of IT oversight — but it is possible to make this work a lot easier by using tools that help you scale your remediation activities.",{"data":14910,"content":14911,"nodeType":880},{},[14912],{"data":14913,"content":14914,"nodeType":866},{},[14915,14919,14928],{"data":14916,"marks":14917,"value":14918,"nodeType":865},{},[],"Despite another year where cybersecurity spend increased (now up to almost $1,100 per user, according to ",{"data":14920,"content":14922,"nodeType":1102},{"uri":14921},"https://www.forrester.com/report/2024-cybersecurity-benchmarks-global/RES181118",[14923],{"data":14924,"marks":14925,"value":14927,"nodeType":865},{},[14926],{"type":4537},"Forrester",{"data":14929,"marks":14930,"value":14931,"nodeType":865},{},[],"), existing approaches are not successfully preventing account takeovers. Security teams need to be able to detect and respond to these attacks where they happen: The browser.",{"data":14933,"content":14934,"nodeType":866},{},[14935],{"data":14936,"marks":14937,"value":14938,"nodeType":865},{},[],"In this article, we’ll take a look back at how these themes influenced key features we delivered for Push customers in 2024.",{"data":14940,"content":14941,"nodeType":938},{},[],{"data":14943,"content":14944,"nodeType":948},{},[14945],{"data":14946,"marks":14947,"value":14948,"nodeType":865},{},[],"Defending against modern phishing attacks",{"data":14950,"content":14951,"nodeType":866},{},[14952],{"data":14953,"marks":14954,"value":14955,"nodeType":865},{},[],"Phishing techniques that bypass MFA are now the norm, and few organizations have successfully achieved full coverage of phishing-resistant MFA methods. ",{"data":14957,"content":14958,"nodeType":866},{},[14959,14963,14972,14976,14985],{"data":14960,"marks":14961,"value":14962,"nodeType":865},{},[],"Equally, while phishing attacks via email remain the most commonly reported vector, phishing attacks increasingly target users outside of email. For example, phishing links are often encountered through normal internet use — such as ",{"data":14964,"content":14966,"nodeType":1102},{"uri":14965},"https://www.bleepingcomputer.com/news/security/hackers-use-google-search-ads-to-steal-google-ads-accounts/",[14967],{"data":14968,"marks":14969,"value":14971,"nodeType":865},{},[14970],{"type":4537},"in malicious Google ads",{"data":14973,"marks":14974,"value":14975,"nodeType":865},{},[]," — and attackers frequently conduct their campaigns over IM platforms like Slack and Teams. Late last year there was ",{"data":14977,"content":14979,"nodeType":1102},{"uri":14978},"https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ?utm_source=share&utm_medium=member_desktop",[14980],{"data":14981,"marks":14982,"value":14984,"nodeType":865},{},[14983],{"type":4537},"a rise in attackers inundating users with spam via Teams",{"data":14986,"marks":14987,"value":14988,"nodeType":865},{},[],", combined with phone scams posing as IT admins. Since anti-phishing controls are usually email-based, they fail to protect users from attacks taking place elsewhere. ",{"data":14990,"content":14991,"nodeType":866},{},[14992,14996],{"data":14993,"marks":14994,"value":14995,"nodeType":865},{},[],"At Push, we’ve built a suite of anti-phishing features over the last year that act as a defense-in-depth approach to the types of modern phishing techniques we’ve been observing in the wild. ",{"data":14997,"marks":14998,"value":15000,"nodeType":865},{},[14999],{"type":946},"Here’s what we built and why.",{"data":15002,"content":15003,"nodeType":938},{},[],{"data":15005,"content":15006,"nodeType":948},{},[15007],{"data":15008,"marks":15009,"value":15010,"nodeType":865},{},[],"Protecting passwords used for SSO",{"data":15012,"content":15013,"nodeType":1218},{},[15014,15019],{"data":15015,"marks":15016,"value":15018,"nodeType":865},{},[15017],{"type":946},"What happened?",{"data":15020,"marks":15021,"value":6192,"nodeType":865},{},[],{"data":15023,"content":15024,"nodeType":866},{},[15025],{"data":15026,"marks":15027,"value":15028,"nodeType":865},{},[],"Attackers explicitly targeted Okta, Entra, and Google Workspace accounts in 2023 and 2024, so we knew a top priority would be protecting identity provider accounts. These IdP accounts are a key target because they allow attackers to move laterally to other valuable apps and data via SSO following the initial account takeover.",{"data":15030,"content":15031,"nodeType":866},{},[15032,15036,15045],{"data":15033,"marks":15034,"value":15035,"nodeType":865},{},[],"It’s not just the typical IdPs you need to watch out for, either: Apps like GitHub, Slack, Salesforce, Facebook, X, and others all provide SSO functionality, increasing the blast radius of a compromise. And as we reported in ",{"data":15037,"content":15039,"nodeType":1102},{"uri":15038},"https://pushsecurity.com/blog/cross-idp-impersonation/",[15040],{"data":15041,"marks":15042,"value":15044,"nodeType":865},{},[15043],{"type":4537},"our research on cross-IdP impersonation",{"data":15046,"marks":15047,"value":15048,"nodeType":865},{},[],", apps can be accessed using multiple SSO methods simultaneously — and 3 in 5 apps that we tested recently did not require re-verification by default when adding a new login method.",{"data":15050,"content":15054,"nodeType":907},{"target":15051},{"sys":15052},{"id":15053,"type":904,"linkType":905},"3EOOr4dVQoiPjl2ucUs1mA",[],{"data":15056,"content":15057,"nodeType":866},{},[15058,15062,15071],{"data":15059,"marks":15060,"value":15061,"nodeType":865},{},[],"Phishing is a problem that would be significantly reduced in a world without passwords. But while the ideal case is that organizations can put in place phishing-resistant authentication methods like passkeys or other WebAuthn-based methods, the reality is that ",{"data":15063,"content":15065,"nodeType":1102},{"uri":15064},"https://www.ncsc.gov.uk/blog-post/passkeys-not-perfect-getting-better",[15066],{"data":15067,"marks":15068,"value":15070,"nodeType":865},{},[15069],{"type":4537},"it’s not a perfect solution right now",{"data":15072,"marks":15073,"value":15074,"nodeType":865},{},[]," — widespread passkey implementation is hard to achieve.",{"data":15076,"content":15077,"nodeType":866},{},[15078],{"data":15079,"marks":15080,"value":15081,"nodeType":865},{},[],"One of the key advantages of passkeys is that they are domain-bound: Meaning they can’t be used on a site with the wrong domain. So, we started thinking: What if it were possible to essentially domain-bind a password? ",{"data":15083,"content":15084,"nodeType":1218},{},[15085,15090],{"data":15086,"marks":15087,"value":15089,"nodeType":865},{},[15088],{"type":946},"What we built",{"data":15091,"marks":15092,"value":6192,"nodeType":865},{},[],{"data":15094,"content":15095,"nodeType":866},{},[15096,15100,15109],{"data":15097,"marks":15098,"value":15099,"nodeType":865},{},[],"In the first half of 2024, we delivered our ",{"data":15101,"content":15102,"nodeType":1102},{"uri":7255},[15103],{"data":15104,"marks":15105,"value":15108,"nodeType":865},{},[15106,15107],{"type":4537},{"type":946},"SSO password protection",{"data":15110,"marks":15111,"value":15112,"nodeType":865},{},[]," feature, which allows Push administrators to block employees from entering their IdP password into any site that’s not the identity provider — in effect domain-binding SSO credentials. ",{"data":15114,"content":15115,"nodeType":866},{},[15116,15120,15129],{"data":15117,"marks":15118,"value":15119,"nodeType":865},{},[],"Push accomplishes this via the Push browser agent, which ",{"data":15121,"content":15123,"nodeType":1102},{"uri":15122},"https://pushsecurity.com/help/10109/#how-does-sso-password-protection-work",[15124],{"data":15125,"marks":15126,"value":15128,"nodeType":865},{},[15127],{"type":4537},"observes and fingerprints",{"data":15130,"marks":15131,"value":15132,"nodeType":865},{},[]," the user’s SSO password and legitimate SSO login pages, and then enforces in-browser controls to prevent an SSO password from being submitted on any URL that doesn’t match the legitimate provider, an extremely strong anti-phishing protection. Separately, Push also verifies that passwords it observes are not easily guessable.",{"data":15134,"content":15135,"nodeType":866},{},[15136],{"data":15137,"marks":15138,"value":15139,"nodeType":865},{},[],"The idea behind this approach is to gain some similar benefits to passkeys — by ensuring that passwords used for SSO access to your apps cannot be phished and are unique and strong — but in a way that “just works” with existing password-based authentication. ",{"data":15141,"content":15142,"nodeType":866},{},[15143,15147,15155],{"data":15144,"marks":15145,"value":15146,"nodeType":865},{},[],"Organizations that monitor for SSO password reuse will find that the practice turns out to be incredibly widespread, so being able to detect and prevent password reuse — even outside of actual phishing attempts — is an asset to security teams. (Our ",{"data":15148,"content":15149,"nodeType":1102},{"uri":6406},[15150],{"data":15151,"marks":15152,"value":15154,"nodeType":865},{},[15153],{"type":4537},"research shows",{"data":15156,"marks":15157,"value":15158,"nodeType":865},{},[]," that 10% of IdP accounts are using a password that is shared with another app — where it is much more likely to be compromised.) ",{"data":15160,"content":15164,"nodeType":907},{"target":15161},{"sys":15162},{"id":15163,"type":904,"linkType":905},"4Ce999wf4mqCZwu1jLofsx",[],{"data":15166,"content":15167,"nodeType":866},{},[15168,15172,15181],{"data":15169,"marks":15170,"value":15171,"nodeType":865},{},[],"By streaming events to your SIEM and setting up a simple automation, you can also use Push-supplied intelligence on SSO password reuse to ",{"data":15173,"content":15175,"nodeType":1102},{"uri":15174},"https://pushsecurity.com/blog/automating-sso-password-resets-using-push/",[15176],{"data":15177,"marks":15178,"value":15180,"nodeType":865},{},[15179],{"type":4537},"automatically reset",{"data":15182,"marks":15183,"value":15184,"nodeType":865},{},[]," potentially compromised passwords — this provides instant response to successful phishing and gets rid of password re-use of your most sensitive credentials in one move - the kind of combo we love!",{"data":15186,"content":15187,"nodeType":938},{},[],{"data":15189,"content":15190,"nodeType":948},{},[15191],{"data":15192,"marks":15193,"value":15194,"nodeType":865},{},[],"Blocking AitM phishing and cloned login pages",{"data":15196,"content":15197,"nodeType":1218},{},[15198],{"data":15199,"marks":15200,"value":15018,"nodeType":865},{},[15201],{"type":946},{"data":15203,"content":15204,"nodeType":866},{},[15205],{"data":15206,"marks":15207,"value":15208,"nodeType":865},{},[],"When you’re able to detect SSO passwords being used in all the wrong places, it’s not surprising that one of the main offenders is phishing attacks. ",{"data":15210,"content":15211,"nodeType":866},{},[15212,15216,15225],{"data":15213,"marks":15214,"value":15215,"nodeType":865},{},[],"In 2024, we wrote extensively about the rise in ",{"data":15217,"content":15219,"nodeType":1102},{"uri":15218},"https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/",[15220],{"data":15221,"marks":15222,"value":15224,"nodeType":865},{},[15223],{"type":4537},"modern phishing attacks",{"data":15226,"marks":15227,"value":15228,"nodeType":865},{},[]," that use adversary-in-the middle toolkits (AiTM), including EvilNoVNC, Evilginx, and others.",{"data":15230,"content":15231,"nodeType":866},{},[15232,15236,15244],{"data":15233,"marks":15234,"value":15235,"nodeType":865},{},[],"AiTM phishing is a newer variant of phishing that allows attackers to bypass MFA protection by using tools that act as a proxy between the end-user and a legitimate login portal. AitM attacks increased 146% in 2023 (",{"data":15237,"content":15239,"nodeType":1102},{"uri":15238},"https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/final/en-us/microsoft-brand/documents/Microsoft%20Digital%20Defense%20Report%202024%20%281%29.pdf",[15240],{"data":15241,"marks":15242,"value":5800,"nodeType":865},{},[15243],{"type":4537},{"data":15245,"marks":15246,"value":6459,"nodeType":865},{},[],{"data":15248,"content":15249,"nodeType":866},{},[15250],{"data":15251,"marks":15252,"value":15253,"nodeType":865},{},[],"This trend in tradecraft was reflected in our own customer base last year, but what’s interesting is that we observed a lot of phish kits and tactics that were new — meaning traditional detections failed to find them before Push did. ",{"data":15255,"content":15256,"nodeType":866},{},[15257,15261,15269],{"data":15258,"marks":15259,"value":15260,"nodeType":865},{},[],"In particular, we saw newer ",{"data":15262,"content":15263,"nodeType":1102},{"uri":7038},[15264],{"data":15265,"marks":15266,"value":15268,"nodeType":865},{},[15267],{"type":4537},"web-based obfuscation techniques",{"data":15270,"marks":15271,"value":15272,"nodeType":865},{},[]," that allowed attackers to get past the features of email security tools like web gateways and email scanning appliances, such as bypassing web sandbox analysis, and deter other forms of automated investigation by using Cloudflare Turnstile and other tactics — similar to the approaches legit websites use to protect against automated bots (this is essentially the same problem for both).",{"data":15274,"content":15275,"nodeType":866},{},[15276],{"data":15277,"marks":15278,"value":15279,"nodeType":865},{},[],"The gap in existing controls was obvious: When all phishing routes eventually lead to the browser, security teams need to be able to detect and respond in the browser. To do this well they need to observe what the employee sees, not what loads in a sandbox.",{"data":15281,"content":15282,"nodeType":1218},{},[15283],{"data":15284,"marks":15285,"value":15089,"nodeType":865},{},[15286],{"type":946},{"data":15288,"content":15289,"nodeType":866},{},[15290,15294,15303,15308],{"data":15291,"marks":15292,"value":15293,"nodeType":865},{},[],"To address this gap, we released new capabilities for the Push browser agent to be able to ",{"data":15295,"content":15296,"nodeType":1102},{"uri":7395},[15297],{"data":15298,"marks":15299,"value":15302,"nodeType":865},{},[15300,15301],{"type":4537},{"type":946},"detect and block",{"data":15304,"marks":15305,"value":15307,"nodeType":865},{},[15306],{"type":946}," when a site is running AiTM phishing toolkits",{"data":15309,"marks":15310,"value":7361,"nodeType":865},{},[],{"data":15312,"content":15313,"nodeType":866},{},[15314],{"data":15315,"marks":15316,"value":15317,"nodeType":865},{},[],"Push does this via a set of readymade detections for common AiTM tools. By dynamically analyzing the behavior of malware in the browser, the Push browser agent can find indicators of compromise beyond just domains, file names, IP addresses, etc., focusing instead on behavioral attributes, such as Javascript calls being made or data structures saved to local storage.",{"data":15319,"content":15320,"nodeType":866},{},[15321,15325,15333],{"data":15322,"marks":15323,"value":15324,"nodeType":865},{},[],"This approach of focusing on the top of the ",{"data":15326,"content":15328,"nodeType":1102},{"uri":15327},"https://pushsecurity.com/blog/our-design-philosophy-detecting-what-matters/#id-building-effective-identity-threat-detection-controls_id-scenario-detecting-a-web-based-phishing-attack",[15329],{"data":15330,"marks":15331,"value":6871,"nodeType":865},{},[15332],{"type":4537},{"data":15334,"marks":15335,"value":15336,"nodeType":865},{},[]," — e.g. building detections for attributes of an attack that are the hardest for attackers to change, and therefore the most reliably accurate — is core to Push’s design philosophy. ",{"data":15338,"content":15339,"nodeType":866},{},[15340,15344,15353],{"data":15341,"marks":15342,"value":15343,"nodeType":865},{},[],"Finally, toward the second half of the year, we released ",{"data":15345,"content":15346,"nodeType":1102},{"uri":7374},[15347],{"data":15348,"marks":15349,"value":15352,"nodeType":865},{},[15350,15351],{"type":4537},{"type":946},"cloned login page detection",{"data":15354,"marks":15355,"value":15356,"nodeType":865},{},[],", a natural extension of our layered approach to preventing phishing attacks in the browser. With this security control, you can identify malicious webpages that are masquerading as legitimate IdP login portals. ",{"data":15358,"content":15362,"nodeType":907},{"target":15359},{"sys":15360},{"id":15361,"type":904,"linkType":905},"4y25OxesssUk9lzEx12HFa",[],{"data":15364,"content":15365,"nodeType":866},{},[15366],{"data":15367,"marks":15368,"value":15369,"nodeType":865},{},[],"When a cloned login page is detected, you can add the URL to your blocklist in Push and prevent any other employees from being targeted. ",{"data":15371,"content":15372,"nodeType":866},{},[15373,15377,15385],{"data":15374,"marks":15375,"value":15376,"nodeType":865},{},[],"By layering multiple anti-phishing controls that all prevent account takeover, defenders have the best chance at thwarting the ",{"data":15378,"content":15379,"nodeType":1102},{"uri":9381},[15380],{"data":15381,"marks":15382,"value":15384,"nodeType":865},{},[15383],{"type":4537},"short, fast attack chains",{"data":15386,"marks":15387,"value":15388,"nodeType":865},{},[]," that are emblematic of today’s identity attacks.",{"data":15390,"content":15391,"nodeType":938},{},[],{"data":15393,"content":15394,"nodeType":948},{},[15395],{"data":15396,"marks":15397,"value":15398,"nodeType":865},{},[],"Defending against stolen sessions and stolen credentials",{"data":15400,"content":15401,"nodeType":866},{},[15402,15406,15414],{"data":15403,"marks":15404,"value":15405,"nodeType":865},{},[],"With as little as $10 to buy a stolen password and a little skill, attackers capitalized on the use of stolen credentials last year. Stolen creds were the No. 1 attacker action in 2023 and 2024, according to ",{"data":15407,"content":15409,"nodeType":1102},{"uri":15408},"https://www.verizon.com/business/en-gb/resources/reports/dbir/",[15410],{"data":15411,"marks":15412,"value":5844,"nodeType":865},{},[15413],{"type":4537},{"data":15415,"marks":15416,"value":1151,"nodeType":865},{},[],{"data":15418,"content":15419,"nodeType":866},{},[15420,15424,15432],{"data":15421,"marks":15422,"value":15423,"nodeType":865},{},[],"Nowhere was this more plain than in the ",{"data":15425,"content":15426,"nodeType":1102},{"uri":4601},[15427],{"data":15428,"marks":15429,"value":15431,"nodeType":865},{},[15430],{"type":4537},"attacks on Snowflake customers",{"data":15433,"marks":15434,"value":15435,"nodeType":865},{},[],", one of the biggest breaches of last year. In this incident, cyber criminals targeted around 165 customers of the cloud-based data warehouse tool Snowflake by taking over accounts using credentials harvested from infostealer infections dating as far back as 2020.",{"data":15437,"content":15438,"nodeType":866},{},[15439],{"data":15440,"marks":15441,"value":15442,"nodeType":865},{},[],"The Snowflake incident underscored the challenges of control and visibility that security teams face when attempting to secure identities on a patchwork of managed and unmanaged apps:",{"data":15444,"content":15445,"nodeType":891},{},[15446,15456,15466,15476,15486],{"data":15447,"content":15448,"nodeType":880},{},[15449],{"data":15450,"content":15451,"nodeType":866},{},[15452],{"data":15453,"marks":15454,"value":15455,"nodeType":865},{},[],"Do I know all the workforce accounts my employees use?",{"data":15457,"content":15458,"nodeType":880},{},[15459],{"data":15460,"content":15461,"nodeType":866},{},[15462],{"data":15463,"marks":15464,"value":15465,"nodeType":865},{},[],"Do those accounts have a strong security posture?",{"data":15467,"content":15468,"nodeType":880},{},[15469],{"data":15470,"content":15471,"nodeType":866},{},[15472],{"data":15473,"marks":15474,"value":15475,"nodeType":865},{},[],"Do those accounts use MFA? The most phishing-resistant methods?",{"data":15477,"content":15478,"nodeType":880},{},[15479],{"data":15480,"content":15481,"nodeType":866},{},[15482],{"data":15483,"marks":15484,"value":15485,"nodeType":865},{},[],"Do I have tools to detect, respond, and remediate after an account takeover or breach of a critical software vendor?",{"data":15487,"content":15488,"nodeType":880},{},[15489],{"data":15490,"content":15491,"nodeType":866},{},[15492],{"data":15493,"marks":15494,"value":15495,"nodeType":865},{},[],"Do I know when a session has been stolen, pointing to a device compromised by infostealer malware?",{"data":15497,"content":15498,"nodeType":866},{},[15499],{"data":15500,"marks":15501,"value":15502,"nodeType":865},{},[],"Here’s what we delivered last year to make it easier for security teams to protect their organizations from the threat of stolen sessions and stolen creds.",{"data":15504,"content":15505,"nodeType":938},{},[],{"data":15507,"content":15508,"nodeType":948},{},[15509],{"data":15510,"marks":15511,"value":15512,"nodeType":865},{},[],"Detecting stolen sessions",{"data":15514,"content":15515,"nodeType":1218},{},[15516],{"data":15517,"marks":15518,"value":15018,"nodeType":865},{},[15519],{"type":946},{"data":15521,"content":15522,"nodeType":866},{},[15523,15526,15535],{"data":15524,"marks":15525,"value":21,"nodeType":865},{},[],{"data":15527,"content":15529,"nodeType":1102},{"uri":15528},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/",[15530],{"data":15531,"marks":15532,"value":15534,"nodeType":865},{},[15533],{"type":4537},"Infostealer malware",{"data":15536,"marks":15537,"value":15538,"nodeType":865},{},[]," — a type of malware designed to collect user credentials, including session cookies, from end-user devices — had a very successful 2024, accounting for nearly 10 percent of activity that Red Canary was able to associate with named threats, and the majority of all detected malware that Sophos threat researchers documented last year.",{"data":15540,"content":15541,"nodeType":866},{},[15542,15546,15555],{"data":15543,"marks":15544,"value":15545,"nodeType":865},{},[],"While the use of stolen credentials is rampant, often facilitated by successful infostealer campaigns, a related attack type also ",{"data":15547,"content":15549,"nodeType":1102},{"uri":15548},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/#id-the-state-of-infostealers-today",[15550],{"data":15551,"marks":15552,"value":15554,"nodeType":865},{},[15553],{"type":4537},"jumped in prevalence",{"data":15556,"marks":15557,"value":15558,"nodeType":865},{},[]," last year: session token theft attacks.",{"data":15560,"content":15561,"nodeType":866},{},[15562],{"data":15563,"marks":15564,"value":15565,"nodeType":865},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session. ",{"data":15567,"content":15568,"nodeType":1218},{},[15569],{"data":15570,"marks":15571,"value":15089,"nodeType":865},{},[15572],{"type":946},{"data":15574,"content":15575,"nodeType":866},{},[15576],{"data":15577,"marks":15578,"value":15579,"nodeType":865},{},[],"In order to detect a stolen session in use, you need telemetry that allows you to tie activity to a trusted endpoint. This didn’t previously exist, and you have to be in the browser to do it. So that’s what we built. ",{"data":15581,"content":15582,"nodeType":866},{},[15583,15587,15597],{"data":15584,"marks":15585,"value":15586,"nodeType":865},{},[],"Push’s ",{"data":15588,"content":15590,"nodeType":1102},{"uri":15589},"https://pushsecurity.com/blog/introducing-session-token-theft-detection-why-browser-is-best/",[15591],{"data":15592,"marks":15593,"value":15596,"nodeType":865},{},[15594,15595],{"type":4537},{"type":946},"session theft detection",{"data":15598,"marks":15599,"value":15600,"nodeType":865},{},[]," capability uses the power of the Push browser extension to inject a unique marker into the user-agent string of sessions that occur in browsers enrolled in Push. ",{"data":15602,"content":15603,"nodeType":866},{},[15604],{"data":15605,"marks":15606,"value":15607,"nodeType":865},{},[],"By analyzing logs from your IdP in your SIEM, you can then identify activity from the same session that both has and that lacks the Push marker, indicating that a session has been extracted from the browser and maliciously imported into a different browser that is not enrolled in Push.",{"data":15609,"content":15610,"nodeType":866},{},[15611],{"data":15612,"marks":15613,"value":15614,"nodeType":865},{},[],"This is a reliable signal that a stolen session token is being used and an endpoint has been compromised.",{"data":15616,"content":15620,"nodeType":907},{"target":15617},{"sys":15618},{"id":15619,"type":904,"linkType":905},"1XNNkaoW64t3PPvC54KGXF",[],{"data":15622,"content":15626,"nodeType":907},{"target":15623},{"sys":15624},{"id":15625,"type":904,"linkType":905},"6dOEnPzZXd9DqeSdalqlzO",[],{"data":15628,"content":15629,"nodeType":938},{},[],{"data":15631,"content":15632,"nodeType":948},{},[15633],{"data":15634,"marks":15635,"value":15636,"nodeType":865},{},[],"Detecting compromised credentials",{"data":15638,"content":15639,"nodeType":1218},{},[15640],{"data":15641,"marks":15642,"value":15018,"nodeType":865},{},[15643],{"type":946},{"data":15645,"content":15646,"nodeType":866},{},[15647],{"data":15648,"marks":15649,"value":15650,"nodeType":865},{},[],"Alongside stolen session cookies, stolen credentials made a lot of headlines last year. The 2024 Verizon DBIR found that 79% of web application compromises were the result of breached creds, and researchers at IBM found a 71% year-over-year increase in cyberattacks using stolen or compromised credentials.",{"data":15652,"content":15653,"nodeType":866},{},[15654,15658,15667],{"data":15655,"marks":15656,"value":15657,"nodeType":865},{},[],"In Push’s own research, we counted ",{"data":15659,"content":15661,"nodeType":1102},{"uri":15660},"https://pushsecurity.com/blog/2024-identity-breaches/",[15662],{"data":15663,"marks":15664,"value":15666,"nodeType":865},{},[15665],{"type":4537},"30 public identity-related breaches",{"data":15668,"marks":15669,"value":15670,"nodeType":865},{},[]," in 2024 where the breach and the breach vector were disclosed. Of those, nearly three-quarters were the result of compromised credentials, including notable breaches such as Microsoft, Change Healthcare, and the attacks on Snowflake customers.",{"data":15672,"content":15673,"nodeType":15681},{},[15674],{"data":15675,"content":15676,"nodeType":866},{},[15677],{"data":15678,"marks":15679,"value":15680,"nodeType":865},{},[],"73% of public identity-related breaches in 2024 were the result of compromised credentials (the rest were phishing attacks). ","blockquote",{"data":15683,"content":15684,"nodeType":866},{},[15685,15689,15697],{"data":15686,"marks":15687,"value":15688,"nodeType":865},{},[],"The influx of compromised credentials has been amplified by the ",{"data":15690,"content":15691,"nodeType":1102},{"uri":15528},[15692],{"data":15693,"marks":15694,"value":15696,"nodeType":865},{},[15695],{"type":4537},"rise of infostealers",{"data":15698,"marks":15699,"value":15700,"nodeType":865},{},[],", which contribute the vast majority of valid stolen credentials, alongside mass credential phishing campaigns and third-party data breach dumps. ",{"data":15702,"content":15703,"nodeType":866},{},[15704],{"data":15705,"marks":15706,"value":15707,"nodeType":865},{},[],"And while there’s no shortage of threat intelligence about stolen credentials for sale on the web, security teams struggle to separate the needle from the haystack because a large portion of TI on stolen creds is out of date.",{"data":15709,"content":15710,"nodeType":866},{},[15711],{"data":15712,"marks":15713,"value":15714,"nodeType":865},{},[],"In evaluating TI data here at Push, we reviewed 5,763 username and password combos that matched domains in use by Push customers. We found that less than 1% of the creds in a multi-vendor dataset were true positives. In other words, 99.5% of the stolen creds we checked were false positives at the time of review — illustrating the challenge security teams face when trying to extract actionable intelligence from this kind of data. ",{"data":15716,"content":15717,"nodeType":15681},{},[15718],{"data":15719,"content":15720,"nodeType":866},{},[15721],{"data":15722,"marks":15723,"value":15724,"nodeType":865},{},[],"99.5% of the findings in compromised credential feeds were found to be false positives.",{"data":15726,"content":15727,"nodeType":1218},{},[15728],{"data":15729,"marks":15730,"value":15089,"nodeType":865},{},[15731],{"type":946},{"data":15733,"content":15734,"nodeType":866},{},[15735],{"data":15736,"marks":15737,"value":15738,"nodeType":865},{},[],"Using its browser agent, Push assesses the strength of end-user passwords by creating and analyzing a truncated, salted SHA256 hash of the password for a given account. (These k-anonymized fingerprints are never seen by Push’s back-end and exist only in local browser extension storage.) ",{"data":15740,"content":15741,"nodeType":866},{},[15742,15746,15756],{"data":15743,"marks":15744,"value":15745,"nodeType":865},{},[],"These fingerprints give Push a directly observable source of truth for corporate creds, which allowed us to build a ",{"data":15747,"content":15749,"nodeType":1102},{"uri":15748},"https://pushsecurity.com/blog/verified-stolen-credential-detection/",[15750],{"data":15751,"marks":15752,"value":15755,"nodeType":865},{},[15753,15754],{"type":4537},{"type":946},"verified stolen credential detection",{"data":15757,"marks":15758,"value":15759,"nodeType":865},{},[]," capability last year that removes all false positives from TI sources to pinpoint only those stolen creds still actively in use by employees.",{"data":15761,"content":15765,"nodeType":907},{"target":15762},{"sys":15763},{"id":15764,"type":904,"linkType":905},"3BITHZvDadjHpOAqIn0g4w",[],{"data":15767,"content":15768,"nodeType":938},{},[],{"data":15770,"content":15771,"nodeType":948},{},[15772],{"data":15773,"marks":15774,"value":15775,"nodeType":865},{},[],"Reducing and securing shadow IT and account sprawl",{"data":15777,"content":15778,"nodeType":866},{},[15779],{"data":15780,"marks":15781,"value":15782,"nodeType":865},{},[],"You can think of this last part of the story as the ground from which the attack trends we’ve been talking about emerged: The shift to doing business almost entirely in the browser, and the resulting sprawl in accounts and unmanaged apps, leading to an explosion of internet-facing identities for threat actors to target.",{"data":15784,"content":15785,"nodeType":866},{},[15786],{"data":15787,"marks":15788,"value":15789,"nodeType":865},{},[],"Even in organizations with mature security practices, the challenge of getting 100% compliance with identity posture best practices is evident. Last year, Push researchers analyzed a data set of 300,000 accounts from our customer base and found that:",{"data":15791,"content":15792,"nodeType":891},{},[15793,15812,15831],{"data":15794,"content":15795,"nodeType":880},{},[15796],{"data":15797,"content":15798,"nodeType":866},{},[15799,15803,15808],{"data":15800,"marks":15801,"value":15802,"nodeType":865},{},[],"Organizations have ",{"data":15804,"marks":15805,"value":15807,"nodeType":865},{},[15806],{"type":946},"more apps and identities than they thought",{"data":15809,"marks":15810,"value":15811,"nodeType":865},{},[]," — an average of ~15 identities per employee and ~220 apps per organization.",{"data":15813,"content":15814,"nodeType":880},{},[15815],{"data":15816,"content":15817,"nodeType":866},{},[15818,15822,15827],{"data":15819,"marks":15820,"value":15821,"nodeType":865},{},[],"Many accounts ",{"data":15823,"marks":15824,"value":15826,"nodeType":865},{},[15825],{"type":946},"lack basic security protections",{"data":15828,"marks":15829,"value":15830,"nodeType":865},{},[],", with 37% of accounts lacking any form of MFA and ~9% of accounts using a password that is leaked, weak, or reused, making them especially susceptible to account takeover. On accounts where password is the only login method in use (e.g. not using SSO or any other federated login like OIDC), there was no MFA in use in 4 out of 5 cases.",{"data":15832,"content":15833,"nodeType":880},{},[15834],{"data":15835,"content":15836,"nodeType":866},{},[15837,15841,15846,15850,15858],{"data":15838,"marks":15839,"value":15840,"nodeType":865},{},[],"Security ",{"data":15842,"marks":15843,"value":15845,"nodeType":865},{},[15844],{"type":946},"gaps persist even with SSO",{"data":15847,"marks":15848,"value":15849,"nodeType":865},{},[]," accounts — with 10% of SSO-using accounts also having a local password, a risk for ",{"data":15851,"content":15853,"nodeType":1102},{"uri":15852},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/",[15854],{"data":15855,"marks":15856,"value":5383,"nodeType":865},{},[15857],{"type":4537},{"data":15859,"marks":15860,"value":15861,"nodeType":865},{},[],"; and 1 in 5 IdP accounts themselves missing MFA.",{"data":15863,"content":15864,"nodeType":866},{},[15865],{"data":15866,"marks":15867,"value":15868,"nodeType":865},{},[],"From our perspective, organizations need scalable controls, and they need easy-to-deploy tools that get them visibility of all their workforce identities, apps, and accounts alongside telemetry that makes the information actionable.",{"data":15870,"content":15871,"nodeType":866},{},[15872],{"data":15873,"marks":15874,"value":15875,"nodeType":865},{},[],"Push already provides a real-time inventory of all your accounts and apps, including internal corporate apps, and analyzes the security posture, login methods, and MFA status of those accounts to offer a comprehensive picture of your identity attack surface. ",{"data":15877,"content":15878,"nodeType":866},{},[15879],{"data":15880,"marks":15881,"value":15882,"nodeType":865},{},[],"To help customers enforce their security policies even more seamlessly, here’s what we built last year:",{"data":15884,"content":15885,"nodeType":1218},{},[15886],{"data":15887,"marks":15888,"value":15890,"nodeType":865},{},[15889],{"type":946},"1. App banners",{"data":15892,"content":15893,"nodeType":866},{},[15894,15898,15908],{"data":15895,"marks":15896,"value":15897,"nodeType":865},{},[],"With a range of modes from informing to blocking, ",{"data":15899,"content":15901,"nodeType":1102},{"uri":15900},"https://pushsecurity.com/help/10106#start",[15902],{"data":15903,"marks":15904,"value":15907,"nodeType":865},{},[15905,15906],{"type":4537},{"type":946},"app banners",{"data":15909,"marks":15910,"value":15911,"nodeType":865},{},[]," allow security teams to communicate best practices and policies with end-users directly in their browser. It works by displaying a banner with your custom message on the login and signup pages for workplace apps. ",{"data":15913,"content":15914,"nodeType":866},{},[15915],{"data":15916,"marks":15917,"value":15918,"nodeType":865},{},[],"Using configuration rules, you can set conditions for how banner controls get applied. Common use cases include: Restricting use of GenAI software; carving out an exception for admins on a specific app; reminding users to log in with SSO instead of a password, and others. ",{"data":15920,"content":15924,"nodeType":907},{"target":15921},{"sys":15922},{"id":15923,"type":904,"linkType":905},"4RPHmeMLyZmb5V8rXYLtey",[],{"data":15926,"content":15927,"nodeType":1218},{},[15928,15933],{"data":15929,"marks":15930,"value":15932,"nodeType":865},{},[15931],{"type":946},"2. Password manager identification",{"data":15934,"marks":15935,"value":6192,"nodeType":865},{},[],{"data":15937,"content":15938,"nodeType":866},{},[15939,15943,15953],{"data":15940,"marks":15941,"value":15942,"nodeType":865},{},[],"We also expanded Push’s capability to observe employees’ account security posture by adding an identification of ",{"data":15944,"content":15946,"nodeType":1102},{"uri":15945},"https://pushsecurity.com/blog/stop-users-saving-corp-creds-into-personal-password-managers/",[15947],{"data":15948,"marks":15949,"value":15952,"nodeType":865},{},[15950,15951],{"type":4537},{"type":946},"which password manager",{"data":15954,"marks":15955,"value":15956,"nodeType":865},{},[]," (if any) they’re using. ",{"data":15958,"content":15959,"nodeType":866},{},[15960],{"data":15961,"marks":15962,"value":15963,"nodeType":865},{},[],"We’ve heard from many security teams that they’re concerned about corporate credentials being stored in unapproved password managers — not to mention the ROI from ensuring employees are all using the corporate password manager you already pay for. This feature helps them achieve both objectives.",{"data":15965,"content":15966,"nodeType":1218},{},[15967],{"data":15968,"marks":15969,"value":15971,"nodeType":865},{},[15970],{"type":946},"3. MFA enforcement",{"data":15973,"content":15974,"nodeType":866},{},[15975,15979,15988],{"data":15976,"marks":15977,"value":15978,"nodeType":865},{},[],"Finally, we rounded out 2024 with a new security control called ",{"data":15980,"content":15982,"nodeType":1102},{"uri":15981},"https://pushsecurity.com/blog/enforce-mfa-on-third-party-apps/",[15983],{"data":15984,"marks":15985,"value":1909,"nodeType":865},{},[15986,15987],{"type":4537},{"type":946},{"data":15989,"marks":15990,"value":15991,"nodeType":865},{},[]," that builds on the popular app banners concept by detecting when users lack MFA and then prompting them to register for MFA. ",{"data":15993,"content":15994,"nodeType":866},{},[15995],{"data":15996,"marks":15997,"value":15998,"nodeType":865},{},[],"Admins choose which apps they wish to enforce MFA on, and the Push extension does the rest. ",{"data":16000,"content":16001,"nodeType":866},{},[16002],{"data":16003,"marks":16004,"value":16005,"nodeType":865},{},[],"Security teams we work with are especially eager to use this feature to close MFA coverage gaps on non-SSO and otherwise unmanaged applications.",{"data":16007,"content":16011,"nodeType":907},{"target":16008},{"sys":16009},{"id":16010,"type":904,"linkType":905},"4imhff7SWJi2Gan5iFEs2P",[],{"data":16013,"content":16014,"nodeType":938},{},[],{"data":16016,"content":16017,"nodeType":948},{},[16018],{"data":16019,"marks":16020,"value":16021,"nodeType":865},{},[],"Want to see more?",{"data":16023,"content":16024,"nodeType":866},{},[16025,16029,16036],{"data":16026,"marks":16027,"value":16028,"nodeType":865},{},[],"There’s a lot we didn’t touch on here that Push can help you achieve. If you’d like to learn more, ",{"data":16030,"content":16031,"nodeType":1102},{"uri":10028},[16032],{"data":16033,"marks":16034,"value":16035,"nodeType":865},{},[],"set up a demo with our team",{"data":16037,"marks":16038,"value":16039,"nodeType":865},{},[]," or sign up yourself to have a look at the platform.","How real-world attacks and research drove Push’s most popular features of 2024","How in-the-wild attacks and our own R&D inspired what we built in 2024 to stop account takeover and reduce security risks across your workforce identities. ","2025-01-16T00:00:00.000Z","push-features-2024",{"items":16045},[16046,16048],{"sys":16047,"name":342},{"id":2527},{"sys":16049,"name":297},{"id":11129},{"items":16051},[16052],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":16053},{"url":853},{"__typename":2239,"sys":16055,"content":16056,"title":13322,"synopsis":16675,"hashTags":59,"publishedDate":16676,"slug":13323,"tagsCollection":16677,"authorsCollection":16681},{"id":12935},{"json":16057},{"data":16058,"content":16059,"nodeType":2232},{},[16060,16067,16074,16081,16100,16107,16114,16117,16125,16132,16139,16146,16152,16159,16162,16170,16177,16184,16191,16198,16204,16211,16214,16222,16230,16237,16244,16251,16271,16279,16286,16293,16300,16307,16315,16322,16329,16335,16338,16346,16353,16360,16367,16374,16381,16384,16392,16399,16406,16413,16420,16427,16536,16552,16559,16565,16568,16576,16583,16650,16657],{"data":16061,"content":16062,"nodeType":866},{},[16063],{"data":16064,"marks":16065,"value":16066,"nodeType":865},{},[],"2024 was an unprecedented year in terms of the impact of identity-based attacks. Or that’s what it felt like anyway, so I decided to trawl through a year of news to see if reality stacked up. ",{"data":16068,"content":16069,"nodeType":866},{},[16070],{"data":16071,"marks":16072,"value":16073,"nodeType":865},{},[],"My main obstacles here were the ever-disappointing levels of public information disclosure for cyber breaches. Even where breaches are disclosed, it’s rare that any public information contains the nature of the initial access vector (though I can’t say I’m surprised — it’s hard to argue the ‘highly sophisticated’ nature of a breach that involved stolen credentials and no MFA). ",{"data":16075,"content":16076,"nodeType":866},{},[16077],{"data":16078,"marks":16079,"value":16080,"nodeType":865},{},[],"Publicly disclosed breaches are just the tip of the iceberg, and with the rise in data theft and extortion over more disruptive attacks (e.g. ransomware), there is often no obvious service interruption indicating that an incident has taken place. This makes it more likely that these situations can be settled quietly or smoothed over, without hitting the headlines. ",{"data":16082,"content":16083,"nodeType":866},{},[16084,16088,16097],{"data":16085,"marks":16086,"value":16087,"nodeType":865},{},[],"That said, the requirement that US companies submit a Form-8K for breaches of a material nature does appear to have increased the number of voluntary declarations (inside the US, at least) and the growing willingness of the SEC to prosecute negligent or misleading behavior is also a considerable motivator, such as ",{"data":16089,"content":16091,"nodeType":1102},{"uri":16090},"https://www.bleepingcomputer.com/news/security/sec-charges-tech-companies-for-downplaying-solarwinds-breaches/",[16092],{"data":16093,"marks":16094,"value":16096,"nodeType":865},{},[16095],{"type":4537},"the recent prosecution of companies for misleading investors about the impact of the 2020 SolarWinds Orion hack",{"data":16098,"marks":16099,"value":1151,"nodeType":865},{},[],{"data":16101,"content":16102,"nodeType":866},{},[16103],{"data":16104,"marks":16105,"value":16106,"nodeType":865},{},[],"Despite all this, I totalled 30 breaches that were the result of an identity-based initial access vector, such as phishing, credential stuffing, social engineering, session hijacking, etc. To make the list, it had to have appeared in the public domain, confirmed by the victim or an authoritative source, and the breach vector had to have been named. ",{"data":16108,"content":16109,"nodeType":866},{},[16110],{"data":16111,"marks":16112,"value":16113,"nodeType":865},{},[],"Public identity-related breaches in 2024 resulted in hundreds of millions of breached customer records (with the final impact of many still yet to appear in the public domain).",{"data":16115,"content":16116,"nodeType":938},{},[],{"data":16118,"content":16119,"nodeType":948},{},[16120],{"data":16121,"marks":16122,"value":16124,"nodeType":865},{},[16123],{"type":946},"What is an identity attack?",{"data":16126,"content":16127,"nodeType":866},{},[16128],{"data":16129,"marks":16130,"value":16131,"nodeType":865},{},[],"First, what do we mean by identity attack? ",{"data":16133,"content":16134,"nodeType":866},{},[16135],{"data":16136,"marks":16137,"value":16138,"nodeType":865},{},[],"An identity attack is any attack (regardless of the steps that follow) involving identity-based techniques, such as phishing, credential stuffing, and session hijacking, to log into an account/service. Basically, where identity is the initial breach vector.",{"data":16140,"content":16141,"nodeType":866},{},[16142],{"data":16143,"marks":16144,"value":16145,"nodeType":865},{},[],"The length and complexity of the overall attack chain will vary. For example, a SaaS-based account takeover where the attacker logs in and dumps the data from the app is naturally going to be more direct than a scenario in which an identity-based compromise leads to the takeover of an endpoint or device in a traditional networking environment. ",{"data":16147,"content":16151,"nodeType":907},{"target":16148},{"sys":16149},{"id":16150,"type":904,"linkType":905},"SCbhb6dzXnaKUianhgLEL",[],{"data":16153,"content":16154,"nodeType":866},{},[16155],{"data":16156,"marks":16157,"value":16158,"nodeType":865},{},[],"In 2024, we’ve seen examples of both SaaS-based account takeover as well as identity attacks being used for initial access to more traditional networks, often resulting in ransomware deployment.",{"data":16160,"content":16161,"nodeType":938},{},[],{"data":16163,"content":16164,"nodeType":948},{},[16165],{"data":16166,"marks":16167,"value":16169,"nodeType":865},{},[16168],{"type":946},"Breakdown of public identity breaches in 2024",{"data":16171,"content":16172,"nodeType":866},{},[16173],{"data":16174,"marks":16175,"value":16176,"nodeType":865},{},[],"It’s always tricky to gauge the impact of a cyber breach, particularly when considering the limited information typically shared. Different types of breach are easier to assess than others — for example, any breach involving extortion/ransom payment has a clear cost associated. Regulator fines and penalties are also clear cut. But aside from these, you’re looking at the extent of any disruption/downtime, recovery costs, and the like. Long term, indirect impacts such as the loss of customer confidence are naturally tricky to estimate. ",{"data":16178,"content":16179,"nodeType":866},{},[16180],{"data":16181,"marks":16182,"value":16183,"nodeType":865},{},[],"However, many identity breaches don’t even have these metrics to go by. The general shift toward data theft only (as opposed to ransomware deployment) continued in 2024, and many of the public identity breaches reflect this. In these attacks, attackers steal data to extort a ransom payment, blackmail end-customers, and/or sell the data via underground criminal marketplaces. ",{"data":16185,"content":16186,"nodeType":866},{},[16187],{"data":16188,"marks":16189,"value":16190,"nodeType":865},{},[],"The one consistent metric we do have is the number of breached records, which is available in many (but not all) cases. Some organizations have attempted to calculate the financial impact per breached record. Most notably IBMs annual ‘Cost of a Data Breach’ report estimates the average data breach to cost $4.88m, and the cost per compromised record to be $169. But when applied to the sheer magnitude of 2024’s biggest attacks (in the region of hundreds of millions of breached records) the figures quickly reach unbelievable levels. ",{"data":16192,"content":16193,"nodeType":866},{},[16194],{"data":16195,"marks":16196,"value":16197,"nodeType":865},{},[],"All this is to say: It’s hard to pin down the relative impact of data breaches. But with the information available (profile of the victim organization, type of data impacted, number of customers impacted) it’s possible to provide a finger-in-the-air assessment — which is what I’ve attempted to do below. Here, we can see the overall month-by-month impact of public identity breaches, dated from when they were first reported (or using dates provided in said reports). ",{"data":16199,"content":16203,"nodeType":907},{"target":16200},{"sys":16201},{"id":16202,"type":904,"linkType":905},"2XYuNqLuKhZbISb4II9IW4",[],{"data":16205,"content":16206,"nodeType":866},{},[16207],{"data":16208,"marks":16209,"value":16210,"nodeType":865},{},[],"Let’s take a closer look at the most notable breaches (and why they were especially significant). ",{"data":16212,"content":16213,"nodeType":938},{},[],{"data":16215,"content":16216,"nodeType":948},{},[16217],{"data":16218,"marks":16219,"value":16221,"nodeType":865},{},[16220],{"type":946},"Top 3 public identity-related breaches in 2024",{"data":16223,"content":16224,"nodeType":1218},{},[16225],{"data":16226,"marks":16227,"value":16229,"nodeType":865},{},[16228],{"type":946},"#3: Microsoft — January 2024",{"data":16231,"content":16232,"nodeType":866},{},[16233],{"data":16234,"marks":16235,"value":16236,"nodeType":865},{},[],"The threat group known as APT29, associated with the Russian SVR intelligence service, utilized password spray attacks that successfully compromised a non-production tenant account that did not have multi-factor authentication (MFA) enabled. They then leveraged this account to compromise a ‘test’ OAuth application that had elevated access to the Microsoft corporate environment. This was then used to access the email accounts of Microsoft employees. ",{"data":16238,"content":16239,"nodeType":866},{},[16240],{"data":16241,"marks":16242,"value":16243,"nodeType":865},{},[],"The attacks then continued throughout the year using information stolen from Microsoft mailboxes, with password spraying attacks increasing tenfold since the initial attack, resulting in the further compromise of source code repositories. ",{"data":16245,"content":16246,"nodeType":866},{},[16247],{"data":16248,"marks":16249,"value":16250,"nodeType":865},{},[],"Microsoft has shared limited information about the breach, but despite this it caused a significant stir. We can expect the number of email accounts compromised to be significant, given that it was later suggested that at least 100 external organizations had been contacted by Microsoft regarding their communications being breached (we only know this because 100-ish organizations reported the email as spam). The list of companies impacted included both public and private sector organizations, from major enterprises to government agencies in the US and other countries. ",{"data":16252,"content":16253,"nodeType":866},{},[16254,16258,16267],{"data":16255,"marks":16256,"value":16257,"nodeType":865},{},[],"Microsoft’s challenges with credential management didn’t end here either, ",{"data":16259,"content":16261,"nodeType":1102},{"uri":16260},"https://pushsecurity.com/blog/learning-from-the-servicenow-disclosure/",[16262],{"data":16263,"marks":16264,"value":16266,"nodeType":865},{},[16265],{"type":4537},"with bug bounty hunters able to use stolen credentials from a TI platform to breach Microsoft’s ServiceNow tenant",{"data":16268,"marks":16269,"value":16270,"nodeType":865},{},[],", accessing 1,000s of support ticket descriptions and attachments, and 250k+ employee emails.",{"data":16272,"content":16273,"nodeType":1218},{},[16274],{"data":16275,"marks":16276,"value":16278,"nodeType":865},{},[16277],{"type":946},"#2: Change Healthcare — February 2024",{"data":16280,"content":16281,"nodeType":866},{},[16282],{"data":16283,"marks":16284,"value":16285,"nodeType":865},{},[],"In February, attackers stole 6TB of data from UnitedHealth subsidiary Change Healthcare as part of a severe ransomware attack that caused massive disruption to the US healthcare industry. This impacted a wide range of critical services used by healthcare providers across the U.S., including payment processing, prescription writing, and insurance claims, and caused financial damages estimated at $872 million. The attack impacted the personal medical data of over 100M customers. ",{"data":16287,"content":16288,"nodeType":866},{},[16289],{"data":16290,"marks":16291,"value":16292,"nodeType":865},{},[],"The attacker used stolen credentials to breach the company's Citrix remote access service, which did not have multi-factor authentication enabled, as the initial breach vector for the attack. ",{"data":16294,"content":16295,"nodeType":866},{},[16296],{"data":16297,"marks":16298,"value":16299,"nodeType":865},{},[],"Following the attack, the organization's IT team replaced thousands of laptops, rotated credentials, and completely rebuilt Change Healthcare's data center network and core services.",{"data":16301,"content":16302,"nodeType":866},{},[16303],{"data":16304,"marks":16305,"value":16306,"nodeType":865},{},[],"The UnitedHealth Group admitted to paying a ransom demand to receive a decryptor and for the threat actors to delete the stolen data. The ransom payment was allegedly $22 million, according to the BlackCat ransomware affiliate who conducted the attack.",{"data":16308,"content":16309,"nodeType":1218},{},[16310],{"data":16311,"marks":16312,"value":16314,"nodeType":865},{},[16313],{"type":946},"#1: Snowflake — April-June 2024",{"data":16316,"content":16317,"nodeType":866},{},[16318],{"data":16319,"marks":16320,"value":16321,"nodeType":865},{},[],"165 organizations around the world were targeted using stolen credentials gathered from infostealer infections dating back to 2020. The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers. It has been touted by some news outlets as ‘one of the biggest breaches ever’. ",{"data":16323,"content":16324,"nodeType":866},{},[16325],{"data":16326,"marks":16327,"value":16328,"nodeType":865},{},[],"In total, nine public victims were named following the breach, collectively impacting hundreds of millions of their respective customers. Data was put up for sale on criminal forums for fees ranging from $150k to $2m per organization, while AT&T was also confirmed as paying an undisclosed ransom fee. ",{"data":16330,"content":16334,"nodeType":907},{"target":16331},{"sys":16332},{"id":16333,"type":904,"linkType":905},"68txz4KkLmCX2hF9QySUZs",[],{"data":16336,"content":16337,"nodeType":938},{},[],{"data":16339,"content":16340,"nodeType":948},{},[16341],{"data":16342,"marks":16343,"value":16345,"nodeType":865},{},[16344],{"type":946},"Identity attacks vs. other attacks in 2024",{"data":16347,"content":16348,"nodeType":866},{},[16349],{"data":16350,"marks":16351,"value":16352,"nodeType":865},{},[],"In many ways, 2024 was a year of identity attacks. The attacks on Snowflake customers was unarguably one of (if not the most) significant cyber security event of the year (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. ",{"data":16354,"content":16355,"nodeType":866},{},[16356],{"data":16357,"marks":16358,"value":16359,"nodeType":865},{},[],"Arguably the biggest non-identity story of the year was the Chinese state-sponsored “Salt Typhoon” campaign against global telecommunications firms, with at least nine major providers compromised — including AT&T, Verizon, and T-Mobile. The group reportedly focused on infiltrating telecommunications infrastructure to steal text messages, phone call information, and voicemails from targeted people. The threat actors also targeted the wiretapping platforms used by the US government, raising serious national security concerns.",{"data":16361,"content":16362,"nodeType":866},{},[16363],{"data":16364,"marks":16365,"value":16366,"nodeType":865},{},[],"Undoubtedly this was one of the biggest intelligence compromises in US history and is of major significance. But it’s also arguable that identity attacks had a more widespread commercial impact in 2024 when we look at the big picture.   ",{"data":16368,"content":16369,"nodeType":866},{},[16370],{"data":16371,"marks":16372,"value":16373,"nodeType":865},{},[],"Attacks on edge networking devices were also incredibly prominent, as were very much interlinked with the targeting of telecommunications infrastructure. A barrage of 0-days generated a huge amount of concern about the software security practices of many vendors. ",{"data":16375,"content":16376,"nodeType":866},{},[16377],{"data":16378,"marks":16379,"value":16380,"nodeType":865},{},[],"But despite these honorable mentions, the runaway threat of the year was an identity-based one… ",{"data":16382,"content":16383,"nodeType":938},{},[],{"data":16385,"content":16386,"nodeType":948},{},[16387],{"data":16388,"marks":16389,"value":16391,"nodeType":865},{},[16390],{"type":946},"Threat of the year: Infostealers",{"data":16393,"content":16394,"nodeType":866},{},[16395],{"data":16396,"marks":16397,"value":16398,"nodeType":865},{},[],"2024 saw an unprecedented rise in the role of infostealers. The played a huge role in the attacks on Snowflake customers, where 80% of the accounts were targeted using credentials found in infostealer infections. ",{"data":16400,"content":16401,"nodeType":866},{},[16402],{"data":16403,"marks":16404,"value":16405,"nodeType":865},{},[],"News relating to new infostealer variants and distributions campaigns came thick and fast in 2024, as attackers sought to harvest credentials from victims to use as part of their own malicious campaigns, or to sell on to other criminals on underground marketplaces for compromised credentials. Attackers leaned into alternative distribution channels, branching away from email-based campaigns to target victims via gaming forums, Facebook ads, and YouTube video descriptions. GitHub was also continuously targeted as a malware distribution mechanism throughout the year — and the majority of the time it was to push infostealers. ",{"data":16407,"content":16408,"nodeType":866},{},[16409],{"data":16410,"marks":16411,"value":16412,"nodeType":865},{},[],"Infostealers are the weapon of choice for attackers looking to harvest credentials at scale. Compared to credential harvesting phishing campaigns, infostealers target a much broader range of credentials, taking everything saved in the victim’s browser (and often also from local apps, including password managers).",{"data":16414,"content":16415,"nodeType":866},{},[16416],{"data":16417,"marks":16418,"value":16419,"nodeType":865},{},[],"Infostealers are nothing new, but have historically been seen as a problem affecting less secure personal devices and accounts. But 2024 has demonstrated that infostealers are finding ways to harvest business data — by finding ways around controls like EDR, and because of the ways that personal and business identities and accounts are converging in the modern workplace. For example, it’s not uncommon for employees to log into their personal Google account on their work device (and vice versa), inadvertently saving corporate credentials to their personal password store — which is later compromised through an infostealer infection on a personal device. ",{"data":16421,"content":16422,"nodeType":866},{},[16423],{"data":16424,"marks":16425,"value":16426,"nodeType":865},{},[],"The impact of infostealers (and the resulting stolen credentials and session cookies) is underlined by various figures:",{"data":16428,"content":16429,"nodeType":891},{},[16430,16450,16472,16494,16514],{"data":16431,"content":16432,"nodeType":880},{},[16433],{"data":16434,"content":16435,"nodeType":866},{},[16436,16440,16447],{"data":16437,"marks":16438,"value":16439,"nodeType":865},{},[],"79% of web application compromises were the result of breached credentials (",{"data":16441,"content":16442,"nodeType":1102},{"uri":15408},[16443],{"data":16444,"marks":16445,"value":5844,"nodeType":865},{},[16446],{"type":4537},{"data":16448,"marks":16449,"value":6459,"nodeType":865},{},[],{"data":16451,"content":16452,"nodeType":880},{},[16453],{"data":16454,"content":16455,"nodeType":866},{},[16456,16460,16469],{"data":16457,"marks":16458,"value":16459,"nodeType":865},{},[],"Infostealer activity increased by 266% in 2023, while the number of attacks featuring valid credentials saw a 71% increase year-over-year (",{"data":16461,"content":16463,"nodeType":1102},{"uri":16462},"https://www.ibm.com/downloads/cas/L0GKXDWJ",[16464],{"data":16465,"marks":16466,"value":16468,"nodeType":865},{},[16467],{"type":4537},"IBM",{"data":16470,"marks":16471,"value":6459,"nodeType":865},{},[],{"data":16473,"content":16474,"nodeType":880},{},[16475],{"data":16476,"content":16477,"nodeType":866},{},[16478,16482,16491],{"data":16479,"marks":16480,"value":16481,"nodeType":865},{},[],"Nearly half of the malware detected last year targeted victims’ data specifically, and the majority of that malware was classified as infostealers (",{"data":16483,"content":16485,"nodeType":1102},{"uri":16484},"https://news.sophos.com/en-us/2024/03/12/2024-sophos-threat-report/",[16486],{"data":16487,"marks":16488,"value":16490,"nodeType":865},{},[16489],{"type":4537},"Sophos",{"data":16492,"marks":16493,"value":6459,"nodeType":865},{},[],{"data":16495,"content":16496,"nodeType":880},{},[16497],{"data":16498,"content":16499,"nodeType":866},{},[16500,16504,16511],{"data":16501,"marks":16502,"value":16503,"nodeType":865},{},[],"39,000 session token attacks are detected per day (",{"data":16505,"content":16506,"nodeType":1102},{"uri":15238},[16507],{"data":16508,"marks":16509,"value":5800,"nodeType":865},{},[16510],{"type":4537},{"data":16512,"marks":16513,"value":6459,"nodeType":865},{},[],{"data":16515,"content":16516,"nodeType":880},{},[16517],{"data":16518,"content":16519,"nodeType":866},{},[16520,16524,16533],{"data":16521,"marks":16522,"value":16523,"nodeType":865},{},[],"Attacks on session cookies happen at the same rough order of magnitude as password-based attacks (",{"data":16525,"content":16527,"nodeType":1102},{"uri":16526},"https://github.com/WICG/dbsc/issues/13#issuecomment-1977657864",[16528],{"data":16529,"marks":16530,"value":16532,"nodeType":865},{},[16531],{"type":4537},"Google",{"data":16534,"marks":16535,"value":6459,"nodeType":865},{},[],{"data":16537,"content":16538,"nodeType":866},{},[16539,16543,16548],{"data":16540,"marks":16541,"value":16542,"nodeType":865},{},[],"And of the confirmed identity-based breaches in the public domain that we identified, ",{"data":16544,"marks":16545,"value":16547,"nodeType":865},{},[16546],{"type":946},"a whopping 73% were the result of compromised credentials ",{"data":16549,"marks":16550,"value":16551,"nodeType":865},{},[],"(the rest were phishing attacks). ",{"data":16553,"content":16554,"nodeType":866},{},[16555],{"data":16556,"marks":16557,"value":16558,"nodeType":865},{},[],"As the primary source of compromised credentials, it’s fair to say that infostealers deserve the top spot for 2024.",{"data":16560,"content":16564,"nodeType":907},{"target":16561},{"sys":16562},{"id":16563,"type":904,"linkType":905},"7mMQEYQTXKAajIGFviDJKt",[],{"data":16566,"content":16567,"nodeType":938},{},[],{"data":16569,"content":16570,"nodeType":948},{},[16571],{"data":16572,"marks":16573,"value":16575,"nodeType":865},{},[16574],{"type":946},"Defend against infostealers with Push",{"data":16577,"content":16578,"nodeType":866},{},[16579],{"data":16580,"marks":16581,"value":16582,"nodeType":865},{},[],"As a browser-based identity security platform designed to stop identity attacks, Push helps organizations to defend against the rise in infostealers by:",{"data":16584,"content":16585,"nodeType":891},{},[16586,16619,16640],{"data":16587,"content":16588,"nodeType":880},{},[16589],{"data":16590,"content":16591,"nodeType":866},{},[16592,16595,16603,16607,16615],{"data":16593,"marks":16594,"value":21,"nodeType":865},{},[],{"data":16596,"content":16597,"nodeType":1102},{"uri":15748},[16598],{"data":16599,"marks":16600,"value":16602,"nodeType":865},{},[16601],{"type":4537},"Alerting you whenever the valid credentials your employees are using appear in a compromised credential data feed",{"data":16604,"marks":16605,"value":16606,"nodeType":865},{},[],", which can be leveraged to ",{"data":16608,"content":16609,"nodeType":1102},{"uri":15174},[16610],{"data":16611,"marks":16612,"value":16614,"nodeType":865},{},[16613],{"type":4537},"trigger automated password resets",{"data":16616,"marks":16617,"value":16618,"nodeType":865},{},[]," whenever an event fires and is received by your SIEM tool.",{"data":16620,"content":16621,"nodeType":880},{},[16622],{"data":16623,"content":16624,"nodeType":866},{},[16625,16628,16636],{"data":16626,"marks":16627,"value":21,"nodeType":865},{},[],{"data":16629,"content":16630,"nodeType":1102},{"uri":15589},[16631],{"data":16632,"marks":16633,"value":16635,"nodeType":865},{},[16634],{"type":4537},"Detecting session hijacking attacks using stolen cookies to identify when an attacker logs into an app",{"data":16637,"marks":16638,"value":16639,"nodeType":865},{},[]," from an unmanaged device without the Push browser extension — this can also be used to detect suspicious access in general!",{"data":16641,"content":16642,"nodeType":880},{},[16643],{"data":16644,"content":16645,"nodeType":866},{},[16646],{"data":16647,"marks":16648,"value":16649,"nodeType":865},{},[],"Enabling you to enforce MFA the next time an employee logs into an app (even when the app itself doesn’t allow you to enforce mandatory MFA) — particularly handy if a weak, breached, or reused password is detected for their account!  ",{"data":16651,"content":16652,"nodeType":866},{},[16653],{"data":16654,"marks":16655,"value":16656,"nodeType":865},{},[],"And much, much more. ",{"data":16658,"content":16659,"nodeType":866},{},[16660,16664,16672],{"data":16661,"marks":16662,"value":16663,"nodeType":865},{},[],"If you’d like to explore the platform yourself and discover more of our great features, you can ",{"data":16665,"content":16666,"nodeType":1102},{"uri":4935},[16667],{"data":16668,"marks":16669,"value":16671,"nodeType":865},{},[16670],{"type":4537},"request a demo",{"data":16673,"marks":16674,"value":1151,"nodeType":865},{},[],"Reviewing public breaches that stemmed from identity attacks in 2024. ","2025-01-10T00:00:00.000Z",{"items":16678},[16679],{"sys":16680,"name":2524},{"id":2523},{"items":16682},[16683],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":16684},{"url":6031},{"__typename":2239,"sys":16686,"content":16688,"title":17304,"synopsis":17305,"hashTags":59,"publishedDate":17306,"slug":17307,"tagsCollection":17308,"authorsCollection":17314},{"id":16687},"SiALa9w13C6q3OzeTeUum",{"json":16689},{"data":16690,"content":16691,"nodeType":2232},{},[16692,16699,16715,16722,16728,16735,16742,16745,16752,16759,16766,16790,16797,16813,16816,16823,16830,16853,16860,16867,16885,16891,16898,16917,16923,16930,16976,16984,16991,17003,17015,17022,17055,17062,17065,17072,17092,17099,17106,17113,17116,17123,17131,17138,17145,17208,17215,17222,17229,17262,17268,17275,17282,17288],{"data":16693,"content":16694,"nodeType":866},{},[16695],{"data":16696,"marks":16697,"value":16698,"nodeType":865},{},[],"Computer-Using Agents (CUAs) are a new type of AI agent that drives your browser/OS for you. With the research preview release of OpenAI Operator last week, it’s likely that we’ll be seeing a lot more of this technology in the future as OpenAI iterates and competitors launch their own versions. ",{"data":16700,"content":16701,"nodeType":866},{},[16702,16706,16711],{"data":16703,"marks":16704,"value":16705,"nodeType":865},{},[],"These models run on the same UI as the user sees, rather than using code or API based add-ons or tools (e.g. with access via API keys). In Operator’s case, the agent runs in its own browser, where it can navigate to and interact with webpages by typing, clicking, and scrolling. It effectively sees and interacts with pages as a human would, ",{"data":16707,"marks":16708,"value":16710,"nodeType":865},{},[16709],{"type":946},"using human (not machine) identities",{"data":16712,"marks":16713,"value":16714,"nodeType":865},{},[]," — taking actions on the web without requiring custom API integrations. ",{"data":16716,"content":16717,"nodeType":866},{},[16718],{"data":16719,"marks":16720,"value":16721,"nodeType":865},{},[],"This means that a user describes a task, and Operator performs it autonomously on their behalf. The examples provided by OpenAI are things like booking a dinner reservation or shopping for groceries — but naturally the potential use cases are much, much broader, especially in a work context.",{"data":16723,"content":16727,"nodeType":907},{"target":16724},{"sys":16725},{"id":16726,"type":904,"linkType":905},"5mWWi5mfqEcSQX12gOtyQm",[],{"data":16729,"content":16730,"nodeType":866},{},[16731],{"data":16732,"marks":16733,"value":16734,"nodeType":865},{},[],"Obviously the broad impact of this technology is almost impossible to predict this early in the game. But since we’re focussed on identity security at Push, we can at least describe some of the very predictable impacts in this area.",{"data":16736,"content":16737,"nodeType":866},{},[16738],{"data":16739,"marks":16740,"value":16741,"nodeType":865},{},[],"CUAs like Operator are essentially very flexible no-code automation platforms. This means that these tools (or future iterations of them) will enable low-cost, low-effort automation of common web tasks — the very tasks that app developers and vendors have worked hard to prevent from being automated — including those frequently performed by attackers.",{"data":16743,"content":16744,"nodeType":938},{},[],{"data":16746,"content":16747,"nodeType":948},{},[16748],{"data":16749,"marks":16750,"value":16751,"nodeType":865},{},[],"Why do CUAs stand to benefit attackers more than previous AI tools? ",{"data":16753,"content":16754,"nodeType":866},{},[16755],{"data":16756,"marks":16757,"value":16758,"nodeType":865},{},[],"Organizations have been concerned about the security and privacy implications of GenAI tools and platforms for a while now — mainly concerning the risk of inputting sensitive data into LLMs, and prompt injection attacks in which models can be tricked into disclosing internal data. ",{"data":16760,"content":16761,"nodeType":866},{},[16762],{"data":16763,"marks":16764,"value":16765,"nodeType":865},{},[],"But so far, the primary impact of GenAI on attacker capabilities specifically has been mainly limited to the use of LLMs for the creation of phishing emails and in AI-assisted malware development — no doubt significant, but not exactly transformative. And although the concept of an AI agent is nothing new, they haven’t been particularly common outside of research circles. ",{"data":16767,"content":16768,"nodeType":866},{},[16769,16773,16778,16781,16786],{"data":16770,"marks":16771,"value":16772,"nodeType":865},{},[],"CUAs, on the other hand, use LLMs trained using datasets which make them far more able to understand and interact with web pages. Coupled with what is essentially a production-grade integration between browser and LLM, and you have an agent that is able to understand and interact with websites to achieve an outcome, with minimal human input and oversight (as opposed to simply scraping the data) ",{"data":16774,"marks":16775,"value":16777,"nodeType":865},{},[16776],{"type":946},"with much the same behaviors and capabilities",{"data":16779,"marks":16780,"value":6192,"nodeType":865},{},[],{"data":16782,"marks":16783,"value":16785,"nodeType":865},{},[16784],{"type":946},"as a human operator.",{"data":16787,"marks":16788,"value":16789,"nodeType":865},{},[]," ",{"data":16791,"content":16792,"nodeType":866},{},[16793],{"data":16794,"marks":16795,"value":16796,"nodeType":865},{},[],"By performing actions autonomously on the user’s behalf, it has a lot in common with a low/no-code automation platform like Zapier or Make.com — except it doesn’t perform actions via API, but by performing actions in the browser as a user would. Unlike no/low-code automations, it doesn’t need a strict or rigid step-by-step description of tasks that should be automated and can dynamically generate steps like a human does. ",{"data":16798,"content":16799,"nodeType":866},{},[16800,16804,16809],{"data":16801,"marks":16802,"value":16803,"nodeType":865},{},[],"None of this can’t be done using other automation tools, but it’s the difference between writing code to automate a task by hand and asking a human assistant to do something for you — ",{"data":16805,"marks":16806,"value":16808,"nodeType":865},{},[16807],{"type":946},"the effort required is reduced by orders of magnitude.",{"data":16810,"marks":16811,"value":16812,"nodeType":865},{},[]," This makes it both more flexible and accessible to a much wider range of users. ",{"data":16814,"content":16815,"nodeType":938},{},[],{"data":16817,"content":16818,"nodeType":948},{},[16819],{"data":16820,"marks":16821,"value":16822,"nodeType":865},{},[],"How can CUAs be abused by attackers?",{"data":16824,"content":16825,"nodeType":866},{},[16826],{"data":16827,"marks":16828,"value":16829,"nodeType":865},{},[],"There are two main groups of attack to be aware of:",{"data":16831,"content":16832,"nodeType":891},{},[16833,16843],{"data":16834,"content":16835,"nodeType":880},{},[16836],{"data":16837,"content":16838,"nodeType":866},{},[16839],{"data":16840,"marks":16841,"value":16842,"nodeType":865},{},[],"Attacks enabled by the technology (CUA)",{"data":16844,"content":16845,"nodeType":880},{},[16846],{"data":16847,"content":16848,"nodeType":866},{},[16849],{"data":16850,"marks":16851,"value":16852,"nodeType":865},{},[],"Attacks against specific CUA tools/implementations (e.g. Operator)",{"data":16854,"content":16855,"nodeType":866},{},[16856],{"data":16857,"marks":16858,"value":16859,"nodeType":865},{},[],"Because the answer to the latter question is subjective depending on the CUA being targeted (and Operator is still in its “research preview” release) we’ll focus on how attackers can potentially use CUAs for malicious purposes in general. ",{"data":16861,"content":16862,"nodeType":1218},{},[16863],{"data":16864,"marks":16865,"value":16866,"nodeType":865},{},[],"How attackers can use their own CUAs to conduct AI-powered cyber attacks",{"data":16868,"content":16869,"nodeType":866},{},[16870,16874,16882],{"data":16871,"marks":16872,"value":16873,"nodeType":865},{},[],"The most obvious use-case for an attacker-controlled CUA is targeting internet-based app accounts. Most organizations are now using hundreds of apps, with thousands of sprawling identities (including both inside enterprise SSO connected accounts and local username & password logins) — ",{"data":16875,"content":16876,"nodeType":1102},{"uri":6406},[16877],{"data":16878,"marks":16879,"value":16881,"nodeType":865},{},[16880],{"type":4537},"many of which are highly vulnerable to even low-sophistication attack techniques",{"data":16883,"marks":16884,"value":7361,"nodeType":865},{},[],{"data":16886,"content":16890,"nodeType":907},{"target":16887},{"sys":16888},{"id":16889,"type":904,"linkType":905},"7itjimRwqpkrCF7YRI8FTq",[],{"data":16892,"content":16893,"nodeType":866},{},[16894],{"data":16895,"marks":16896,"value":16897,"nodeType":865},{},[],"Previously, identity attacks against modern SaaS environments and the sprawl of apps and accounts required a lot of manual work to scale. Because web identities are implemented in mostly bespoke ways across thousands of sites (and they are constantly changing) attacks on them are challenging to automate. Further, the act of logging in using automated methods has been impacted by widespread bot protection — specifically to prevent malicious automation. ",{"data":16899,"content":16900,"nodeType":866},{},[16901,16905,16913],{"data":16902,"marks":16903,"value":16904,"nodeType":865},{},[],"So, attackers end up sending phishing links through email, and targeting only a few high value apps for cred stuffing — despite the availability of credentials online (which, ",{"data":16906,"content":16907,"nodeType":1102},{"uri":4601},[16908],{"data":16909,"marks":16910,"value":16912,"nodeType":865},{},[16911],{"type":4537},"as the Snowflake attacks demonstrate",{"data":16914,"marks":16915,"value":16916,"nodeType":865},{},[],", can be an untapped treasure trove for attackers).",{"data":16918,"content":16922,"nodeType":907},{"target":16919},{"sys":16920},{"id":16921,"type":904,"linkType":905},"24HV5O6LJ12ZVECTSel2WL",[],{"data":16924,"content":16925,"nodeType":866},{},[16926],{"data":16927,"marks":16928,"value":16929,"nodeType":865},{},[],"We know that about 1 in 3 users re-use passwords, so there is a great chance a lot of those exact same credentials were actually valid for many other apps. It’s very tough to manually test each credential by logging into even a few dozen apps (or building a web automation to do so). But this is significantly easier if you can ask a CUA to: ",{"data":16931,"content":16932,"nodeType":891},{},[16933,16943,16953],{"data":16934,"content":16935,"nodeType":880},{},[16936],{"data":16937,"content":16938,"nodeType":866},{},[16939],{"data":16940,"marks":16941,"value":16942,"nodeType":865},{},[],"“Find a list of the top 1000 SaaS apps”. ",{"data":16944,"content":16945,"nodeType":880},{},[16946],{"data":16947,"content":16948,"nodeType":866},{},[16949],{"data":16950,"marks":16951,"value":16952,"nodeType":865},{},[],"“Try to login to the app using this username and password. Let me know which apps you successfully logged into”. ",{"data":16954,"content":16955,"nodeType":880},{},[16956],{"data":16957,"content":16958,"nodeType":866},{},[16959,16963,16972],{"data":16960,"marks":16961,"value":16962,"nodeType":865},{},[],"“Use ",{"data":16964,"content":16966,"nodeType":1102},{"uri":16965},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/takeout_services/description.md",[16967],{"data":16968,"marks":16969,"value":16971,"nodeType":865},{},[16970],{"type":4537},"takeout services",{"data":16973,"marks":16974,"value":16975,"nodeType":865},{},[]," to download data from each app and send it to this location, grouping by company name” (or even just ask the model to cut and paste or download the data from the account).",{"data":16977,"content":16978,"nodeType":866},{},[16979],{"data":16980,"marks":16981,"value":16983,"nodeType":865},{},[16982],{"type":946},"This is how you really scale these attacks.",{"data":16985,"content":16986,"nodeType":866},{},[16987],{"data":16988,"marks":16989,"value":16990,"nodeType":865},{},[],"CUA agents also change how and where phishing can take place. Where phishing takes place outside of email, it’s much less likely to be intercepted by enterprise anti-phishing controls. You could:",{"data":16992,"content":16993,"nodeType":866},{},[16994,16999],{"data":16995,"marks":16996,"value":16998,"nodeType":865},{},[16997],{"type":946},"1.",{"data":17000,"marks":17001,"value":17002,"nodeType":865},{},[]," Task an agent to create Reddit, Discord, and Slack accounts, login, and find the 100 (or 10000?) biggest subreddits/communities/channels. Now have it join those, and write posts that seem relevant to ongoing threads, or write targeted DMs and include links to a phishing page. If the account gets banned, no problem, automatically start over. Not enough karma? Instruct the agent to build karma.",{"data":17004,"content":17005,"nodeType":866},{},[17006,17011],{"data":17007,"marks":17008,"value":17010,"nodeType":865},{},[17009],{"type":946},"2.",{"data":17012,"marks":17013,"value":17014,"nodeType":865},{},[]," Or consider a more targeted scenario: connect to a specific target (or group of targets) via LinkedIn, read all your target’s posts and comments, and using that context start a conversation with them, using a topic you know that will interest them to create a phishing lure, and direct them to your phishing site. ",{"data":17016,"content":17017,"nodeType":1218},{},[17018],{"data":17019,"marks":17020,"value":17021,"nodeType":865},{},[],"Operator caveats",{"data":17023,"content":17024,"nodeType":866},{},[17025,17029,17038,17042,17051],{"data":17026,"marks":17027,"value":17028,"nodeType":865},{},[],"Now, it’s worth pointing out that Operator has controls that are designed to prevent this sort of abuse. ",{"data":17030,"content":17032,"nodeType":1102},{"uri":17031},"https://openai.com/index/introducing-operator/",[17033],{"data":17034,"marks":17035,"value":17037,"nodeType":865},{},[17036],{"type":4537},"For example",{"data":17039,"marks":17040,"value":17041,"nodeType":865},{},[],", Operator is trained to proactively ask the user to take over for tasks that require login, payment details, or when solving CAPTCHAs. The ",{"data":17043,"content":17045,"nodeType":1102},{"uri":17044},"https://openai.com/index/operator-system-card/",[17046],{"data":17047,"marks":17048,"value":17050,"nodeType":865},{},[17049],{"type":4537},"Operator System Card",{"data":17052,"marks":17053,"value":17054,"nodeType":865},{},[]," also cites proactive refusals of high-risk tasks, confirmation prompts before critical actions, and active monitoring systems to detect and mitigate potential threats.",{"data":17056,"content":17057,"nodeType":866},{},[17058],{"data":17059,"marks":17060,"value":17061,"nodeType":865},{},[],"It’s unclear at this point how resistant Operator will be to attack or abuse, but really, as we said earlier, this is not about Operator — once CUA tech becomes more widely available (if recent trends are anything to go by) there’s no doubt that models will emerge with fewer (or no) safety controls. ",{"data":17063,"content":17064,"nodeType":938},{},[],{"data":17066,"content":17067,"nodeType":948},{},[17068],{"data":17069,"marks":17070,"value":17071,"nodeType":865},{},[],"Why CUA-based automation is a problem for security teams",{"data":17073,"content":17074,"nodeType":866},{},[17075,17079,17088],{"data":17076,"marks":17077,"value":17078,"nodeType":865},{},[],"Attackers have been using automation tools forever, and in response, developers have been building protections against them (e.g. Cloudflare Turnstile and CAPTCHAs). Using LLMs to super power them isn’t even new, nor is using automation apps for malicious purposes (see our SaaS attack matrix entry for ",{"data":17080,"content":17082,"nodeType":1102},{"uri":17081},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/shadow_workflows/description.md",[17083],{"data":17084,"marks":17085,"value":17087,"nodeType":865},{},[17086],{"type":4537},"shadow workflows",{"data":17089,"marks":17090,"value":17091,"nodeType":865},{},[],") — so what’s the difference?",{"data":17093,"content":17094,"nodeType":866},{},[17095],{"data":17096,"marks":17097,"value":17098,"nodeType":865},{},[],"Previously, attackers needed to tie together automated browsers, get bot protection bypasses working, write code to extract screenshots from these browsers, pump those screenshots into a traditional LLM, generate response actions, and write code to execute those actions using browser automation. It was a lot of manual work — and needed constant maintenance — and wasn’t very effective because the general LLMs weren’t good at interpreting what they were seeing.",{"data":17100,"content":17101,"nodeType":866},{},[17102],{"data":17103,"marks":17104,"value":17105,"nodeType":865},{},[],"So, this isn’t so much a change in capability but a signal that there is going to be a massive increase in performance compared to other AI agents. Bundle the new model’s ability to understand with the ability to interact with webpages and you have something that might soon create real world impact at scale. ",{"data":17107,"content":17108,"nodeType":866},{},[17109],{"data":17110,"marks":17111,"value":17112,"nodeType":865},{},[],"Perhaps the only real obstacles are safety controls and cost. But as we’ve seen after previous GenAI launches, most recently with DeepSeek — competitors have been fast following with models that out-perform the original. Some of these models will be open and contain far fewer safety protections. An open CUA model in the future might be the trigger that enables attackers to leverage these capabilities at scale. ",{"data":17114,"content":17115,"nodeType":938},{},[],{"data":17117,"content":17118,"nodeType":948},{},[17119],{"data":17120,"marks":17121,"value":17122,"nodeType":865},{},[],"So what?",{"data":17124,"content":17125,"nodeType":866},{},[17126],{"data":17127,"marks":17128,"value":17130,"nodeType":865},{},[17129],{"type":946},"The TL;DR is that the adoption of CUAs has the potential to significantly lower the cost to attackers of running identity attacks such as phishing and credential stuffing, while increasing their reach.",{"data":17132,"content":17133,"nodeType":866},{},[17134],{"data":17135,"marks":17136,"value":17137,"nodeType":865},{},[],"We can expect improved account takeover attacks in the future as this technology becomes more widespread, with phishing attacks being increasingly delivered outside of traditional (well-protected) mediums like email, and credential stuffing being weaponized on an even more widespread scale, across a broader range of apps. These capabilities will also become more accessible, with even less advanced attackers able to harness them.",{"data":17139,"content":17140,"nodeType":866},{},[17141],{"data":17142,"marks":17143,"value":17144,"nodeType":865},{},[],"Right now, Operator runs in a sandboxed browser environment. But going forward, more value will require an increased ability to perform authenticated access as the user — so one could imagine a world where new features are built to expose passwords into this sandbox — or that these agents will be enabled outside these sandboxes and operate in your browser (primarily) or directly on your OS using agents. We’ve already seen these agents implemented as browser extensions. This makes sense as extensions can see the tab, and interact with the page — and some early extension-based agents have existed for a while:",{"data":17146,"content":17147,"nodeType":891},{},[17148,17168,17188],{"data":17149,"content":17150,"nodeType":880},{},[17151],{"data":17152,"content":17153,"nodeType":866},{},[17154,17157,17165],{"data":17155,"marks":17156,"value":21,"nodeType":865},{},[],{"data":17158,"content":17160,"nodeType":1102},{"uri":17159},"https://github.com/richardyc/Chrome-GPT",[17161],{"data":17162,"marks":17163,"value":17159,"nodeType":865},{},[17164],{"type":4537},{"data":17166,"marks":17167,"value":16789,"nodeType":865},{},[],{"data":17169,"content":17170,"nodeType":880},{},[17171],{"data":17172,"content":17173,"nodeType":866},{},[17174,17177,17185],{"data":17175,"marks":17176,"value":21,"nodeType":865},{},[],{"data":17178,"content":17180,"nodeType":1102},{"uri":17179},"https://github.com/handrew/browserpilot",[17181],{"data":17182,"marks":17183,"value":17179,"nodeType":865},{},[17184],{"type":4537},{"data":17186,"marks":17187,"value":21,"nodeType":865},{},[],{"data":17189,"content":17190,"nodeType":880},{},[17191],{"data":17192,"content":17193,"nodeType":866},{},[17194,17197,17205],{"data":17195,"marks":17196,"value":21,"nodeType":865},{},[],{"data":17198,"content":17200,"nodeType":1102},{"uri":17199},"https://github.com/TaxyAI/browser-extension",[17201],{"data":17202,"marks":17203,"value":17199,"nodeType":865},{},[17204],{"type":4537},{"data":17206,"marks":17207,"value":1151,"nodeType":865},{},[],{"data":17209,"content":17210,"nodeType":866},{},[17211],{"data":17212,"marks":17213,"value":17214,"nodeType":865},{},[],"If we have agents operating on user endpoints, not in sandboxes, that means they will have access to all identities that are already authenticated, or that can be automatically authenticated (password manager autofills etc.). There’s nothing fundamentally stopping you from prompt-injecting a victim's CUA and tricking it into creating a malicious integration, or sending you an API key.",{"data":17216,"content":17217,"nodeType":1218},{},[17218],{"data":17219,"marks":17220,"value":17221,"nodeType":865},{},[],"So to summarize...",{"data":17223,"content":17224,"nodeType":866},{},[17225],{"data":17226,"marks":17227,"value":17228,"nodeType":865},{},[],"Organizations should anticipate an increase in identity attacks targeting web-based apps and services using techniques that can be amplified by CUAs such as phishing and credential stuffing. We recommend that organizations:",{"data":17230,"content":17231,"nodeType":891},{},[17232,17242,17252],{"data":17233,"content":17234,"nodeType":880},{},[17235],{"data":17236,"content":17237,"nodeType":866},{},[17238],{"data":17239,"marks":17240,"value":17241,"nodeType":865},{},[],"Anticipate an increase in phishing attacks delivered outside of email, and evaluate your detection capabilities for mediums such as IM platforms and social media sites.",{"data":17243,"content":17244,"nodeType":880},{},[17245],{"data":17246,"content":17247,"nodeType":866},{},[17248],{"data":17249,"marks":17250,"value":17251,"nodeType":865},{},[],"Find and harden identities that could be vulnerable to attacks using techniques that can be automated (e.g. mass credential stuffing) such as those missing phishing resistant MFA (or MFA altogether).",{"data":17253,"content":17254,"nodeType":880},{},[17255],{"data":17256,"content":17257,"nodeType":866},{},[17258],{"data":17259,"marks":17260,"value":17261,"nodeType":865},{},[],"Ensure that all identities are suitably protected — even those outside the scope of traditional identity stores (such as Active Directory and modern equivalents e.g. Entra, Okta) used to access the much broader set of web-based services. ",{"data":17263,"content":17264,"nodeType":1218},{},[17265],{"data":17266,"marks":17267,"value":5966,"nodeType":865},{},[],{"data":17269,"content":17270,"nodeType":866},{},[17271],{"data":17272,"marks":17273,"value":17274,"nodeType":865},{},[],"AI-powered or not, identity attacks are what Push is designed to combat. Our features and controls designed to stop account takeover via phishing, credential stuffing, and session hijacking remain effective in this new world — in fact, as attackers are granted the ability to conduct these attacks with greater speed and scale, they become more valuable than ever. ",{"data":17276,"content":17277,"nodeType":866},{},[17278],{"data":17279,"marks":17280,"value":17281,"nodeType":865},{},[],"If you're interested in learning more, check out our on-demand webinar where we demonstrate the use of CUAs for automating identity attacks, particularly in the context of SaaS account takeover. ",{"data":17283,"content":17287,"nodeType":907},{"target":17284},{"sys":17285},{"id":17286,"type":904,"linkType":905},"UCmd5kqVZ03ce5Cs9M0r5",[],{"data":17289,"content":17290,"nodeType":866},{},[17291,17295,17301],{"data":17292,"marks":17293,"value":17294,"nodeType":865},{},[],"If you’d like to learn more about Push, ",{"data":17296,"content":17297,"nodeType":1102},{"uri":10028},[17298],{"data":17299,"marks":17300,"value":16035,"nodeType":865},{},[],{"data":17302,"marks":17303,"value":16039,"nodeType":865},{},[],"Considering the security implications of Computer-Using Agents (like OpenAI Operator)","CUAs are a new type of AI agent that drives your browser/OS for you, enabling effortless automation of web tasks — including those performed by attackers.","2025-01-28T00:00:00.000Z","considering-the-impact-of-computer-using-agents",{"items":17309},[17310,17312],{"sys":17311,"name":2524},{"id":2523},{"sys":17313,"name":297},{"id":11129},{"items":17315},[17316],{"fullName":17317,"firstName":17318,"jobTitle":17319,"profilePicture":17320},"Jacques Louw","Jacques","Co-founder / CRO",{"url":17321},"https://images.ctfassets.net/y1cdw1ablpvd/39m8bektV23lnCRcEq0G8h/2a08f6276a50744f1a4b499b273f6bb2/Push_Founders_at_Cahoots_October_28_2022_by_Doug_Coombe-21.jpg","minimum-viable-identity-security","blog/minimum-viable-identity-security","8 ways app developers can go beyond MVSP to mitigate identity-based attacks",{"json":17326},{"data":17327,"content":17328,"nodeType":2232},{},[17329],{"data":17330,"content":17331,"nodeType":866},{},[17332],{"data":17333,"marks":17334,"value":17335,"nodeType":865},{},[],"How app developers can go beyond the Minimum Viable Secure Product (MVSP) controls framework to implement better identity protections and prevent identity-based attacks. ","How app developers can go beyond Minimum Viable Secure Product (MVSP) to implement better identity protections and prevent identity-based attacks. ",{"id":17338,"publishedAt":17339},"1VGP8VIzwMh0zjNOzU5qaq","2026-08-13T09:35:15.589Z",{"items":17341},[17342,17344],{"sys":17343,"name":297},{"id":11129},{"sys":17345,"name":342},{"id":2527},{"items":17347},[17348,17350,17352,17354,17356,17358,17360,17362,17364,17366,17368,17370,17372,17374,17376],{"sys":17349,"name":413,"slug":414,"tier":31},{"id":410},{"sys":17351,"name":545,"slug":546,"tier":31},{"id":542},{"sys":17353,"name":297,"slug":298,"tier":31},{"id":294},{"sys":17355,"name":342,"slug":343,"tier":31},{"id":339},{"sys":17357,"name":502,"slug":503,"tier":45},{"id":499},{"sys":17359,"name":457,"slug":458,"tier":45},{"id":454},{"sys":17361,"name":395,"slug":396,"tier":45},{"id":392},{"sys":17363,"name":571,"slug":572,"tier":45},{"id":568},{"sys":17365,"name":333,"slug":334,"tier":45},{"id":330},{"sys":17367,"name":466,"slug":467,"tier":45},{"id":463},{"sys":17369,"name":493,"slug":494,"tier":45},{"id":490},{"sys":17371,"name":484,"slug":485,"tier":45},{"id":481},{"sys":17373,"name":404,"slug":405,"tier":45},{"id":401},{"sys":17375,"name":324,"slug":325,"tier":45},{"id":321},{"sys":17377,"name":598,"slug":599,"tier":45},{"id":595},"36eBiMftHHKz8mXIjsEN0ybWULXePeHjkaI21BYrWJE",{"id":17380,"title":17381,"authorsCollection":17382,"content":17390,"extension":228,"faqItemsCollection":17746,"faqTitle":59,"featured":6,"hashTags":59,"meta":17748,"metaTitle":17749,"ogImage":59,"postType":10139,"publishedDate":17750,"relatedBlogPostsCollection":17751,"slug":19655,"stem":19656,"subtitle":59,"summary":19657,"synopsis":19668,"sys":19669,"tagsCollection":19672,"topicsCollection":19678,"__hash__":19696},"blog/blog/automating-sso-password-resets-using-push.json","Automating SSO password resets using Push",{"items":17383},[17384],{"fullName":17385,"firstName":17386,"jobTitle":17387,"socialLinks":59,"profilePicture":17388},"Johann Scheepers","Johann","Senior Security Engineer",{"url":17389},"https://images.ctfassets.net/y1cdw1ablpvd/75IEOH93vR0hbvxuqTu1m3/f6222745ee6892ea07bc18727a5a5ae7/T016S22KZ96-U02LU3SKC2D-e1e755770536-512.png",{"json":17391,"links":17718},{"data":17392,"content":17393,"nodeType":2232},{},[17394,17401,17408,17427,17445,17468,17475,17491,17498,17505,17512,17515,17522,17542,17560,17566,17586,17593,17600,17606,17613,17619,17652,17659,17678,17681,17688,17699,17706,17712],{"data":17395,"content":17396,"nodeType":948},{},[17397],{"data":17398,"marks":17399,"value":17400,"nodeType":865},{},[],"Preventing credential attacks with automated password resets ",{"data":17402,"content":17403,"nodeType":866},{},[17404],{"data":17405,"marks":17406,"value":17407,"nodeType":865},{},[],"Preventing credential attacks is not an easy task, especially if you’re a member of the security team tasked with protecting some of your organization’s most valued assets: SSO identities.",{"data":17409,"content":17410,"nodeType":866},{},[17411,17415,17424],{"data":17412,"marks":17413,"value":17414,"nodeType":865},{},[],"IdP accounts such as a user’s Okta, Entra, or Google Workspace login are the most lucrative identities that an attacker can take over. By compromising an SSO identity, attackers not only gain access to the account itself, but also any downstream apps accessed via SSO – and the juicy data and functionality stored there. This was evidenced earlier this year when ",{"data":17416,"content":17418,"nodeType":1102},{"uri":17417},"https://www.bleepingcomputer.com/news/security/okta-warns-of-unprecedented-credential-stuffing-attacks-on-customers/",[17419],{"data":17420,"marks":17421,"value":17423,"nodeType":865},{},[17422],{"type":4537},"Okta users experienced unprecedented levels of credential stuffing attacks",{"data":17425,"marks":17426,"value":7361,"nodeType":865},{},[],{"data":17428,"content":17429,"nodeType":866},{},[17430,17434,17442],{"data":17431,"marks":17432,"value":17433,"nodeType":865},{},[],"You might also be surprised to learn that even these most critical accounts have serious security gaps. For example, ",{"data":17435,"content":17436,"nodeType":1102},{"uri":6406},[17437],{"data":17438,"marks":17439,"value":17441,"nodeType":865},{},[17440],{"type":4537},"in a recent study we identified that",{"data":17443,"marks":17444,"value":3467,"nodeType":865},{},[],{"data":17446,"content":17447,"nodeType":891},{},[17448,17458],{"data":17449,"content":17450,"nodeType":880},{},[17451],{"data":17452,"content":17453,"nodeType":866},{},[17454],{"data":17455,"marks":17456,"value":17457,"nodeType":865},{},[],"1 in 5 IdP accounts does not have an MFA method set, leaving them exposed to single-factor compromises using stolen credentials.",{"data":17459,"content":17460,"nodeType":880},{},[17461],{"data":17462,"content":17463,"nodeType":866},{},[17464],{"data":17465,"marks":17466,"value":17467,"nodeType":865},{},[],"10% of IdP accounts share a password that is used to access other identities. (We’re not talking about the actual SSO process here – many users will use the same password as they do to log into their Okta or Entra as they do personal accounts such as shopping or food delivery. Yes, really.)  ",{"data":17469,"content":17470,"nodeType":866},{},[17471],{"data":17472,"marks":17473,"value":17474,"nodeType":865},{},[],"It’s a constant worry that your CFO’s Microsoft, Google, or Okta credentials are going to show up in the next big darkweb password dump. Ideally you’d want to prevent users from reusing passwords across multiple services. That’s why your information security policy is mandating password manager use, right?",{"data":17476,"content":17477,"nodeType":866},{},[17478,17482,17487],{"data":17479,"marks":17480,"value":17481,"nodeType":865},{},[],"No matter how many policies you have in place, ",{"data":17483,"marks":17484,"value":17486,"nodeType":865},{},[17485],{"type":4537},"people will inevitably use the same passwords across multiple services",{"data":17488,"marks":17489,"value":17490,"nodeType":865},{},[],". But who can blame them? Having to remember multiple passwords is a drag, especially when they find they can’t log into their company’s password manager from their home computers… The next best thing is to just reuse your Entra or Okta password across all services, right?!",{"data":17492,"content":17493,"nodeType":866},{},[17494],{"data":17495,"marks":17496,"value":17497,"nodeType":865},{},[],"At Push we realize that mistakes happen. That's why it's important to look out for when critical credentials are entered into a dodgy ecommerce platform, or the next entry lands on haveibeenpwnd.com.",{"data":17499,"content":17500,"nodeType":866},{},[17501],{"data":17502,"marks":17503,"value":17504,"nodeType":865},{},[],"By quickly forcing a password change when an SSO password is reused or breached, we can minimize the chance of it being abused by attackers. ",{"data":17506,"content":17507,"nodeType":866},{},[17508],{"data":17509,"marks":17510,"value":17511,"nodeType":865},{},[],"But how will you know when a password is reused or compromised? ",{"data":17513,"content":17514,"nodeType":938},{},[],{"data":17516,"content":17517,"nodeType":948},{},[17518],{"data":17519,"marks":17520,"value":17521,"nodeType":865},{},[],"Using Push data to alert on password vulnerabilities ",{"data":17523,"content":17524,"nodeType":866},{},[17525,17529,17538],{"data":17526,"marks":17527,"value":17528,"nodeType":865},{},[],"Enter the Push browser extension. Push fingerprints passwords (",{"data":17530,"content":17532,"nodeType":1102},{"uri":17531},"https://pushsecurity.com/help/how-does-the-push-browser-extension-securely-track-reused-passwords",[17533],{"data":17534,"marks":17535,"value":17537,"nodeType":865},{},[17536],{"type":4537},"in a safe way",{"data":17539,"marks":17540,"value":17541,"nodeType":865},{},[],") as they are used by employees to access apps in their browsers. ",{"data":17543,"content":17544,"nodeType":866},{},[17545,17549,17557],{"data":17546,"marks":17547,"value":17548,"nodeType":865},{},[],"When a user logs into an app using credentials that they’ve previously used to login to another account, Push fires off an alert. ",{"data":17550,"content":17551,"nodeType":1102},{"uri":15748},[17552],{"data":17553,"marks":17554,"value":17556,"nodeType":865},{},[17555],{"type":4537},"We can also detect when an active password is stolen and appears on a criminal forum",{"data":17558,"marks":17559,"value":7361,"nodeType":865},{},[],{"data":17561,"content":17565,"nodeType":907},{"target":17562},{"sys":17563},{"id":17564,"type":904,"linkType":905},"5He3FB0NT3D3lcbwiVtn02",[],{"data":17567,"content":17568,"nodeType":866},{},[17569,17573,17582],{"data":17570,"marks":17571,"value":17572,"nodeType":865},{},[],"If you’ve ",{"data":17574,"content":17576,"nodeType":1102},{"uri":17575},"https://pushsecurity.com/help/audience/administrators/docs/connect-to-siem-or-soar/#start",[17577],{"data":17578,"marks":17579,"value":17581,"nodeType":865},{},[17580],{"type":4537},"connected Push to your SIEM or SOAR",{"data":17583,"marks":17584,"value":17585,"nodeType":865},{},[],", you’ll be able to create a workflow to respond automatically. ",{"data":17587,"content":17588,"nodeType":1218},{},[17589],{"data":17590,"marks":17591,"value":17592,"nodeType":865},{},[],"Automating password resets in your SIEM using Push webhooks",{"data":17594,"content":17595,"nodeType":866},{},[17596],{"data":17597,"marks":17598,"value":17599,"nodeType":865},{},[],"You can automate password resets for accounts by ingesting this information via webhook into a SIEM, generating an alert. This in turn can fire off another webhook or workflow that sets the ‘force password change on next logon’ attribute on the user’s account.",{"data":17601,"content":17605,"nodeType":907},{"target":17602},{"sys":17603},{"id":17604,"type":904,"linkType":905},"5WFLIVm4DWcuH7a6owQlR1",[],{"data":17607,"content":17608,"nodeType":866},{},[17609],{"data":17610,"marks":17611,"value":17612,"nodeType":865},{},[],"Below is some POC python code we use internally. This is specific to Google Workspace, but the general logic should apply to any IdP that allows you to perform these actions via API calls.",{"data":17614,"content":17618,"nodeType":907},{"target":17615},{"sys":17616},{"id":17617,"type":904,"linkType":905},"4YNirRo8BlRrgGKwwzXE8R",[],{"data":17620,"content":17621,"nodeType":866},{},[17622,17626,17635,17639,17648],{"data":17623,"marks":17624,"value":17625,"nodeType":865},{},[],"You can perform similar functions in Microsoft Entra ID by modifying the user's ",{"data":17627,"content":17629,"nodeType":1102},{"uri":17628},"https://learn.microsoft.com/en-us/graph/api/user-update?view=graph-rest-1.0&tabs=http#:~:text=DisablePasswordExpiration%2C%20DisableStrongPassword.-,passwordProfile,-PasswordProfile",[17630],{"data":17631,"marks":17632,"value":17634,"nodeType":865},{},[17633],{"type":4537},"passwordProfile",{"data":17636,"marks":17637,"value":17638,"nodeType":865},{},[]," attribute via Microsoft Graph API, or in Okta via the ",{"data":17640,"content":17642,"nodeType":1102},{"uri":17641},"https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/expirePassword",[17643],{"data":17644,"marks":17645,"value":17647,"nodeType":865},{},[17646],{"type":4537},"expire_password",{"data":17649,"marks":17650,"value":17651,"nodeType":865},{},[]," API endpoint.",{"data":17653,"content":17654,"nodeType":866},{},[17655],{"data":17656,"marks":17657,"value":17658,"nodeType":865},{},[],"You aren’t limited to just IdP accounts either – any app with an API that provides this functionality can be configured for automated password resets using Push data. ",{"data":17660,"content":17661,"nodeType":866},{},[17662,17666,17674],{"data":17663,"marks":17664,"value":17665,"nodeType":865},{},[],"We also use SSO password data to ",{"data":17667,"content":17668,"nodeType":1102},{"uri":7255},[17669],{"data":17670,"marks":17671,"value":17673,"nodeType":865},{},[17672],{"type":4537},"prevent users from entering their SSO credentials into phishing sites",{"data":17675,"marks":17676,"value":17677,"nodeType":865},{},[],", providing strong anti-phishing protection that is extremely hard for attackers to bypass. ",{"data":17679,"content":17680,"nodeType":938},{},[],{"data":17682,"content":17683,"nodeType":948},{},[17684],{"data":17685,"marks":17686,"value":17687,"nodeType":865},{},[],"Preventing attackers from exploiting vulnerable credentials has never been easier",{"data":17689,"content":17690,"nodeType":866},{},[17691,17695],{"data":17692,"marks":17693,"value":17694,"nodeType":865},{},[],"This is just one of the possible SecOps use cases that Push streamlines and levels up for security teams. ",{"data":17696,"marks":17697,"value":17698,"nodeType":865},{},[],"Push Security is the most powerful AI-native security tool in the browser. Think EDR, but for the browser — high-fidelity telemetry and real-time control across every session, on every device, with no browser migration required.",{"data":17700,"content":17701,"nodeType":866},{},[17702],{"data":17703,"marks":17704,"value":17705,"nodeType":865},{},[],"Security teams use Push to detect and stop advanced browser-based attacks like AiTM phishing, ClickFix, and session hijacking; gain visibility and control over AI tool usage across their workforce; harden identities by surfacing credential reuse, SSO gaps, and shadow IT; and support data loss and insider investigations with browser-layer telemetry that other tools can't see.",{"data":17707,"content":17711,"nodeType":907},{"target":17708},{"sys":17709},{"id":17710,"type":904,"linkType":905},"11p9wnGrZHqp3XPpThHFk3",[],{"data":17713,"content":17714,"nodeType":866},{},[17715],{"data":17716,"marks":17717,"value":21,"nodeType":865},{},[],{"entries":17719},{"hyperlink":17720,"inline":17721,"block":17722},[],[],[17723,17727,17735,17741],{"sys":17724,"__typename":4959,"type":4960,"ctaText":17725,"buttonLabel":17726,"buttonColour":14691,"buttonUrl":15174},{"id":17564},"Learn more about our verified stolen credential detection feature","Read the blog",{"sys":17728,"__typename":2366,"title":17729,"caption":17730,"layoutMode":59,"file":17731},{"id":17604},"Automating Password resets with Push","Automating password resets using Push",{"url":17732,"width":17733,"height":17734},"https://images.ctfassets.net/y1cdw1ablpvd/3xEHX60bfsoM8oC88L5bXs/bd2567087156edcb849ec2dd6286559e/Automating_password_resets__3_.png",3070,1358,{"sys":17736,"__typename":17737,"name":17738,"type":17739,"syntax":17740},{"id":17617},"CodeBlockComponent","Automating password resets code snippet","python","import json\nfrom google.oauth2 import service_account\nfrom googleapiclient.discovery import build\n\n\ndef ssoPasswordReset(event):\n    # extract email from message\n    email_address = event[\"email\"]\n\n    # GWS service account credentials\n    gws_service_account_credentials = \"xxx\"\n\n    SCOPES = [\"https://www.googleapis.com/auth/admin.directory.user\"]\n\n    # Google requires us to associate this activity to a user account\n    DELEGATED_ADMIN_EMAIL = \"user@domain.com\"\n\n    credentials = service_account.Credentials.from_service_account_info(json.loads(gws_service_account_credentials), \n    scopes=SCOPES).with_subject(DELEGATED_ADMIN_EMAIL)\n\n    service = build(\"admin\", \"directory_v1\", credentials=credentials)\n\n    # Set changePasswordAtNextLogin on the account\n    service.users().update(userKey=email_address, body={\"changePasswordAtNextLogin\": True}).execute()\n",{"sys":17742,"__typename":4959,"type":17743,"ctaText":17744,"buttonLabel":17745,"buttonColour":4963,"buttonUrl":59},{"id":17710},"Demo","Book a demo to see how Push stops account takeover","Book demo",{"items":17747},[],{},"Using Push to automate SSO password resets","2024-12-13T00:00:00.000Z",{"items":17752},[17753,18468,18854],{"__typename":2239,"sys":17754,"content":17756,"title":18454,"synopsis":18455,"hashTags":59,"publishedDate":18456,"slug":18457,"tagsCollection":18458,"authorsCollection":18464},{"id":17755},"6vCr4d3R1XA1E8dU883l7N",{"json":17757},{"data":17758,"content":17759,"nodeType":2232},{},[17760,17766,17769,17785,17792,17799,17805,17812,17830,17849,17856,17862,17869,17872,17879,17886,17893,17900,17907,17914,17947,17953,17960,17963,17970,17977,18092,18099,18117,18124,18142,18149,18169,18176,18195,18198,18205,18212,18219,18252,18259,18266,18284,18290,18297,18304,18310,18317,18380,18387,18394,18401,18408,18415,18418,18425,18442,18448],{"data":17761,"content":17765,"nodeType":907},{"target":17762},{"sys":17763},{"id":17764,"type":904,"linkType":905},"HcoxuG8EK0w5uFQlN0hbh",[],{"data":17767,"content":17768,"nodeType":938},{},[],{"data":17770,"content":17771,"nodeType":866},{},[17772,17776,17781],{"data":17773,"marks":17774,"value":17775,"nodeType":865},{},[],"While ",{"data":17777,"marks":17778,"value":17780,"nodeType":865},{},[17779],{"type":979},"striking",{"data":17782,"marks":17783,"value":17784,"nodeType":865},{},[]," gold sure feels good, mining for gold doesn’t. All that sifting for a few grains of value. ",{"data":17786,"content":17787,"nodeType":866},{},[17788],{"data":17789,"marks":17790,"value":17791,"nodeType":865},{},[],"If you’ve ever tried to make use of a TI feed on stolen credentials, you’ll know exactly how this feels. Yet the need to identify signal from noise is obvious. When it matters, it really matters. ",{"data":17793,"content":17794,"nodeType":866},{},[17795],{"data":17796,"marks":17797,"value":17798,"nodeType":865},{},[],"While there’s an enormous volume of TI data available on stolen creds, data trustworthiness is much harder to establish. Are these creds still in use? Are they in use on company applications? And without trust in the data, it’s harder to take action.",{"data":17800,"content":17804,"nodeType":907},{"target":17801},{"sys":17802},{"id":17803,"type":904,"linkType":905},"4unFZadFrWEQsiHsD3YAEo",[],{"data":17806,"content":17807,"nodeType":866},{},[17808],{"data":17809,"marks":17810,"value":17811,"nodeType":865},{},[],"We set out to solve this problem at Push and ended up flipping the script on conventional approaches to evaluating TI on stolen credentials. (Lay down your shovel, friend.)",{"data":17813,"content":17814,"nodeType":15681},{},[17815],{"data":17816,"content":17817,"nodeType":866},{},[17818,17822,17827],{"data":17819,"marks":17820,"value":17821,"nodeType":865},{},[],"With our latest release, Push takes TI on stolen credentials sourced from criminal forums and compares it to the actual credentials still being used across customer environments, ",{"data":17823,"marks":17824,"value":17826,"nodeType":865},{},[17825],{"type":946},"alerting on validated true positives only",{"data":17828,"marks":17829,"value":1677,"nodeType":865},{},[],{"data":17831,"content":17832,"nodeType":866},{},[17833,17837,17845],{"data":17834,"marks":17835,"value":17836,"nodeType":865},{},[],"As of January 2025, you can also bring your own TI to the Push platform. Using the ",{"data":17838,"content":17840,"nodeType":1102},{"uri":17839},"https://pushsecurity.redoc.ly/rest-v1#tag/Stolen-credential-detection",[17841],{"data":17842,"marks":17843,"value":17844,"nodeType":865},{},[],"Push REST API",{"data":17846,"marks":17847,"value":17848,"nodeType":865},{},[],", you can share stolen credential reports you receive from your existing vendors and task the Push browser agent with finding the ones still in use by employees.",{"data":17850,"content":17851,"nodeType":866},{},[17852],{"data":17853,"marks":17854,"value":17855,"nodeType":865},{},[],"Call it the “dirt in, gold out” model for TI feeds.",{"data":17857,"content":17861,"nodeType":907},{"target":17858},{"sys":17859},{"id":17860,"type":904,"linkType":905},"5VtuerdMpP4U9yL7pjrb4P",[],{"data":17863,"content":17864,"nodeType":866},{},[17865],{"data":17866,"marks":17867,"value":17868,"nodeType":865},{},[],"In this article, we’ll cover some of the challenges with threat intel on stolen credentials, why the rise of infostealers has added urgency to determining the trustworthiness of this category of threat, and how Push’s approach of validating stolen credentials cuts through uncertainty. ",{"data":17870,"content":17871,"nodeType":938},{},[],{"data":17873,"content":17874,"nodeType":948},{},[17875],{"data":17876,"marks":17877,"value":17878,"nodeType":865},{},[],"Why actionable intel on creds is hard",{"data":17880,"content":17881,"nodeType":866},{},[17882],{"data":17883,"marks":17884,"value":17885,"nodeType":865},{},[],"Both threat actors and security teams have ready access to information on stolen credentials, with obviously opposite goals. There is now a robust economy for this data, driven in part by both the success of attacks using stolen creds, and the SaaS-ification of business software. In the past, security teams could audit their Active Directory passwords. Today, many if not most corporate credentials are stored in apps that do not provide that level of visibility.",{"data":17887,"content":17888,"nodeType":866},{},[17889],{"data":17890,"marks":17891,"value":17892,"nodeType":865},{},[],"So when it comes to stolen credential TI, the challenge is not the availability of data — dozens of vendors already do the hard work of establishing presences in these forums in order to collect and disseminate information on credentials such as usernames, passwords, cookies, and API keys that have been stolen through data breaches, phishing attacks, infostealers, or other methods. ",{"data":17894,"content":17895,"nodeType":1218},{},[17896],{"data":17897,"marks":17898,"value":17899,"nodeType":865},{},[],"Too much data, not enough context",{"data":17901,"content":17902,"nodeType":866},{},[17903],{"data":17904,"marks":17905,"value":17906,"nodeType":865},{},[],"Rather, the difficulty is determining which information to act on. Finding the gold, in other words.",{"data":17908,"content":17909,"nodeType":866},{},[17910],{"data":17911,"marks":17912,"value":17913,"nodeType":865},{},[],"TI on stolen credentials often suffers from:",{"data":17915,"content":17916,"nodeType":891},{},[17917,17932],{"data":17918,"content":17919,"nodeType":880},{},[17920],{"data":17921,"content":17922,"nodeType":866},{},[17923,17928],{"data":17924,"marks":17925,"value":17927,"nodeType":865},{},[17926],{"type":946},"Data overload:",{"data":17929,"marks":17930,"value":17931,"nodeType":865},{},[]," The double bind of TI is especially evident here — once you know about a potential true positive, you feel obligated to investigate, yet the scale of the information and the high incidence of outdated or incomplete information can pose a risk of desensitizing the SOC or wasting dozens of hours of time investigating what turn out to be false positives, especially when that time could have been better spent on in-depth threat hunting.",{"data":17933,"content":17934,"nodeType":880},{},[17935],{"data":17936,"content":17937,"nodeType":866},{},[17938,17943],{"data":17939,"marks":17940,"value":17942,"nodeType":865},{},[17941],{"type":946},"Minimal context:",{"data":17944,"marks":17945,"value":17946,"nodeType":865},{},[]," Intelligence is often incomplete or out of date. TI feeds may present stolen passwords as new breaches, but the data is actually a recycled combolist (aggregated list of lists) rather than a new incident. In some situations, infostealer threat intel can stem from a personal device that was compromised and once accessed corporate assets, but is no longer active or using that password. Then there are the false negatives, where you get an alert for stolen credentials on a core app following a breach, and the creds are no longer in use there — but they are still being used on a different high-value app. ",{"data":17948,"content":17952,"nodeType":907},{"target":17949},{"sys":17950},{"id":17951,"type":904,"linkType":905},"40ZWbzJFQLRjCAaFCA0YLS",[],{"data":17954,"content":17955,"nodeType":866},{},[17956],{"data":17957,"marks":17958,"value":17959,"nodeType":865},{},[],"Despite these challenges, there is still a strong case for incorporating TI on stolen creds into your cyber defense practice for one important reason: Attackers are increasingly using stolen credentials to compromise organizations.",{"data":17961,"content":17962,"nodeType":938},{},[],{"data":17964,"content":17965,"nodeType":948},{},[17966],{"data":17967,"marks":17968,"value":17969,"nodeType":865},{},[],"The commodification of stolen creds in the age of infostealers",{"data":17971,"content":17972,"nodeType":866},{},[17973],{"data":17974,"marks":17975,"value":17976,"nodeType":865},{},[],"A few headline stats on how ubiquitous stolen credential exploitation has become:",{"data":17978,"content":17979,"nodeType":891},{},[17980,18001,18023,18046,18082],{"data":17981,"content":17982,"nodeType":880},{},[17983],{"data":17984,"content":17985,"nodeType":866},{},[17986,17989,17997],{"data":17987,"marks":17988,"value":13846,"nodeType":865},{},[],{"data":17990,"content":17991,"nodeType":1102},{"uri":15408},[17992],{"data":17993,"marks":17994,"value":17996,"nodeType":865},{},[17995],{"type":4537},"2024 Verizon DBIR",{"data":17998,"marks":17999,"value":18000,"nodeType":865},{},[]," found that 79% of web application compromises were the result of breached credentials.",{"data":18002,"content":18003,"nodeType":880},{},[18004],{"data":18005,"content":18006,"nodeType":866},{},[18007,18010,18019],{"data":18008,"marks":18009,"value":21,"nodeType":865},{},[],{"data":18011,"content":18013,"nodeType":1102},{"uri":18012},"https://www.ibm.com/reports/threat-intelligence",[18014],{"data":18015,"marks":18016,"value":18018,"nodeType":865},{},[18017],{"type":4537},"Researchers at IBM",{"data":18020,"marks":18021,"value":18022,"nodeType":865},{},[]," identified a 71% year-over-year increase in cyberattacks using stolen or compromised credentials. This jump made stolen creds the No. 1 source of initial access for cyberattacks in their study. They also found a 266% uptick in the last year in the use of infostealers — malware designed to capture passwords, cookies, and other credential data.",{"data":18024,"content":18025,"nodeType":880},{},[18026],{"data":18027,"content":18028,"nodeType":866},{},[18029,18033,18042],{"data":18030,"marks":18031,"value":18032,"nodeType":865},{},[],"Researchers at threat intelligence provider ",{"data":18034,"content":18036,"nodeType":1102},{"uri":18035},"https://go.recordedfuture.com/hubfs/reports/ta-2024-0321.pdf",[18037],{"data":18038,"marks":18039,"value":18041,"nodeType":865},{},[18040],{"type":4537},"Recorded Future",{"data":18043,"marks":18044,"value":18045,"nodeType":865},{},[]," found a 135% increase last year in the number of harvested credentials among their data sources, and a 166% increase in credentials that included cookies, providing an easy way for attackers to bypass MFA protections.",{"data":18047,"content":18048,"nodeType":880},{},[18049],{"data":18050,"content":18051,"nodeType":866},{},[18052,18056,18065,18069,18078],{"data":18053,"marks":18054,"value":18055,"nodeType":865},{},[],"Meanwhile, Mandiant’s last two ",{"data":18057,"content":18059,"nodeType":1102},{"uri":18058},"https://cloud.google.com/security/resources/m-trends",[18060],{"data":18061,"marks":18062,"value":18064,"nodeType":865},{},[18063],{"type":4537},"M-Trends reports",{"data":18066,"marks":18067,"value":18068,"nodeType":865},{},[]," found that stolen creds were the third and fourth most-used initial intrusion method of the last two years. Cisco Talos researchers found that the ",{"data":18070,"content":18072,"nodeType":1102},{"uri":18071},"https://blog.talosintelligence.com/cisco-talos-2023-year-in-review/",[18073],{"data":18074,"marks":18075,"value":18077,"nodeType":865},{},[18076],{"type":4537},"use of valid accounts",{"data":18079,"marks":18080,"value":18081,"nodeType":865},{},[]," was the second-most common attack technique they observed last year.",{"data":18083,"content":18084,"nodeType":880},{},[18085],{"data":18086,"content":18087,"nodeType":866},{},[18088],{"data":18089,"marks":18090,"value":18091,"nodeType":865},{},[],"Push’s own review of the 25 most notable public identity-related breaches over the last year found that 23 were tied to stolen credentials.",{"data":18093,"content":18094,"nodeType":866},{},[18095],{"data":18096,"marks":18097,"value":18098,"nodeType":865},{},[],"What’s not immediately obvious from these statistics is that not only are credential-based attacks becoming more common, but they’re also becoming easier for attackers to execute.",{"data":18100,"content":18101,"nodeType":866},{},[18102,18105,18113],{"data":18103,"marks":18104,"value":21,"nodeType":865},{},[],{"data":18106,"content":18107,"nodeType":1102},{"uri":18012},[18108],{"data":18109,"marks":18110,"value":18112,"nodeType":865},{},[18111],{"type":4537},"IBM X-Force researchers",{"data":18114,"marks":18115,"value":18116,"nodeType":865},{},[]," have found that credentials for cloud accounts account for 90% of all cloud assets for sale on the dark web, making them readily accessible. Price tags can be as low as $10.",{"data":18118,"content":18119,"nodeType":1218},{},[18120],{"data":18121,"marks":18122,"value":18123,"nodeType":865},{},[],"The rise of infostealers has supercharged the stolen credential marketplace",{"data":18125,"content":18126,"nodeType":866},{},[18127,18131,18139],{"data":18128,"marks":18129,"value":18130,"nodeType":865},{},[],"One category of threat — infostealer malware — has emerged as an especially successful avenue of compromise. While infostealers aren’t new, they have developed alongside what is now a robust economy for stolen credentials (think: dedicated Telegram channels advertising stolen data from the most popular infostealers), making them a fruitful option for attackers. For a deeper dive on the rise of infostealers, see our ",{"data":18132,"content":18133,"nodeType":1102},{"uri":15528},[18134],{"data":18135,"marks":18136,"value":18138,"nodeType":865},{},[18137],{"type":4537},"previous article",{"data":18140,"marks":18141,"value":1151,"nodeType":865},{},[],{"data":18143,"content":18144,"nodeType":866},{},[18145],{"data":18146,"marks":18147,"value":18148,"nodeType":865},{},[],"Once attackers gain possession of stolen creds, they have plenty of soft targets. For organizations with a large amount of SaaS — a percentage of which will always be unmanaged shadow IT or freemium — the risk is heightened because all attackers need to do is log in to potentially hundreds of services, dump the data they find (including additional creds in some cases), and profit. ",{"data":18150,"content":18151,"nodeType":866},{},[18152,18156,18165],{"data":18153,"marks":18154,"value":18155,"nodeType":865},{},[],"In other words, the average attack path for SaaS is shorter and occurs in-app, often using legitimate workflows, making it therefore harder to detect than traditional network exploits. We discuss this phenomenon in our ",{"data":18157,"content":18158,"nodeType":1102},{"uri":9381},[18159],{"data":18160,"marks":18161,"value":18164,"nodeType":865},{},[18162,18163],{"type":4537},{"type":946},"shifting detection left",{"data":18166,"marks":18167,"value":18168,"nodeType":865},{},[]," article.",{"data":18170,"content":18171,"nodeType":866},{},[18172],{"data":18173,"marks":18174,"value":18175,"nodeType":865},{},[],"Our take: We haven’t yet seen the peak of identity attacks that leverage compromised credentials. The opportunities for attackers are too numerous, and front-line defenses like MFA are still not widely enough enforced, particularly on unmanaged apps used for work.",{"data":18177,"content":18178,"nodeType":866},{},[18179,18183,18191],{"data":18180,"marks":18181,"value":18182,"nodeType":865},{},[],"Push Security’s ",{"data":18184,"content":18185,"nodeType":1102},{"uri":6406},[18186],{"data":18187,"marks":18188,"value":18190,"nodeType":865},{},[18189],{"type":4537},"own research",{"data":18192,"marks":18193,"value":18194,"nodeType":865},{},[]," has found that 37% of corporate identities are using passwords with no MFA. For attackers in possession of stolen creds, these are easy marks.",{"data":18196,"content":18197,"nodeType":938},{},[],{"data":18199,"content":18200,"nodeType":948},{},[18201],{"data":18202,"marks":18203,"value":18204,"nodeType":865},{},[],"How Push detects stolen creds with high confidence",{"data":18206,"content":18207,"nodeType":866},{},[18208],{"data":18209,"marks":18210,"value":18211,"nodeType":865},{},[],"Now let’s take a look at how Push’s approach to this problem is different.",{"data":18213,"content":18214,"nodeType":866},{},[18215],{"data":18216,"marks":18217,"value":18218,"nodeType":865},{},[],"If you’re not familiar with the Push platform, a bit of context will be useful here: Push uses a browser agent deployed to employee browsers (we support all major browsers) to prevent, detect, and block identity attacks. ",{"data":18220,"content":18221,"nodeType":866},{},[18222,18226,18235,18239,18248],{"data":18223,"marks":18224,"value":18225,"nodeType":865},{},[],"In addition to enforcing ",{"data":18227,"content":18229,"nodeType":1102},{"uri":18228},"https://pushsecurity.com/blog/introducing-set-and-forget-controls-that-stop-real-world-identity-attacks/",[18230],{"data":18231,"marks":18232,"value":18234,"nodeType":865},{},[18233],{"type":4537},"security controls",{"data":18236,"marks":18237,"value":18238,"nodeType":865},{},[]," in the browser, Push also assesses the strength of end-user passwords by ",{"data":18240,"content":18242,"nodeType":1102},{"uri":18241},"https://pushsecurity.com/help/10065#start",[18243],{"data":18244,"marks":18245,"value":18247,"nodeType":865},{},[18246],{"type":4537},"creating and analyzing",{"data":18249,"marks":18250,"value":18251,"nodeType":865},{},[]," a truncated, salted SHA256 hash of the password for a given account. This is called a password fingerprint. These k-anonymized fingerprints are never seen by Push’s back-end and exist only in local browser extension storage.",{"data":18253,"content":18254,"nodeType":866},{},[18255],{"data":18256,"marks":18257,"value":18258,"nodeType":865},{},[],"This approach gives Push a directly observable source of truth for corporate credentials, and that data point turns out to be the key to flipping the script on how threat intelligence on stolen credentials is typically evaluated.",{"data":18260,"content":18261,"nodeType":866},{},[18262],{"data":18263,"marks":18264,"value":18265,"nodeType":865},{},[],"In the past, evaluating TI on stolen creds meant performing traditional intelligence assessments, such as confidence level based on factors like the intel source and whether the data was still current. Only after determining whether the information was high-confidence could you take action.",{"data":18267,"content":18268,"nodeType":866},{},[18269,18273,18280],{"data":18270,"marks":18271,"value":18272,"nodeType":865},{},[],"It’s worth noting, too, that the age of TI alone is not enough of an indicator to determine whether to take action. With the ",{"data":18274,"content":18275,"nodeType":1102},{"uri":4601},[18276],{"data":18277,"marks":18278,"value":18279,"nodeType":865},{},[],"Snowflake breach earlier this year",{"data":18281,"marks":18282,"value":18283,"nodeType":865},{},[],", we saw how even older credentials posed a threat of account takeover where these creds were still in use. In the case of Snowflake, the attacker used credentials sourced from historical infostealer campaigns, some dating as far back as 2020.",{"data":18285,"content":18289,"nodeType":907},{"target":18286},{"sys":18287},{"id":18288,"type":904,"linkType":905},"2lSZ7HbZfLmSFXneCnVJzY",[],{"data":18291,"content":18292,"nodeType":1218},{},[18293],{"data":18294,"marks":18295,"value":18296,"nodeType":865},{},[],"Forget about time-consuming manual TI validation and get straight to the true positives",{"data":18298,"content":18299,"nodeType":866},{},[18300],{"data":18301,"marks":18302,"value":18303,"nodeType":865},{},[],"With Push, the platform now can analyze threat intelligence on stolen credentials and alert when there’s a validated match among current credentials in use in your environment. This method works regardless of the source of the data or its age. This method also finds the needles in the haystack — situations where threat intel flags a stolen credential on one app, but that credential is also in use on several other apps. ",{"data":18305,"content":18309,"nodeType":907},{"target":18306},{"sys":18307},{"id":18308,"type":904,"linkType":905},"7GSFasHfHb3UgpgF8pZ2N2",[],{"data":18311,"content":18312,"nodeType":866},{},[18313],{"data":18314,"marks":18315,"value":18316,"nodeType":865},{},[],"Here’s how it works:",{"data":18318,"content":18319,"nodeType":891},{},[18320,18340,18350,18360,18370],{"data":18321,"content":18322,"nodeType":880},{},[18323],{"data":18324,"content":18325,"nodeType":866},{},[18326,18330,18337],{"data":18327,"marks":18328,"value":18329,"nodeType":865},{},[],"Push receives TI on stolen credentials from vendor feeds. Use the feeds that Push supplies (at no additional cost for Push customers), or, additionally, bring your own TI by supplying stolen credential reports via the ",{"data":18331,"content":18333,"nodeType":1102},{"uri":18332},"https://pushsecurity.redoc.ly/rest-v1#operation/post-controls-stolenCredentials",[18334],{"data":18335,"marks":18336,"value":17844,"nodeType":865},{},[],{"data":18338,"marks":18339,"value":1677,"nodeType":865},{},[],{"data":18341,"content":18342,"nodeType":880},{},[18343],{"data":18344,"content":18345,"nodeType":866},{},[18346],{"data":18347,"marks":18348,"value":18349,"nodeType":865},{},[],"For each customer environment, Push checks for customer domains in the data set.",{"data":18351,"content":18352,"nodeType":880},{},[18353],{"data":18354,"content":18355,"nodeType":866},{},[18356],{"data":18357,"marks":18358,"value":18359,"nodeType":865},{},[],"When suspected stolen creds for a customer environment are present, Push hashes and salts the passwords and then sends those fingerprints to the relevant browser agents for comparison. ",{"data":18361,"content":18362,"nodeType":880},{},[18363],{"data":18364,"content":18365,"nodeType":866},{},[18366],{"data":18367,"marks":18368,"value":18369,"nodeType":865},{},[],"If the stolen credential fingerprint matches a known credential fingerprint observed to be in use by the Push browser agent, the platform returns a validated true positive alert. Note that Push can alert on a validated true positive regardless of which platform the TI source indicated was the source of the stolen cred, allowing you to find those compromised credentials in use across any of your apps.",{"data":18371,"content":18372,"nodeType":880},{},[18373],{"data":18374,"content":18375,"nodeType":866},{},[18376],{"data":18377,"marks":18378,"value":18379,"nodeType":865},{},[],"You can choose to receive alerts for this detection via webhook, ChatOps notification, or in the Push admin console.",{"data":18381,"content":18382,"nodeType":866},{},[18383],{"data":18384,"marks":18385,"value":18386,"nodeType":865},{},[],"From there, security teams can take action to reset passwords, identify potentially compromised devices, or perform other investigations.",{"data":18388,"content":18389,"nodeType":866},{},[18390],{"data":18391,"marks":18392,"value":18393,"nodeType":865},{},[],"By comparing all possible matches to only those credentials that are still in use, Push eliminates time-consuming validation exercises. In essence, the provenance of the intel no longer matters; only the true positives do.",{"data":18395,"content":18396,"nodeType":1218},{},[18397],{"data":18398,"marks":18399,"value":18400,"nodeType":865},{},[],"Bring your own TI",{"data":18402,"content":18403,"nodeType":866},{},[18404],{"data":18405,"marks":18406,"value":18407,"nodeType":865},{},[],"With verified stolen credential detection, you can also extract a lot more value from your existing threat intelligence feeds by sharing stolen creds reports with the Push platform via API. ",{"data":18409,"content":18410,"nodeType":866},{},[18411],{"data":18412,"marks":18413,"value":18414,"nodeType":865},{},[],"This allows Push to perform the same checks to compare the reports to observed password fingerprints and flag only the true positives — eliminating the time-consuming work of manual triage, investigation, and end-user follow-up for your security team.",{"data":18416,"content":18417,"nodeType":938},{},[],{"data":18419,"content":18420,"nodeType":948},{},[18421],{"data":18422,"marks":18423,"value":18424,"nodeType":865},{},[],"Try Push for yourself",{"data":18426,"content":18427,"nodeType":866},{},[18428,18432,18439],{"data":18429,"marks":18430,"value":18431,"nodeType":865},{},[],"The validated stolen credential detections feature is available at no additional cost for all Push customers. If you’d like to explore the platform yourself, ",{"data":18433,"content":18434,"nodeType":1102},{"uri":10028},[18435],{"data":18436,"marks":18437,"value":16671,"nodeType":865},{},[18438],{"type":4537},{"data":18440,"marks":18441,"value":7361,"nodeType":865},{},[],{"data":18443,"content":18447,"nodeType":907},{"target":18444},{"sys":18445},{"id":18446,"type":904,"linkType":905},"3tqVk7Vr7pYLOEVukIJM2g",[],{"data":18449,"content":18450,"nodeType":866},{},[18451],{"data":18452,"marks":18453,"value":21,"nodeType":865},{},[],"Eliminate false positives with verified stolen credential detections using Push","Push now compares user passwords with TI feeds to alert you when valid credentials are available on the clearweb and darkweb.","2024-12-03T00:00:00.000Z","verified-stolen-credential-detection",{"items":18459},[18460,18462],{"sys":18461,"name":3915},{"id":3914},{"sys":18463,"name":342},{"id":2527},{"items":18465},[18466],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":18467},{"url":853},{"__typename":2239,"sys":18469,"content":18471,"title":18840,"synopsis":18841,"hashTags":59,"publishedDate":18842,"slug":18843,"tagsCollection":18844,"authorsCollection":18850},{"id":18470},"7uLeQ9twNl5RyNaWkkJNjd",{"json":18472},{"data":18473,"content":18474,"nodeType":2232},{},[18475,18481,18484,18491,18498,18523,18526,18533,18540,18547,18566,18573,18576,18583,18590,18597,18604,18611,18644,18650,18683,18689,18692,18699,18706,18713,18719,18726,18732,18739,18742,18749,18764,18770,18777,18800,18803,18810,18828,18834],{"data":18476,"content":18480,"nodeType":907},{"target":18477},{"sys":18478},{"id":18479,"type":904,"linkType":905},"2qUzJLoMtI3Uaf3ooGw582",[],{"data":18482,"content":18483,"nodeType":938},{},[],{"data":18485,"content":18486,"nodeType":948},{},[18487],{"data":18488,"marks":18489,"value":18490,"nodeType":865},{},[],"Which password managers are my employees using?",{"data":18492,"content":18493,"nodeType":866},{},[18494],{"data":18495,"marks":18496,"value":18497,"nodeType":865},{},[],"Tens of millions of people now use password managers, both at work and at home. And it probably won’t come as much of a surprise that most of Push’s security-savvy customers also provide their users with a corporate password manager. ",{"data":18499,"content":18500,"nodeType":866},{},[18501,18505,18510,18514,18519],{"data":18502,"marks":18503,"value":18504,"nodeType":865},{},[],"Up until now, Push has been able to show you whether or not your employees are using ",{"data":18506,"marks":18507,"value":18509,"nodeType":865},{},[18508],{"type":4537},"a",{"data":18511,"marks":18512,"value":18513,"nodeType":865},{},[]," password manager to log into their work apps. But now, we can actually show you ",{"data":18515,"marks":18516,"value":18518,"nodeType":865},{},[18517],{"type":4537},"which",{"data":18520,"marks":18521,"value":18522,"nodeType":865},{},[]," password managers they’re using.",{"data":18524,"content":18525,"nodeType":938},{},[],{"data":18527,"content":18528,"nodeType":948},{},[18529],{"data":18530,"marks":18531,"value":18532,"nodeType":865},{},[],"There’s more than first meets the eye with this detection   ",{"data":18534,"content":18535,"nodeType":866},{},[18536],{"data":18537,"marks":18538,"value":18539,"nodeType":865},{},[],"There’s a couple of reasons why you’ll want to know which password managers your employees are using.",{"data":18541,"content":18542,"nodeType":866},{},[18543],{"data":18544,"marks":18545,"value":18546,"nodeType":865},{},[],"The obvious one is to make sure all your employees are using, and benefiting from, the password manager you're providing them with. They’re not cheap and you’ll want to get the best bang for your buck. ",{"data":18548,"content":18549,"nodeType":866},{},[18550,18554,18562],{"data":18551,"marks":18552,"value":18553,"nodeType":865},{},[],"The second reason speaks to a specific concern a lot of security teams have around attackers compromising users’ personal password managers containing corporate passwords, and then being able to pivot into the organization's corporate environment. This is a very valid concern given ",{"data":18555,"content":18556,"nodeType":1102},{"uri":15528},[18557],{"data":18558,"marks":18559,"value":18561,"nodeType":865},{},[18560],{"type":4537},"the rise in attacks using infostealers",{"data":18563,"marks":18564,"value":18565,"nodeType":865},{},[]," following the Snowflake breach earlier this year. ",{"data":18567,"content":18568,"nodeType":866},{},[18569],{"data":18570,"marks":18571,"value":18572,"nodeType":865},{},[],"Using this feature, you can now detect which password managers are storing credentials for your most sensitive systems and stop this attack scenario from happening.   ",{"data":18574,"content":18575,"nodeType":938},{},[],{"data":18577,"content":18578,"nodeType":948},{},[18579],{"data":18580,"marks":18581,"value":18582,"nodeType":865},{},[],"Why corporate passwords in personal password managers is a big no-no",{"data":18584,"content":18585,"nodeType":866},{},[18586],{"data":18587,"marks":18588,"value":18589,"nodeType":865},{},[],"Remote working, BYOD, and users having both personal and professional accounts on the same platforms (Google, Microsoft etc.) have all blurred the line between people’s work lives and their home lives. It’s not uncommon for one to spill over into the other, and one place we see evidence of this is in password managers. ",{"data":18591,"content":18592,"nodeType":866},{},[18593],{"data":18594,"marks":18595,"value":18596,"nodeType":865},{},[],"Creds for personal accounts end up getting stored in corporate password managers, and corporate creds end up getting stored in personal password managers. ",{"data":18598,"content":18599,"nodeType":866},{},[18600],{"data":18601,"marks":18602,"value":18603,"nodeType":865},{},[],"The big risk when the latter happens is that a sensitive corporate asset (a users’ Microsoft account password for example) is effectively being exfiltrated out of the corporate environment by the user, and placed out of reach of your security team. ",{"data":18605,"content":18606,"nodeType":866},{},[18607],{"data":18608,"marks":18609,"value":18610,"nodeType":865},{},[],"This creates new opportunities for attackers: ",{"data":18612,"content":18613,"nodeType":891},{},[18614,18624,18634],{"data":18615,"content":18616,"nodeType":880},{},[18617],{"data":18618,"content":18619,"nodeType":866},{},[18620],{"data":18621,"marks":18622,"value":18623,"nodeType":865},{},[],"Your average user’s personal laptop isn't going to be as well protected as their company laptop. So they offer an easier target for attackers using traditional endpoint compromise techniques. ",{"data":18625,"content":18626,"nodeType":880},{},[18627],{"data":18628,"content":18629,"nodeType":866},{},[18630],{"data":18631,"marks":18632,"value":18633,"nodeType":865},{},[],"An attacker can compromise a personal laptop with infostealer malware that targets password managers in the browser. If corporate credentials are stored in that personal password manager then they are also going to be stolen. ",{"data":18635,"content":18636,"nodeType":880},{},[18637],{"data":18638,"content":18639,"nodeType":866},{},[18640],{"data":18641,"marks":18642,"value":18643,"nodeType":865},{},[],"Now the attacker is in possession of the user's Microsoft account credentials, they can potentially pivot from a personal laptop to one of your organization's core platforms over the internet.  ",{"data":18645,"content":18649,"nodeType":907},{"target":18646},{"sys":18647},{"id":18648,"type":904,"linkType":905},"Dw05IslqXVN5unTFuvTZV",[],{"data":18651,"content":18652,"nodeType":1218},{},[18653,18657,18662,18666,18671,18675,18680],{"data":18654,"marks":18655,"value":18656,"nodeType":865},{},[],"Using Push, you can now make sure that sensitive ",{"data":18658,"marks":18659,"value":18661,"nodeType":865},{},[18660],{"type":4537},"corporate credentials",{"data":18663,"marks":18664,"value":18665,"nodeType":865},{},[]," stay in your ",{"data":18667,"marks":18668,"value":18670,"nodeType":865},{},[18669],{"type":4537},"corporate password manager",{"data":18672,"marks":18673,"value":18674,"nodeType":865},{},[]," and don’t leave your ",{"data":18676,"marks":18677,"value":18679,"nodeType":865},{},[18678],{"type":4537},"corporate environment.",{"data":18681,"marks":18682,"value":6192,"nodeType":865},{},[],{"data":18684,"content":18688,"nodeType":907},{"target":18685},{"sys":18686},{"id":18687,"type":904,"linkType":905},"27d7qit3k7ETS9lemJexIJ",[],{"data":18690,"content":18691,"nodeType":938},{},[],{"data":18693,"content":18694,"nodeType":948},{},[18695],{"data":18696,"marks":18697,"value":18698,"nodeType":865},{},[],"All powered by the Push browser extension",{"data":18700,"content":18701,"nodeType":866},{},[18702],{"data":18703,"marks":18704,"value":18705,"nodeType":865},{},[],"Push detects which password managers your employees are using with our browser extension. It observes all your employees logins using their work identities. The telemetry the browser extension generates shows you what employees are logging into, when they’re logging in, how they’re logging in, and if any aspect of that login process is risky or potentially malicious. ",{"data":18707,"content":18708,"nodeType":866},{},[18709],{"data":18710,"marks":18711,"value":18712,"nodeType":865},{},[],"The password managers (and browsers with built-in password managers) supported by this detection are: ",{"data":18714,"content":18718,"nodeType":907},{"target":18715},{"sys":18716},{"id":18717,"type":904,"linkType":905},"7q3CYLPpBhEGyCeP4S0bzJ",[],{"data":18720,"content":18721,"nodeType":866},{},[18722],{"data":18723,"marks":18724,"value":18725,"nodeType":865},{},[],"When a login using one of those password managers is observed by Push, it appears in your events feed. This data can be sent to your SIEM using Push’s webhooks. ",{"data":18727,"content":18731,"nodeType":907},{"target":18728},{"sys":18729},{"id":18730,"type":904,"linkType":905},"qDRJ7CYd81L4RUHQBuHvQ",[],{"data":18733,"content":18734,"nodeType":866},{},[18735],{"data":18736,"marks":18737,"value":18738,"nodeType":865},{},[],"The password manager user will also appear on the corresponding account on the accounts page. Here you can see every workforce account and the login methods used to access them. ",{"data":18740,"content":18741,"nodeType":938},{},[],{"data":18743,"content":18744,"nodeType":948},{},[18745],{"data":18746,"marks":18747,"value":18748,"nodeType":865},{},[],"Bonus feature — detecting clipboard pasting",{"data":18750,"content":18751,"nodeType":866},{},[18752,18756,18761],{"data":18753,"marks":18754,"value":18755,"nodeType":865},{},[],"The eagle-eyed among you might have seen that in the list of supported “password managers” is one called ",{"data":18757,"marks":18758,"value":18760,"nodeType":865},{},[18759],{"type":946},"Clipboard paste",{"data":18762,"marks":18763,"value":7361,"nodeType":865},{},[],{"data":18765,"content":18769,"nodeType":907},{"target":18766},{"sys":18767},{"id":18768,"type":904,"linkType":905},"2ApsFXkrSznhT7cJqSOAIV",[],{"data":18771,"content":18772,"nodeType":866},{},[18773],{"data":18774,"marks":18775,"value":18776,"nodeType":865},{},[],"You’ll see this when we observe users pasting a password into the password field. This detection is really useful for a couple of reasons:",{"data":18778,"content":18779,"nodeType":891},{},[18780,18790],{"data":18781,"content":18782,"nodeType":880},{},[18783],{"data":18784,"content":18785,"nodeType":866},{},[18786],{"data":18787,"marks":18788,"value":18789,"nodeType":865},{},[],"Copying passwords from a password manager and pasting them into a login page is bad practice. Password managers typically also store which page the password is for so they won't auto-populate on a phishing page. Pasting your password manually makes you more susceptible to being phished.",{"data":18791,"content":18792,"nodeType":880},{},[18793],{"data":18794,"content":18795,"nodeType":866},{},[18796],{"data":18797,"marks":18798,"value":18799,"nodeType":865},{},[],"Or, it could indicate that the user is storing their passwords in a notes app, word doc, spreadsheet etc. Obviously these are all low hanging fruit for any attacker so you want to get the user to move their passwords into their password manager and set fire to whatever doc they had been using. ",{"data":18801,"content":18802,"nodeType":938},{},[],{"data":18804,"content":18805,"nodeType":948},{},[18806],{"data":18807,"marks":18808,"value":18809,"nodeType":865},{},[],"Try it out for yourself",{"data":18811,"content":18812,"nodeType":866},{},[18813,18817,18825],{"data":18814,"marks":18815,"value":18816,"nodeType":865},{},[],"If you have any question about this feature or any other of our detection use cases, ",{"data":18818,"content":18819,"nodeType":1102},{"uri":10028},[18820],{"data":18821,"marks":18822,"value":18824,"nodeType":865},{},[18823],{"type":4537},"book a meeting with one of our team",{"data":18826,"marks":18827,"value":1151,"nodeType":865},{},[],{"data":18829,"content":18833,"nodeType":907},{"target":18830},{"sys":18831},{"id":18832,"type":904,"linkType":905},"6iKFd9Qys2SSuNqKVQB7ka",[],{"data":18835,"content":18836,"nodeType":866},{},[18837],{"data":18838,"marks":18839,"value":21,"nodeType":865},{},[],"Don’t let attackers find the keys to your kingdom in a personal password manager","Make sure sensitive corporate credentials don’t leave your corporate environment and end up in personal password managers with Push.","2024-11-05T00:00:00.000Z","stop-users-saving-corp-creds-into-personal-password-managers",{"items":18845},[18846,18848],{"sys":18847,"name":3915},{"id":3914},{"sys":18849,"name":297},{"id":11129},{"items":18851},[18852],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":18853},{"url":11136},{"__typename":2239,"sys":18855,"content":18857,"title":19643,"synopsis":19644,"hashTags":59,"publishedDate":19645,"slug":19646,"tagsCollection":19647,"authorsCollection":19651},{"id":18856},"PAPJPr3CIB6J20udYyy1r",{"json":18858},{"data":18859,"content":18860,"nodeType":2232},{},[18861,18867,18886,18893,18900,18905,18908,18916,18923,18942,18953,18960,18967,18974,19067,19070,19078,19161,19167,19170,19178,19186,19193,19200,19208,19225,19232,19240,19247,19254,19262,19269,19276,19296,19302,19305,19313,19321,19328,19431,19438,19446,19453,19460,19466,19474,19481,19488,19495,19503,19510,19517,19524,19531,19537,19540,19548,19555,19588,19595,19613,19632,19637],{"data":18862,"content":18866,"nodeType":907},{"target":18863},{"sys":18864},{"id":18865,"type":904,"linkType":905},"1eBClNW4NOR66F0tl9h6lD",[],{"data":18868,"content":18869,"nodeType":866},{},[18870,18874,18882],{"data":18871,"marks":18872,"value":18873,"nodeType":865},{},[],"The attacks on Snowflake customers in 2024 collectively constituted the biggest cyber security event of the year in terms of the number of organizations and individuals affected (at least, if you exclude CrowdStrike causing a worldwide outage in July) — certainly, it was the largest perpetrated by a criminal group against commercial enterprises. It has been touted by some news outlets as ‘",{"data":18875,"content":18876,"nodeType":1102},{"uri":6977},[18877],{"data":18878,"marks":18879,"value":18881,"nodeType":865},{},[18880],{"type":4537},"one of the biggest breaches ever",{"data":18883,"marks":18884,"value":18885,"nodeType":865},{},[],"’.  ",{"data":18887,"content":18888,"nodeType":866},{},[18889],{"data":18890,"marks":18891,"value":18892,"nodeType":865},{},[],"Snowflake was a watershed moment that signalled the significant opportunity presented by identity attacks on cloud services. It demonstrated how comparatively unsophisticated methods (logging in to user accounts with stolen credentials and dumping the data) can have the same or greater impact as a traditional network or endpoint based cyber attack involving vulnerability exploitation, malware deployment, ransomware, etc. ",{"data":18894,"content":18895,"nodeType":866},{},[18896],{"data":18897,"marks":18898,"value":18899,"nodeType":865},{},[],"Here’s everything you need to know about the Snowflake attacks — and what you can do to protect yourself against the next Snowflake in the future.",{"data":18901,"content":18904,"nodeType":907},{"target":18902},{"sys":18903},{"id":13827,"type":904,"linkType":905},[],{"data":18906,"content":18907,"nodeType":938},{},[],{"data":18909,"content":18910,"nodeType":948},{},[18911],{"data":18912,"marks":18913,"value":18915,"nodeType":865},{},[18914],{"type":946},"Snowflake: The facts",{"data":18917,"content":18918,"nodeType":866},{},[18919],{"data":18920,"marks":18921,"value":18922,"nodeType":865},{},[],"Cyber criminals associated with the threat group known as ShinyHunters claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. ",{"data":18924,"content":18925,"nodeType":866},{},[18926,18930,18939],{"data":18927,"marks":18928,"value":18929,"nodeType":865},{},[],"ShinyHunters associates targeted ~165 organizations that were subjected to account takeover attacks using stolen credentials harvested from historical infostealer infections dating back as far as 2020, ",{"data":18931,"content":18933,"nodeType":1102},{"uri":18932},"https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",[18934],{"data":18935,"marks":18936,"value":18938,"nodeType":865},{},[18937],{"type":4537},"according to Mandiant’s investigation",{"data":18940,"marks":18941,"value":7361,"nodeType":865},{},[],{"data":18943,"content":18944,"nodeType":15681},{},[18945],{"data":18946,"content":18947,"nodeType":866},{},[18948],{"data":18949,"marks":18950,"value":18952,"nodeType":865},{},[18951],{"type":946},">80% of the compromised accounts belonging to Snowflake customers had prior credential exposure. ",{"data":18954,"content":18955,"nodeType":866},{},[18956],{"data":18957,"marks":18958,"value":18959,"nodeType":865},{},[],"The impacted accounts lacked MFA, meaning successful authentication only required a valid username and password. As the Snowflake credentials found in infostealer malware credential dumps had not been rotated or updated, they remained valid and could be used to authenticate to user accounts on Snowflake tenants belonging to various customers.",{"data":18961,"content":18962,"nodeType":866},{},[18963],{"data":18964,"marks":18965,"value":18966,"nodeType":865},{},[],"As a data warehousing platform integrated with a range of connected cloud services, access to a customer’s Snowflake tenant provided attackers with large quantities of sensitive commercial and personal data that could be stolen and monetized by attackers in a variety of ways — such as by ransoming the victim organization, extorting individual end-customers, and selling the data on to other criminal organizations. ",{"data":18968,"content":18969,"nodeType":866},{},[18970],{"data":18971,"marks":18972,"value":18973,"nodeType":865},{},[],"In total, 9 public victims were named following the breach, collectively impacting hundreds of millions of people. ",{"data":18975,"content":18976,"nodeType":891},{},[18977,18987,18997,19007,19017,19027,19037,19047,19057],{"data":18978,"content":18979,"nodeType":880},{},[18980],{"data":18981,"content":18982,"nodeType":866},{},[18983],{"data":18984,"marks":18985,"value":18986,"nodeType":865},{},[],"Lending Tree: Sensitive data for over 190 million people available online including customer details, partial credit card numbers, insurance quotes and other information, being sold for $2m.",{"data":18988,"content":18989,"nodeType":880},{},[18990],{"data":18991,"content":18992,"nodeType":866},{},[18993],{"data":18994,"marks":18995,"value":18996,"nodeType":865},{},[],"Truist Bank: Information belonging to 65,000 employees being sold online for $1m",{"data":18998,"content":18999,"nodeType":880},{},[19000],{"data":19001,"content":19002,"nodeType":866},{},[19003],{"data":19004,"marks":19005,"value":19006,"nodeType":865},{},[],"Advance Auto Parts: 3TB of data for sale for $1.5 million. Affected 2.3 million people, as well as current and former employees and job applicants.",{"data":19008,"content":19009,"nodeType":880},{},[19010],{"data":19011,"content":19012,"nodeType":866},{},[19013],{"data":19014,"marks":19015,"value":19016,"nodeType":865},{},[],"Pure Storage: Workspace with 11k customer records including company, email, LDAP username and software version numbers.",{"data":19018,"content":19019,"nodeType":880},{},[19020],{"data":19021,"content":19022,"nodeType":866},{},[19023],{"data":19024,"marks":19025,"value":19026,"nodeType":865},{},[],"Los Angeles Unified: Student data, disability information, discipline details, and parent information, being sold online for $150k.",{"data":19028,"content":19029,"nodeType":880},{},[19030],{"data":19031,"content":19032,"nodeType":866},{},[19033],{"data":19034,"marks":19035,"value":19036,"nodeType":865},{},[],"Neiman Marcus: 31m email addresses exposed alongside various personal information.",{"data":19038,"content":19039,"nodeType":880},{},[19040],{"data":19041,"content":19042,"nodeType":866},{},[19043],{"data":19044,"marks":19045,"value":19046,"nodeType":865},{},[],"Santander: 30 million customer details for sale relating to customers of Santander Chile, Spain, and Uruguay.",{"data":19048,"content":19049,"nodeType":880},{},[19050],{"data":19051,"content":19052,"nodeType":866},{},[19053],{"data":19054,"marks":19055,"value":19056,"nodeType":865},{},[],"Ticketmaster: 560 million customer details for sale, disruption to events and ticketing worldwide, increasing in scam ticket production.",{"data":19058,"content":19059,"nodeType":880},{},[19060],{"data":19061,"content":19062,"nodeType":866},{},[19063],{"data":19064,"marks":19065,"value":19066,"nodeType":865},{},[],"AT&T: Call logs stolen for approximately 109 million customers (nearly all of its mobile customers). AT&T paid an undisclosed ransom fee. ",{"data":19068,"content":19069,"nodeType":938},{},[],{"data":19071,"content":19072,"nodeType":948},{},[19073],{"data":19074,"marks":19075,"value":19077,"nodeType":865},{},[19076],{"type":946},"The Snowflake attacks step-by-step",{"data":19079,"content":19080,"nodeType":891},{},[19081,19091,19101,19111,19121,19131,19141,19151],{"data":19082,"content":19083,"nodeType":880},{},[19084],{"data":19085,"content":19086,"nodeType":866},{},[19087],{"data":19088,"marks":19089,"value":19090,"nodeType":865},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":19092,"content":19093,"nodeType":880},{},[19094],{"data":19095,"content":19096,"nodeType":866},{},[19097],{"data":19098,"marks":19099,"value":19100,"nodeType":865},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and Telegram channels.",{"data":19102,"content":19103,"nodeType":880},{},[19104],{"data":19105,"content":19106,"nodeType":866},{},[19107],{"data":19108,"marks":19109,"value":19110,"nodeType":865},{},[],"ShinyHunters saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":19112,"content":19113,"nodeType":880},{},[19114],{"data":19115,"content":19116,"nodeType":866},{},[19117],{"data":19118,"marks":19119,"value":19120,"nodeType":865},{},[],"ShinyHunters embarked on a large-scale campaign targeting Snowflake customer accounts using previously breached credentials. ",{"data":19122,"content":19123,"nodeType":880},{},[19124],{"data":19125,"content":19126,"nodeType":866},{},[19127],{"data":19128,"marks":19129,"value":19130,"nodeType":865},{},[],"ShinyHunters accessed user accounts that lacked MFA, belonging to approximately 165 Snowflake customers. ",{"data":19132,"content":19133,"nodeType":880},{},[19134],{"data":19135,"content":19136,"nodeType":866},{},[19137],{"data":19138,"marks":19139,"value":19140,"nodeType":865},{},[],"ShinyHunters used SQL-based reconnaissance, staging, and data exfiltration techniques, expedited by custom hacker tooling developed specifically for Snowflake, to conduct attacks at scale.",{"data":19142,"content":19143,"nodeType":880},{},[19144],{"data":19145,"content":19146,"nodeType":866},{},[19147],{"data":19148,"marks":19149,"value":19150,"nodeType":865},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. ",{"data":19152,"content":19153,"nodeType":880},{},[19154],{"data":19155,"content":19156,"nodeType":866},{},[19157],{"data":19158,"marks":19159,"value":19160,"nodeType":865},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired.",{"data":19162,"content":19166,"nodeType":907},{"target":19163},{"sys":19164},{"id":19165,"type":904,"linkType":905},"2J92gFLs1wAAGC4nQTaiWu",[],{"data":19168,"content":19169,"nodeType":938},{},[],{"data":19171,"content":19172,"nodeType":948},{},[19173],{"data":19174,"marks":19175,"value":19177,"nodeType":865},{},[19176],{"type":946},"Why did the Snowflake breaches happen?",{"data":19179,"content":19180,"nodeType":1218},{},[19181],{"data":19182,"marks":19183,"value":19185,"nodeType":865},{},[19184],{"type":946},"Stolen credentials remained valid for years",{"data":19187,"content":19188,"nodeType":866},{},[19189],{"data":19190,"marks":19191,"value":19192,"nodeType":865},{},[],"The credentials used to access Snowflake accounts from historical infostealer infections had not been changed or rotated despite dating back as far as 2020, and remained valid. ",{"data":19194,"content":19195,"nodeType":866},{},[19196],{"data":19197,"marks":19198,"value":19199,"nodeType":865},{},[],"This highlights the potential risk of breached credentials already in the public domain, particularly in the case of cloud services like Snowflake that may not be subject to the same levels of credential hygiene as other traditional enterprise domain accounts. ",{"data":19201,"content":19202,"nodeType":1218},{},[19203],{"data":19204,"marks":19205,"value":19207,"nodeType":865},{},[19206],{"type":946},"Local logins lacked MFA ",{"data":19209,"content":19210,"nodeType":866},{},[19211,19215,19222],{"data":19212,"marks":19213,"value":19214,"nodeType":865},{},[],"Even where organizations were primarily encouraging employees to use SSO to access their Snowflake tenant, previously created local logins with a username and password continue to exist even after introducing SSO-based logins. Further, MFA was not globally enforceable at the application level, meaning that MFA was only set when logging into an IdP account for SSO, but not for local logins. We call this problem ",{"data":19216,"content":19217,"nodeType":1102},{"uri":15852},[19218],{"data":19219,"marks":19220,"value":5383,"nodeType":865},{},[19221],{"type":4537},{"data":19223,"marks":19224,"value":7361,"nodeType":865},{},[],{"data":19226,"content":19227,"nodeType":866},{},[19228],{"data":19229,"marks":19230,"value":19231,"nodeType":865},{},[],"This meant that attackers were able to take over Snowflake accounts with only a single authentication factor (username & password). ",{"data":19233,"content":19234,"nodeType":1218},{},[19235],{"data":19236,"marks":19237,"value":19239,"nodeType":865},{},[19238],{"type":946},"Snowflake was a high-value target used by many organizations",{"data":19241,"content":19242,"nodeType":866},{},[19243],{"data":19244,"marks":19245,"value":19246,"nodeType":865},{},[],"As a data warehousing platform used by a vast number of organizations, Snowflake represented a high-value target based on the data typically stored within it, and the repeatable way in which Snowflake users could be targeted. ",{"data":19248,"content":19249,"nodeType":866},{},[19250],{"data":19251,"marks":19252,"value":19253,"nodeType":865},{},[],"The attacker followed a near identical process when targeting Snowflake victims, meaning it could be scripted and executed at scale, with attacks taking a matter of minutes. ",{"data":19255,"content":19256,"nodeType":1218},{},[19257],{"data":19258,"marks":19259,"value":19261,"nodeType":865},{},[19260],{"type":946},"Infostealer infections are driving credential availability",{"data":19263,"content":19264,"nodeType":866},{},[19265],{"data":19266,"marks":19267,"value":19268,"nodeType":865},{},[],"Infostealers are often seen as a low-priority issue, but are the primary source of stolen credentials used in campaigns like this one. ",{"data":19270,"content":19271,"nodeType":866},{},[19272],{"data":19273,"marks":19274,"value":19275,"nodeType":865},{},[],"EDR is a strong protection but is often bypassed by infostealers as attackers continually modify them to bypass security controls. Further, unmanaged devices such as those used by third-party contractors or BYOD employees often lack the robust controls applied to company-managed devices and are naturally more susceptible to infostealer attacks. And since browser profiles can be synced across devices, even personal device compromises can result in the capture of corporate credentials.  ",{"data":19277,"content":19278,"nodeType":866},{},[19279,19283,19292],{"data":19280,"marks":19281,"value":19282,"nodeType":865},{},[],"There is some suggestion that targeting key third-party suppliers – ",{"data":19284,"content":19286,"nodeType":1102},{"uri":19285},"https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/",[19287],{"data":19288,"marks":19289,"value":19291,"nodeType":865},{},[19290],{"type":4537},"such as EPAM Systems, a software engineering firm and Snowflake ‘Elite Tier Partner’",{"data":19293,"marks":19294,"value":19295,"nodeType":865},{},[]," – provided some of the access to Snowflake customers needed. It’s unclear what came first, but it’s possible (likely, even) that EPAM was identified as a target specifically because of its lucrative customer base and Snowflake credentials — adding another indicator that Snowflake was potentially a premeditated attack inspired by the availability of Snowflake credentials online.",{"data":19297,"content":19301,"nodeType":907},{"target":19298},{"sys":19299},{"id":19300,"type":904,"linkType":905},"4D0gjt5oJLNKJH8GzjP8Je",[],{"data":19303,"content":19304,"nodeType":938},{},[],{"data":19306,"content":19307,"nodeType":948},{},[19308],{"data":19309,"marks":19310,"value":19312,"nodeType":865},{},[19311],{"type":946},"Key takeaways from the Snowflake attacks",{"data":19314,"content":19315,"nodeType":1218},{},[19316],{"data":19317,"marks":19318,"value":19320,"nodeType":865},{},[19319],{"type":946},"Securing your IdP accounts is not enough",{"data":19322,"content":19323,"nodeType":866},{},[19324],{"data":19325,"marks":19326,"value":19327,"nodeType":865},{},[],"SSO can help reduce your identity attack surface, but it's not feasible to get every workforce identity behind it.",{"data":19329,"content":19330,"nodeType":891},{},[19331,19354,19375,19409],{"data":19332,"content":19333,"nodeType":880},{},[19334],{"data":19335,"content":19336,"nodeType":866},{},[19337,19341,19350],{"data":19338,"marks":19339,"value":19340,"nodeType":865},{},[],"Only 1 in 3 apps support SAML SSO, and those that offer it often charge more for it; the “",{"data":19342,"content":19344,"nodeType":1102},{"uri":19343},"https://ssotax.org/",[19345],{"data":19346,"marks":19347,"value":19349,"nodeType":865},{},[19348],{"type":4537},"SSO tax",{"data":19351,"marks":19352,"value":19353,"nodeType":865},{},[],"”.",{"data":19355,"content":19356,"nodeType":880},{},[19357],{"data":19358,"content":19359,"nodeType":866},{},[19360,19364,19372],{"data":19361,"marks":19362,"value":19363,"nodeType":865},{},[],"Many apps are self-adopted by employees, leaving security teams unaware and unable to enforce SSO.  The typical organization has ",{"data":19365,"content":19366,"nodeType":1102},{"uri":6406},[19367],{"data":19368,"marks":19369,"value":19371,"nodeType":865},{},[19370],{"type":4537},"hundreds of apps and thousands of unmanaged identities outside of SSO",{"data":19373,"marks":19374,"value":1151,"nodeType":865},{},[],{"data":19376,"content":19377,"nodeType":880},{},[19378],{"data":19379,"content":19380,"nodeType":866},{},[19381,19385,19392,19396,19405],{"data":19382,"marks":19383,"value":19384,"nodeType":865},{},[],"Most apps do not prevent users from creating additional \"",{"data":19386,"content":19387,"nodeType":1102},{"uri":15852},[19388],{"data":19389,"marks":19390,"value":6455,"nodeType":865},{},[19391],{"type":4537},{"data":19393,"marks":19394,"value":19395,"nodeType":865},{},[],"\" methods outside of SSO (especially by default), accounting for around ",{"data":19397,"content":19399,"nodeType":1102},{"uri":19398},"https://pushsecurity.com/blog/how-many-vulnerable-identities-do-you-have/#id-identity-configurations-and-how-they-can-be-exploited_id-many-accounts-lack-the-most-basic-protections",[19400],{"data":19401,"marks":19402,"value":19404,"nodeType":865},{},[19403],{"type":4537},"10% of all identities",{"data":19406,"marks":19407,"value":19408,"nodeType":865},{},[]," observed by Push. ",{"data":19410,"content":19411,"nodeType":880},{},[19412],{"data":19413,"content":19414,"nodeType":866},{},[19415,19419,19427],{"data":19416,"marks":19417,"value":19418,"nodeType":865},{},[],"In total, we identified that ",{"data":19420,"content":19421,"nodeType":1102},{"uri":6406},[19422],{"data":19423,"marks":19424,"value":19426,"nodeType":865},{},[19425],{"type":4537},"37% (2 in 5) accounts have a password login set with no MFA",{"data":19428,"marks":19429,"value":19430,"nodeType":865},{},[],", while 9% have no MFA AND a weak, breached, or reused password.",{"data":19432,"content":19433,"nodeType":866},{},[19434],{"data":19435,"marks":19436,"value":19437,"nodeType":865},{},[],"So, relying on locked-down IdP accounts and maximising the use of SSO is an important pillar of an effective identity security strategy, but there will always be gaps. Unless you recognize this, you may be blindsided by attackers finding them before you do. ",{"data":19439,"content":19440,"nodeType":1218},{},[19441],{"data":19442,"marks":19443,"value":19445,"nodeType":865},{},[19444],{"type":946},"The threat of infostealers and stolen credentials needs to be taken seriously",{"data":19447,"content":19448,"nodeType":866},{},[19449],{"data":19450,"marks":19451,"value":19452,"nodeType":865},{},[],"Breached credentials appearing online is not always seen as a top priority for security teams, particularly when there’s so much noise from all of the outdated or simply erroneous findings (anyone that’s ever subscribed to a credential TI feed knows the pain of this). ",{"data":19454,"content":19455,"nodeType":866},{},[19456],{"data":19457,"marks":19458,"value":19459,"nodeType":865},{},[],"But Snowflake serves as a stark reminder that despite all the false positives, stolen credentials are sometimes valid — and when weaponized at-scale they can be a powerful tool for attackers. ",{"data":19461,"content":19465,"nodeType":907},{"target":19462},{"sys":19463},{"id":19464,"type":904,"linkType":905},"4EODpwKsqNivpvP2yMtZCd",[],{"data":19467,"content":19468,"nodeType":1218},{},[19469],{"data":19470,"marks":19471,"value":19473,"nodeType":865},{},[19472],{"type":946},"Don’t rely on third-parties to protect your identities for you",{"data":19475,"content":19476,"nodeType":866},{},[19477],{"data":19478,"marks":19479,"value":19480,"nodeType":865},{},[],"Snowflake came under fire following the attacks for not enabling MFA by default, or giving security teams sufficient tools to deal with the incident. ",{"data":19482,"content":19483,"nodeType":866},{},[19484],{"data":19485,"marks":19486,"value":19487,"nodeType":865},{},[],"This is perhaps justifiable, but is hardly the exception. Very few apps enforce MFA by default or provide a global MFA enforcement mechanism. Most don’t even provide audit logs (and when they do, the scope of logging is pretty limited). And we regularly encounter apps that don’t give you any information about account configuration as an admin — like which accounts have MFA, or the login methods that they’re using (e.g. SSO via SAML, SSO via OIDC, password, which IdPs are being used…) which is essential information to be able to secure your identity attack surface. ",{"data":19489,"content":19490,"nodeType":866},{},[19491],{"data":19492,"marks":19493,"value":19494,"nodeType":865},{},[],"Yes, it would be great if app vendors put security first and made controls available by default, for all customers (not just the premium ones). But in the absence of an industrywide shift toward security-first product development, it’s important that organizations don’t just point the finger at service providers — and take matters into their own hands when it comes to securing their user identities. ",{"data":19496,"content":19497,"nodeType":1218},{},[19498],{"data":19499,"marks":19500,"value":19502,"nodeType":865},{},[19501],{"type":946},"This isn’t a specific Snowflake problem — it could have been any application",{"data":19504,"content":19505,"nodeType":866},{},[19506],{"data":19507,"marks":19508,"value":19509,"nodeType":865},{},[],"While Snowflake was admittedly a high-value target because of the data it collected, apps with sensitive data (or with integrations connecting them to data collected in adjacent apps) are not in short supply. ",{"data":19511,"content":19512,"nodeType":866},{},[19513],{"data":19514,"marks":19515,"value":19516,"nodeType":865},{},[],"If we accept that many other apps are similarly desirable targets, then we should also consider that it’s unlikely that Snowflake is the only app that has valid credentials sitting around on the internet, waiting to be weaponized by criminals. Equally, it’s not the only app that doesn’t require mandatory MFA for user accounts, as we discussed above. The next Snowflake is likely to lurk in the same breached datasets, possibly even using the same credentials.",{"data":19518,"content":19519,"nodeType":866},{},[19520],{"data":19521,"marks":19522,"value":19523,"nodeType":865},{},[],"There’s been a clear increase in the number of infostealer and stolen credential related breaches and news stories since Snowflake as attackers wise up to the potential opportunity and start seeing the dollar signs. It would be naive to think that this was a one off event — the next Snowflake is probably not too far away. ",{"data":19525,"content":19526,"nodeType":866},{},[19527],{"data":19528,"marks":19529,"value":19530,"nodeType":865},{},[],"For a deep-dive analysis of the impact of Snowflake, check out our on-demand webinar from earlier this year.",{"data":19532,"content":19536,"nodeType":907},{"target":19533},{"sys":19534},{"id":19535,"type":904,"linkType":905},"7LkU5DqE9HJ1PQu9BTg6Mw",[],{"data":19538,"content":19539,"nodeType":938},{},[],{"data":19541,"content":19542,"nodeType":948},{},[19543],{"data":19544,"marks":19545,"value":19547,"nodeType":865},{},[19546],{"type":946},"How to protect yourself from the next Snowflake using Push",{"data":19549,"content":19550,"nodeType":866},{},[19551],{"data":19552,"marks":19553,"value":19554,"nodeType":865},{},[],"Organizations looking to reduce their exposure to account takeover using stolen credentials should look to:",{"data":19556,"content":19557,"nodeType":891},{},[19558,19568,19578],{"data":19559,"content":19560,"nodeType":880},{},[19561],{"data":19562,"content":19563,"nodeType":866},{},[19564],{"data":19565,"marks":19566,"value":19567,"nodeType":865},{},[],"Identify the apps being used across the business and locate vulnerable workforce identities using weak, breached, or reused credentials, and missing MFA. Where SSO is the preferred login method, local username & password logins should ideally be removed. ",{"data":19569,"content":19570,"nodeType":880},{},[19571],{"data":19572,"content":19573,"nodeType":866},{},[19574],{"data":19575,"marks":19576,"value":19577,"nodeType":865},{},[],"Where credentials appear in third-party data breaches, verify where they are still valid and ensure that the credentials are changed. ",{"data":19579,"content":19580,"nodeType":880},{},[19581],{"data":19582,"content":19583,"nodeType":866},{},[19584],{"data":19585,"marks":19586,"value":19587,"nodeType":865},{},[],"Detect unauthorized access to workforce identities where sessions are initiated or resumed from unusual or unexpected locations. It should be noted that while this is a fairly common feature for larger enterprise cloud platforms with configurable access control policies, this is not typically possible for most SaaS applications.  ",{"data":19589,"content":19590,"nodeType":866},{},[19591],{"data":19592,"marks":19593,"value":19594,"nodeType":865},{},[],"All of these use cases can be achieved using Push. The Push browser extension detects all logins performed in employee browsers, capturing granular information about the login method and MFA types used, and enriching this data by integrating with your preferred IdP.",{"data":19596,"content":19597,"nodeType":866},{},[19598,19601,19609],{"data":19599,"marks":19600,"value":15586,"nodeType":865},{},[],{"data":19602,"content":19604,"nodeType":1102},{"uri":19603},"https://pushsecurity.com/blog/verified-stolen-credential-detection",[19605],{"data":19606,"marks":19607,"value":19608,"nodeType":865},{},[],"verified stolen credential detection feature",{"data":19610,"marks":19611,"value":19612,"nodeType":865},{},[]," compares a k-anonymized hash of user passwords observed with stolen credential TI feeds to cut through the noise and identify where stolen credentials appearing online represent a genuine vulnerability.   ",{"data":19614,"content":19615,"nodeType":866},{},[19616,19620,19628],{"data":19617,"marks":19618,"value":19619,"nodeType":865},{},[],"On top of this, all logins made in browsers protected by the Push extension, across every app, are verified by ",{"data":19621,"content":19622,"nodeType":1102},{"uri":15589},[19623],{"data":19624,"marks":19625,"value":19627,"nodeType":865},{},[19626],{"type":4537},"adding a unique marker to the user agent string of the session",{"data":19629,"marks":19630,"value":19631,"nodeType":865},{},[],", which will then appear in your IdP logs. This means that any session occurring outside of the Push-protected estate can be flagged to your security team via SIEM alert — including where an attacker uses stolen credentials to log into an app from a browser without the Push extension running. ",{"data":19633,"content":19636,"nodeType":907},{"target":19634},{"sys":19635},{"id":18446,"type":904,"linkType":905},[],{"data":19638,"content":19639,"nodeType":866},{},[19640],{"data":19641,"marks":19642,"value":21,"nodeType":865},{},[],"Snowflake: Looking back on 2024’s landmark security event","165 Snowflake customers were targeted by criminals using stolen credentials from infostealer infections, impacting hundreds of millions of people. ","2024-11-29T00:00:00.000Z","snowflake-retro",{"items":19648},[19649],{"sys":19650,"name":2524},{"id":2523},{"items":19652},[19653],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":19654},{"url":6031},"automating-sso-password-resets-using-push","blog/automating-sso-password-resets-using-push",{"json":19658},{"data":19659,"content":19660,"nodeType":2232},{},[19661],{"data":19662,"content":19663,"nodeType":866},{},[19664],{"data":19665,"marks":19666,"value":19667,"nodeType":865},{},[],"Automate password resets for your most critical identities when a password vulnerability is detected, such as when an employee reuses their SSO password outside of SSO, or valid credentials are detected in a compromised credential feed.","Using Push to automate password resets for your most critical identities when a password vulnerability is detected.",{"id":19670,"publishedAt":19671},"75wcCkoZEKwEMl7zBmDMtT","2026-08-12T11:54:39.926Z",{"items":19673},[19674,19676],{"sys":19675,"name":297},{"id":11129},{"sys":19677,"name":342},{"id":2527},{"items":19679},[19680,19682,19684,19686,19688,19690,19692,19694],{"sys":19681,"name":413,"slug":414,"tier":31},{"id":410},{"sys":19683,"name":297,"slug":298,"tier":31},{"id":294},{"sys":19685,"name":342,"slug":343,"tier":31},{"id":339},{"sys":19687,"name":502,"slug":503,"tier":45},{"id":499},{"sys":19689,"name":333,"slug":334,"tier":45},{"id":330},{"sys":19691,"name":422,"slug":423,"tier":45},{"id":419},{"sys":19693,"name":457,"slug":458,"tier":45},{"id":454},{"sys":19695,"name":598,"slug":599,"tier":45},{"id":595},"q80K9VPoT317fRd4VSKWsBadfP5Demd2gTp57CuJsqM",{"id":19698,"title":19699,"authorsCollection":19700,"content":19704,"extension":228,"faqItemsCollection":21305,"faqTitle":59,"featured":6,"hashTags":59,"meta":21307,"metaTitle":21308,"ogImage":59,"postType":2498,"publishedDate":21309,"relatedBlogPostsCollection":21310,"slug":23092,"stem":23093,"subtitle":59,"summary":23094,"synopsis":23105,"sys":23106,"tagsCollection":23109,"topicsCollection":23113,"__hash__":23131},"blog/blog/navigating-your-first-90-days-with-push.json","River crossing: What you can accomplish in your first 90 days with Push Security",{"items":19701},[19702],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":19703},{"url":853},{"json":19705,"links":21200},{"data":19706,"content":19707,"nodeType":2232},{},[19708,19715,19722,19738,19744,19763,19770,19777,19780,19787,19794,19873,19880,19887,19894,19901,19908,19915,19930,19936,20016,20023,20030,20066,20073,20079,20086,20101,20211,20235,20241,20248,20264,20270,20273,20280,20287,20302,20309,20316,20323,20346,20367,20373,20380,20387,20394,20410,20416,20452,20458,20465,20493,20505,20512,20519,20526,20576,20583,20589,20596,20599,20606,20613,20620,20627,20680,20694,20744,20775,20782,20847,20853,20860,20913,20932,20939,20954,20992,20999,21006,21013,21039,21045,21048,21055,21062,21069,21181,21188,21194],{"data":19709,"content":19710,"nodeType":948},{},[19711],{"data":19712,"marks":19713,"value":19714,"nodeType":865},{},[],"The journey ahead",{"data":19716,"content":19717,"nodeType":866},{},[19718],{"data":19719,"marks":19720,"value":19721,"nodeType":865},{},[],"So you’ve chosen Push to accompany you on your identity security journey. Good choice! We’ve got (threat) hunting supplies and a sturdy raft. It’s risky to go alone, though, so take this map with you.",{"data":19723,"content":19724,"nodeType":866},{},[19725,19729,19734],{"data":19726,"marks":19727,"value":19728,"nodeType":865},{},[],"Inspired by the classic 1980s video game* ",{"data":19730,"marks":19731,"value":19733,"nodeType":865},{},[19732],{"type":979},"Oregon Trail",{"data":19735,"marks":19736,"value":19737,"nodeType":865},{},[],", we’ve put together the following guide for intrepid security teams who are traveling across potentially unknown territory as they uncover their identity attack surface, including shadow identities and apps, and secure it against modern identity attacks.",{"data":19739,"content":19743,"nodeType":907},{"target":19740},{"sys":19741},{"id":19742,"type":904,"linkType":905},"3Ys8l6lqQcWOFX5O6QSulO",[],{"data":19745,"content":19746,"nodeType":866},{},[19747,19751,19759],{"data":19748,"marks":19749,"value":19750,"nodeType":865},{},[],"(*For Push fans outside the U.S., Oregon Trail followed a group of pioneers as they attempted to cross the continent in a covered wagon, avoiding wild animals and hunting for food along the way. The ",{"data":19752,"content":19754,"nodeType":1102},{"uri":19753},"https://knowyourmeme.com/memes/subcultures/the-oregon-trail",[19755],{"data":19756,"marks":19757,"value":19758,"nodeType":865},{},[],"memes",{"data":19760,"marks":19761,"value":19762,"nodeType":865},{},[]," now outlive the game, but we remember it fondly.)",{"data":19764,"content":19765,"nodeType":866},{},[19766],{"data":19767,"marks":19768,"value":19769,"nodeType":865},{},[],"In this guide, we’ll provide advice on what you can accomplish in your first three months after deploying Push to your workforce, transforming your employees’ browsers into a reliable control point to enforce a strong identity posture and stop account takeover.",{"data":19771,"content":19772,"nodeType":866},{},[19773],{"data":19774,"marks":19775,"value":19776,"nodeType":865},{},[],"In your first 90 days using Push, you can go far. Let’s take a look.",{"data":19778,"content":19779,"nodeType":938},{},[],{"data":19781,"content":19782,"nodeType":948},{},[19783],{"data":19784,"marks":19785,"value":19786,"nodeType":865},{},[],"First 30 days: Get intel and secure against bears",{"data":19788,"content":19789,"nodeType":866},{},[19790],{"data":19791,"marks":19792,"value":19793,"nodeType":865},{},[],"This guide assumes you’ve identified a few identity security goals already. These probably include things like:",{"data":19795,"content":19796,"nodeType":891},{},[19797,19820,19843,19853,19863],{"data":19798,"content":19799,"nodeType":880},{},[19800],{"data":19801,"content":19802,"nodeType":866},{},[19803,19807,19817],{"data":19804,"marks":19805,"value":19806,"nodeType":865},{},[],"Closing gaps in existing security controls to protect against MFA bypass attacks like Adversary-in-the-Middle ",{"data":19808,"content":19812,"nodeType":1038},{"target":19809},{"sys":19810},{"id":19811,"type":904,"linkType":905},"11C3shj5SlkS8sAd3AlYDp",[19813],{"data":19814,"marks":19815,"value":19816,"nodeType":865},{},[],"(AiTM) phishing toolkits",{"data":19818,"marks":19819,"value":1151,"nodeType":865},{},[],{"data":19821,"content":19822,"nodeType":880},{},[19823],{"data":19824,"content":19825,"nodeType":866},{},[19826,19830,19839],{"data":19827,"marks":19828,"value":19829,"nodeType":865},{},[],"Increasing ",{"data":19831,"content":19834,"nodeType":1038},{"target":19832},{"sys":19833},{"id":6837,"type":904,"linkType":905},[19835],{"data":19836,"marks":19837,"value":19838,"nodeType":865},{},[],"visibility of user activity",{"data":19840,"marks":19841,"value":19842,"nodeType":865},{},[]," in the browser to identify and respond to threats.",{"data":19844,"content":19845,"nodeType":880},{},[19846],{"data":19847,"content":19848,"nodeType":866},{},[19849],{"data":19850,"marks":19851,"value":19852,"nodeType":865},{},[],"Using federated SSO-based logins over password-based logins to limit the number of identities created, and removing unused login methods.",{"data":19854,"content":19855,"nodeType":880},{},[19856],{"data":19857,"content":19858,"nodeType":866},{},[19859],{"data":19860,"marks":19861,"value":19862,"nodeType":865},{},[],"Implementing phishing-resistant authentication methods, and removing phishable ones.",{"data":19864,"content":19865,"nodeType":880},{},[19866],{"data":19867,"content":19868,"nodeType":866},{},[19869],{"data":19870,"marks":19871,"value":19872,"nodeType":865},{},[],"Where password use cannot be avoided, ensuring good hygiene (no weak, reused, or breached passwords) and phishing-resistant MFA factors.",{"data":19874,"content":19875,"nodeType":866},{},[19876],{"data":19877,"marks":19878,"value":19879,"nodeType":865},{},[],"Then, once you’ve deployed the Push browser extension to your browser ecosystem, invited your security team to the Push admin console, and begun collecting behavioral and identity posture data from your employees’ login activity, you’re ready to embark.",{"data":19881,"content":19882,"nodeType":866},{},[19883],{"data":19884,"marks":19885,"value":19886,"nodeType":865},{},[],"Right away, you can set up your first out-of-the-box security control to provide novel and effective protection against adversary-in-the-middle (AiTM) phishing toolkits such as Evilginx, EvilNoVNC, and others.",{"data":19888,"content":19889,"nodeType":866},{},[19890],{"data":19891,"marks":19892,"value":19893,"nodeType":865},{},[],"It’s the identity security equivalent of bear deterrent (something sadly lacking on the Oregon Trail), and it takes just a couple of minutes.",{"data":19895,"content":19896,"nodeType":866},{},[19897],{"data":19898,"marks":19899,"value":19900,"nodeType":865},{},[],"You can also set additional security controls in Monitor mode and begin collecting valuable insights from your users’ account and app activity.",{"data":19902,"content":19903,"nodeType":866},{},[19904],{"data":19905,"marks":19906,"value":19907,"nodeType":865},{},[],"Here’s what we recommend for your first 30 days using Push:",{"data":19909,"content":19910,"nodeType":1218},{},[19911],{"data":19912,"marks":19913,"value":19914,"nodeType":865},{},[],"Enable phishing tool detection in Warn or Block mode",{"data":19916,"content":19917,"nodeType":866},{},[19918,19922,19927],{"data":19919,"marks":19920,"value":19921,"nodeType":865},{},[],"Begin protecting employees from adversary-in-the-middle phishing from AitM tools by enabling ",{"data":19923,"marks":19924,"value":19926,"nodeType":865},{},[19925],{"type":946},"Phishing tool detection",{"data":19928,"marks":19929,"value":1151,"nodeType":865},{},[],{"data":19931,"content":19935,"nodeType":907},{"target":19932},{"sys":19933},{"id":19934,"type":904,"linkType":905},"2ylIkR0JXHkFStGuCFRjlN",[],{"data":19937,"content":19938,"nodeType":891},{},[19939,19978,19988,19998],{"data":19940,"content":19941,"nodeType":880},{},[19942],{"data":19943,"content":19944,"nodeType":866},{},[19945,19948,19952,19956,19960,19964,19968,19971,19975],{"data":19946,"marks":19947,"value":2124,"nodeType":865},{},[],{"data":19949,"marks":19950,"value":2821,"nodeType":865},{},[19951],{"type":946},{"data":19953,"marks":19954,"value":19955,"nodeType":865},{},[]," page in the Push admin console, select ",{"data":19957,"marks":19958,"value":19926,"nodeType":865},{},[19959],{"type":946},{"data":19961,"marks":19962,"value":19963,"nodeType":865},{},[]," and set the mode to ",{"data":19965,"marks":19966,"value":2080,"nodeType":865},{},[19967],{"type":946},{"data":19969,"marks":19970,"value":1773,"nodeType":865},{},[],{"data":19972,"marks":19973,"value":2088,"nodeType":865},{},[19974],{"type":946},{"data":19976,"marks":19977,"value":1151,"nodeType":865},{},[],{"data":19979,"content":19980,"nodeType":880},{},[19981],{"data":19982,"content":19983,"nodeType":866},{},[19984],{"data":19985,"marks":19986,"value":19987,"nodeType":865},{},[],"Customize the message that employees will see if they encounter a malicious site.",{"data":19989,"content":19990,"nodeType":880},{},[19991],{"data":19992,"content":19993,"nodeType":866},{},[19994],{"data":19995,"marks":19996,"value":19997,"nodeType":865},{},[],"Add domains to the ignore list if you wish to ignore enforcing the control on specific domains or encounter any domains that trigger false positives.",{"data":19999,"content":20000,"nodeType":880},{},[20001],{"data":20002,"content":20003,"nodeType":866},{},[20004,20008,20012],{"data":20005,"marks":20006,"value":20007,"nodeType":865},{},[],"You can monitor the ",{"data":20009,"marks":20010,"value":2058,"nodeType":865},{},[20011],{"type":946},{"data":20013,"marks":20014,"value":20015,"nodeType":865},{},[]," page (or send Push events to an external SIEM or SOAR) to see when the control is triggered.",{"data":20017,"content":20018,"nodeType":866},{},[20019],{"data":20020,"marks":20021,"value":20022,"nodeType":865},{},[],"You may also wish to communicate with your end-users to let them know you’re enabling a new security protection to stop phishing attacks and that if they encounter a malicious site, they’ll see a warning.",{"data":20024,"content":20025,"nodeType":1218},{},[20026],{"data":20027,"marks":20028,"value":20029,"nodeType":865},{},[],"Check for verified stolen credentials",{"data":20031,"content":20032,"nodeType":866},{},[20033,20037,20046,20050,20055,20059,20063],{"data":20034,"marks":20035,"value":20036,"nodeType":865},{},[],"Push uses threat intelligence sources to compare suspected ",{"data":20038,"content":20041,"nodeType":1038},{"target":20039},{"sys":20040},{"id":17755,"type":904,"linkType":905},[20042],{"data":20043,"marks":20044,"value":20045,"nodeType":865},{},[],"stolen credentials",{"data":20047,"marks":20048,"value":20049,"nodeType":865},{},[]," to those still actively in use across your workforce identities. You don’t need to configure anything for this feature, and you can check for any verified true positives by viewing the ",{"data":20051,"marks":20052,"value":20054,"nodeType":865},{},[20053],{"type":946},"Vulnerable identities",{"data":20056,"marks":20057,"value":20058,"nodeType":865},{},[]," section of the ",{"data":20060,"marks":20061,"value":3741,"nodeType":865},{},[20062],{"type":946},{"data":20064,"marks":20065,"value":1677,"nodeType":865},{},[],{"data":20067,"content":20068,"nodeType":866},{},[20069],{"data":20070,"marks":20071,"value":20072,"nodeType":865},{},[],"We recommend investigating immediately and taking action to remediate any accounts with verified stolen credentials.",{"data":20074,"content":20078,"nodeType":907},{"target":20075},{"sys":20076},{"id":20077,"type":904,"linkType":905},"150dE4aTzofOwFXJCtGkJF",[],{"data":20080,"content":20081,"nodeType":1218},{},[20082],{"data":20083,"marks":20084,"value":20085,"nodeType":865},{},[],"Enable additional security controls in Monitor mode",{"data":20087,"content":20088,"nodeType":866},{},[20089,20093,20097],{"data":20090,"marks":20091,"value":20092,"nodeType":865},{},[],"Next, set up additional security controls in ",{"data":20094,"marks":20095,"value":2041,"nodeType":865},{},[20096],{"type":946},{"data":20098,"marks":20099,"value":20100,"nodeType":865},{},[]," mode so you can begin finetuning your configuration or adding to ignore lists. A few details to keep in mind:",{"data":20102,"content":20103,"nodeType":891},{},[20104,20142,20165,20188],{"data":20105,"content":20106,"nodeType":880},{},[20107],{"data":20108,"content":20109,"nodeType":866},{},[20110,20115,20119,20130,20134,20138],{"data":20111,"marks":20112,"value":20114,"nodeType":865},{},[20113],{"type":946},"For all controls",{"data":20116,"marks":20117,"value":20118,"nodeType":865},{},[],", update your ",{"data":20120,"content":20124,"nodeType":1038},{"target":20121},{"sys":20122},{"id":20123,"type":904,"linkType":905},"2q4iZicL3D85XGTsYZ5mgK",[20125],{"data":20126,"marks":20127,"value":20129,"nodeType":865},{},[20128],{"type":946},"Custom login URLs",{"data":20131,"marks":20132,"value":20133,"nodeType":865},{},[]," list on the ",{"data":20135,"marks":20136,"value":2129,"nodeType":865},{},[20137],{"type":946},{"data":20139,"marks":20140,"value":20141,"nodeType":865},{},[]," page to include any custom URLs you use for your identity provider or other important apps, so that Push can correctly identify those logins as belonging to your IdP (or other app).",{"data":20143,"content":20144,"nodeType":880},{},[20145],{"data":20146,"content":20147,"nodeType":866},{},[20148,20153,20157,20161],{"data":20149,"marks":20150,"value":20152,"nodeType":865},{},[20151],{"type":946},"For SSO password protection",{"data":20154,"marks":20155,"value":20156,"nodeType":865},{},[],", we recommend starting in ",{"data":20158,"marks":20159,"value":2041,"nodeType":865},{},[20160],{"type":946},{"data":20162,"marks":20163,"value":20164,"nodeType":865},{},[]," so you can identify any sites in your environment that cause false positives, such as sites that are configured to legitimately allow use of SSO credentials. Then add these sites to your ignore list. By running in monitor mode for a few weeks, you can also get a sense of how often employees are reusing their corporate IdP credentials on other sites where they shouldn’t, such as personal apps.",{"data":20166,"content":20167,"nodeType":880},{},[20168],{"data":20169,"content":20170,"nodeType":866},{},[20171,20176,20180,20184],{"data":20172,"marks":20173,"value":20175,"nodeType":865},{},[20174],{"type":946},"For cloned login page detection",{"data":20177,"marks":20178,"value":20179,"nodeType":865},{},[],", set the mode to ",{"data":20181,"marks":20182,"value":2041,"nodeType":865},{},[20183],{"type":946},{"data":20185,"marks":20186,"value":20187,"nodeType":865},{},[]," to receive events when employees visit a site using a cloned login screen for important apps including your identity provider.",{"data":20189,"content":20190,"nodeType":880},{},[20191],{"data":20192,"content":20193,"nodeType":866},{},[20194,20199,20203,20207],{"data":20195,"marks":20196,"value":20198,"nodeType":865},{},[20197],{"type":946},"For URL blocking",{"data":20200,"marks":20201,"value":20202,"nodeType":865},{},[],", test a blocked URL or begin compiling a list of URLs you wish to block, such as AiTM sites discovered through phishing sites you find while using the ",{"data":20204,"marks":20205,"value":19926,"nodeType":865},{},[20206],{"type":946},{"data":20208,"marks":20209,"value":20210,"nodeType":865},{},[]," feature.",{"data":20212,"content":20213,"nodeType":866},{},[20214,20218,20222,20226,20231],{"data":20215,"marks":20216,"value":20217,"nodeType":865},{},[],"To see events generated by these controls, filter the ",{"data":20219,"marks":20220,"value":2058,"nodeType":865},{},[20221],{"type":946},{"data":20223,"marks":20224,"value":20225,"nodeType":865},{},[]," page. Go to the filters icon, then select ",{"data":20227,"marks":20228,"value":20230,"nodeType":865},{},[20229],{"type":946},"Events > By type",{"data":20232,"marks":20233,"value":20234,"nodeType":865},{},[]," from the dropdown and choose the specific control to see associated events.",{"data":20236,"content":20240,"nodeType":907},{"target":20237},{"sys":20238},{"id":20239,"type":904,"linkType":905},"2M0Cjc2Wo9L7c9rIQebx0S",[],{"data":20242,"content":20243,"nodeType":1218},{},[20244],{"data":20245,"marks":20246,"value":20247,"nodeType":865},{},[],"Set up alerts for your security team",{"data":20249,"content":20250,"nodeType":866},{},[20251,20255,20260],{"data":20252,"marks":20253,"value":20254,"nodeType":865},{},[],"Push can send notifications of interesting employee activity to a Microsoft Teams or Slack channel so you can stay on top of new apps and account security findings. In the admin console, go to the ",{"data":20256,"marks":20257,"value":20259,"nodeType":865},{},[20258],{"type":946},"ChatOps",{"data":20261,"marks":20262,"value":20263,"nodeType":865},{},[]," page and integrate your Teams or Slack instance, then enable topics you wish to get notified about.",{"data":20265,"content":20269,"nodeType":907},{"target":20266},{"sys":20267},{"id":20268,"type":904,"linkType":905},"OObhJQA1HMcmwBvpWfmC7",[],{"data":20271,"content":20272,"nodeType":938},{},[],{"data":20274,"content":20275,"nodeType":948},{},[20276],{"data":20277,"marks":20278,"value":20279,"nodeType":865},{},[],"First 60 days: Go (threat) hunting",{"data":20281,"content":20282,"nodeType":866},{},[20283],{"data":20284,"marks":20285,"value":20286,"nodeType":865},{},[],"Now you’re ready to survey the landscape and see where there are dangers hiding among your workforce identities such as missing MFA or SSO, unused accounts, compromised passwords, and unsanctioned or untrustworthy apps and integrations. ",{"data":20288,"content":20289,"nodeType":866},{},[20290,20294,20298],{"data":20291,"marks":20292,"value":20293,"nodeType":865},{},[],"Luckily, Push doesn’t make you forage for the important information. Use the ",{"data":20295,"marks":20296,"value":3741,"nodeType":865},{},[20297],{"type":946},{"data":20299,"marks":20300,"value":20301,"nodeType":865},{},[]," in the Push admin console to pinpoint vulnerable identities and see SSO trends and other insights.",{"data":20303,"content":20304,"nodeType":866},{},[20305],{"data":20306,"marks":20307,"value":20308,"nodeType":865},{},[],"After getting a baseline understanding of your ecosystem, you can begin translating your security policies into actionable controls by preparing end-users and creating the foundation for control configuration rules.",{"data":20310,"content":20311,"nodeType":866},{},[20312],{"data":20313,"marks":20314,"value":20315,"nodeType":865},{},[],"Here’s what we recommend for your second month using Push:",{"data":20317,"content":20318,"nodeType":1218},{},[20319],{"data":20320,"marks":20321,"value":20322,"nodeType":865},{},[],"Understand which identities are most vulnerable to account takeover",{"data":20324,"content":20325,"nodeType":866},{},[20326,20330,20334,20338,20342],{"data":20327,"marks":20328,"value":20329,"nodeType":865},{},[],"On the ",{"data":20331,"marks":20332,"value":3741,"nodeType":865},{},[20333],{"type":946},{"data":20335,"marks":20336,"value":20337,"nodeType":865},{},[],", you can identify which identities are most at risk because they use a leaked, reused, or weak password and lack MFA by referencing the ",{"data":20339,"marks":20340,"value":20054,"nodeType":865},{},[20341],{"type":946},{"data":20343,"marks":20344,"value":20345,"nodeType":865},{},[]," section.",{"data":20347,"content":20348,"nodeType":866},{},[20349,20354,20358,20363],{"data":20350,"marks":20351,"value":20353,"nodeType":865},{},[20352],{"type":946},"Tip: ",{"data":20355,"marks":20356,"value":20357,"nodeType":865},{},[],"Toggle the view to ",{"data":20359,"marks":20360,"value":20362,"nodeType":865},{},[20361],{"type":946},"All identities",{"data":20364,"marks":20365,"value":20366,"nodeType":865},{},[]," if you are not yet using the sensitivity labels for apps to get a full picture of your data.",{"data":20368,"content":20372,"nodeType":907},{"target":20369},{"sys":20370},{"id":20371,"type":904,"linkType":905},"4xPy4cr18jk7JV7TWqnmoy",[],{"data":20374,"content":20375,"nodeType":866},{},[20376],{"data":20377,"marks":20378,"value":20379,"nodeType":865},{},[],"Select each slice of the chart to go to a filtered list of the accounts with those security issues. You can then evaluate which accounts pose the biggest risk, whether they belong to high-sensitivity apps or high-value roles, such as admins or executives, or whether there are any data patterns, such as a cluster of account issues that belong to specific teams, that will help you decide on a remediation strategy.",{"data":20381,"content":20382,"nodeType":866},{},[20383],{"data":20384,"marks":20385,"value":20386,"nodeType":865},{},[],"As mentioned earlier, we recommend taking immediate action for any accounts with verified stolen credentials, especially those that also lack MFA protection.",{"data":20388,"content":20389,"nodeType":1218},{},[20390],{"data":20391,"marks":20392,"value":20393,"nodeType":865},{},[],"Check your SSO coverage",{"data":20395,"content":20396,"nodeType":866},{},[20397,20401,20406],{"data":20398,"marks":20399,"value":20400,"nodeType":865},{},[],"On the Dashboard, you can also start to see your ",{"data":20402,"marks":20403,"value":20405,"nodeType":865},{},[20404],{"type":946},"SSO trends",{"data":20407,"marks":20408,"value":20409,"nodeType":865},{},[],". Use this section of the dashboard to see a breakdown of login methods for your accounts (SAML, OIDC, or non-SSO).",{"data":20411,"content":20415,"nodeType":907},{"target":20412},{"sys":20413},{"id":20414,"type":904,"linkType":905},"6GbX5cV4wOerwFeqKKAolC",[],{"data":20417,"content":20418,"nodeType":866},{},[20419,20423,20427,20431,20436,20440,20449],{"data":20420,"marks":20421,"value":20422,"nodeType":865},{},[],"You can look at more granular information on the ",{"data":20424,"marks":20425,"value":8936,"nodeType":865},{},[20426],{"type":946},{"data":20428,"marks":20429,"value":20430,"nodeType":865},{},[]," page by filtering by ",{"data":20432,"marks":20433,"value":20435,"nodeType":865},{},[20434],{"type":946},"Login method",{"data":20437,"marks":20438,"value":20439,"nodeType":865},{},[],". For example, you may wish to view accounts that have used both password and SAML login methods to identify local accounts on high-value apps that should be using SSO only — otherwise known as ",{"data":20441,"content":20445,"nodeType":1038},{"target":20442},{"sys":20443},{"id":20444,"type":904,"linkType":905},"174u87EYeKMKHzYYxBLlHO",[20446],{"data":20447,"marks":20448,"value":5383,"nodeType":865},{},[],{"data":20450,"marks":20451,"value":1151,"nodeType":865},{},[],{"data":20453,"content":20457,"nodeType":907},{"target":20454},{"sys":20455},{"id":20456,"type":904,"linkType":905},"68Sfs2MmpkdISb4rnoTCzW",[],{"data":20459,"content":20460,"nodeType":1218},{},[20461],{"data":20462,"marks":20463,"value":20464,"nodeType":865},{},[],"Review patterns in employee activity",{"data":20466,"content":20467,"nodeType":866},{},[20468,20471,20475,20478,20482,20485,20489],{"data":20469,"marks":20470,"value":1904,"nodeType":865},{},[],{"data":20472,"marks":20473,"value":8928,"nodeType":865},{},[20474],{"type":946},{"data":20476,"marks":20477,"value":3531,"nodeType":865},{},[],{"data":20479,"marks":20480,"value":8920,"nodeType":865},{},[20481],{"type":946},{"data":20483,"marks":20484,"value":8940,"nodeType":865},{},[],{"data":20486,"marks":20487,"value":8936,"nodeType":865},{},[20488],{"type":946},{"data":20490,"marks":20491,"value":20492,"nodeType":865},{},[]," pages, you can then get a sense of which apps employees are accessing, using which login methods, whether they’re registered for MFA (and which MFA methods are registered on the account), whether they’re using a password manager, and where there are account security issues such as weak, reused, or shared passwords.",{"data":20494,"content":20495,"nodeType":866},{},[20496,20501],{"data":20497,"marks":20498,"value":20500,"nodeType":865},{},[20499],{"type":946},"Tip:",{"data":20502,"marks":20503,"value":20504,"nodeType":865},{},[]," Use the filters on these pages to zero in on issues of interest, such as password logins, account security findings, or weak MFA methods.",{"data":20506,"content":20507,"nodeType":1218},{},[20508],{"data":20509,"marks":20510,"value":20511,"nodeType":865},{},[],"Put your security policies into practice",{"data":20513,"content":20514,"nodeType":866},{},[20515],{"data":20516,"marks":20517,"value":20518,"nodeType":865},{},[],"Equipped with this context, now you’re ready to lay the foundation for remediation and blocking controls, putting your security policies into practice.",{"data":20520,"content":20521,"nodeType":866},{},[20522],{"data":20523,"marks":20524,"value":20525,"nodeType":865},{},[],"At this stage, we recommend that you:",{"data":20527,"content":20528,"nodeType":891},{},[20529,20556,20566],{"data":20530,"content":20531,"nodeType":880},{},[20532],{"data":20533,"content":20534,"nodeType":866},{},[20535,20539,20544,20547,20552],{"data":20536,"marks":20537,"value":20538,"nodeType":865},{},[],"Set the ",{"data":20540,"marks":20541,"value":20543,"nodeType":865},{},[20542],{"type":946},"Approval status",{"data":20545,"marks":20546,"value":1913,"nodeType":865},{},[],{"data":20548,"marks":20549,"value":20551,"nodeType":865},{},[20550],{"type":946},"Sensitivity level",{"data":20553,"marks":20554,"value":20555,"nodeType":865},{},[]," of your apps using the provided categories in Push.",{"data":20557,"content":20558,"nodeType":880},{},[20559],{"data":20560,"content":20561,"nodeType":866},{},[20562],{"data":20563,"marks":20564,"value":20565,"nodeType":865},{},[],"Create employee groups (which can be done manually or via API to match your existing directory groups) and assign employees to them based on department or job function.",{"data":20567,"content":20568,"nodeType":880},{},[20569],{"data":20570,"content":20571,"nodeType":866},{},[20572],{"data":20573,"marks":20574,"value":20575,"nodeType":865},{},[],"Create custom labels for apps as needed.",{"data":20577,"content":20578,"nodeType":866},{},[20579],{"data":20580,"marks":20581,"value":20582,"nodeType":865},{},[],"By adding this metadata, you’ll be able to use these classifications when configuring rules for how to apply your desired security controls.",{"data":20584,"content":20588,"nodeType":907},{"target":20585},{"sys":20586},{"id":20587,"type":904,"linkType":905},"pCIPMrpBAWlmqFoKxTL8P",[],{"data":20590,"content":20591,"nodeType":866},{},[20592],{"data":20593,"marks":20594,"value":20595,"nodeType":865},{},[],"Before enabling end-user remediation and blocking controls, which we cover in the next section, you may also wish to let your employees know what they should expect to see in terms of self-remediation workflows or other employee-facing guidance in their browser.",{"data":20597,"content":20598,"nodeType":938},{},[],{"data":20600,"content":20601,"nodeType":948},{},[20602],{"data":20603,"marks":20604,"value":20605,"nodeType":865},{},[],"First 90 days: Remediate issues and arrive safely",{"data":20607,"content":20608,"nodeType":866},{},[20609],{"data":20610,"marks":20611,"value":20612,"nodeType":865},{},[],"With your team prepared and your rifle well-oiled, you’re ready to pick off security issues like SSO password phishing; missing MFA; and use of unsanctioned apps.",{"data":20614,"content":20615,"nodeType":866},{},[20616],{"data":20617,"marks":20618,"value":20619,"nodeType":865},{},[],"Here’s what we recommend for your third month using Push:",{"data":20621,"content":20622,"nodeType":1218},{},[20623],{"data":20624,"marks":20625,"value":20626,"nodeType":865},{},[],"Move security controls out of Monitor mode to Warn or Block",{"data":20628,"content":20629,"nodeType":866},{},[20630,20634,20638,20642,20646,20649,20653,20657,20661,20665,20669,20672,20676],{"data":20631,"marks":20632,"value":20633,"nodeType":865},{},[],"Once you’ve informed your employees and curated your ignore list, you’re ready to move security controls such as ",{"data":20635,"marks":20636,"value":15108,"nodeType":865},{},[20637],{"type":946},{"data":20639,"marks":20640,"value":20641,"nodeType":865},{},[]," into ",{"data":20643,"marks":20644,"value":2080,"nodeType":865},{},[20645],{"type":946},{"data":20647,"marks":20648,"value":1773,"nodeType":865},{},[],{"data":20650,"marks":20651,"value":2088,"nodeType":865},{},[20652],{"type":946},{"data":20654,"marks":20655,"value":20656,"nodeType":865},{},[]," mode. (If you have not already set the ",{"data":20658,"marks":20659,"value":19926,"nodeType":865},{},[20660],{"type":946},{"data":20662,"marks":20663,"value":20664,"nodeType":865},{},[]," control to ",{"data":20666,"marks":20667,"value":2080,"nodeType":865},{},[20668],{"type":946},{"data":20670,"marks":20671,"value":1773,"nodeType":865},{},[],{"data":20673,"marks":20674,"value":2088,"nodeType":865},{},[20675],{"type":946},{"data":20677,"marks":20678,"value":20679,"nodeType":865},{},[],", now is also a good time to do that.)",{"data":20681,"content":20682,"nodeType":866},{},[20683,20686,20690],{"data":20684,"marks":20685,"value":2124,"nodeType":865},{},[],{"data":20687,"marks":20688,"value":2821,"nodeType":865},{},[20689],{"type":946},{"data":20691,"marks":20692,"value":20693,"nodeType":865},{},[]," page of the admin console:",{"data":20695,"content":20696,"nodeType":891},{},[20697,20714,20724,20734],{"data":20698,"content":20699,"nodeType":880},{},[20700],{"data":20701,"content":20702,"nodeType":866},{},[20703,20707,20711],{"data":20704,"marks":20705,"value":20706,"nodeType":865},{},[],"Open the tile for the given control and update the ",{"data":20708,"marks":20709,"value":4333,"nodeType":865},{},[20710],{"type":946},{"data":20712,"marks":20713,"value":1151,"nodeType":865},{},[],{"data":20715,"content":20716,"nodeType":880},{},[20717],{"data":20718,"content":20719,"nodeType":866},{},[20720],{"data":20721,"marks":20722,"value":20723,"nodeType":865},{},[],"Create a custom message that employees will see when the control is triggered.",{"data":20725,"content":20726,"nodeType":880},{},[20727],{"data":20728,"content":20729,"nodeType":866},{},[20730],{"data":20731,"marks":20732,"value":20733,"nodeType":865},{},[],"Save the configuration.",{"data":20735,"content":20736,"nodeType":880},{},[20737],{"data":20738,"content":20739,"nodeType":866},{},[20740],{"data":20741,"marks":20742,"value":20743,"nodeType":865},{},[],"If possible, we also recommend consuming the webhook events generated when these controls are triggered in your SIEM or other alerting platform so you have good visibility.",{"data":20745,"content":20746,"nodeType":866},{},[20747,20751,20755,20758,20762,20766,20771],{"data":20748,"marks":20749,"value":20750,"nodeType":865},{},[],"If you’ve found any malicious sites using the ",{"data":20752,"marks":20753,"value":19926,"nodeType":865},{},[20754],{"type":946},{"data":20756,"marks":20757,"value":1773,"nodeType":865},{},[],{"data":20759,"marks":20760,"value":3617,"nodeType":865},{},[20761],{"type":946},{"data":20763,"marks":20764,"value":20765,"nodeType":865},{},[]," control, you may also wish to update your blocklist using the ",{"data":20767,"marks":20768,"value":20770,"nodeType":865},{},[20769],{"type":946},"URL blocking",{"data":20772,"marks":20773,"value":20774,"nodeType":865},{},[]," control. ",{"data":20776,"content":20777,"nodeType":1218},{},[20778],{"data":20779,"marks":20780,"value":20781,"nodeType":865},{},[],"Implement banners to guide secure employee behavior",{"data":20783,"content":20784,"nodeType":866},{},[20785,20789,20793,20797,20802,20805,20810,20813,20818,20822,20826,20830,20834,20838,20843],{"data":20786,"marks":20787,"value":20788,"nodeType":865},{},[],"Depending on your security goals, you may want to implement in-browser guidance for employees in the form of ",{"data":20790,"marks":20791,"value":1971,"nodeType":865},{},[20792],{"type":946},{"data":20794,"marks":20795,"value":20796,"nodeType":865},{},[],". You can configure a banner in ",{"data":20798,"marks":20799,"value":20801,"nodeType":865},{},[20800],{"type":946},"Inform",{"data":20803,"marks":20804,"value":3531,"nodeType":865},{},[],{"data":20806,"marks":20807,"value":20809,"nodeType":865},{},[20808],{"type":946},"Acknowledge",{"data":20811,"marks":20812,"value":3531,"nodeType":865},{},[],{"data":20814,"marks":20815,"value":20817,"nodeType":865},{},[20816],{"type":946},"Reason",{"data":20819,"marks":20820,"value":20821,"nodeType":865},{},[],", or ",{"data":20823,"marks":20824,"value":2088,"nodeType":865},{},[20825],{"type":946},{"data":20827,"marks":20828,"value":20829,"nodeType":865},{},[]," modes from the ",{"data":20831,"marks":20832,"value":2821,"nodeType":865},{},[20833],{"type":946},{"data":20835,"marks":20836,"value":20837,"nodeType":865},{},[]," page. Use the ",{"data":20839,"marks":20840,"value":20842,"nodeType":865},{},[20841],{"type":946},"Rules",{"data":20844,"marks":20845,"value":20846,"nodeType":865},{},[]," feature to specify which employees or employee groups should see a banner, and which apps to apply it to.",{"data":20848,"content":20852,"nodeType":907},{"target":20849},{"sys":20850},{"id":20851,"type":904,"linkType":905},"2rVWMTYrjShEdrswkzobJe",[],{"data":20854,"content":20855,"nodeType":866},{},[20856],{"data":20857,"marks":20858,"value":20859,"nodeType":865},{},[],"Common use cases include:",{"data":20861,"content":20862,"nodeType":891},{},[20863,20873,20883,20893,20903],{"data":20864,"content":20865,"nodeType":880},{},[20866],{"data":20867,"content":20868,"nodeType":866},{},[20869],{"data":20870,"marks":20871,"value":20872,"nodeType":865},{},[],"Blocking an app while you investigate a potential data breach.",{"data":20874,"content":20875,"nodeType":880},{},[20876],{"data":20877,"content":20878,"nodeType":866},{},[20879],{"data":20880,"marks":20881,"value":20882,"nodeType":865},{},[],"Blocking unapproved apps, such as a file-sharing service that’s not approved for storing sensitive information.",{"data":20884,"content":20885,"nodeType":880},{},[20886],{"data":20887,"content":20888,"nodeType":866},{},[20889],{"data":20890,"marks":20891,"value":20892,"nodeType":865},{},[],"Requiring employees to acknowledge your GenAI policy before using GenAI apps.",{"data":20894,"content":20895,"nodeType":880},{},[20896],{"data":20897,"content":20898,"nodeType":866},{},[20899],{"data":20900,"marks":20901,"value":20902,"nodeType":865},{},[],"Reminding employees to use SSO for SAML-enabled apps rather than a local account password.",{"data":20904,"content":20905,"nodeType":880},{},[20906],{"data":20907,"content":20908,"nodeType":866},{},[20909],{"data":20910,"marks":20911,"value":20912,"nodeType":865},{},[],"Asking employees not to use an app before it can be reviewed by the security team, for apps not yet in your inventory.",{"data":20914,"content":20915,"nodeType":866},{},[20916,20920,20924,20928],{"data":20917,"marks":20918,"value":20500,"nodeType":865},{},[20919],{"type":946},{"data":20921,"marks":20922,"value":20923,"nodeType":865},{},[]," You can monitor employee engagement with app banners on the ",{"data":20925,"marks":20926,"value":2058,"nodeType":865},{},[20927],{"type":946},{"data":20929,"marks":20930,"value":20931,"nodeType":865},{},[]," page and send webhook events for when a banner is displayed or interacted with to your SIEM or SOAR.",{"data":20933,"content":20934,"nodeType":1218},{},[20935],{"data":20936,"marks":20937,"value":20938,"nodeType":865},{},[],"Enforce MFA on high-value apps",{"data":20940,"content":20941,"nodeType":866},{},[20942,20946,20950],{"data":20943,"marks":20944,"value":20945,"nodeType":865},{},[],"If you’ve identified accounts on important apps that lack MFA, you can prompt employees to add an MFA method using ",{"data":20947,"marks":20948,"value":1909,"nodeType":865},{},[20949],{"type":946},{"data":20951,"marks":20952,"value":20953,"nodeType":865},{},[],". This control uses an in-browser message to direct employees to register for MFA on apps where they lack it. This control is enabled on a per-app basis, so you can decide where you want to prompt for MFA registration.",{"data":20955,"content":20956,"nodeType":891},{},[20957,20982],{"data":20958,"content":20959,"nodeType":880},{},[20960],{"data":20961,"content":20962,"nodeType":866},{},[20963,20966,20970,20974,20978],{"data":20964,"marks":20965,"value":2124,"nodeType":865},{},[],{"data":20967,"marks":20968,"value":2821,"nodeType":865},{},[20969],{"type":946},{"data":20971,"marks":20972,"value":20973,"nodeType":865},{},[]," page, select the ",{"data":20975,"marks":20976,"value":1909,"nodeType":865},{},[20977],{"type":946},{"data":20979,"marks":20980,"value":20981,"nodeType":865},{},[]," tile.",{"data":20983,"content":20984,"nodeType":880},{},[20985],{"data":20986,"content":20987,"nodeType":866},{},[20988],{"data":20989,"marks":20990,"value":20991,"nodeType":865},{},[],"Customize the message to employees, if you like.",{"data":20993,"content":20994,"nodeType":866},{},[20995],{"data":20996,"marks":20997,"value":20998,"nodeType":865},{},[],"image",{"data":21000,"content":21001,"nodeType":1218},{},[21002],{"data":21003,"marks":21004,"value":21005,"nodeType":865},{},[],"Send events to your SIEM or SOAR",{"data":21007,"content":21008,"nodeType":866},{},[21009],{"data":21010,"marks":21011,"value":21012,"nodeType":865},{},[],"To stay informed about end-user activity, findings, and controls on the Push platform, we recommend consuming events important to your security strategy in your SIEM, SOAR, or other similar alerting or automation platform.",{"data":21014,"content":21015,"nodeType":866},{},[21016,21020,21024,21028,21035],{"data":21017,"marks":21018,"value":21019,"nodeType":865},{},[],"Use the ",{"data":21021,"marks":21022,"value":2058,"nodeType":865},{},[21023],{"type":946},{"data":21025,"marks":21026,"value":21027,"nodeType":865},{},[]," page in the admin console to get familiar with the data structure of events, as well as the volume of events, and then review our ",{"data":21029,"content":21030,"nodeType":1102},{"uri":1668},[21031],{"data":21032,"marks":21033,"value":21034,"nodeType":865},{},[],"REST API and webhooks documentation",{"data":21036,"marks":21037,"value":21038,"nodeType":865},{},[]," for details on which entities, activities, control events, and audit logs you can consume.",{"data":21040,"content":21044,"nodeType":907},{"target":21041},{"sys":21042},{"id":21043,"type":904,"linkType":905},"1oG13vQ3AGP5i6TD24dnjs",[],{"data":21046,"content":21047,"nodeType":938},{},[],{"data":21049,"content":21050,"nodeType":948},{},[21051],{"data":21052,"marks":21053,"value":21054,"nodeType":865},{},[],"Next: Chart your own course",{"data":21056,"content":21057,"nodeType":866},{},[21058],{"data":21059,"marks":21060,"value":21061,"nodeType":865},{},[],"In your first 90 days and beyond, you can also begin creating custom workflows in your SIEM or SOAR platform to take Push’s browser and user activity telemetry and transform it into the triggers for solving specific problems in your environment.",{"data":21063,"content":21064,"nodeType":866},{},[21065],{"data":21066,"marks":21067,"value":21068,"nodeType":865},{},[],"Here are some ideas for what you can accomplish using Push’s REST API and webhooks:",{"data":21070,"content":21071,"nodeType":891},{},[21072,21087,21102,21117,21132,21151,21166],{"data":21073,"content":21074,"nodeType":880},{},[21075],{"data":21076,"content":21077,"nodeType":866},{},[21078,21083],{"data":21079,"marks":21080,"value":21082,"nodeType":865},{},[21081],{"type":946},"Harden identities and reduce account compromise",{"data":21084,"marks":21085,"value":21086,"nodeType":865},{},[],", such as alerting you when passwords are identified in public data breaches or when employees are using an unapproved app or when an SSO app is accessed via local account.",{"data":21088,"content":21089,"nodeType":880},{},[21090],{"data":21091,"content":21092,"nodeType":866},{},[21093,21098],{"data":21094,"marks":21095,"value":21097,"nodeType":865},{},[21096],{"type":946},"Monitor for suspicious activity or high-risk changes",{"data":21099,"marks":21100,"value":21101,"nodeType":865},{},[],", such as checking for MFA method changes, or flagging when employees reuse corporate SSO passwords or visit sites running phishing malware.",{"data":21103,"content":21104,"nodeType":880},{},[21105],{"data":21106,"content":21107,"nodeType":866},{},[21108,21113],{"data":21109,"marks":21110,"value":21112,"nodeType":865},{},[21111],{"type":946},"Investigate indicators of compromise",{"data":21114,"marks":21115,"value":21116,"nodeType":865},{},[],", such as correlating login events with platform logs, searching for recent signups to risky apps, or identifying post-compromise lateral movement opportunities.",{"data":21118,"content":21119,"nodeType":880},{},[21120],{"data":21121,"content":21122,"nodeType":866},{},[21123,21128],{"data":21124,"marks":21125,"value":21127,"nodeType":865},{},[21126],{"type":946},"Force-reset an IdP password",{"data":21129,"marks":21130,"value":21131,"nodeType":865},{},[]," if Push finds a compromised password on an employee account.",{"data":21133,"content":21134,"nodeType":880},{},[21135],{"data":21136,"content":21137,"nodeType":866},{},[21138,21142,21147],{"data":21139,"marks":21140,"value":21141,"nodeType":865},{},[],"Automate a workflow showing you all the",{"data":21143,"marks":21144,"value":21146,"nodeType":865},{},[21145],{"type":946}," accounts and apps used by an employee you’re offboarding",{"data":21148,"marks":21149,"value":21150,"nodeType":865},{},[],", and their account login methods.",{"data":21152,"content":21153,"nodeType":880},{},[21154],{"data":21155,"content":21156,"nodeType":866},{},[21157,21162],{"data":21158,"marks":21159,"value":21161,"nodeType":865},{},[21160],{"type":946},"Automate a workflow to revoke licenses",{"data":21163,"marks":21164,"value":21165,"nodeType":865},{},[]," on SaaS after a period of inactivity, saving money.",{"data":21167,"content":21168,"nodeType":880},{},[21169],{"data":21170,"content":21171,"nodeType":866},{},[21172,21177],{"data":21173,"marks":21174,"value":21176,"nodeType":865},{},[21175],{"type":946},"Build an approved apps list",{"data":21178,"marks":21179,"value":21180,"nodeType":865},{},[]," in your company wiki, synced from Push’s source of truth.",{"data":21182,"content":21183,"nodeType":866},{},[21184],{"data":21185,"marks":21186,"value":21187,"nodeType":865},{},[],"If you’ve made it this far, congratulations! You did not die of identity attacks.",{"data":21189,"content":21193,"nodeType":907},{"target":21190},{"sys":21191},{"id":21192,"type":904,"linkType":905},"4B7JIz8Iy7kp83vWLEVgOw",[],{"data":21195,"content":21196,"nodeType":866},{},[21197],{"data":21198,"marks":21199,"value":21,"nodeType":865},{},[],{"entries":21201},{"inline":21202,"hyperlink":21203,"block":21221},[],[21204,21208,21210,21212,21217],{"sys":21205,"__typename":2239,"title":21206,"slug":21207},{"id":19811},"How AitM phishing kits evade detection","how-aitm-phishing-kits-evade-detection",{"sys":21209,"__typename":2239,"title":7491,"slug":7494},{"id":6837},{"sys":21211,"__typename":2239,"title":18454,"slug":18457},{"id":17755},{"sys":21213,"__typename":2256,"title":21214,"slug":21215,"articleId":21216},{"id":20123},"How do I add a custom login domain in Push?","how-do-i-add-a-custom-login-domain-in-push",10120,{"sys":21218,"__typename":2239,"title":21219,"slug":21220},{"id":20444},"Ghost logins: When forgotten identities come back to haunt you","ghost-logins-when-forgotten-identities-come-back-to-haunt-you",[21222,21230,21235,21242,21249,21255,21262,21269,21276,21283,21291,21298],{"sys":21223,"__typename":2366,"title":21224,"caption":21225,"layoutMode":59,"file":21226},{"id":19742},"Oregon Trail river crossing screenshot","Image from the iconic 1980s Oregon Trail video game. Source: Wikipedia",{"url":21227,"width":21228,"height":21229},"https://images.ctfassets.net/y1cdw1ablpvd/5Q70RXxpUqYYbljrI8fAmu/64dcb9044921e0a87fd511a4faeebe48/OregonTrailScreenshot.png",280,192,{"sys":21231,"__typename":2341,"title":21232,"arcadeDemoUrl":21233,"playText":21234},{"id":19934},"Phishing tool detection demo","https://demo.arcade.software/56g5alxkmegzjvQnZxrC?embed","1 min",{"sys":21236,"__typename":2366,"title":21237,"caption":59,"layoutMode":59,"file":21238},{"id":20077},"Stolen creds detection example - KB 10126",{"url":21239,"width":21240,"height":21241},"https://images.ctfassets.net/y1cdw1ablpvd/10hLISFPMFMCmatHDrdCOy/f706764340f828221f18acc9bc9a6d34/stolen_creds_example_slideout.png",783,1229,{"sys":21243,"__typename":2366,"title":21244,"caption":59,"layoutMode":59,"file":21245},{"id":20239},"Events page - filter by event type - for blog",{"url":21246,"width":21247,"height":21248},"https://images.ctfassets.net/y1cdw1ablpvd/6aWpsvvFlys8LwZoG2BXaY/81d35e7eb0b5e9f897b3c875b15b72cc/events_page_filtered.png",1548,654,{"sys":21250,"__typename":2366,"title":21251,"caption":59,"layoutMode":59,"file":21252},{"id":20268},"Security finding chat message - reused password - KB 10093",{"url":21253,"width":21254,"height":282},"https://images.ctfassets.net/y1cdw1ablpvd/7zFrC3hJT12YgClc2filik/7a4848f447719b74c2e48d7151181bc6/chatops_reused_password_finding_20230713.png",932,{"sys":21256,"__typename":2366,"title":21257,"caption":59,"layoutMode":59,"file":21258},{"id":20371},"Vulnerable identities widget - Dec 2024 (updated) - for blog",{"url":21259,"width":21260,"height":21261},"https://images.ctfassets.net/y1cdw1ablpvd/5erTJduzTr4JraM40e1cBU/d2720fb02b5cf0072f9ab90b6a5ec886/vulnerable_identities_widget.png",1388,608,{"sys":21263,"__typename":2366,"title":21264,"caption":59,"layoutMode":59,"file":21265},{"id":20414},"SSO trends widget - for blog",{"url":21266,"width":21267,"height":21268},"https://images.ctfassets.net/y1cdw1ablpvd/jXYA5z47q4FIq4WYWmFnU/8853b72a58f0271f81a2d6f5a9771c7a/sso_trends_dashboard.png",736,355,{"sys":21270,"__typename":2366,"title":21271,"caption":59,"layoutMode":59,"file":21272},{"id":20456},"Multiple login methods example - for blog",{"url":21273,"width":21274,"height":21275},"https://images.ctfassets.net/y1cdw1ablpvd/6G0kC36A0fVvTVgLMtotNM/a30914e78c3c61f323dbe9883fd5472f/local_account_example.png",697,305,{"sys":21277,"__typename":2366,"title":21278,"caption":59,"layoutMode":59,"file":21279},{"id":20587},"Add app labels dropdown - Manage apps and accounts - docs",{"url":21280,"width":21281,"height":21282},"https://images.ctfassets.net/y1cdw1ablpvd/6PaJLcv43FdcXpX6Y8sODx/e2dc116aaf8b6a2635460def1e8b0ce7/app_labels_edit_20260609.png",1376,1026,{"sys":21284,"__typename":2366,"title":21285,"caption":21286,"layoutMode":59,"file":21287},{"id":20851},"App banner - Block mode - KB 10106","App banner in Block mode",{"url":21288,"width":21289,"height":21290},"https://images.ctfassets.net/y1cdw1ablpvd/5IP2jbUkJt48ZxGm1QseOS/0d487ba192748cca0e3f6fae55f49b52/banner_branded_block.png",1269,718,{"sys":21292,"__typename":2366,"title":21293,"caption":59,"layoutMode":59,"file":21294},{"id":21043},"Illustration of SIEM alert for blog",{"url":21295,"width":21296,"height":21297},"https://images.ctfassets.net/y1cdw1ablpvd/3RugDN0VZO2Ag051p5ULpA/90d47ccea9e5cf6b2e572b581a4a9f12/siem_alert_for_arcade.png",1920,1080,{"sys":21299,"__typename":2366,"title":21300,"caption":59,"layoutMode":59,"file":21301},{"id":21192},"Oregon Trail meme for blog",{"url":21302,"width":21303,"height":21304},"https://images.ctfassets.net/y1cdw1ablpvd/5kUzO3qi4NdznU9yD9BTA3/17d1075b382f33cb6b79e935ebf87074/oregon_trail_meme_push.png",488,451,{"items":21306},[],{},"What you can accomplish in your first 90 days with Push","2024-12-09T00:00:00.000Z",{"items":21311},[21312,21926,22761],{"__typename":2239,"sys":21313,"content":21314,"title":18454,"synopsis":18455,"hashTags":59,"publishedDate":18456,"slug":18457,"tagsCollection":21916,"authorsCollection":21922},{"id":17755},{"json":21315},{"data":21316,"content":21317,"nodeType":2232},{},[21318,21323,21326,21339,21345,21351,21356,21362,21378,21393,21399,21404,21410,21413,21419,21425,21431,21437,21443,21449,21478,21483,21489,21492,21498,21504,21602,21608,21624,21630,21646,21652,21669,21675,21691,21694,21700,21706,21712,21738,21744,21750,21765,21770,21776,21782,21787,21793,21850,21856,21862,21868,21874,21880,21883,21889,21905,21910],{"data":21319,"content":21322,"nodeType":907},{"target":21320},{"sys":21321},{"id":17764,"type":904,"linkType":905},[],{"data":21324,"content":21325,"nodeType":938},{},[],{"data":21327,"content":21328,"nodeType":866},{},[21329,21332,21336],{"data":21330,"marks":21331,"value":17775,"nodeType":865},{},[],{"data":21333,"marks":21334,"value":17780,"nodeType":865},{},[21335],{"type":979},{"data":21337,"marks":21338,"value":17784,"nodeType":865},{},[],{"data":21340,"content":21341,"nodeType":866},{},[21342],{"data":21343,"marks":21344,"value":17791,"nodeType":865},{},[],{"data":21346,"content":21347,"nodeType":866},{},[21348],{"data":21349,"marks":21350,"value":17798,"nodeType":865},{},[],{"data":21352,"content":21355,"nodeType":907},{"target":21353},{"sys":21354},{"id":17803,"type":904,"linkType":905},[],{"data":21357,"content":21358,"nodeType":866},{},[21359],{"data":21360,"marks":21361,"value":17811,"nodeType":865},{},[],{"data":21363,"content":21364,"nodeType":15681},{},[21365],{"data":21366,"content":21367,"nodeType":866},{},[21368,21371,21375],{"data":21369,"marks":21370,"value":17821,"nodeType":865},{},[],{"data":21372,"marks":21373,"value":17826,"nodeType":865},{},[21374],{"type":946},{"data":21376,"marks":21377,"value":1677,"nodeType":865},{},[],{"data":21379,"content":21380,"nodeType":866},{},[21381,21384,21390],{"data":21382,"marks":21383,"value":17836,"nodeType":865},{},[],{"data":21385,"content":21386,"nodeType":1102},{"uri":17839},[21387],{"data":21388,"marks":21389,"value":17844,"nodeType":865},{},[],{"data":21391,"marks":21392,"value":17848,"nodeType":865},{},[],{"data":21394,"content":21395,"nodeType":866},{},[21396],{"data":21397,"marks":21398,"value":17855,"nodeType":865},{},[],{"data":21400,"content":21403,"nodeType":907},{"target":21401},{"sys":21402},{"id":17860,"type":904,"linkType":905},[],{"data":21405,"content":21406,"nodeType":866},{},[21407],{"data":21408,"marks":21409,"value":17868,"nodeType":865},{},[],{"data":21411,"content":21412,"nodeType":938},{},[],{"data":21414,"content":21415,"nodeType":948},{},[21416],{"data":21417,"marks":21418,"value":17878,"nodeType":865},{},[],{"data":21420,"content":21421,"nodeType":866},{},[21422],{"data":21423,"marks":21424,"value":17885,"nodeType":865},{},[],{"data":21426,"content":21427,"nodeType":866},{},[21428],{"data":21429,"marks":21430,"value":17892,"nodeType":865},{},[],{"data":21432,"content":21433,"nodeType":1218},{},[21434],{"data":21435,"marks":21436,"value":17899,"nodeType":865},{},[],{"data":21438,"content":21439,"nodeType":866},{},[21440],{"data":21441,"marks":21442,"value":17906,"nodeType":865},{},[],{"data":21444,"content":21445,"nodeType":866},{},[21446],{"data":21447,"marks":21448,"value":17913,"nodeType":865},{},[],{"data":21450,"content":21451,"nodeType":891},{},[21452,21465],{"data":21453,"content":21454,"nodeType":880},{},[21455],{"data":21456,"content":21457,"nodeType":866},{},[21458,21462],{"data":21459,"marks":21460,"value":17927,"nodeType":865},{},[21461],{"type":946},{"data":21463,"marks":21464,"value":17931,"nodeType":865},{},[],{"data":21466,"content":21467,"nodeType":880},{},[21468],{"data":21469,"content":21470,"nodeType":866},{},[21471,21475],{"data":21472,"marks":21473,"value":17942,"nodeType":865},{},[21474],{"type":946},{"data":21476,"marks":21477,"value":17946,"nodeType":865},{},[],{"data":21479,"content":21482,"nodeType":907},{"target":21480},{"sys":21481},{"id":17951,"type":904,"linkType":905},[],{"data":21484,"content":21485,"nodeType":866},{},[21486],{"data":21487,"marks":21488,"value":17959,"nodeType":865},{},[],{"data":21490,"content":21491,"nodeType":938},{},[],{"data":21493,"content":21494,"nodeType":948},{},[21495],{"data":21496,"marks":21497,"value":17969,"nodeType":865},{},[],{"data":21499,"content":21500,"nodeType":866},{},[21501],{"data":21502,"marks":21503,"value":17976,"nodeType":865},{},[],{"data":21505,"content":21506,"nodeType":891},{},[21507,21526,21545,21564,21593],{"data":21508,"content":21509,"nodeType":880},{},[21510],{"data":21511,"content":21512,"nodeType":866},{},[21513,21516,21523],{"data":21514,"marks":21515,"value":13846,"nodeType":865},{},[],{"data":21517,"content":21518,"nodeType":1102},{"uri":15408},[21519],{"data":21520,"marks":21521,"value":17996,"nodeType":865},{},[21522],{"type":4537},{"data":21524,"marks":21525,"value":18000,"nodeType":865},{},[],{"data":21527,"content":21528,"nodeType":880},{},[21529],{"data":21530,"content":21531,"nodeType":866},{},[21532,21535,21542],{"data":21533,"marks":21534,"value":21,"nodeType":865},{},[],{"data":21536,"content":21537,"nodeType":1102},{"uri":18012},[21538],{"data":21539,"marks":21540,"value":18018,"nodeType":865},{},[21541],{"type":4537},{"data":21543,"marks":21544,"value":18022,"nodeType":865},{},[],{"data":21546,"content":21547,"nodeType":880},{},[21548],{"data":21549,"content":21550,"nodeType":866},{},[21551,21554,21561],{"data":21552,"marks":21553,"value":18032,"nodeType":865},{},[],{"data":21555,"content":21556,"nodeType":1102},{"uri":18035},[21557],{"data":21558,"marks":21559,"value":18041,"nodeType":865},{},[21560],{"type":4537},{"data":21562,"marks":21563,"value":18045,"nodeType":865},{},[],{"data":21565,"content":21566,"nodeType":880},{},[21567],{"data":21568,"content":21569,"nodeType":866},{},[21570,21573,21580,21583,21590],{"data":21571,"marks":21572,"value":18055,"nodeType":865},{},[],{"data":21574,"content":21575,"nodeType":1102},{"uri":18058},[21576],{"data":21577,"marks":21578,"value":18064,"nodeType":865},{},[21579],{"type":4537},{"data":21581,"marks":21582,"value":18068,"nodeType":865},{},[],{"data":21584,"content":21585,"nodeType":1102},{"uri":18071},[21586],{"data":21587,"marks":21588,"value":18077,"nodeType":865},{},[21589],{"type":4537},{"data":21591,"marks":21592,"value":18081,"nodeType":865},{},[],{"data":21594,"content":21595,"nodeType":880},{},[21596],{"data":21597,"content":21598,"nodeType":866},{},[21599],{"data":21600,"marks":21601,"value":18091,"nodeType":865},{},[],{"data":21603,"content":21604,"nodeType":866},{},[21605],{"data":21606,"marks":21607,"value":18098,"nodeType":865},{},[],{"data":21609,"content":21610,"nodeType":866},{},[21611,21614,21621],{"data":21612,"marks":21613,"value":21,"nodeType":865},{},[],{"data":21615,"content":21616,"nodeType":1102},{"uri":18012},[21617],{"data":21618,"marks":21619,"value":18112,"nodeType":865},{},[21620],{"type":4537},{"data":21622,"marks":21623,"value":18116,"nodeType":865},{},[],{"data":21625,"content":21626,"nodeType":1218},{},[21627],{"data":21628,"marks":21629,"value":18123,"nodeType":865},{},[],{"data":21631,"content":21632,"nodeType":866},{},[21633,21636,21643],{"data":21634,"marks":21635,"value":18130,"nodeType":865},{},[],{"data":21637,"content":21638,"nodeType":1102},{"uri":15528},[21639],{"data":21640,"marks":21641,"value":18138,"nodeType":865},{},[21642],{"type":4537},{"data":21644,"marks":21645,"value":1151,"nodeType":865},{},[],{"data":21647,"content":21648,"nodeType":866},{},[21649],{"data":21650,"marks":21651,"value":18148,"nodeType":865},{},[],{"data":21653,"content":21654,"nodeType":866},{},[21655,21658,21666],{"data":21656,"marks":21657,"value":18155,"nodeType":865},{},[],{"data":21659,"content":21660,"nodeType":1102},{"uri":9381},[21661],{"data":21662,"marks":21663,"value":18164,"nodeType":865},{},[21664,21665],{"type":4537},{"type":946},{"data":21667,"marks":21668,"value":18168,"nodeType":865},{},[],{"data":21670,"content":21671,"nodeType":866},{},[21672],{"data":21673,"marks":21674,"value":18175,"nodeType":865},{},[],{"data":21676,"content":21677,"nodeType":866},{},[21678,21681,21688],{"data":21679,"marks":21680,"value":18182,"nodeType":865},{},[],{"data":21682,"content":21683,"nodeType":1102},{"uri":6406},[21684],{"data":21685,"marks":21686,"value":18190,"nodeType":865},{},[21687],{"type":4537},{"data":21689,"marks":21690,"value":18194,"nodeType":865},{},[],{"data":21692,"content":21693,"nodeType":938},{},[],{"data":21695,"content":21696,"nodeType":948},{},[21697],{"data":21698,"marks":21699,"value":18204,"nodeType":865},{},[],{"data":21701,"content":21702,"nodeType":866},{},[21703],{"data":21704,"marks":21705,"value":18211,"nodeType":865},{},[],{"data":21707,"content":21708,"nodeType":866},{},[21709],{"data":21710,"marks":21711,"value":18218,"nodeType":865},{},[],{"data":21713,"content":21714,"nodeType":866},{},[21715,21718,21725,21728,21735],{"data":21716,"marks":21717,"value":18225,"nodeType":865},{},[],{"data":21719,"content":21720,"nodeType":1102},{"uri":18228},[21721],{"data":21722,"marks":21723,"value":18234,"nodeType":865},{},[21724],{"type":4537},{"data":21726,"marks":21727,"value":18238,"nodeType":865},{},[],{"data":21729,"content":21730,"nodeType":1102},{"uri":18241},[21731],{"data":21732,"marks":21733,"value":18247,"nodeType":865},{},[21734],{"type":4537},{"data":21736,"marks":21737,"value":18251,"nodeType":865},{},[],{"data":21739,"content":21740,"nodeType":866},{},[21741],{"data":21742,"marks":21743,"value":18258,"nodeType":865},{},[],{"data":21745,"content":21746,"nodeType":866},{},[21747],{"data":21748,"marks":21749,"value":18265,"nodeType":865},{},[],{"data":21751,"content":21752,"nodeType":866},{},[21753,21756,21762],{"data":21754,"marks":21755,"value":18272,"nodeType":865},{},[],{"data":21757,"content":21758,"nodeType":1102},{"uri":4601},[21759],{"data":21760,"marks":21761,"value":18279,"nodeType":865},{},[],{"data":21763,"marks":21764,"value":18283,"nodeType":865},{},[],{"data":21766,"content":21769,"nodeType":907},{"target":21767},{"sys":21768},{"id":18288,"type":904,"linkType":905},[],{"data":21771,"content":21772,"nodeType":1218},{},[21773],{"data":21774,"marks":21775,"value":18296,"nodeType":865},{},[],{"data":21777,"content":21778,"nodeType":866},{},[21779],{"data":21780,"marks":21781,"value":18303,"nodeType":865},{},[],{"data":21783,"content":21786,"nodeType":907},{"target":21784},{"sys":21785},{"id":18308,"type":904,"linkType":905},[],{"data":21788,"content":21789,"nodeType":866},{},[21790],{"data":21791,"marks":21792,"value":18316,"nodeType":865},{},[],{"data":21794,"content":21795,"nodeType":891},{},[21796,21814,21823,21832,21841],{"data":21797,"content":21798,"nodeType":880},{},[21799],{"data":21800,"content":21801,"nodeType":866},{},[21802,21805,21811],{"data":21803,"marks":21804,"value":18329,"nodeType":865},{},[],{"data":21806,"content":21807,"nodeType":1102},{"uri":18332},[21808],{"data":21809,"marks":21810,"value":17844,"nodeType":865},{},[],{"data":21812,"marks":21813,"value":1677,"nodeType":865},{},[],{"data":21815,"content":21816,"nodeType":880},{},[21817],{"data":21818,"content":21819,"nodeType":866},{},[21820],{"data":21821,"marks":21822,"value":18349,"nodeType":865},{},[],{"data":21824,"content":21825,"nodeType":880},{},[21826],{"data":21827,"content":21828,"nodeType":866},{},[21829],{"data":21830,"marks":21831,"value":18359,"nodeType":865},{},[],{"data":21833,"content":21834,"nodeType":880},{},[21835],{"data":21836,"content":21837,"nodeType":866},{},[21838],{"data":21839,"marks":21840,"value":18369,"nodeType":865},{},[],{"data":21842,"content":21843,"nodeType":880},{},[21844],{"data":21845,"content":21846,"nodeType":866},{},[21847],{"data":21848,"marks":21849,"value":18379,"nodeType":865},{},[],{"data":21851,"content":21852,"nodeType":866},{},[21853],{"data":21854,"marks":21855,"value":18386,"nodeType":865},{},[],{"data":21857,"content":21858,"nodeType":866},{},[21859],{"data":21860,"marks":21861,"value":18393,"nodeType":865},{},[],{"data":21863,"content":21864,"nodeType":1218},{},[21865],{"data":21866,"marks":21867,"value":18400,"nodeType":865},{},[],{"data":21869,"content":21870,"nodeType":866},{},[21871],{"data":21872,"marks":21873,"value":18407,"nodeType":865},{},[],{"data":21875,"content":21876,"nodeType":866},{},[21877],{"data":21878,"marks":21879,"value":18414,"nodeType":865},{},[],{"data":21881,"content":21882,"nodeType":938},{},[],{"data":21884,"content":21885,"nodeType":948},{},[21886],{"data":21887,"marks":21888,"value":18424,"nodeType":865},{},[],{"data":21890,"content":21891,"nodeType":866},{},[21892,21895,21902],{"data":21893,"marks":21894,"value":18431,"nodeType":865},{},[],{"data":21896,"content":21897,"nodeType":1102},{"uri":10028},[21898],{"data":21899,"marks":21900,"value":16671,"nodeType":865},{},[21901],{"type":4537},{"data":21903,"marks":21904,"value":7361,"nodeType":865},{},[],{"data":21906,"content":21909,"nodeType":907},{"target":21907},{"sys":21908},{"id":18446,"type":904,"linkType":905},[],{"data":21911,"content":21912,"nodeType":866},{},[21913],{"data":21914,"marks":21915,"value":21,"nodeType":865},{},[],{"items":21917},[21918,21920],{"sys":21919,"name":3915},{"id":3914},{"sys":21921,"name":342},{"id":2527},{"items":21923},[21924],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":21925},{"url":853},{"__typename":2239,"sys":21927,"content":21929,"title":22747,"synopsis":22748,"hashTags":59,"publishedDate":22749,"slug":22750,"tagsCollection":22751,"authorsCollection":22757},{"id":21928},"4Bc6qX9kURetHcK7nkS8on",{"json":21930},{"data":21931,"content":21932,"nodeType":2232},{},[21933,21940,21947,21954,21960,21968,21975,21981,21988,21994,22001,22009,22016,22022,22029,22061,22068,22075,22108,22116,22123,22131,22139,22146,22153,22172,22179,22186,22193,22201,22208,22215,22248,22255,22308,22315,22322,22330,22337,22344,22351,22359,22366,22389,22396,22444,22451,22457,22464,22507,22514,22522,22529,22536,22567,22575,22582,22588,22595,22601,22608,22614,22621,22701,22708,22715,22722,22740],{"data":21934,"content":21935,"nodeType":866},{},[21936],{"data":21937,"marks":21938,"value":21939,"nodeType":865},{},[],"As an industry, we’ve been conditioned to think about threat detection and response as something that happens post-compromise. Best practice has formed around resources like the Cyber Kill Chain and the MITRE ATT&CK Framework which focus on detecting indicators of an attacker presence on your network, and their behaviors and actions as they move through it.",{"data":21941,"content":21942,"nodeType":866},{},[21943],{"data":21944,"marks":21945,"value":21946,"nodeType":865},{},[],"But with the shift to identity attacks, where attackers look to take over accounts on internet-facing apps and services, relying on an assumed compromise approach to detection is becoming less reliable. The most significant breaches of the last 12-18 months have been the result of browser-based attacks where an attacker has taken over an account, exfiltrated data… and that’s it. ",{"data":21948,"content":21949,"nodeType":866},{},[21950],{"data":21951,"marks":21952,"value":21953,"nodeType":865},{},[],"This change means that the typical methods of post-compromise detection and response become much less viable. So, we’re going to talk a bit about what’s changed, why controls are failing, and what we’re doing here at Push to address the detection gaps. ",{"data":21955,"content":21959,"nodeType":907},{"target":21956},{"sys":21957},{"id":21958,"type":904,"linkType":905},"4179AY8ZEIJ3Ce9jszn4fA",[],{"data":21961,"content":21962,"nodeType":948},{},[21963],{"data":21964,"marks":21965,"value":21967,"nodeType":865},{},[21966],{"type":946},"The good old days",{"data":21969,"content":21970,"nodeType":866},{},[21971],{"data":21972,"marks":21973,"value":21974,"nodeType":865},{},[],"Over the previous decade the typical attack paths, and the controls that have formed around it, have become very familiar to SecOps teams. ",{"data":21976,"content":21980,"nodeType":907},{"target":21977},{"sys":21978},{"id":21979,"type":904,"linkType":905},"4AOzwBGuNkXXogyqy46ki5",[],{"data":21982,"content":21983,"nodeType":866},{},[21984],{"data":21985,"marks":21986,"value":21987,"nodeType":865},{},[],"Even with the more recent transition to enterprise cloud and hybrid networking, the broad offensive logic of “land and expand” remains. This has seen the typical view of a network-based attack path simply expand to add first enterprise cloud, and then SaaS to the picture. ",{"data":21989,"content":21993,"nodeType":907},{"target":21990},{"sys":21991},{"id":21992,"type":904,"linkType":905},"2J3s38YOVcMuJuTdryhERA",[],{"data":21995,"content":21996,"nodeType":866},{},[21997],{"data":21998,"marks":21999,"value":22000,"nodeType":865},{},[],"And while this sort of attack path is theoretically possible, what happens in reality looks quite different. ",{"data":22002,"content":22003,"nodeType":948},{},[22004],{"data":22005,"marks":22006,"value":22008,"nodeType":865},{},[22007],{"type":946},"The new world",{"data":22010,"content":22011,"nodeType":866},{},[22012],{"data":22013,"marks":22014,"value":22015,"nodeType":865},{},[],"Instead of needing to progress through the network, moving laterally, elevating privileges, etc. modern account takeover tends to take a much more direct approach. ",{"data":22017,"content":22021,"nodeType":907},{"target":22018},{"sys":22019},{"id":22020,"type":904,"linkType":905},"6wIzMu3jBhaas9jtpV48bz",[],{"data":22023,"content":22024,"nodeType":866},{},[22025],{"data":22026,"marks":22027,"value":22028,"nodeType":865},{},[],"It’s a common misconception that SaaS compromise typically comes after the traditional attack chain (a myth largely promoted by old-school consultancy providers, MSSPs, and managed SOC providers). There’s no need for an attacker looking to take over a SaaS account to target the network first – and many organizations today simply no longer have a network in the conventional sense.  ",{"data":22030,"content":22031,"nodeType":866},{},[22032,22036,22045,22049,22058],{"data":22033,"marks":22034,"value":22035,"nodeType":865},{},[],"This isn’t to say that there aren’t examples of longer SaaS compromises involving lateral movement from SaaS to SaaS, or SaaS to cloud (",{"data":22037,"content":22039,"nodeType":1102},{"uri":22038},"https://github.com/pushsecurity/saas-attacks",[22040],{"data":22041,"marks":22042,"value":22044,"nodeType":865},{},[22043],{"type":4537},"we created a whole attack matrix demonstrating the art of the possible here",{"data":22046,"marks":22047,"value":22048,"nodeType":865},{},[],"). Equally, there are examples of very short and direct attacks in enterprise cloud environments leading to ransomware deployment (for example, ",{"data":22050,"content":22052,"nodeType":1102},{"uri":22051},"https://www.bleepingcomputer.com/news/security/mgm-casinos-esxi-servers-allegedly-encrypted-in-ransomware-attack/",[22053],{"data":22054,"marks":22055,"value":22057,"nodeType":865},{},[22056],{"type":4537},"Scattered Spider turning an initial account takeover in Okta into a full-scale VMware ESXi ransomware compromise",{"data":22059,"marks":22060,"value":14366,"nodeType":865},{},[],{"data":22062,"content":22063,"nodeType":866},{},[22064],{"data":22065,"marks":22066,"value":22067,"nodeType":865},{},[],"But statistically, the average network or enterprise cloud attack involves much more complex lateral movement, privilege escalation, and defense evasion than the average SaaS attack path. ",{"data":22069,"content":22070,"nodeType":866},{},[22071],{"data":22072,"marks":22073,"value":22074,"nodeType":865},{},[],"The Snowflake attack path is a useful case study here: ",{"data":22076,"content":22077,"nodeType":891},{},[22078,22088,22098],{"data":22079,"content":22080,"nodeType":880},{},[22081],{"data":22082,"content":22083,"nodeType":866},{},[22084],{"data":22085,"marks":22086,"value":22087,"nodeType":865},{},[],"Attackers logged into the Snowflake tenant of ~165 organizations using stolen credentials to access user accounts via the web-based ‘SnowSight’ portal. ",{"data":22089,"content":22090,"nodeType":880},{},[22091],{"data":22092,"content":22093,"nodeType":866},{},[22094],{"data":22095,"marks":22096,"value":22097,"nodeType":865},{},[],"To take advantage of the many exposed accounts, the attacker created a utility performing account takeover and recon at-scale. ",{"data":22099,"content":22100,"nodeType":880},{},[22101],{"data":22102,"content":22103,"nodeType":866},{},[22104],{"data":22105,"marks":22106,"value":22107,"nodeType":865},{},[],"The attack finished with the attacker executing the same set of SQL commands across customer instances to stage and exfiltrate data. ",{"data":22109,"content":22110,"nodeType":866},{},[22111],{"data":22112,"marks":22113,"value":22115,"nodeType":865},{},[22114],{"type":946},"And that’s it. ",{"data":22117,"content":22118,"nodeType":866},{},[22119],{"data":22120,"marks":22121,"value":22122,"nodeType":865},{},[],"Since these attacks happen in-app, to be able to detect and intercept them you’d need deep app-level telemetry, and probably the ability to automate any containment and response activities. But unfortunately…",{"data":22124,"content":22125,"nodeType":948},{},[22126],{"data":22127,"marks":22128,"value":22130,"nodeType":865},{},[22129],{"type":946},"Detecting and responding after account takeover is really, really difficult",{"data":22132,"content":22133,"nodeType":1218},{},[22134],{"data":22135,"marks":22136,"value":22138,"nodeType":865},{},[22137],{"type":946},"Limited log data ",{"data":22140,"content":22141,"nodeType":866},{},[22142],{"data":22143,"marks":22144,"value":22145,"nodeType":865},{},[],"The first challenge is that in-app malicious activity is mostly indistinguishable from legitimate user behavior. Even mass data exfiltration might appear legitimate depending on what the app is used for!",{"data":22147,"content":22148,"nodeType":866},{},[22149],{"data":22150,"marks":22151,"value":22152,"nodeType":865},{},[],"To meaningfully detect malicious activity in-app, for starters you would need visibility of user behavior and actions. Unfortunately, you don’t have this. ",{"data":22154,"content":22155,"nodeType":866},{},[22156,22160,22168],{"data":22157,"marks":22158,"value":22159,"nodeType":865},{},[],"We’ve previously discussed in detail why ",{"data":22161,"content":22162,"nodeType":1102},{"uri":7446},[22163],{"data":22164,"marks":22165,"value":22167,"nodeType":865},{},[22166],{"type":4537},"log sources like network (web proxy), IdP, and app logs fall short",{"data":22169,"marks":22170,"value":22171,"nodeType":865},{},[]," when it comes to identity attacks, but the TL;DR is that most applications provide extremely limited security logging (if they provide it at all). ",{"data":22173,"content":22174,"nodeType":866},{},[22175],{"data":22176,"marks":22177,"value":22178,"nodeType":865},{},[],"When logs are available, you’re limited to the events that the third-party deems suitable to log. Out of the 100 most popular apps we see across our customers, and perhaps the few dozen or so that are security critical, only a small handful provide any useful logging. So extremely risky actions, like cloning a private GitHub repo, or downloading SharePoint files via ‘open in app’ or file syncing, don’t generate any logs at all. ",{"data":22180,"content":22181,"nodeType":866},{},[22182],{"data":22183,"marks":22184,"value":22185,"nodeType":865},{},[],"Further, the lack of out-of-the-box connectors for many apps means that complex custom architectures are often required for ingestion.",{"data":22187,"content":22188,"nodeType":866},{},[22189],{"data":22190,"marks":22191,"value":22192,"nodeType":865},{},[],"So, even if logs are available and you’re able to ingest them into your SIEM, there’s no guarantee that the telemetry available will contribute to any meaningful detection of malicious activity. ",{"data":22194,"content":22195,"nodeType":1218},{},[22196],{"data":22197,"marks":22198,"value":22200,"nodeType":865},{},[22199],{"type":946},"Limited response capabilities",{"data":22202,"content":22203,"nodeType":866},{},[22204],{"data":22205,"marks":22206,"value":22207,"nodeType":865},{},[],"By some miracle, you’ve detected an account takeover. Now what?",{"data":22209,"content":22210,"nodeType":866},{},[22211],{"data":22212,"marks":22213,"value":22214,"nodeType":865},{},[],"The ability to respond to an attack is dictated by the controls that are available to the security team. Unfortunately:",{"data":22216,"content":22217,"nodeType":891},{},[22218,22228,22238],{"data":22219,"content":22220,"nodeType":880},{},[22221],{"data":22222,"content":22223,"nodeType":866},{},[22224],{"data":22225,"marks":22226,"value":22227,"nodeType":865},{},[],"Depending on the app and how it was adopted, there’s no guarantee that you have admin rights. ",{"data":22229,"content":22230,"nodeType":880},{},[22231],{"data":22232,"content":22233,"nodeType":866},{},[22234],{"data":22235,"marks":22236,"value":22237,"nodeType":865},{},[],"It’s not guaranteed that admins will have the required security features available to them, like forcing a logout on a session or disabling an account (you may not even know who the users and admins are within your organization, particularly if it was self-adopted by a specific team). ",{"data":22239,"content":22240,"nodeType":880},{},[22241],{"data":22242,"content":22243,"nodeType":866},{},[22244],{"data":22245,"marks":22246,"value":22247,"nodeType":865},{},[],"Response probably requires that you log into the app and perform these actions in the admin interface (rather than being something you can orchestrate via SIEM workflow or API).",{"data":22249,"content":22250,"nodeType":866},{},[22251],{"data":22252,"marks":22253,"value":22254,"nodeType":865},{},[],"So at the point that the SecOps team is engaged, the team needs to be able to respond by eradicating the attacker’s access and closing the vulnerabilities exploited to prevent re-entry. To do this, the team needs to be able to identify, for example:",{"data":22256,"content":22257,"nodeType":891},{},[22258,22268,22278,22288,22298],{"data":22259,"content":22260,"nodeType":880},{},[22261],{"data":22262,"content":22263,"nodeType":866},{},[22264],{"data":22265,"marks":22266,"value":22267,"nodeType":865},{},[],"How the attacker gained access to the account",{"data":22269,"content":22270,"nodeType":880},{},[22271],{"data":22272,"content":22273,"nodeType":866},{},[22274],{"data":22275,"marks":22276,"value":22277,"nodeType":865},{},[],"What the attacker did using the compromised account",{"data":22279,"content":22280,"nodeType":880},{},[22281],{"data":22282,"content":22283,"nodeType":866},{},[22284],{"data":22285,"marks":22286,"value":22287,"nodeType":865},{},[],"Whether any alternative access methods were established (e.g. backup emails, API keys, or OAuth integrations)",{"data":22289,"content":22290,"nodeType":880},{},[22291],{"data":22292,"content":22293,"nodeType":866},{},[22294],{"data":22295,"marks":22296,"value":22297,"nodeType":865},{},[],"Where the attacker could have laterally moved to using the account (based on the integrations and permissions of the identity)",{"data":22299,"content":22300,"nodeType":880},{},[22301],{"data":22302,"content":22303,"nodeType":866},{},[22304],{"data":22305,"marks":22306,"value":22307,"nodeType":865},{},[],"Other accounts the attacker could also access using the same credentials",{"data":22309,"content":22310,"nodeType":866},{},[22311],{"data":22312,"marks":22313,"value":22314,"nodeType":865},{},[],"Given the limited tools available and the probable lack of app-specific knowledge (you can’t be an expert in every app!), by the time you’ve managed to respond, the attacker has probably already sailed off into the sunset with all of the data they can lay their hands on. ",{"data":22316,"content":22317,"nodeType":866},{},[22318],{"data":22319,"marks":22320,"value":22321,"nodeType":865},{},[],"Clearly, post-compromise detection and response isn’t really a viable option – you’re basically entering full response and recovery mode at this point. ",{"data":22323,"content":22324,"nodeType":948},{},[22325],{"data":22326,"marks":22327,"value":22329,"nodeType":865},{},[22328],{"type":946},"Shifting detection left",{"data":22331,"content":22332,"nodeType":866},{},[22333],{"data":22334,"marks":22335,"value":22336,"nodeType":865},{},[],"If you can’t reasonably detect and respond to post-compromise activity, it makes detecting and blocking initial access much more important. ",{"data":22338,"content":22339,"nodeType":866},{},[22340],{"data":22341,"marks":22342,"value":22343,"nodeType":865},{},[],"Again, it seems obvious, but it’s yet another notion that’s fallen under the radar – despite the trendiness of ‘shifting left’ in other areas like software development and vulnerability management. Partly because as we’ve discussed, post-compromise detection and response has been the norm for so long. But also because we’ve accepted the status quo of the (somewhat disappointing) preventative controls that are available. ",{"data":22345,"content":22346,"nodeType":866},{},[22347],{"data":22348,"marks":22349,"value":22350,"nodeType":865},{},[],"First, let’s isolate the techniques and steps that attackers typically rely on for account takeover. ",{"data":22352,"content":22353,"nodeType":1218},{},[22354],{"data":22355,"marks":22356,"value":22358,"nodeType":865},{},[22357],{"type":946},"Methods of account takeover",{"data":22360,"content":22361,"nodeType":866},{},[22362],{"data":22363,"marks":22364,"value":22365,"nodeType":865},{},[],"To be able to hijack an account, an attacker needs to possess one of two things:",{"data":22367,"content":22368,"nodeType":891},{},[22369,22379],{"data":22370,"content":22371,"nodeType":880},{},[22372],{"data":22373,"content":22374,"nodeType":866},{},[22375],{"data":22376,"marks":22377,"value":22378,"nodeType":865},{},[],"Authentication material e.g. a username and password, with a login portal URL.",{"data":22380,"content":22381,"nodeType":880},{},[22382],{"data":22383,"content":22384,"nodeType":866},{},[22385],{"data":22386,"marks":22387,"value":22388,"nodeType":865},{},[],"Session material e.g. session cookies. ",{"data":22390,"content":22391,"nodeType":866},{},[22392],{"data":22393,"marks":22394,"value":22395,"nodeType":865},{},[],"There are three main ways that an attacker can hijack an account by acquiring (or generating) these materials: Phishing, infostealers, and credential stuffing. ",{"data":22397,"content":22398,"nodeType":891},{},[22399,22414,22429],{"data":22400,"content":22401,"nodeType":880},{},[22402],{"data":22403,"content":22404,"nodeType":866},{},[22405,22410],{"data":22406,"marks":22407,"value":22409,"nodeType":865},{},[22408],{"type":946},"Phishing:",{"data":22411,"marks":22412,"value":22413,"nodeType":865},{},[]," Stealing valid authentication and session material from victims, including usernames, passwords, and session cookies (if AitM or BitM), for a specific site or app.",{"data":22415,"content":22416,"nodeType":880},{},[22417],{"data":22418,"content":22419,"nodeType":866},{},[22420,22425],{"data":22421,"marks":22422,"value":22424,"nodeType":865},{},[22423],{"type":946},"Infostealers:",{"data":22426,"marks":22427,"value":22428,"nodeType":865},{},[]," Stealing valid authentication and session material from the victim’s web browsers for all apps that the user has signed into, as well as desktop information from the device.",{"data":22430,"content":22431,"nodeType":880},{},[22432],{"data":22433,"content":22434,"nodeType":866},{},[22435,22440],{"data":22436,"marks":22437,"value":22439,"nodeType":865},{},[22438],{"type":946},"Credential stuffing: ",{"data":22441,"marks":22442,"value":22443,"nodeType":865},{},[],"Using previously breached authentication or session material in data breach dumps, or taking advantage of weak or guessable passwords (as a result of password reuse).",{"data":22445,"content":22446,"nodeType":866},{},[22447],{"data":22448,"marks":22449,"value":22450,"nodeType":865},{},[],"Once this information has been acquired, the attack path follows a similar journey regardless of the initial attack technique, ending in the attacker initiating a session in their own browser. ",{"data":22452,"content":22456,"nodeType":907},{"target":22453},{"sys":22454},{"id":22455,"type":904,"linkType":905},"7CJT84yPsiUaUO4Mfb6oFd",[],{"data":22458,"content":22459,"nodeType":866},{},[22460],{"data":22461,"marks":22462,"value":22463,"nodeType":865},{},[],"Clearly, there are a number of steps here that involve user behaviors/actions that could in theory be detected with the right visibility:",{"data":22465,"content":22466,"nodeType":891},{},[22467,22477,22487,22497],{"data":22468,"content":22469,"nodeType":880},{},[22470],{"data":22471,"content":22472,"nodeType":866},{},[22473],{"data":22474,"marks":22475,"value":22476,"nodeType":865},{},[],"The victim being sent and accessing a malicious link, or downloading a malicious file",{"data":22478,"content":22479,"nodeType":880},{},[22480],{"data":22481,"content":22482,"nodeType":866},{},[22483],{"data":22484,"marks":22485,"value":22486,"nodeType":865},{},[],"The victim loading a malicious webpage",{"data":22488,"content":22489,"nodeType":880},{},[22490],{"data":22491,"content":22492,"nodeType":866},{},[22493],{"data":22494,"marks":22495,"value":22496,"nodeType":865},{},[],"The victim interacting with a malicious webpage, such as entering their credentials",{"data":22498,"content":22499,"nodeType":880},{},[22500],{"data":22501,"content":22502,"nodeType":866},{},[22503],{"data":22504,"marks":22505,"value":22506,"nodeType":865},{},[],"(If an infostealer attack) The victim executing malware on their device",{"data":22508,"content":22509,"nodeType":866},{},[22510],{"data":22511,"marks":22512,"value":22513,"nodeType":865},{},[],"Finally, the attacker must also access the stolen account from their own device/browser.",{"data":22515,"content":22516,"nodeType":1218},{},[22517],{"data":22518,"marks":22519,"value":22521,"nodeType":865},{},[22520],{"type":946},"Existing controls are falling short",{"data":22523,"content":22524,"nodeType":866},{},[22525],{"data":22526,"marks":22527,"value":22528,"nodeType":865},{},[],"So, now we know what these attacks look like, how do you feasibly detect and block them? ",{"data":22530,"content":22531,"nodeType":866},{},[22532],{"data":22533,"marks":22534,"value":22535,"nodeType":865},{},[],"The vast majority of identity attacks take place entirely over the internet. These attacks don’t involve traditional network and endpoint-based techniques, and therefore don’t run into many of your existing perimeter controls. Infostealer attacks are the exception in that they do involve an endpoint compromise (and therefore come up against EDR), but attackers are continually finding new bypass techniques, or are targeting unmanaged devices that are not protected by EDR. ",{"data":22537,"content":22538,"nodeType":866},{},[22539,22543,22551,22555,22563],{"data":22540,"marks":22541,"value":22542,"nodeType":865},{},[],"This leaves us in the hands of TI-driven blocklists and SWG/email controls that identify and block malicious content. However, these controls are largely based on ",{"data":22544,"content":22545,"nodeType":1102},{"uri":4696},[22546],{"data":22547,"marks":22548,"value":22550,"nodeType":865},{},[22549],{"type":4537},"indicators like domain names, URLs, and IPs",{"data":22552,"marks":22553,"value":22554,"nodeType":865},{},[]," which are easy for attackers to change (and therefore bypass). Where pages and downloads are analyzed, ",{"data":22556,"content":22557,"nodeType":1102},{"uri":7038},[22558],{"data":22559,"marks":22560,"value":22562,"nodeType":865},{},[22561],{"type":4537},"attackers are routinely implementing obfuscation measures to defeat more advanced dynamic controls",{"data":22564,"marks":22565,"value":22566,"nodeType":865},{},[]," with a lot of success, or using techniques like HTML smuggling to bypass download scanning tools. ",{"data":22568,"content":22569,"nodeType":1218},{},[22570],{"data":22571,"marks":22572,"value":22574,"nodeType":865},{},[22573],{"type":946},"Detecting and responding to account takeover with Push",{"data":22576,"content":22577,"nodeType":866},{},[22578],{"data":22579,"marks":22580,"value":22581,"nodeType":865},{},[],"But, Push’s vantage point in the browser gives us a very different perspective. Because in the browser, you have much better visibility of the rendered web page (meaning it's much harder to disguise malicious content). You also aren’t restricted to email, and can intercept a user loading a malicious page whatever it’s source. ",{"data":22583,"content":22587,"nodeType":907},{"target":22584},{"sys":22585},{"id":22586,"type":904,"linkType":905},"4JpFRHGRGEbCb1hNF0CGlE",[],{"data":22589,"content":22590,"nodeType":866},{},[22591],{"data":22592,"marks":22593,"value":22594,"nodeType":865},{},[],"So, let’s compare the typical web-based controls that organizations rely on against what’s possible using Push’s browser-based solution. We’ll put EDR to one side here and focus on a typical phishing attack, since the majority of the attack path happens over the internet (and the attacker has to return to the internet to access the app/account anyway). ",{"data":22596,"content":22600,"nodeType":907},{"target":22597},{"sys":22598},{"id":22599,"type":904,"linkType":905},"4ua9ZNNSnxJnRLwJvRTaf1",[],{"data":22602,"content":22603,"nodeType":866},{},[22604],{"data":22605,"marks":22606,"value":22607,"nodeType":865},{},[],"You can see here that attackers have established methods of routinely bypassing these controls. In contrast, with Push, there are layered detections against different stages of the attack path to account takeover, providing defense-in-depth should a layer be somehow bypassed.",{"data":22609,"content":22613,"nodeType":907},{"target":22610},{"sys":22611},{"id":22612,"type":904,"linkType":905},"ogIj92nzV9Q2Z7I9YOgG3",[],{"data":22615,"content":22616,"nodeType":866},{},[22617],{"data":22618,"marks":22619,"value":22620,"nodeType":865},{},[],"In practice, this creates four strong lines of defense – all before an attacker can even take over an account. ",{"data":22622,"content":22623,"nodeType":891},{},[22624,22643,22662,22681],{"data":22625,"content":22626,"nodeType":880},{},[22627],{"data":22628,"content":22629,"nodeType":866},{},[22630,22634,22640],{"data":22631,"marks":22632,"value":22633,"nodeType":865},{},[],"1st line: ",{"data":22635,"content":22636,"nodeType":1102},{"uri":7374},[22637],{"data":22638,"marks":22639,"value":7379,"nodeType":865},{},[],{"data":22641,"marks":22642,"value":21,"nodeType":865},{},[],{"data":22644,"content":22645,"nodeType":880},{},[22646],{"data":22647,"content":22648,"nodeType":866},{},[22649,22653,22659],{"data":22650,"marks":22651,"value":22652,"nodeType":865},{},[],"2nd line: ",{"data":22654,"content":22655,"nodeType":1102},{"uri":7395},[22656],{"data":22657,"marks":22658,"value":7400,"nodeType":865},{},[],{"data":22660,"marks":22661,"value":7361,"nodeType":865},{},[],{"data":22663,"content":22664,"nodeType":880},{},[22665],{"data":22666,"content":22667,"nodeType":866},{},[22668,22672,22678],{"data":22669,"marks":22670,"value":22671,"nodeType":865},{},[],"3rd line: ",{"data":22673,"content":22674,"nodeType":1102},{"uri":7255},[22675],{"data":22676,"marks":22677,"value":7357,"nodeType":865},{},[],{"data":22679,"marks":22680,"value":7361,"nodeType":865},{},[],{"data":22682,"content":22683,"nodeType":880},{},[22684],{"data":22685,"content":22686,"nodeType":866},{},[22687,22691,22698],{"data":22688,"marks":22689,"value":22690,"nodeType":865},{},[],"4th line: ",{"data":22692,"content":22693,"nodeType":1102},{"uri":15589},[22694],{"data":22695,"marks":22696,"value":22697,"nodeType":865},{},[],"Detecting when an attacker resumes a stolen session in a browser without the Push extension running. ",{"data":22699,"marks":22700,"value":21,"nodeType":865},{},[],{"data":22702,"content":22703,"nodeType":866},{},[22704],{"data":22705,"marks":22706,"value":22707,"nodeType":865},{},[],"Each of these controls either detects and blocks the account takeover attempt outright, or provides a high-fidelity indicator that should trigger a priority investigation via your SecOps workflow. ",{"data":22709,"content":22710,"nodeType":948},{},[22711],{"data":22712,"marks":22713,"value":6758,"nodeType":865},{},[22714],{"type":946},{"data":22716,"content":22717,"nodeType":866},{},[22718],{"data":22719,"marks":22720,"value":22721,"nodeType":865},{},[],"Hopefully we’ve demonstrated shifting detection left isn’t just possible, but essential for defending against modern identity attacks and account takeover. ",{"data":22723,"content":22724,"nodeType":866},{},[22725,22729,22737],{"data":22726,"marks":22727,"value":22728,"nodeType":865},{},[],"This is the second post in our design philosophy series, so if you want to read about how we’re building detections that are hard for attackers to bypass using the Pyramid of Pain, ",{"data":22730,"content":22731,"nodeType":1102},{"uri":4696},[22732],{"data":22733,"marks":22734,"value":22736,"nodeType":865},{},[22735],{"type":4537},"you can check it out here",{"data":22738,"marks":22739,"value":7361,"nodeType":865},{},[],{"data":22741,"content":22742,"nodeType":866},{},[22743],{"data":22744,"marks":22745,"value":22746,"nodeType":865},{},[],"We look forward to sharing more about our design philosophy with you in the future! ","Shifting detection left for more effective threat detection","Why relying on post-compromise detection and response is no longer an option for modern browser-based attacks.","2024-10-25T00:00:00.000Z","shifting-detection-left-for-more-effective-threat-detection",{"items":22752},[22753,22755],{"sys":22754,"name":342},{"id":2527},{"sys":22756,"name":2524},{"id":2523},{"items":22758},[22759],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":22760},{"url":6031},{"__typename":2239,"sys":22762,"content":22764,"title":23078,"synopsis":23079,"hashTags":59,"publishedDate":23080,"slug":23081,"tagsCollection":23082,"authorsCollection":23088},{"id":22763},"4bYO5rVy9n2OO3vtMVQeda",{"json":22765},{"data":22766,"content":22767,"nodeType":2232},{},[22768,22775,22793,22808,22815,22822,22825,22832,22839,22892,22899,22905,22908,22915,22922,22929,22936,22943,22960,22966,22973,22980,22997,23003,23010,23017,23024,23031,23038,23041,23048,23066,23072],{"data":22769,"content":22770,"nodeType":948},{},[22771],{"data":22772,"marks":22773,"value":22774,"nodeType":865},{},[],"All phishing eventually leads to the browser",{"data":22776,"content":22777,"nodeType":866},{},[22778,22782,22790],{"data":22779,"marks":22780,"value":22781,"nodeType":865},{},[],"The best attack detection methods are those that focus on ",{"data":22783,"content":22784,"nodeType":1102},{"uri":4696},[22785],{"data":22786,"marks":22787,"value":22789,"nodeType":865},{},[22788],{"type":4537},"detecting indicators that are difficult for attackers to change or obfuscate",{"data":22791,"marks":22792,"value":7361,"nodeType":865},{},[],{"data":22794,"content":22795,"nodeType":866},{},[22796,22800,22804],{"data":22797,"marks":22798,"value":22799,"nodeType":865},{},[],"For a credential phishing attack to succeed, the victim ",{"data":22801,"marks":22802,"value":13546,"nodeType":865},{},[22803],{"type":4537},{"data":22805,"marks":22806,"value":22807,"nodeType":865},{},[]," to enter their password into a webpage. There’s no two-ways about it, attackers cannot change this. ",{"data":22809,"content":22810,"nodeType":866},{},[22811],{"data":22812,"marks":22813,"value":22814,"nodeType":865},{},[],"So it stands to reason that, if you can detect this user behavior, and block them from entering their password, then you can stop phishing. ",{"data":22816,"content":22817,"nodeType":866},{},[22818],{"data":22819,"marks":22820,"value":22821,"nodeType":865},{},[],"This is exactly what Push does.",{"data":22823,"content":22824,"nodeType":938},{},[],{"data":22826,"content":22827,"nodeType":1218},{},[22828],{"data":22829,"marks":22830,"value":22831,"nodeType":865},{},[],"Most anti-phishing tools are easily bypassed",{"data":22833,"content":22834,"nodeType":866},{},[22835],{"data":22836,"marks":22837,"value":22838,"nodeType":865},{},[],"Other anti-phishing tools rely on detecting elements of the attack that attackers can change and hide, such as domains or the webpage contents. Attackers use tricks to evade these detection, like:",{"data":22840,"content":22841,"nodeType":891},{},[22842,22852,22862,22872,22882],{"data":22843,"content":22844,"nodeType":880},{},[22845],{"data":22846,"content":22847,"nodeType":866},{},[22848],{"data":22849,"marks":22850,"value":22851,"nodeType":865},{},[],"Using Cloudflare Workers to block automatic analysis of their phishing site",{"data":22853,"content":22854,"nodeType":880},{},[22855],{"data":22856,"content":22857,"nodeType":866},{},[22858],{"data":22859,"marks":22860,"value":22861,"nodeType":865},{},[],"Hacking a Wordpress blog to get a reputable domain that passes domain checks ",{"data":22863,"content":22864,"nodeType":880},{},[22865],{"data":22866,"content":22867,"nodeType":866},{},[22868],{"data":22869,"marks":22870,"value":22871,"nodeType":865},{},[],"Using redirects and rotating the URLs delivered to the victim to bypass link analysis",{"data":22873,"content":22874,"nodeType":880},{},[22875],{"data":22876,"content":22877,"nodeType":866},{},[22878],{"data":22879,"marks":22880,"value":22881,"nodeType":865},{},[],"Randomizing the HTML title for the web page to bypass blocklists ",{"data":22883,"content":22884,"nodeType":880},{},[22885],{"data":22886,"content":22887,"nodeType":866},{},[22888],{"data":22889,"marks":22890,"value":22891,"nodeType":865},{},[],"One-time phishing links that only work the first time they are clicked",{"data":22893,"content":22894,"nodeType":866},{},[22895],{"data":22896,"marks":22897,"value":22898,"nodeType":865},{},[],"Push is putting an end to this game of cat and mouse, by keeping it really simple; you can’t phish someone who can’t put their password into a phishing page. ",{"data":22900,"content":22904,"nodeType":907},{"target":22901},{"sys":22902},{"id":22903,"type":904,"linkType":905},"6AwOZSpqaChmeksnj4SyWE",[],{"data":22906,"content":22907,"nodeType":938},{},[],{"data":22909,"content":22910,"nodeType":1218},{},[22911],{"data":22912,"marks":22913,"value":22914,"nodeType":865},{},[],"Domain-binding passwords",{"data":22916,"content":22917,"nodeType":866},{},[22918],{"data":22919,"marks":22920,"value":22921,"nodeType":865},{},[],"If you’re familiar with how passkeys are domain-bound, then think of what Push does as domain-binding passwords. We pin the password to its legitimate domain(s) and then don’t allow it to be entered into any webpage on any other domain. ",{"data":22923,"content":22924,"nodeType":866},{},[22925],{"data":22926,"marks":22927,"value":22928,"nodeType":865},{},[],"But just because you’ve stopped your users from being phished doesn’t mean you don’t want to know when attackers are attempting to phish your users and how. ",{"data":22930,"content":22931,"nodeType":866},{},[22932],{"data":22933,"marks":22934,"value":22935,"nodeType":865},{},[],"Push still inspects webpages to see if attackers are rendering cloned app login pages in the browser or if known AitM and BitM toolkits are being used. This way you don’t lose visibility of the unsuccessful attacks that are targeting your users. Think of it as a handy second and third layer of defense.",{"data":22937,"content":22938,"nodeType":866},{},[22939],{"data":22940,"marks":22941,"value":22942,"nodeType":865},{},[],"Lets run through a quick before and after example:",{"data":22944,"content":22945,"nodeType":1218},{},[22946,22950,22956],{"data":22947,"marks":22948,"value":22949,"nodeType":865},{},[],"Scenario 1: An attacker attempts to phish an employee that ",{"data":22951,"marks":22952,"value":22955,"nodeType":865},{},[22953,22954],{"type":4537},{"type":946},"doesn’t",{"data":22957,"marks":22958,"value":22959,"nodeType":865},{},[]," have Push deployed to their browser.",{"data":22961,"content":22965,"nodeType":907},{"target":22962},{"sys":22963},{"id":22964,"type":904,"linkType":905},"2CbGMUSJsP1mNeHkmpLl6N",[],{"data":22967,"content":22968,"nodeType":866},{},[22969],{"data":22970,"marks":22971,"value":22972,"nodeType":865},{},[],"Here, an attacker hacks a Wordpress blog to get a reputable domain and then runs a phishing toolkit on the webpage. They email one of your employees a link to it. Your SWG / email scanning solution inspects it in a sandbox but the phish kit detects this and redirects to a benign site so that it passes the inspection. ",{"data":22974,"content":22975,"nodeType":866},{},[22976],{"data":22977,"marks":22978,"value":22979,"nodeType":865},{},[],"Your user gets the email with the link and is now free to interact with the phishing page. They enter their credentials plus MFA code into the page and voila! The attacker steals them and is able to compromise the user’s account.  ",{"data":22981,"content":22982,"nodeType":1218},{},[22983,22987,22993],{"data":22984,"marks":22985,"value":22986,"nodeType":865},{},[],"Scenario 2: An attacker attempts to phish an employee that ",{"data":22988,"marks":22989,"value":22992,"nodeType":865},{},[22990,22991],{"type":4537},{"type":946},"does",{"data":22994,"marks":22995,"value":22996,"nodeType":865},{},[]," have Push deployed to their browser. ",{"data":22998,"content":23002,"nodeType":907},{"target":22999},{"sys":23000},{"id":23001,"type":904,"linkType":905},"77smnID1woCfFJrJPyTvKY",[],{"data":23004,"content":23005,"nodeType":866},{},[23006],{"data":23007,"marks":23008,"value":23009,"nodeType":865},{},[],"This time, the attacker uses the same phishing toolkit and domain from the first example. But in reality, they don’t have to send it to your employee using email, instead, they could use LinkedIn messenger, Slack, Teams, or any application that allows employees to communicate with each other. ",{"data":23011,"content":23012,"nodeType":866},{},[23013],{"data":23014,"marks":23015,"value":23016,"nodeType":865},{},[],"Like before, the user receives the link, opens it and starts to enter their credentials into the webpage. This time though, the Push browser extension inspects the webpage running in the user's browser. Push observes that the webpage is a login page and the user is entering their password into the page.",{"data":23018,"content":23019,"nodeType":866},{},[23020],{"data":23021,"marks":23022,"value":23023,"nodeType":865},{},[],"The first detection Push makes is checking that the password the user is entering matches the domain that password is pinned to. Since it doesn't match, based on this detection alone the user is automatically redirected to a blocking page. An important point to make here is that the password never leaves the user’s browser and the check is made using a shortened salted hash of the password.   ",{"data":23025,"content":23026,"nodeType":866},{},[23027],{"data":23028,"marks":23029,"value":23030,"nodeType":865},{},[],"The second detection Push makes is that the rendered web app is using a cloned app login page. The third detection is that a phishing toolkit is running in the web app code. ",{"data":23032,"content":23033,"nodeType":866},{},[23034],{"data":23035,"marks":23036,"value":23037,"nodeType":865},{},[],"In this particular scenario these second and third detections serve as useful context for understanding the nature of the phishing attack. But both will still redirect to a blocking page if they are triggered in isolation of the other phishing detections. ",{"data":23039,"content":23040,"nodeType":938},{},[],{"data":23042,"content":23043,"nodeType":948},{},[23044],{"data":23045,"marks":23046,"value":23047,"nodeType":865},{},[],"We don’t just stop phishing attacks",{"data":23049,"content":23050,"nodeType":866},{},[23051,23055,23063],{"data":23052,"marks":23053,"value":23054,"nodeType":865},{},[],"We also detect other identity-related attack techniques used to compromise user accounts. That includes credential stuffing, password spraying and session hijacking using stolen session tokens. If you want to learn more about how Push helps you to detect and defeat common identity attack techniques, ",{"data":23056,"content":23057,"nodeType":1102},{"uri":10028},[23058],{"data":23059,"marks":23060,"value":23062,"nodeType":865},{},[23061],{"type":4537},"book some time with one of our team",{"data":23064,"marks":23065,"value":6360,"nodeType":865},{},[],{"data":23067,"content":23071,"nodeType":907},{"target":23068},{"sys":23069},{"id":23070,"type":904,"linkType":905},"2JSmYDaiAciOx7Z1MRuJlA",[],{"data":23073,"content":23074,"nodeType":866},{},[23075],{"data":23076,"marks":23077,"value":21,"nodeType":865},{},[],"Detecting and blocking phishing attacks in the browser","How Push detects and blocks phishing attempts in the browser – explained in less than two minutes. ","2024-10-23T00:00:00.000Z","detecting-and-blocking-phishing-attacks-in-the-browser",{"items":23083},[23084,23086],{"sys":23085,"name":2524},{"id":2523},{"sys":23087,"name":342},{"id":2527},{"items":23089},[23090],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":23091},{"url":11136},"navigating-your-first-90-days-with-push","blog/navigating-your-first-90-days-with-push",{"json":23095},{"data":23096,"content":23097,"nodeType":2232},{},[23098],{"data":23099,"content":23100,"nodeType":866},{},[23101],{"data":23102,"marks":23103,"value":23104,"nodeType":865},{},[],"Inspired by the classic 1980s video game Oregon Trail, we’ve put together the following guide for intrepid security teams who are traveling across potentially unknown territory as they uncover their identity attack surface and secure it against modern identity attacks.","We’ve put together the following guide for intrepid security teams as they use Push to secure against modern identity attacks.",{"id":23107,"publishedAt":23108},"3lWfiuAMsVecxVyEKiwV0c","2026-08-12T11:54:41.421Z",{"items":23110},[23111],{"sys":23112,"name":297},{"id":11129},{"items":23114},[23115,23117,23119,23121,23123,23125,23127,23129],{"sys":23116,"name":297,"slug":298,"tier":31},{"id":294},{"sys":23118,"name":413,"slug":414,"tier":31},{"id":410},{"sys":23120,"name":261,"slug":262,"tier":45},{"id":258},{"sys":23122,"name":502,"slug":503,"tier":45},{"id":499},{"sys":23124,"name":457,"slug":458,"tier":45},{"id":454},{"sys":23126,"name":589,"slug":590,"tier":45},{"id":586},{"sys":23128,"name":395,"slug":396,"tier":45},{"id":392},{"sys":23130,"name":598,"slug":599,"tier":45},{"id":595},"rgDbhODISg-tt7K5smL6U2HeAtlYB9JhuuUxRhh-k7A",{"id":23133,"title":22747,"authorsCollection":23134,"content":23139,"extension":228,"faqItemsCollection":23909,"faqTitle":59,"featured":6,"hashTags":59,"meta":23911,"metaTitle":23912,"ogImage":23913,"postType":5061,"publishedDate":22749,"relatedBlogPostsCollection":23915,"slug":22750,"stem":26791,"subtitle":59,"summary":26792,"synopsis":22748,"sys":26803,"tagsCollection":26805,"topicsCollection":26811,"__hash__":26841},"blog/blog/shifting-detection-left-for-more-effective-threat-detection.json",{"items":23135},[23136],{"fullName":6027,"firstName":6028,"jobTitle":6029,"socialLinks":23137,"profilePicture":23138},[13796],{"url":6031},{"json":23140,"links":23857},{"data":23141,"content":23142,"nodeType":2232},{},[23143,23149,23155,23161,23166,23173,23179,23184,23190,23195,23201,23208,23214,23219,23225,23251,23257,23263,23293,23300,23306,23313,23320,23326,23332,23348,23354,23360,23366,23373,23379,23385,23415,23421,23469,23475,23481,23488,23494,23500,23506,23513,23519,23540,23546,23588,23594,23599,23605,23644,23650,23657,23663,23669,23695,23702,23708,23713,23719,23724,23730,23735,23741,23816,23822,23829,23835,23851],{"data":23144,"content":23145,"nodeType":866},{},[23146],{"data":23147,"marks":23148,"value":21939,"nodeType":865},{},[],{"data":23150,"content":23151,"nodeType":866},{},[23152],{"data":23153,"marks":23154,"value":21946,"nodeType":865},{},[],{"data":23156,"content":23157,"nodeType":866},{},[23158],{"data":23159,"marks":23160,"value":21953,"nodeType":865},{},[],{"data":23162,"content":23165,"nodeType":907},{"target":23163},{"sys":23164},{"id":21958,"type":904,"linkType":905},[],{"data":23167,"content":23168,"nodeType":948},{},[23169],{"data":23170,"marks":23171,"value":21967,"nodeType":865},{},[23172],{"type":946},{"data":23174,"content":23175,"nodeType":866},{},[23176],{"data":23177,"marks":23178,"value":21974,"nodeType":865},{},[],{"data":23180,"content":23183,"nodeType":907},{"target":23181},{"sys":23182},{"id":21979,"type":904,"linkType":905},[],{"data":23185,"content":23186,"nodeType":866},{},[23187],{"data":23188,"marks":23189,"value":21987,"nodeType":865},{},[],{"data":23191,"content":23194,"nodeType":907},{"target":23192},{"sys":23193},{"id":21992,"type":904,"linkType":905},[],{"data":23196,"content":23197,"nodeType":866},{},[23198],{"data":23199,"marks":23200,"value":22000,"nodeType":865},{},[],{"data":23202,"content":23203,"nodeType":948},{},[23204],{"data":23205,"marks":23206,"value":22008,"nodeType":865},{},[23207],{"type":946},{"data":23209,"content":23210,"nodeType":866},{},[23211],{"data":23212,"marks":23213,"value":22015,"nodeType":865},{},[],{"data":23215,"content":23218,"nodeType":907},{"target":23216},{"sys":23217},{"id":22020,"type":904,"linkType":905},[],{"data":23220,"content":23221,"nodeType":866},{},[23222],{"data":23223,"marks":23224,"value":22028,"nodeType":865},{},[],{"data":23226,"content":23227,"nodeType":866},{},[23228,23231,23238,23241,23248],{"data":23229,"marks":23230,"value":22035,"nodeType":865},{},[],{"data":23232,"content":23233,"nodeType":1102},{"uri":22038},[23234],{"data":23235,"marks":23236,"value":22044,"nodeType":865},{},[23237],{"type":4537},{"data":23239,"marks":23240,"value":22048,"nodeType":865},{},[],{"data":23242,"content":23243,"nodeType":1102},{"uri":22051},[23244],{"data":23245,"marks":23246,"value":22057,"nodeType":865},{},[23247],{"type":4537},{"data":23249,"marks":23250,"value":14366,"nodeType":865},{},[],{"data":23252,"content":23253,"nodeType":866},{},[23254],{"data":23255,"marks":23256,"value":22067,"nodeType":865},{},[],{"data":23258,"content":23259,"nodeType":866},{},[23260],{"data":23261,"marks":23262,"value":22074,"nodeType":865},{},[],{"data":23264,"content":23265,"nodeType":891},{},[23266,23275,23284],{"data":23267,"content":23268,"nodeType":880},{},[23269],{"data":23270,"content":23271,"nodeType":866},{},[23272],{"data":23273,"marks":23274,"value":22087,"nodeType":865},{},[],{"data":23276,"content":23277,"nodeType":880},{},[23278],{"data":23279,"content":23280,"nodeType":866},{},[23281],{"data":23282,"marks":23283,"value":22097,"nodeType":865},{},[],{"data":23285,"content":23286,"nodeType":880},{},[23287],{"data":23288,"content":23289,"nodeType":866},{},[23290],{"data":23291,"marks":23292,"value":22107,"nodeType":865},{},[],{"data":23294,"content":23295,"nodeType":866},{},[23296],{"data":23297,"marks":23298,"value":22115,"nodeType":865},{},[23299],{"type":946},{"data":23301,"content":23302,"nodeType":866},{},[23303],{"data":23304,"marks":23305,"value":22122,"nodeType":865},{},[],{"data":23307,"content":23308,"nodeType":948},{},[23309],{"data":23310,"marks":23311,"value":22130,"nodeType":865},{},[23312],{"type":946},{"data":23314,"content":23315,"nodeType":1218},{},[23316],{"data":23317,"marks":23318,"value":22138,"nodeType":865},{},[23319],{"type":946},{"data":23321,"content":23322,"nodeType":866},{},[23323],{"data":23324,"marks":23325,"value":22145,"nodeType":865},{},[],{"data":23327,"content":23328,"nodeType":866},{},[23329],{"data":23330,"marks":23331,"value":22152,"nodeType":865},{},[],{"data":23333,"content":23334,"nodeType":866},{},[23335,23338,23345],{"data":23336,"marks":23337,"value":22159,"nodeType":865},{},[],{"data":23339,"content":23340,"nodeType":1102},{"uri":7446},[23341],{"data":23342,"marks":23343,"value":22167,"nodeType":865},{},[23344],{"type":4537},{"data":23346,"marks":23347,"value":22171,"nodeType":865},{},[],{"data":23349,"content":23350,"nodeType":866},{},[23351],{"data":23352,"marks":23353,"value":22178,"nodeType":865},{},[],{"data":23355,"content":23356,"nodeType":866},{},[23357],{"data":23358,"marks":23359,"value":22185,"nodeType":865},{},[],{"data":23361,"content":23362,"nodeType":866},{},[23363],{"data":23364,"marks":23365,"value":22192,"nodeType":865},{},[],{"data":23367,"content":23368,"nodeType":1218},{},[23369],{"data":23370,"marks":23371,"value":22200,"nodeType":865},{},[23372],{"type":946},{"data":23374,"content":23375,"nodeType":866},{},[23376],{"data":23377,"marks":23378,"value":22207,"nodeType":865},{},[],{"data":23380,"content":23381,"nodeType":866},{},[23382],{"data":23383,"marks":23384,"value":22214,"nodeType":865},{},[],{"data":23386,"content":23387,"nodeType":891},{},[23388,23397,23406],{"data":23389,"content":23390,"nodeType":880},{},[23391],{"data":23392,"content":23393,"nodeType":866},{},[23394],{"data":23395,"marks":23396,"value":22227,"nodeType":865},{},[],{"data":23398,"content":23399,"nodeType":880},{},[23400],{"data":23401,"content":23402,"nodeType":866},{},[23403],{"data":23404,"marks":23405,"value":22237,"nodeType":865},{},[],{"data":23407,"content":23408,"nodeType":880},{},[23409],{"data":23410,"content":23411,"nodeType":866},{},[23412],{"data":23413,"marks":23414,"value":22247,"nodeType":865},{},[],{"data":23416,"content":23417,"nodeType":866},{},[23418],{"data":23419,"marks":23420,"value":22254,"nodeType":865},{},[],{"data":23422,"content":23423,"nodeType":891},{},[23424,23433,23442,23451,23460],{"data":23425,"content":23426,"nodeType":880},{},[23427],{"data":23428,"content":23429,"nodeType":866},{},[23430],{"data":23431,"marks":23432,"value":22267,"nodeType":865},{},[],{"data":23434,"content":23435,"nodeType":880},{},[23436],{"data":23437,"content":23438,"nodeType":866},{},[23439],{"data":23440,"marks":23441,"value":22277,"nodeType":865},{},[],{"data":23443,"content":23444,"nodeType":880},{},[23445],{"data":23446,"content":23447,"nodeType":866},{},[23448],{"data":23449,"marks":23450,"value":22287,"nodeType":865},{},[],{"data":23452,"content":23453,"nodeType":880},{},[23454],{"data":23455,"content":23456,"nodeType":866},{},[23457],{"data":23458,"marks":23459,"value":22297,"nodeType":865},{},[],{"data":23461,"content":23462,"nodeType":880},{},[23463],{"data":23464,"content":23465,"nodeType":866},{},[23466],{"data":23467,"marks":23468,"value":22307,"nodeType":865},{},[],{"data":23470,"content":23471,"nodeType":866},{},[23472],{"data":23473,"marks":23474,"value":22314,"nodeType":865},{},[],{"data":23476,"content":23477,"nodeType":866},{},[23478],{"data":23479,"marks":23480,"value":22321,"nodeType":865},{},[],{"data":23482,"content":23483,"nodeType":948},{},[23484],{"data":23485,"marks":23486,"value":22329,"nodeType":865},{},[23487],{"type":946},{"data":23489,"content":23490,"nodeType":866},{},[23491],{"data":23492,"marks":23493,"value":22336,"nodeType":865},{},[],{"data":23495,"content":23496,"nodeType":866},{},[23497],{"data":23498,"marks":23499,"value":22343,"nodeType":865},{},[],{"data":23501,"content":23502,"nodeType":866},{},[23503],{"data":23504,"marks":23505,"value":22350,"nodeType":865},{},[],{"data":23507,"content":23508,"nodeType":1218},{},[23509],{"data":23510,"marks":23511,"value":22358,"nodeType":865},{},[23512],{"type":946},{"data":23514,"content":23515,"nodeType":866},{},[23516],{"data":23517,"marks":23518,"value":22365,"nodeType":865},{},[],{"data":23520,"content":23521,"nodeType":891},{},[23522,23531],{"data":23523,"content":23524,"nodeType":880},{},[23525],{"data":23526,"content":23527,"nodeType":866},{},[23528],{"data":23529,"marks":23530,"value":22378,"nodeType":865},{},[],{"data":23532,"content":23533,"nodeType":880},{},[23534],{"data":23535,"content":23536,"nodeType":866},{},[23537],{"data":23538,"marks":23539,"value":22388,"nodeType":865},{},[],{"data":23541,"content":23542,"nodeType":866},{},[23543],{"data":23544,"marks":23545,"value":22395,"nodeType":865},{},[],{"data":23547,"content":23548,"nodeType":891},{},[23549,23562,23575],{"data":23550,"content":23551,"nodeType":880},{},[23552],{"data":23553,"content":23554,"nodeType":866},{},[23555,23559],{"data":23556,"marks":23557,"value":22409,"nodeType":865},{},[23558],{"type":946},{"data":23560,"marks":23561,"value":22413,"nodeType":865},{},[],{"data":23563,"content":23564,"nodeType":880},{},[23565],{"data":23566,"content":23567,"nodeType":866},{},[23568,23572],{"data":23569,"marks":23570,"value":22424,"nodeType":865},{},[23571],{"type":946},{"data":23573,"marks":23574,"value":22428,"nodeType":865},{},[],{"data":23576,"content":23577,"nodeType":880},{},[23578],{"data":23579,"content":23580,"nodeType":866},{},[23581,23585],{"data":23582,"marks":23583,"value":22439,"nodeType":865},{},[23584],{"type":946},{"data":23586,"marks":23587,"value":22443,"nodeType":865},{},[],{"data":23589,"content":23590,"nodeType":866},{},[23591],{"data":23592,"marks":23593,"value":22450,"nodeType":865},{},[],{"data":23595,"content":23598,"nodeType":907},{"target":23596},{"sys":23597},{"id":22455,"type":904,"linkType":905},[],{"data":23600,"content":23601,"nodeType":866},{},[23602],{"data":23603,"marks":23604,"value":22463,"nodeType":865},{},[],{"data":23606,"content":23607,"nodeType":891},{},[23608,23617,23626,23635],{"data":23609,"content":23610,"nodeType":880},{},[23611],{"data":23612,"content":23613,"nodeType":866},{},[23614],{"data":23615,"marks":23616,"value":22476,"nodeType":865},{},[],{"data":23618,"content":23619,"nodeType":880},{},[23620],{"data":23621,"content":23622,"nodeType":866},{},[23623],{"data":23624,"marks":23625,"value":22486,"nodeType":865},{},[],{"data":23627,"content":23628,"nodeType":880},{},[23629],{"data":23630,"content":23631,"nodeType":866},{},[23632],{"data":23633,"marks":23634,"value":22496,"nodeType":865},{},[],{"data":23636,"content":23637,"nodeType":880},{},[23638],{"data":23639,"content":23640,"nodeType":866},{},[23641],{"data":23642,"marks":23643,"value":22506,"nodeType":865},{},[],{"data":23645,"content":23646,"nodeType":866},{},[23647],{"data":23648,"marks":23649,"value":22513,"nodeType":865},{},[],{"data":23651,"content":23652,"nodeType":1218},{},[23653],{"data":23654,"marks":23655,"value":22521,"nodeType":865},{},[23656],{"type":946},{"data":23658,"content":23659,"nodeType":866},{},[23660],{"data":23661,"marks":23662,"value":22528,"nodeType":865},{},[],{"data":23664,"content":23665,"nodeType":866},{},[23666],{"data":23667,"marks":23668,"value":22535,"nodeType":865},{},[],{"data":23670,"content":23671,"nodeType":866},{},[23672,23675,23682,23685,23692],{"data":23673,"marks":23674,"value":22542,"nodeType":865},{},[],{"data":23676,"content":23677,"nodeType":1102},{"uri":4696},[23678],{"data":23679,"marks":23680,"value":22550,"nodeType":865},{},[23681],{"type":4537},{"data":23683,"marks":23684,"value":22554,"nodeType":865},{},[],{"data":23686,"content":23687,"nodeType":1102},{"uri":7038},[23688],{"data":23689,"marks":23690,"value":22562,"nodeType":865},{},[23691],{"type":4537},{"data":23693,"marks":23694,"value":22566,"nodeType":865},{},[],{"data":23696,"content":23697,"nodeType":1218},{},[23698],{"data":23699,"marks":23700,"value":22574,"nodeType":865},{},[23701],{"type":946},{"data":23703,"content":23704,"nodeType":866},{},[23705],{"data":23706,"marks":23707,"value":22581,"nodeType":865},{},[],{"data":23709,"content":23712,"nodeType":907},{"target":23710},{"sys":23711},{"id":22586,"type":904,"linkType":905},[],{"data":23714,"content":23715,"nodeType":866},{},[23716],{"data":23717,"marks":23718,"value":22594,"nodeType":865},{},[],{"data":23720,"content":23723,"nodeType":907},{"target":23721},{"sys":23722},{"id":22599,"type":904,"linkType":905},[],{"data":23725,"content":23726,"nodeType":866},{},[23727],{"data":23728,"marks":23729,"value":22607,"nodeType":865},{},[],{"data":23731,"content":23734,"nodeType":907},{"target":23732},{"sys":23733},{"id":22612,"type":904,"linkType":905},[],{"data":23736,"content":23737,"nodeType":866},{},[23738],{"data":23739,"marks":23740,"value":22620,"nodeType":865},{},[],{"data":23742,"content":23743,"nodeType":891},{},[23744,23762,23780,23798],{"data":23745,"content":23746,"nodeType":880},{},[23747],{"data":23748,"content":23749,"nodeType":866},{},[23750,23753,23759],{"data":23751,"marks":23752,"value":22633,"nodeType":865},{},[],{"data":23754,"content":23755,"nodeType":1102},{"uri":7374},[23756],{"data":23757,"marks":23758,"value":7379,"nodeType":865},{},[],{"data":23760,"marks":23761,"value":21,"nodeType":865},{},[],{"data":23763,"content":23764,"nodeType":880},{},[23765],{"data":23766,"content":23767,"nodeType":866},{},[23768,23771,23777],{"data":23769,"marks":23770,"value":22652,"nodeType":865},{},[],{"data":23772,"content":23773,"nodeType":1102},{"uri":7395},[23774],{"data":23775,"marks":23776,"value":7400,"nodeType":865},{},[],{"data":23778,"marks":23779,"value":7361,"nodeType":865},{},[],{"data":23781,"content":23782,"nodeType":880},{},[23783],{"data":23784,"content":23785,"nodeType":866},{},[23786,23789,23795],{"data":23787,"marks":23788,"value":22671,"nodeType":865},{},[],{"data":23790,"content":23791,"nodeType":1102},{"uri":7255},[23792],{"data":23793,"marks":23794,"value":7357,"nodeType":865},{},[],{"data":23796,"marks":23797,"value":7361,"nodeType":865},{},[],{"data":23799,"content":23800,"nodeType":880},{},[23801],{"data":23802,"content":23803,"nodeType":866},{},[23804,23807,23813],{"data":23805,"marks":23806,"value":22690,"nodeType":865},{},[],{"data":23808,"content":23809,"nodeType":1102},{"uri":15589},[23810],{"data":23811,"marks":23812,"value":22697,"nodeType":865},{},[],{"data":23814,"marks":23815,"value":21,"nodeType":865},{},[],{"data":23817,"content":23818,"nodeType":866},{},[23819],{"data":23820,"marks":23821,"value":22707,"nodeType":865},{},[],{"data":23823,"content":23824,"nodeType":948},{},[23825],{"data":23826,"marks":23827,"value":6758,"nodeType":865},{},[23828],{"type":946},{"data":23830,"content":23831,"nodeType":866},{},[23832],{"data":23833,"marks":23834,"value":22721,"nodeType":865},{},[],{"data":23836,"content":23837,"nodeType":866},{},[23838,23841,23848],{"data":23839,"marks":23840,"value":22728,"nodeType":865},{},[],{"data":23842,"content":23843,"nodeType":1102},{"uri":4696},[23844],{"data":23845,"marks":23846,"value":22736,"nodeType":865},{},[23847],{"type":4537},{"data":23849,"marks":23850,"value":7361,"nodeType":865},{},[],{"data":23852,"content":23853,"nodeType":866},{},[23854],{"data":23855,"marks":23856,"value":22746,"nodeType":865},{},[],{"entries":23858},{"hyperlink":23859,"inline":23860,"block":23861},[],[],[23862,23865,23871,23878,23882,23888,23896,23903],{"sys":23863,"__typename":4959,"type":4960,"ctaText":23864,"buttonLabel":17726,"buttonColour":4963,"buttonUrl":4696},{"id":21958},"New to the series? Read our first design principles blog on building better detections using the Pyramid of Pain",{"sys":23866,"__typename":2366,"title":23867,"caption":23867,"layoutMode":59,"file":23868},{"id":21979},"Network compromise in a traditional 'on-prem' environment",{"url":23869,"width":4955,"height":23870},"https://images.ctfassets.net/y1cdw1ablpvd/2kWUeTHvxsqJDvXP0v2Mev/57cc372e313a1d36e9c53e4c099831b1/Traditional_attack_path.png",597,{"sys":23872,"__typename":2366,"title":23873,"caption":23873,"layoutMode":59,"file":23874},{"id":21992},"The typical attack path (according to old-school consultancies and MSSPs)",{"url":23875,"width":23876,"height":23877},"https://images.ctfassets.net/y1cdw1ablpvd/2lqJtgZROb1Qyoa0myb692/37dedf4120ba60cfb340fd3a69bea248/Typical_hybrid_attack_path.png",1535,893,{"sys":23879,"__typename":2366,"title":23880,"caption":23880,"layoutMode":59,"file":23881},{"id":22020},"The average SaaS attack path involves direct in-app compromise following account takeover",{"url":4954,"width":4955,"height":4956},{"sys":23883,"__typename":2366,"title":23884,"caption":23885,"layoutMode":59,"file":23886},{"id":22455},"Paths to account takeover","Overlapping paths to account takeover via phishing, infostealers and credential stuffing",{"url":23887,"width":23876,"height":23877},"https://images.ctfassets.net/y1cdw1ablpvd/3UZL6NydNnGa0kJHF9s6Ld/2fdb6d3aa8abb45d89cf334f5d3e9139/Paths_to_account_takeover__1_.png",{"sys":23889,"__typename":2366,"title":23890,"caption":23891,"layoutMode":59,"file":23892},{"id":22586},"Browser visibility and telemetry","The browser provides deep, real time visibility of the rendered web app and user activity",{"url":23893,"width":23894,"height":23895},"https://images.ctfassets.net/y1cdw1ablpvd/7ntzZN0bNnt4Rc3kseTfji/d303986b42f9bab60a6566c5694d26b7/image2.png",1786,738,{"sys":23897,"__typename":2366,"title":23898,"caption":23899,"layoutMode":59,"file":23900},{"id":22599},"Identity attack detection without Push","TI-driven blocklists and email scanning tools are routinely bypassed by attackers",{"url":23901,"width":23876,"height":23902},"https://images.ctfassets.net/y1cdw1ablpvd/1pyLJUgcNuPV2hHz8BgXt6/6e587945d0985e9025e9e628efc2e227/Phishing_detection_without_Push__6_.png",764,{"sys":23904,"__typename":2366,"title":23905,"caption":23906,"layoutMode":59,"file":23907},{"id":22612},"Identity attack detection with Push","Push detects and blocks multiple stages of an account takeover attempt",{"url":23908,"width":23876,"height":23902},"https://images.ctfassets.net/y1cdw1ablpvd/3DfcvJLYux6dAVkf6w0izK/0b2ecf039f7f8c749c05a4cde306f4b6/Session_hijacking_detection_with_Push__1_.png",{"items":23910},[],{},"Detect attacks left of boom, before attackers get a foothold",{"url":23914},"https://images.ctfassets.net/y1cdw1ablpvd/32uMppErtDqKKUWVxBF0xG/5dc1ab2271688efacead5b0aaf2cab8e/Legacy_and_modern_attack_paths.png",{"items":23916},[23917,24484,25721],{"__typename":2239,"sys":23918,"content":23919,"title":7491,"synopsis":7492,"hashTags":59,"publishedDate":7493,"slug":7494,"tagsCollection":24474,"authorsCollection":24480},{"id":6837},{"json":23920},{"data":23921,"content":23922,"nodeType":2232},{},[23923,23929,23935,23955,23960,23966,23972,23975,23981,23997,24002,24008,24041,24047,24053,24059,24065,24071,24077,24092,24099,24102,24108,24114,24120,24126,24132,24138,24144,24186,24192,24198,24204,24220,24226,24232,24238,24244,24250,24256,24262,24277,24292,24331,24337,24343,24400,24406,24409,24415,24428,24443,24449,24454,24459,24462,24468],{"data":23924,"content":23925,"nodeType":866},{},[23926],{"data":23927,"marks":23928,"value":6848,"nodeType":865},{},[],{"data":23930,"content":23931,"nodeType":866},{},[23932],{"data":23933,"marks":23934,"value":6855,"nodeType":865},{},[],{"data":23936,"content":23937,"nodeType":866},{},[23938,23941,23948,23951],{"data":23939,"marks":23940,"value":6862,"nodeType":865},{},[],{"data":23942,"content":23943,"nodeType":1102},{"uri":6865},[23944],{"data":23945,"marks":23946,"value":6871,"nodeType":865},{},[23947],{"type":4537},{"data":23949,"marks":23950,"value":6875,"nodeType":865},{},[],{"data":23952,"marks":23953,"value":6880,"nodeType":865},{},[23954],{"type":946},{"data":23956,"content":23959,"nodeType":907},{"target":23957},{"sys":23958},{"id":6885,"type":904,"linkType":905},[],{"data":23961,"content":23962,"nodeType":866},{},[23963],{"data":23964,"marks":23965,"value":6893,"nodeType":865},{},[],{"data":23967,"content":23968,"nodeType":866},{},[23969],{"data":23970,"marks":23971,"value":6900,"nodeType":865},{},[],{"data":23973,"content":23974,"nodeType":938},{},[],{"data":23976,"content":23977,"nodeType":948},{},[23978],{"data":23979,"marks":23980,"value":6910,"nodeType":865},{},[],{"data":23982,"content":23983,"nodeType":866},{},[23984,23987,23994],{"data":23985,"marks":23986,"value":6917,"nodeType":865},{},[],{"data":23988,"content":23989,"nodeType":1102},{"uri":6920},[23990],{"data":23991,"marks":23992,"value":6926,"nodeType":865},{},[23993],{"type":4537},{"data":23995,"marks":23996,"value":6930,"nodeType":865},{},[],{"data":23998,"content":24001,"nodeType":907},{"target":23999},{"sys":24000},{"id":6935,"type":904,"linkType":905},[],{"data":24003,"content":24004,"nodeType":866},{},[24005],{"data":24006,"marks":24007,"value":6943,"nodeType":865},{},[],{"data":24009,"content":24010,"nodeType":866},{},[24011,24014,24020,24023,24029,24032,24038],{"data":24012,"marks":24013,"value":6950,"nodeType":865},{},[],{"data":24015,"content":24016,"nodeType":1102},{"uri":6953},[24017],{"data":24018,"marks":24019,"value":6958,"nodeType":865},{},[],{"data":24021,"marks":24022,"value":6962,"nodeType":865},{},[],{"data":24024,"content":24025,"nodeType":1102},{"uri":6965},[24026],{"data":24027,"marks":24028,"value":6970,"nodeType":865},{},[],{"data":24030,"marks":24031,"value":6974,"nodeType":865},{},[],{"data":24033,"content":24034,"nodeType":1102},{"uri":6977},[24035],{"data":24036,"marks":24037,"value":6982,"nodeType":865},{},[],{"data":24039,"marks":24040,"value":6986,"nodeType":865},{},[],{"data":24042,"content":24043,"nodeType":866},{},[24044],{"data":24045,"marks":24046,"value":6993,"nodeType":865},{},[],{"data":24048,"content":24049,"nodeType":1218},{},[24050],{"data":24051,"marks":24052,"value":7000,"nodeType":865},{},[],{"data":24054,"content":24055,"nodeType":866},{},[24056],{"data":24057,"marks":24058,"value":7007,"nodeType":865},{},[],{"data":24060,"content":24061,"nodeType":866},{},[24062],{"data":24063,"marks":24064,"value":7014,"nodeType":865},{},[],{"data":24066,"content":24067,"nodeType":866},{},[24068],{"data":24069,"marks":24070,"value":7021,"nodeType":865},{},[],{"data":24072,"content":24073,"nodeType":866},{},[24074],{"data":24075,"marks":24076,"value":7028,"nodeType":865},{},[],{"data":24078,"content":24079,"nodeType":866},{},[24080,24083,24089],{"data":24081,"marks":24082,"value":7035,"nodeType":865},{},[],{"data":24084,"content":24085,"nodeType":1102},{"uri":7038},[24086],{"data":24087,"marks":24088,"value":7043,"nodeType":865},{},[],{"data":24090,"marks":24091,"value":7047,"nodeType":865},{},[],{"data":24093,"content":24094,"nodeType":866},{},[24095],{"data":24096,"marks":24097,"value":7055,"nodeType":865},{},[24098],{"type":946},{"data":24100,"content":24101,"nodeType":938},{},[],{"data":24103,"content":24104,"nodeType":948},{},[24105],{"data":24106,"marks":24107,"value":7065,"nodeType":865},{},[],{"data":24109,"content":24110,"nodeType":866},{},[24111],{"data":24112,"marks":24113,"value":7072,"nodeType":865},{},[],{"data":24115,"content":24116,"nodeType":866},{},[24117],{"data":24118,"marks":24119,"value":7079,"nodeType":865},{},[],{"data":24121,"content":24122,"nodeType":866},{},[24123],{"data":24124,"marks":24125,"value":7086,"nodeType":865},{},[],{"data":24127,"content":24128,"nodeType":866},{},[24129],{"data":24130,"marks":24131,"value":7093,"nodeType":865},{},[],{"data":24133,"content":24134,"nodeType":1218},{},[24135],{"data":24136,"marks":24137,"value":7100,"nodeType":865},{},[],{"data":24139,"content":24140,"nodeType":866},{},[24141],{"data":24142,"marks":24143,"value":7107,"nodeType":865},{},[],{"data":24145,"content":24146,"nodeType":891},{},[24147,24160,24173],{"data":24148,"content":24149,"nodeType":880},{},[24150],{"data":24151,"content":24152,"nodeType":866},{},[24153,24157],{"data":24154,"marks":24155,"value":7121,"nodeType":865},{},[24156],{"type":946},{"data":24158,"marks":24159,"value":7125,"nodeType":865},{},[],{"data":24161,"content":24162,"nodeType":880},{},[24163],{"data":24164,"content":24165,"nodeType":866},{},[24166,24170],{"data":24167,"marks":24168,"value":7136,"nodeType":865},{},[24169],{"type":946},{"data":24171,"marks":24172,"value":7140,"nodeType":865},{},[],{"data":24174,"content":24175,"nodeType":880},{},[24176],{"data":24177,"content":24178,"nodeType":866},{},[24179,24183],{"data":24180,"marks":24181,"value":7151,"nodeType":865},{},[24182],{"type":946},{"data":24184,"marks":24185,"value":7155,"nodeType":865},{},[],{"data":24187,"content":24188,"nodeType":866},{},[24189],{"data":24190,"marks":24191,"value":7162,"nodeType":865},{},[],{"data":24193,"content":24194,"nodeType":1218},{},[24195],{"data":24196,"marks":24197,"value":7169,"nodeType":865},{},[],{"data":24199,"content":24200,"nodeType":866},{},[24201],{"data":24202,"marks":24203,"value":7176,"nodeType":865},{},[],{"data":24205,"content":24206,"nodeType":866},{},[24207,24210,24217],{"data":24208,"marks":24209,"value":7183,"nodeType":865},{},[],{"data":24211,"content":24212,"nodeType":1102},{"uri":7186},[24213],{"data":24214,"marks":24215,"value":7192,"nodeType":865},{},[24216],{"type":4537},{"data":24218,"marks":24219,"value":7196,"nodeType":865},{},[],{"data":24221,"content":24222,"nodeType":866},{},[24223],{"data":24224,"marks":24225,"value":7203,"nodeType":865},{},[],{"data":24227,"content":24228,"nodeType":1218},{},[24229],{"data":24230,"marks":24231,"value":7210,"nodeType":865},{},[],{"data":24233,"content":24234,"nodeType":866},{},[24235],{"data":24236,"marks":24237,"value":7217,"nodeType":865},{},[],{"data":24239,"content":24240,"nodeType":866},{},[24241],{"data":24242,"marks":24243,"value":7224,"nodeType":865},{},[],{"data":24245,"content":24246,"nodeType":866},{},[24247],{"data":24248,"marks":24249,"value":7231,"nodeType":865},{},[],{"data":24251,"content":24252,"nodeType":1218},{},[24253],{"data":24254,"marks":24255,"value":7238,"nodeType":865},{},[],{"data":24257,"content":24258,"nodeType":866},{},[24259],{"data":24260,"marks":24261,"value":7245,"nodeType":865},{},[],{"data":24263,"content":24264,"nodeType":866},{},[24265,24268,24274],{"data":24266,"marks":24267,"value":7252,"nodeType":865},{},[],{"data":24269,"content":24270,"nodeType":1102},{"uri":7255},[24271],{"data":24272,"marks":24273,"value":7260,"nodeType":865},{},[],{"data":24275,"marks":24276,"value":1151,"nodeType":865},{},[],{"data":24278,"content":24279,"nodeType":866},{},[24280,24283,24289],{"data":24281,"marks":24282,"value":7270,"nodeType":865},{},[],{"data":24284,"content":24285,"nodeType":1102},{"uri":7038},[24286],{"data":24287,"marks":24288,"value":7277,"nodeType":865},{},[],{"data":24290,"marks":24291,"value":3467,"nodeType":865},{},[],{"data":24293,"content":24294,"nodeType":891},{},[24295,24304,24313,24322],{"data":24296,"content":24297,"nodeType":880},{},[24298],{"data":24299,"content":24300,"nodeType":866},{},[24301],{"data":24302,"marks":24303,"value":7293,"nodeType":865},{},[],{"data":24305,"content":24306,"nodeType":880},{},[24307],{"data":24308,"content":24309,"nodeType":866},{},[24310],{"data":24311,"marks":24312,"value":7303,"nodeType":865},{},[],{"data":24314,"content":24315,"nodeType":880},{},[24316],{"data":24317,"content":24318,"nodeType":866},{},[24319],{"data":24320,"marks":24321,"value":7313,"nodeType":865},{},[],{"data":24323,"content":24324,"nodeType":880},{},[24325],{"data":24326,"content":24327,"nodeType":866},{},[24328],{"data":24329,"marks":24330,"value":7323,"nodeType":865},{},[],{"data":24332,"content":24333,"nodeType":866},{},[24334],{"data":24335,"marks":24336,"value":7330,"nodeType":865},{},[],{"data":24338,"content":24339,"nodeType":866},{},[24340],{"data":24341,"marks":24342,"value":7337,"nodeType":865},{},[],{"data":24344,"content":24345,"nodeType":891},{},[24346,24364,24382],{"data":24347,"content":24348,"nodeType":880},{},[24349],{"data":24350,"content":24351,"nodeType":866},{},[24352,24355,24361],{"data":24353,"marks":24354,"value":7350,"nodeType":865},{},[],{"data":24356,"content":24357,"nodeType":1102},{"uri":7255},[24358],{"data":24359,"marks":24360,"value":7357,"nodeType":865},{},[],{"data":24362,"marks":24363,"value":7361,"nodeType":865},{},[],{"data":24365,"content":24366,"nodeType":880},{},[24367],{"data":24368,"content":24369,"nodeType":866},{},[24370,24373,24379],{"data":24371,"marks":24372,"value":7371,"nodeType":865},{},[],{"data":24374,"content":24375,"nodeType":1102},{"uri":7374},[24376],{"data":24377,"marks":24378,"value":7379,"nodeType":865},{},[],{"data":24380,"marks":24381,"value":21,"nodeType":865},{},[],{"data":24383,"content":24384,"nodeType":880},{},[24385],{"data":24386,"content":24387,"nodeType":866},{},[24388,24391,24397],{"data":24389,"marks":24390,"value":7392,"nodeType":865},{},[],{"data":24392,"content":24393,"nodeType":1102},{"uri":7395},[24394],{"data":24395,"marks":24396,"value":7400,"nodeType":865},{},[],{"data":24398,"marks":24399,"value":7361,"nodeType":865},{},[],{"data":24401,"content":24402,"nodeType":866},{},[24403],{"data":24404,"marks":24405,"value":7410,"nodeType":865},{},[],{"data":24407,"content":24408,"nodeType":938},{},[],{"data":24410,"content":24411,"nodeType":948},{},[24412],{"data":24413,"marks":24414,"value":7420,"nodeType":865},{},[],{"data":24416,"content":24417,"nodeType":866},{},[24418,24421,24425],{"data":24419,"marks":24420,"value":7427,"nodeType":865},{},[],{"data":24422,"marks":24423,"value":7432,"nodeType":865},{},[24424],{"type":946},{"data":24426,"marks":24427,"value":7436,"nodeType":865},{},[],{"data":24429,"content":24430,"nodeType":866},{},[24431,24434,24440],{"data":24432,"marks":24433,"value":7443,"nodeType":865},{},[],{"data":24435,"content":24436,"nodeType":1102},{"uri":7446},[24437],{"data":24438,"marks":24439,"value":7451,"nodeType":865},{},[],{"data":24441,"marks":24442,"value":7455,"nodeType":865},{},[],{"data":24444,"content":24445,"nodeType":866},{},[24446],{"data":24447,"marks":24448,"value":7462,"nodeType":865},{},[],{"data":24450,"content":24453,"nodeType":907},{"target":24451},{"sys":24452},{"id":7467,"type":904,"linkType":905},[],{"data":24455,"content":24458,"nodeType":907},{"target":24456},{"sys":24457},{"id":7473,"type":904,"linkType":905},[],{"data":24460,"content":24461,"nodeType":938},{},[],{"data":24463,"content":24464,"nodeType":948},{},[24465],{"data":24466,"marks":24467,"value":6758,"nodeType":865},{},[],{"data":24469,"content":24470,"nodeType":866},{},[24471],{"data":24472,"marks":24473,"value":7490,"nodeType":865},{},[],{"items":24475},[24476,24478],{"sys":24477,"name":342},{"id":2527},{"sys":24479,"name":2524},{"id":2523},{"items":24481},[24482],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":24483},{"url":6031},{"__typename":2239,"sys":24485,"content":24487,"title":25707,"synopsis":25708,"hashTags":59,"publishedDate":25709,"slug":25710,"tagsCollection":25711,"authorsCollection":25717},{"id":24486},"489LTCEVau7lh88tLgSPX5",{"json":24488},{"data":24489,"content":24490,"nodeType":2232},{},[24491,24498,24518,24525,24531,24538,24571,24577,24583,24590,24597,24603,24610,24630,24637,24644,24650,24657,24664,24712,24730,24737,24744,24751,24757,24764,24771,24778,24785,24792,24799,24811,24817,24824,24842,24860,24867,24874,24894,24901,24918,24925,24976,24983,25002,25009,25015,25032,25050,25057,25076,25083,25089,25096,25115,25122,25129,25135,25142,25149,25156,25163,25168,25175,25182,25189,25196,25202,25209,25216,25228,25244,25251,25258,25324,25331,25338,25345,25352,25359,25366,25373,25380,25398,25405,25411,25418,25424,25431,25438,25445,25451,25458,25465,25472,25505,25512,25519,25526,25533,25540,25547,25554,25561,25609,25615,25622,25665,25671,25678,25695,25701],{"data":24492,"content":24493,"nodeType":866},{},[24494],{"data":24495,"marks":24496,"value":24497,"nodeType":865},{},[],"The last time “hacking” topped the attacker actions chart in a Verizon DBIR, Gamestop was being saved by Redditors, ChatGPT didn’t exist, and Will Smith was welcome at the Oscars. ",{"data":24499,"content":24500,"nodeType":866},{},[24501,24505,24514],{"data":24502,"marks":24503,"value":24504,"nodeType":865},{},[],"That’s right, it was back in the ",{"data":24506,"content":24508,"nodeType":1102},{"uri":24507},"https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/",[24509],{"data":24510,"marks":24511,"value":24513,"nodeType":865},{},[24512],{"type":4537},"2021 DBIR",{"data":24515,"marks":24516,"value":24517,"nodeType":865},{},[]," that good old-fashioned hacking was the thing hackers did the most. ",{"data":24519,"content":24520,"nodeType":866},{},[24521],{"data":24522,"marks":24523,"value":24524,"nodeType":865},{},[],"In every report since, stolen credentials have been the most common “select way-in” (weird term, I know). In this year’s DBIR, stolen credentials accounted for roughly half of the breaches recorded. ",{"data":24526,"content":24530,"nodeType":907},{"target":24527},{"sys":24528},{"id":24529,"type":904,"linkType":905},"16WQ5Siz92HZKCjDsxWBdr",[],{"data":24532,"content":24533,"nodeType":866},{},[24534],{"data":24535,"marks":24536,"value":24537,"nodeType":865},{},[],"These stats, along with others like CrowdStrike’s widely cited “80% of attacks involve identity and compromised credentials,” continue to prove that “hackers don’t hack in, they log in.” ",{"data":24539,"content":24540,"nodeType":866},{},[24541,24545,24554,24558,24567],{"data":24542,"marks":24543,"value":24544,"nodeType":865},{},[],"In the last year, more stories behind those statistics have started to emerge with a series of high profile “no-hack” identity attacks hitting the headlines – the most recent being the ",{"data":24546,"content":24548,"nodeType":1102},{"uri":24547},"https://pushsecurity.com/resources/video/snowflake-the-tip-of-the-iceberg/",[24549],{"data":24550,"marks":24551,"value":24553,"nodeType":865},{},[24552],{"type":4537},"Snowflake incident",{"data":24555,"marks":24556,"value":24557,"nodeType":865},{},[],". You can read more about that breach and others in our repository of ",{"data":24559,"content":24561,"nodeType":1102},{"uri":24560},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/",[24562],{"data":24563,"marks":24564,"value":24566,"nodeType":865},{},[24565],{"type":4537},"identity attacks in the wild",{"data":24568,"marks":24569,"value":24570,"nodeType":865},{},[]," where we take a deep dive into the techniques attackers have been using. ",{"data":24572,"content":24576,"nodeType":907},{"target":24573},{"sys":24574},{"id":24575,"type":904,"linkType":905},"6QY3hnMLMJvnk6zYHYa6pf",[],{"data":24578,"content":24582,"nodeType":907},{"target":24579},{"sys":24580},{"id":24581,"type":904,"linkType":905},"7oAUuhbwgEH5XnDZrm5Zk9",[],{"data":24584,"content":24585,"nodeType":866},{},[24586],{"data":24587,"marks":24588,"value":24589,"nodeType":865},{},[],"Why should they go to the effort of targeting hardened and well-monitored attack surfaces like networks and endpoints with 0-day exploits or EDR-evading malware, when they can instead simply take a set of stolen credentials and fire them at popular business apps to see which pop open?",{"data":24591,"content":24592,"nodeType":866},{},[24593],{"data":24594,"marks":24595,"value":24596,"nodeType":865},{},[],"Taking over an account is the equivalent of compromising an endpoint or getting a foothold on a web-facing server. From this point, an attacker can move laterally, escalate their privileges, and achieve their objective of deploying ransomware, stealing data or disrupting business-critical systems. ",{"data":24598,"content":24602,"nodeType":907},{"target":24599},{"sys":24600},{"id":24601,"type":904,"linkType":905},"3vdbE3kqFxvhE145q2CwOy",[],{"data":24604,"content":24605,"nodeType":866},{},[24606],{"data":24607,"marks":24608,"value":24609,"nodeType":865},{},[],"The data shows that account takeover, whether it’s using stolen credentials or session tokens, is now the route of least resistance for attackers, and the #1 attack vector for security teams to defend against.",{"data":24611,"content":24612,"nodeType":866},{},[24613,24617,24626],{"data":24614,"marks":24615,"value":24616,"nodeType":865},{},[],"I’m sure you already use a number of tools to secure your workforce identities – MFA, SSO, EDR, etc., and all of them have an important role to play. That said, they also have limitations that attackers are exploiting. We’ve laid out some of the ",{"data":24618,"content":24620,"nodeType":1102},{"uri":24619},"https://pushsecurity.com/blog/5-reasons-why-push-security-shouldnt-exist/",[24621],{"data":24622,"marks":24623,"value":24625,"nodeType":865},{},[24624],{"type":4537},"typical misconceptions that can undermine an identity security strategy",{"data":24627,"marks":24628,"value":24629,"nodeType":865},{},[]," so you can avoid the common pitfalls and achieve defense in depth.",{"data":24631,"content":24632,"nodeType":948},{},[24633],{"data":24634,"marks":24635,"value":24636,"nodeType":865},{},[],"Push vs. account takeover techniques",{"data":24638,"content":24639,"nodeType":866},{},[24640],{"data":24641,"marks":24642,"value":24643,"nodeType":865},{},[],"In this article, we’re going to show you how to use Push to bolster your identity security strategy and prevent account takeover. More specifically, we’ll cover how Push prevents, detects, and blocks some of the common attack techniques seen in this account takeover attack chain:",{"data":24645,"content":24649,"nodeType":907},{"target":24646},{"sys":24647},{"id":24648,"type":904,"linkType":905},"1FPMzCU0mBgpg1GMSz1sJH",[],{"data":24651,"content":24652,"nodeType":866},{},[24653],{"data":24654,"marks":24655,"value":24656,"nodeType":865},{},[],"Push uses browser data collected by our browser agent to either detect the attack techniques directly, or identify the vulnerabilities being exploited. Upon making a detection, the browser agent enforces a relevant security control to either block the attack or prevent the user from introducing a vulnerability.",{"data":24658,"content":24659,"nodeType":866},{},[24660],{"data":24661,"marks":24662,"value":24663,"nodeType":865},{},[],"If you’re wondering why we’ve opted to build our tool in the browser, the short answer is that being in the browser gives us:",{"data":24665,"content":24666,"nodeType":891},{},[24667,24682,24697],{"data":24668,"content":24669,"nodeType":880},{},[24670],{"data":24671,"content":24672,"nodeType":866},{},[24673,24678],{"data":24674,"marks":24675,"value":24677,"nodeType":865},{},[24676],{"type":946},"The broadest visibility",{"data":24679,"marks":24680,"value":24681,"nodeType":865},{},[]," across all workforce identities, including unmanaged identities outside your IdP.",{"data":24683,"content":24684,"nodeType":880},{},[24685],{"data":24686,"content":24687,"nodeType":866},{},[24688,24693],{"data":24689,"marks":24690,"value":24692,"nodeType":865},{},[24691],{"type":946},"The best telemetry",{"data":24694,"marks":24695,"value":24696,"nodeType":865},{},[]," for detecting identity attack TTPs and tools.",{"data":24698,"content":24699,"nodeType":880},{},[24700],{"data":24701,"content":24702,"nodeType":866},{},[24703,24708],{"data":24704,"marks":24705,"value":24707,"nodeType":865},{},[24706],{"type":946},"The perfect enforcement point",{"data":24709,"marks":24710,"value":24711,"nodeType":865},{},[]," for stopping attacker actions or risky employee actions in real time. ",{"data":24713,"content":24714,"nodeType":866},{},[24715,24719,24727],{"data":24716,"marks":24717,"value":24718,"nodeType":865},{},[],"If you want a more detailed technical explanation, you can read this article by Dan on ",{"data":24720,"content":24721,"nodeType":1102},{"uri":7446},[24722],{"data":24723,"marks":24724,"value":24726,"nodeType":865},{},[24725],{"type":4537},"why browser data is a better source of telemetry for detecting identity attacks than network, IdP and app logs",{"data":24728,"marks":24729,"value":1151,"nodeType":865},{},[],{"data":24731,"content":24732,"nodeType":866},{},[24733],{"data":24734,"marks":24735,"value":24736,"nodeType":865},{},[],"Now we’ve cleared that up, let's look at some account takeover techniques.",{"data":24738,"content":24739,"nodeType":948},{},[24740],{"data":24741,"marks":24742,"value":24743,"nodeType":865},{},[],"Part 1: Phishing (including AitM and BitM toolkits)",{"data":24745,"content":24746,"nodeType":866},{},[24747],{"data":24748,"marks":24749,"value":24750,"nodeType":865},{},[],"Phishing has been around since forever and there’s a mature category of solutions that are designed to detect and prevent it. But despite solutions like security awareness training, phishing domain detection services and email filtering tools, phishing is still one of the top breach vectors. ",{"data":24752,"content":24756,"nodeType":907},{"target":24753},{"sys":24754},{"id":24755,"type":904,"linkType":905},"4urh9lIuo0ePgVIJZNtP2B",[],{"data":24758,"content":24759,"nodeType":866},{},[24760],{"data":24761,"marks":24762,"value":24763,"nodeType":865},{},[],"We’ve all been conditioned to think about phishing as something that happens over email, but it’s actually the browser where most of the action happens, regardless of the initial delivery channel. Push’s position in the browser gives you the ideal vantage point for detecting and stopping phishing attacks.",{"data":24765,"content":24766,"nodeType":866},{},[24767],{"data":24768,"marks":24769,"value":24770,"nodeType":865},{},[],"The Push browser agent performs both passive observation and active interrogation in order to detect employees having their passwords harvested or visiting cloned app login pages or pages using AitM/BitM toolkits. Phishing attacks are detected in real time so Push blocks them before your employees can enter their credentials.",{"data":24772,"content":24773,"nodeType":1218},{},[24774],{"data":24775,"marks":24776,"value":24777,"nodeType":865},{},[],"Detecting phishing through user behavior",{"data":24779,"content":24780,"nodeType":866},{},[24781],{"data":24782,"marks":24783,"value":24784,"nodeType":865},{},[],"Rather than trying to detect phishing websites and domains that constantly change, Push detects and blocks phishing attempts based on observing user behavior in the browser.",{"data":24786,"content":24787,"nodeType":866},{},[24788],{"data":24789,"marks":24790,"value":24791,"nodeType":865},{},[],"Push does this by observing all logins and generating a fingerprint (or technically a k-anonymized salted partial hash) of the user’s password. This fingerprint is then stored locally to allow Push to perform comparisons.",{"data":24793,"content":24794,"nodeType":866},{},[24795],{"data":24796,"marks":24797,"value":24798,"nodeType":865},{},[],"To detect potential phishing attacks, the browser agent compares the observed password fingerprint to known fingerprints for passwords that already exist in local storage.",{"data":24800,"content":24801,"nodeType":866},{},[24802,24807],{"data":24803,"marks":24804,"value":24806,"nodeType":865},{},[24805],{"type":946},"This means that it works even if that employee was the first person to get phished using a new attacker site: ",{"data":24808,"marks":24809,"value":24810,"nodeType":865},{},[],"Push still detects it and blocks it before your employee can submit their credentials. It also works regardless of the delivery vector used to get the phishing link to the intended victim.",{"data":24812,"content":24816,"nodeType":907},{"target":24813},{"sys":24814},{"id":24815,"type":904,"linkType":905},"2V2My5IpdVUwh4QugqInUw",[],{"data":24818,"content":24819,"nodeType":866},{},[24820],{"data":24821,"marks":24822,"value":24823,"nodeType":865},{},[],"Once you’ve discovered a malicious site, you can use Push’s companion feature, URL blocking, to add the domain to a blocklist and prevent your other end-users from even visiting the site.",{"data":24825,"content":24826,"nodeType":866},{},[24827,24831,24838],{"data":24828,"marks":24829,"value":24830,"nodeType":865},{},[],"You can programmatically manage URL blocking as part of responding to an attempted phishing incident by using the ",{"data":24832,"content":24834,"nodeType":1102},{"uri":24833},"https://pushsecurity.redoc.ly/rest-v1/",[24835],{"data":24836,"marks":24837,"value":17844,"nodeType":865},{},[],{"data":24839,"marks":24840,"value":24841,"nodeType":865},{},[]," to automatically add URLs to the blocklist or to sync with other threat intelligence sources of known-bad sites.",{"data":24843,"content":24844,"nodeType":866},{},[24845,24849,24857],{"data":24846,"marks":24847,"value":24848,"nodeType":865},{},[],"You can find out more about this control in this ",{"data":24850,"content":24851,"nodeType":1102},{"uri":7255},[24852],{"data":24853,"marks":24854,"value":24856,"nodeType":865},{},[24855],{"type":4537},"deep-dive article",{"data":24858,"marks":24859,"value":7361,"nodeType":865},{},[],{"data":24861,"content":24862,"nodeType":1218},{},[24863],{"data":24864,"marks":24865,"value":24866,"nodeType":865},{},[],"Detecting cloned login pages",{"data":24868,"content":24869,"nodeType":866},{},[24870],{"data":24871,"marks":24872,"value":24873,"nodeType":865},{},[],"It’s now very easy for attackers to create cloned login pages that appear to be legitimate, tricking users into providing their credentials. ",{"data":24875,"content":24876,"nodeType":866},{},[24877,24881,24890],{"data":24878,"marks":24879,"value":24880,"nodeType":865},{},[],"There’s a number of phishing kits that allow the attacker to simply copy the HTML code from a legitimate website and duplicate it on the malicious site, creating a virtually identical interface that tricks users into entering their credentials. A final sprinkle of typosquatting techniques completes the illusion of legitimacy. The Federal Communications Commission (FCC) ",{"data":24882,"content":24884,"nodeType":1102},{"uri":24883},"https://www.nextgov.com/cybersecurity/2024/03/fcc-staff-targeted-phishing-attack-cloned-agency-login-site/394609/",[24885],{"data":24886,"marks":24887,"value":24889,"nodeType":865},{},[24888],{"type":4537},"was a recent target",{"data":24891,"marks":24892,"value":24893,"nodeType":865},{},[]," of this kind of attack. ",{"data":24895,"content":24896,"nodeType":866},{},[24897],{"data":24898,"marks":24899,"value":24900,"nodeType":865},{},[],"Push’s cloned app detection feature detects fraudulent login pages by inspecting the resources and structure of pages users log into and fingerprinting them so they can be used to detect when that action occurs on the wrong domain. ",{"data":24902,"content":24903,"nodeType":866},{},[24904,24908,24915],{"data":24905,"marks":24906,"value":24907,"nodeType":865},{},[],"You can ",{"data":24909,"content":24910,"nodeType":1102},{"uri":7374},[24911],{"data":24912,"marks":24913,"value":24914,"nodeType":865},{},[],"read more about this feature here",{"data":24916,"marks":24917,"value":1151,"nodeType":865},{},[],{"data":24919,"content":24920,"nodeType":1218},{},[24921],{"data":24922,"marks":24923,"value":24924,"nodeType":865},{},[],"Detecting AitM and BitM toolkits",{"data":24926,"content":24927,"nodeType":866},{},[24928,24932,24940,24943,24951,24954,24962,24965,24973],{"data":24929,"marks":24930,"value":24931,"nodeType":865},{},[],"Adversary-in-the-Middle (AitM) phishing is a technique that uses dedicated tooling to act as a proxy between the target and a legitimate login portal for an application, principally to bypass MFA. As it’s a proxy to the real application, the page will appear exactly as the user expects, making this technique difficult to spot. Popular AitM toolkits include ",{"data":24933,"content":24935,"nodeType":1102},{"uri":24934},"https://github.com/drk1wi/Modlishka",[24936],{"data":24937,"marks":24938,"value":24939,"nodeType":865},{},[],"Modlishka",{"data":24941,"marks":24942,"value":3531,"nodeType":865},{},[],{"data":24944,"content":24946,"nodeType":1102},{"uri":24945},"https://github.com/muraenateam/muraena",[24947],{"data":24948,"marks":24949,"value":24950,"nodeType":865},{},[],"Muraena",{"data":24952,"marks":24953,"value":3531,"nodeType":865},{},[],{"data":24955,"content":24957,"nodeType":1102},{"uri":24956},"https://github.com/kgretzky/evilginx2",[24958],{"data":24959,"marks":24960,"value":24961,"nodeType":865},{},[],"Evilginx",{"data":24963,"marks":24964,"value":1913,"nodeType":865},{},[],{"data":24966,"content":24968,"nodeType":1102},{"uri":24967},"https://www.bleepingcomputer.com/news/security/evilproxy-uses-indeedcom-open-redirect-for-microsoft-365-phishing/",[24969],{"data":24970,"marks":24971,"value":24972,"nodeType":865},{},[],"Evilproxy",{"data":24974,"marks":24975,"value":7361,"nodeType":865},{},[],{"data":24977,"content":24978,"nodeType":866},{},[24979],{"data":24980,"marks":24981,"value":24982,"nodeType":865},{},[],"Browser-in-the-Middle (BitM) toolkits are different to AitM toolkits because they don’t act as a reverse proxy. Instead, they trick their victim into directly controlling the attacker’s own browser using remote desktop screen sharing and control approaches — think of this like VNC or RDP but using the browser as a client. This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to log in to an app for them, and then taking their laptop back afterwards.",{"data":24984,"content":24985,"nodeType":866},{},[24986,24990,24999],{"data":24987,"marks":24988,"value":24989,"nodeType":865},{},[],"We’ve conducted a lot of research into AitM and BitM toolkits recently. If you want to learn more about how they work and see a demo of them in action, ",{"data":24991,"content":24993,"nodeType":1102},{"uri":24992},"https://pushsecurity.com/resources/video/phishing-detecting-evilginx-evilnovnc-muraena-and-modlishka/",[24994],{"data":24995,"marks":24996,"value":24998,"nodeType":865},{},[24997],{"type":4537},"head over here",{"data":25000,"marks":25001,"value":7361,"nodeType":865},{},[],{"data":25003,"content":25004,"nodeType":866},{},[25005],{"data":25006,"marks":25007,"value":25008,"nodeType":865},{},[],"Push gives you a preconfigured set of detections for AitM and BitM toolkits, informed by our threat detection team’s research into their behavior. This phishing tool detection feature will automatically prevent users from accessing a site that’s running one of these malicious tools, and display a custom warning message to your end-users.",{"data":25010,"content":25014,"nodeType":907},{"target":25011},{"sys":25012},{"id":25013,"type":904,"linkType":905},"4ixcEsEW4EyqckOTmP5Pbb",[],{"data":25016,"content":25017,"nodeType":866},{},[25018,25022,25028],{"data":25019,"marks":25020,"value":25021,"nodeType":865},{},[],"Administrators can also consume phishing tool detection events via the ",{"data":25023,"content":25024,"nodeType":1102},{"uri":24833},[25025],{"data":25026,"marks":25027,"value":17844,"nodeType":865},{},[],{"data":25029,"marks":25030,"value":25031,"nodeType":865},{},[]," into their SIEM or use Push’s webhooks to alert when a warn or block event has occurred.",{"data":25033,"content":25034,"nodeType":866},{},[25035,25039,25047],{"data":25036,"marks":25037,"value":25038,"nodeType":865},{},[],"You can read a full write-up of this feature if you want to ",{"data":25040,"content":25041,"nodeType":1102},{"uri":7395},[25042],{"data":25043,"marks":25044,"value":25046,"nodeType":865},{},[25045],{"type":4537},"learn more",{"data":25048,"marks":25049,"value":7361,"nodeType":865},{},[],{"data":25051,"content":25052,"nodeType":948},{},[25053],{"data":25054,"marks":25055,"value":25056,"nodeType":865},{},[],"Part 2: Infostealer malware",{"data":25058,"content":25059,"nodeType":866},{},[25060,25064,25072],{"data":25061,"marks":25062,"value":25063,"nodeType":865},{},[],"The recent ",{"data":25065,"content":25066,"nodeType":1102},{"uri":6965},[25067],{"data":25068,"marks":25069,"value":25071,"nodeType":865},{},[25070],{"type":4537},"Snowflake breach",{"data":25073,"marks":25074,"value":25075,"nodeType":865},{},[]," highlighted how infostealer malware is becoming a serious issue for security teams. As well as being able to steal credentials for account takeover, infostealers can also be used to steal session tokens which then allow the attacker to assume an already authorized session without needing to bypass MFA.   ",{"data":25077,"content":25078,"nodeType":866},{},[25079],{"data":25080,"marks":25081,"value":25082,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers. ",{"data":25084,"content":25088,"nodeType":907},{"target":25085},{"sys":25086},{"id":25087,"type":904,"linkType":905},"66B5MBFIhbmky7VuLGbuM3",[],{"data":25090,"content":25091,"nodeType":866},{},[25092],{"data":25093,"marks":25094,"value":25095,"nodeType":865},{},[],"Infostealers are primarily being used by Initial Access Brokers to harvest credentials and session tokens that they then sell to other threat actors intent on executing more penetrating attacks (e.g. ransomware).  ",{"data":25097,"content":25098,"nodeType":866},{},[25099,25103,25112],{"data":25100,"marks":25101,"value":25102,"nodeType":865},{},[],"EDR is seen as the go-to solution for defending against infostealer malware. However, attackers are always looking for ways to get around security controls by obfuscating malicious behavior and evading signature-based checks. For example, ",{"data":25104,"content":25106,"nodeType":1102},{"uri":25105},"https://thehackernews.com/2024/07/microsoft-defender-flaw-exploited-to.html",[25107],{"data":25108,"marks":25109,"value":25111,"nodeType":865},{},[25110],{"type":4537},"a flaw in Microsoft Defender SmartScreen was recently exploited to deliver infostealer malware",{"data":25113,"marks":25114,"value":1151,"nodeType":865},{},[],{"data":25116,"content":25117,"nodeType":866},{},[25118],{"data":25119,"marks":25120,"value":25121,"nodeType":865},{},[],"Getting total coverage across your endpoint estate is notoriously difficult, if not totally unrealistic. Unless the malware is stopped on execution, then data will inevitably be stolen, and will continue to be taken until stopped (or it self-terminates). And once an attacker has stolen employee credentials or sessions, the credential stuffing and session hijacking attacks that come next won’t touch the endpoint. ",{"data":25123,"content":25124,"nodeType":866},{},[25125],{"data":25126,"marks":25127,"value":25128,"nodeType":865},{},[],"For those reasons, you can’t rely on EDR as a single line of defense against infostealers. Push gives you those extra layers of defense to stop account takeover attempts that use stolen credentials and sessions.",{"data":25130,"content":25134,"nodeType":907},{"target":25131},{"sys":25132},{"id":25133,"type":904,"linkType":905},"4YB6DLIE5TvaAsAAUoJd5v",[],{"data":25136,"content":25137,"nodeType":1218},{},[25138],{"data":25139,"marks":25140,"value":25141,"nodeType":865},{},[],"Detecting stolen sessions ",{"data":25143,"content":25144,"nodeType":866},{},[25145],{"data":25146,"marks":25147,"value":25148,"nodeType":865},{},[],"Push uses its browser agent to inject a unique marker into the user agent string of sessions that occur in browsers enrolled in Push. You then add the list of domains where you wish to inject the marker into sessions, such as an identity provider like Okta or Microsoft. ",{"data":25150,"content":25151,"nodeType":866},{},[25152],{"data":25153,"marks":25154,"value":25155,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":25157,"content":25158,"nodeType":866},{},[25159],{"data":25160,"marks":25161,"value":25162,"nodeType":865},{},[],"This is a high-fidelity signal that a stolen session token is being used by an attacker. It’s certainly a lot cleaner than relying on IP-based or geolocation-based signals, which result in frequent false positives.",{"data":25164,"content":25167,"nodeType":907},{"target":25165},{"sys":25166},{"id":15619,"type":904,"linkType":905},[],{"data":25169,"content":25170,"nodeType":1218},{},[25171],{"data":25172,"marks":25173,"value":25174,"nodeType":865},{},[],"Detecting stolen credentials being sold on the dark web",{"data":25176,"content":25177,"nodeType":866},{},[25178],{"data":25179,"marks":25180,"value":25181,"nodeType":865},{},[],"Push integrates stolen credential threat intelligence and alerts you when your employees’ credentials are being sold on the dark web. ",{"data":25183,"content":25184,"nodeType":866},{},[25185],{"data":25186,"marks":25187,"value":25188,"nodeType":865},{},[],"Commercial TI feeds of stolen credentials have been available for some time. But what we’ve found is that the false-positive rate is incredibly high and the vast majority of credentials are no longer in use.",{"data":25190,"content":25191,"nodeType":866},{},[25192],{"data":25193,"marks":25194,"value":25195,"nodeType":865},{},[],"Push validates that leaked credentials match those that are currently being used by your employees to authenticate on any apps they are using in the browser. That means that any alerts or automated actions generated by Push are actionable true positives, cutting out a huge amount of noise and saving your security team time. ",{"data":25197,"content":25201,"nodeType":907},{"target":25198},{"sys":25199},{"id":25200,"type":904,"linkType":905},"3RnPM0ioGWi3CFMLkxQanO",[],{"data":25203,"content":25204,"nodeType":948},{},[25205],{"data":25206,"marks":25207,"value":25208,"nodeType":865},{},[],"Part 3: Credential stuffing",{"data":25210,"content":25211,"nodeType":866},{},[25212],{"data":25213,"marks":25214,"value":25215,"nodeType":865},{},[],"The previous sections looked at how Push detects and stops common techniques used for stealing and acquiring credentials. We’re now going to cover how Push stops stolen credentials from being used to access and take over employee accounts. ",{"data":25217,"content":25218,"nodeType":866},{},[25219,25224],{"data":25220,"marks":25221,"value":25223,"nodeType":865},{},[25222],{"type":946},"Credential stuffing ",{"data":25225,"marks":25226,"value":25227,"nodeType":865},{},[],"is when attackers use tools that automate the process of taking a list of stolen passwords and retargeting those credentials against different apps.",{"data":25229,"content":25230,"nodeType":866},{},[25231,25235,25240],{"data":25232,"marks":25233,"value":25234,"nodeType":865},{},[],"Closely related to credential stuffing is ",{"data":25236,"marks":25237,"value":25239,"nodeType":865},{},[25238],{"type":946},"password spraying",{"data":25241,"marks":25242,"value":25243,"nodeType":865},{},[],". Instead of using stolen credentials, an attacker uses a list of commonly used usernames and passwords to attempt to compromise accounts. ",{"data":25245,"content":25246,"nodeType":866},{},[25247],{"data":25248,"marks":25249,"value":25250,"nodeType":865},{},[],"Both credential stuffing and password spraying are high-volume, automated attacks, and they are an unrelenting problem for most businesses. Microsoft observes 4,000 of them every second and nearly half of all login requests Auth0 receive each day are attempts at credential stuffing. ",{"data":25252,"content":25253,"nodeType":866},{},[25254],{"data":25255,"marks":25256,"value":25257,"nodeType":865},{},[],"The true scale of the problem is hard to grasp, as neither app vendors nor users have effective means of monitoring for unauthorized access. Typically these breaches are only detected when:",{"data":25259,"content":25260,"nodeType":891},{},[25261,25281,25302],{"data":25262,"content":25263,"nodeType":880},{},[25264],{"data":25265,"content":25266,"nodeType":866},{},[25267,25271,25278],{"data":25268,"marks":25269,"value":25270,"nodeType":865},{},[],"The attacker leaks the data they’ve stolen, like in the ",{"data":25272,"content":25273,"nodeType":1102},{"uri":6965},[25274],{"data":25275,"marks":25276,"value":25071,"nodeType":865},{},[25277],{"type":4537},{"data":25279,"marks":25280,"value":7361,"nodeType":865},{},[],{"data":25282,"content":25283,"nodeType":880},{},[25284],{"data":25285,"content":25286,"nodeType":866},{},[25287,25291,25299],{"data":25288,"marks":25289,"value":25290,"nodeType":865},{},[],"The attacker deploys ransomware that results in business disruption, like that suffered by ",{"data":25292,"content":25293,"nodeType":1102},{"uri":10932},[25294],{"data":25295,"marks":25296,"value":25298,"nodeType":865},{},[25297],{"type":4537},"MGM resorts",{"data":25300,"marks":25301,"value":1151,"nodeType":865},{},[],{"data":25303,"content":25304,"nodeType":880},{},[25305],{"data":25306,"content":25307,"nodeType":866},{},[25308,25312,25321],{"data":25309,"marks":25310,"value":25311,"nodeType":865},{},[],"The attackers use a compromised account to do something deliberately in the public eye. For example, when the SEC’s X (formerly Twitter) account was compromised and ",{"data":25313,"content":25315,"nodeType":1102},{"uri":25314},"https://incyber.org/en/article/fake-sec-tweet-triggers-bitcoin-surge/#:~:text=The%20fake%20headline%20convinced%20a,an%20unauthorized%20tweet%20was%20posted.",[25316],{"data":25317,"marks":25318,"value":25320,"nodeType":865},{},[25319],{"type":4537},"sent out a message announcing the approval of Bitcoin ETF",{"data":25322,"marks":25323,"value":6360,"nodeType":865},{},[],{"data":25325,"content":25326,"nodeType":866},{},[25327],{"data":25328,"marks":25329,"value":25330,"nodeType":865},{},[],"Push gives you a number of controls to combat attacks using stolen and guessed passwords, both to prevent them from occurring, and detect them when they do.",{"data":25332,"content":25333,"nodeType":1218},{},[25334],{"data":25335,"marks":25336,"value":25337,"nodeType":865},{},[],"Prevent employees using credentials that have already been stolen and leaked",{"data":25339,"content":25340,"nodeType":866},{},[25341],{"data":25342,"marks":25343,"value":25344,"nodeType":865},{},[],"First, let's stop your employees from using any credentials that have already been stolen and are available to attackers for use in a credential-stuffing attack. ",{"data":25346,"content":25347,"nodeType":866},{},[25348],{"data":25349,"marks":25350,"value":25351,"nodeType":865},{},[],"Push monitors stolen credential threat intelligence and compares it to the credentials employees are currently using to access their apps. ",{"data":25353,"content":25354,"nodeType":866},{},[25355],{"data":25356,"marks":25357,"value":25358,"nodeType":865},{},[],"You might be wondering, “Does that mean Push sees all our employees’ passwords!?” No. Rather, we use a fingerprint of each password and it's checked locally in the users’ browser and never leaves it. ",{"data":25360,"content":25361,"nodeType":866},{},[25362],{"data":25363,"marks":25364,"value":25365,"nodeType":865},{},[],"When we get a match – a stolen password that could successfully be used in a credential-stuffing attack – Push alerts you.",{"data":25367,"content":25368,"nodeType":1218},{},[25369],{"data":25370,"marks":25371,"value":25372,"nodeType":865},{},[],"Enforce MFA on all employee accounts",{"data":25374,"content":25375,"nodeType":866},{},[25376],{"data":25377,"marks":25378,"value":25379,"nodeType":865},{},[],"Next step is to secure the accounts most vulnerable to a credential stuffing attack – those that only use a password for single-factor authentication. ",{"data":25381,"content":25382,"nodeType":866},{},[25383,25387,25395],{"data":25384,"marks":25385,"value":25386,"nodeType":865},{},[],"If you’re using SSO to access apps, then it’s easy to overlook instances where local accounts (e.g. username and password logins) are missing MFA – particularly if you’re relying on an IdP solution to audit and enforce MFA. ",{"data":25388,"content":25389,"nodeType":1102},{"uri":15852},[25390],{"data":25391,"marks":25392,"value":25394,"nodeType":865},{},[25393],{"type":4537},"You can read more about this problem in our blog post on ghost logins",{"data":25396,"marks":25397,"value":7361,"nodeType":865},{},[],{"data":25399,"content":25400,"nodeType":866},{},[25401],{"data":25402,"marks":25403,"value":25404,"nodeType":865},{},[],"Push observes every login made by your employees (both inside and outside SSO) and inspects the authentication protocols used. Accounts that are missing MFA are identified and presented to you in the Push platform.",{"data":25406,"content":25410,"nodeType":907},{"target":25407},{"sys":25408},{"id":25409,"type":904,"linkType":905},"4t1PHxzadoTBjtJua6dzuJ",[],{"data":25412,"content":25413,"nodeType":866},{},[25414],{"data":25415,"marks":25416,"value":25417,"nodeType":865},{},[],"You can then use Push to enforce MFA on employee accounts, or present them with in-browser guidance requesting that they enable it themselves.  ",{"data":25419,"content":25423,"nodeType":907},{"target":25420},{"sys":25421},{"id":25422,"type":904,"linkType":905},"3JSTEJGtLT0hfwnkpLRP4K",[],{"data":25425,"content":25426,"nodeType":1218},{},[25427],{"data":25428,"marks":25429,"value":25430,"nodeType":865},{},[],"Prevent multiple accounts being compromised by credential stuffing due to password reuse",{"data":25432,"content":25433,"nodeType":866},{},[25434],{"data":25435,"marks":25436,"value":25437,"nodeType":865},{},[],"The credential stuffing tools that attackers use will target a long list of popular business apps. If a password is reused across multiple apps and is breached, the blast radius is naturally increased – the attacker will be able to hijack multiple accounts, across numerous business applications.",{"data":25439,"content":25440,"nodeType":866},{},[25441],{"data":25442,"marks":25443,"value":25444,"nodeType":865},{},[],"Push detects when employees are trying to use the same password across multiple apps. When this happens, you can request that they change their password.",{"data":25446,"content":25450,"nodeType":907},{"target":25447},{"sys":25448},{"id":25449,"type":904,"linkType":905},"7ARHp2JPiHeKRYHwa2jwIZ",[],{"data":25452,"content":25453,"nodeType":1218},{},[25454],{"data":25455,"marks":25456,"value":25457,"nodeType":865},{},[],"Prevent password spraying breaches",{"data":25459,"content":25460,"nodeType":866},{},[25461],{"data":25462,"marks":25463,"value":25464,"nodeType":865},{},[],"To stop your employees’ accounts from being breached by password spraying attacks, Push checks every password to see if it is easily guessable for attackers.",{"data":25466,"content":25467,"nodeType":866},{},[25468],{"data":25469,"marks":25470,"value":25471,"nodeType":865},{},[],"To determine if a password is easily guessable, the Push browser agent automatically checks the password against:",{"data":25473,"content":25474,"nodeType":891},{},[25475,25485,25495],{"data":25476,"content":25477,"nodeType":880},{},[25478],{"data":25479,"content":25480,"nodeType":866},{},[25481],{"data":25482,"marks":25483,"value":25484,"nodeType":865},{},[],"A list of top 10,000 weak base passwords.",{"data":25486,"content":25487,"nodeType":880},{},[25488],{"data":25489,"content":25490,"nodeType":866},{},[25491],{"data":25492,"marks":25493,"value":25494,"nodeType":865},{},[],"Number and special character variations on these weak base passwords, for example: Password1! or January2022.",{"data":25496,"content":25497,"nodeType":880},{},[25498],{"data":25499,"content":25500,"nodeType":866},{},[25501],{"data":25502,"marks":25503,"value":25504,"nodeType":865},{},[],"Variations on these weak base passwords that replace letters with numerals (1337), for example: P455w0rd.",{"data":25506,"content":25507,"nodeType":866},{},[25508],{"data":25509,"marks":25510,"value":25511,"nodeType":865},{},[],"You can also add your own custom word list that employees and attackers will predictably try and use. Push will then stop those words being used as part of passwords.",{"data":25513,"content":25514,"nodeType":1218},{},[25515],{"data":25516,"marks":25517,"value":25518,"nodeType":865},{},[],"Detect unauthorized sessions  ",{"data":25520,"content":25521,"nodeType":866},{},[25522],{"data":25523,"marks":25524,"value":25525,"nodeType":865},{},[],"Once you have enabled all the Push controls that prevent employees from creating and using accounts that can be easily compromised by credential stuffing and password spraying attacks, the next line of defense is to detect when accounts are taken over.",{"data":25527,"content":25528,"nodeType":866},{},[25529],{"data":25530,"marks":25531,"value":25532,"nodeType":865},{},[],"Push uses its browser agent to inject a unique marker into the user agent string of sessions that occur in browsers enrolled in Push. You then add the list of domains that you want to have injected with the session marker. ",{"data":25534,"content":25535,"nodeType":866},{},[25536],{"data":25537,"marks":25538,"value":25539,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This indicates that the session is not being used by the legitimate user (your employees) in their usual work browser, and could be an attacker using their account. ",{"data":25541,"content":25542,"nodeType":1218},{},[25543],{"data":25544,"marks":25545,"value":25546,"nodeType":865},{},[],"Reduce your identity attack surface",{"data":25548,"content":25549,"nodeType":866},{},[25550],{"data":25551,"marks":25552,"value":25553,"nodeType":865},{},[],"Finally, you’ll likely want to reduce your attack surface that can be targeted by credential stuffing. In other words, reduce the number of username and password accounts your employees have. ",{"data":25555,"content":25556,"nodeType":866},{},[25557],{"data":25558,"marks":25559,"value":25560,"nodeType":865},{},[],"There are a few ways that Push can help you do this.",{"data":25562,"content":25563,"nodeType":891},{},[25564,25579,25594],{"data":25565,"content":25566,"nodeType":880},{},[25567],{"data":25568,"content":25569,"nodeType":866},{},[25570,25575],{"data":25571,"marks":25572,"value":25574,"nodeType":865},{},[25573],{"type":946},"Block access to unapproved apps",{"data":25576,"marks":25577,"value":25578,"nodeType":865},{},[],". Using Push, you can create a block list of apps that you don’t want your users to create accounts and identities on.",{"data":25580,"content":25581,"nodeType":880},{},[25582],{"data":25583,"content":25584,"nodeType":866},{},[25585,25590],{"data":25586,"marks":25587,"value":25589,"nodeType":865},{},[25588],{"type":946},"Use app banners to stop users from creating local accounts",{"data":25591,"marks":25592,"value":25593,"nodeType":865},{},[],". When an employee goes to sign up to an app, Push will present an app banner that tells them to use their SSO identity and not to create a username and password account.",{"data":25595,"content":25596,"nodeType":880},{},[25597],{"data":25598,"content":25599,"nodeType":866},{},[25600,25605],{"data":25601,"marks":25602,"value":25604,"nodeType":865},{},[25603],{"type":946},"Get existing accounts and apps behind SSO",{"data":25606,"marks":25607,"value":25608,"nodeType":865},{},[],". Push shows you how your employees are logging in to every account on every app, including whether they’re using SAML or OIDC SSO. Armed with this data, you can get your employees to use your preferred SSO solution on the apps where it’s already available, and look into whether other popular apps being used in the business offer SSO.",{"data":25610,"content":25614,"nodeType":907},{"target":25611},{"sys":25612},{"id":25613,"type":904,"linkType":905},"3y8L55hbcQaRYPCdYYb3xA",[],{"data":25616,"content":25617,"nodeType":948},{},[25618],{"data":25619,"marks":25620,"value":25621,"nodeType":865},{},[],"Stop account takeover at the push of a button",{"data":25623,"content":25624,"nodeType":866},{},[25625,25629,25636,25640,25645,25648,25653,25657,25661],{"data":25626,"marks":25627,"value":25628,"nodeType":865},{},[],"We’ve described a lot of controls in this article. The good news is that they’re all pre-configured on the the ",{"data":25630,"content":25632,"nodeType":1102},{"uri":25631},"https://pushsecurity.com/help/audience/administrators/docs/manage-security-controls/#start",[25633],{"data":25634,"marks":25635,"value":2821,"nodeType":865},{},[],{"data":25637,"marks":25638,"value":25639,"nodeType":865},{},[]," page in the Push platform. When you get started with Push, you can simply turn on all the controls you want, and decide whether you want them to work in ",{"data":25641,"marks":25642,"value":25644,"nodeType":865},{},[25643],{"type":946},"monitor",{"data":25646,"marks":25647,"value":3531,"nodeType":865},{},[],{"data":25649,"marks":25650,"value":25652,"nodeType":865},{},[25651],{"type":946},"warn",{"data":25654,"marks":25655,"value":25656,"nodeType":865},{},[]," mode or ",{"data":25658,"marks":25659,"value":87,"nodeType":865},{},[25660],{"type":946},{"data":25662,"marks":25663,"value":25664,"nodeType":865},{},[]," mode.    ",{"data":25666,"content":25670,"nodeType":907},{"target":25667},{"sys":25668},{"id":25669,"type":904,"linkType":905},"6FCuO78yQMNZvkcbcALmis",[],{"data":25672,"content":25673,"nodeType":1218},{},[25674],{"data":25675,"marks":25676,"value":25677,"nodeType":865},{},[],"See it for yourself",{"data":25679,"content":25680,"nodeType":866},{},[25681,25685,25691],{"data":25682,"marks":25683,"value":25684,"nodeType":865},{},[],"To learn more, ",{"data":25686,"content":25687,"nodeType":1102},{"uri":10028},[25688],{"data":25689,"marks":25690,"value":11104,"nodeType":865},{},[],{"data":25692,"marks":25693,"value":25694,"nodeType":865},{},[],". We’ll be happy to show you these features, along with how we discover all the apps your employees are using, even the ones not behind SSO.",{"data":25696,"content":25700,"nodeType":907},{"target":25697},{"sys":25698},{"id":25699,"type":904,"linkType":905},"4IRtR9zicpB7lXdz2RvIlK",[],{"data":25702,"content":25703,"nodeType":866},{},[25704],{"data":25705,"marks":25706,"value":21,"nodeType":865},{},[],"Hackers don’t hack in, they log in: How to prevent account takeover with Push","How Push stops attackers from using identity attack tools and techniques to compromise your employee user accounts. ","2024-08-19T00:00:00.000Z","how-to-prevent-account-takeover-with-push",{"items":25712},[25713,25715],{"sys":25714,"name":342},{"id":2527},{"sys":25716,"name":2524},{"id":2523},{"items":25718},[25719],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":25720},{"url":11136},{"__typename":2239,"sys":25722,"content":25724,"title":26777,"synopsis":26778,"hashTags":59,"publishedDate":26779,"slug":26780,"tagsCollection":26781,"authorsCollection":26787},{"id":25723},"1LxqUNZpD2VynzSqbv719Z",{"json":25725},{"data":25726,"content":25727,"nodeType":2232},{},[25728,25747,25754,25761,25768,25775,25778,25785,25871,25878,25885,25892,25907,25926,25933,25936,25943,25950,25956,25973,25997,26004,26011,26043,26074,26081,26099,26106,26113,26120,26128,26135,26164,26170,26187,26218,26225,26244,26251,26257,26275,26282,26289,26292,26299,26306,26313,26316,26323,26330,26337,26356,26488,26495,26498,26505,26512,26613,26620,26627,26630,26637,26644,26696,26703,26710,26713,26720,26727,26746,26765,26771],{"data":25729,"content":25730,"nodeType":866},{},[25731,25735,25743],{"data":25732,"marks":25733,"value":25734,"nodeType":865},{},[],"When we created the ",{"data":25736,"content":25737,"nodeType":1102},{"uri":22038},[25738],{"data":25739,"marks":25740,"value":25742,"nodeType":865},{},[25741],{"type":4537},"SaaS attack matrix",{"data":25744,"marks":25745,"value":25746,"nodeType":865},{},[],", we made a conscious break away from the endpoint-focused techniques captured in industry resources like the MITRE ATT&CK Framework. ",{"data":25748,"content":25749,"nodeType":866},{},[25750],{"data":25751,"marks":25752,"value":25753,"nodeType":865},{},[],"At the time, we were anticipating a shift that was yet to fully materialize. But, a lot can change (and has changed) in the space of a year. We’ve seen the impact of SaaS account takeover attacks laid bare. Snowflake, billed one of the biggest breaches in history, is a telling example that we’ll no doubt look back on as a watershed moment. ",{"data":25755,"content":25756,"nodeType":866},{},[25757],{"data":25758,"marks":25759,"value":25760,"nodeType":865},{},[],"It isn’t an exaggeration or marketing fluff to say that identity attacks are the #1 threat facing organizations today. SaaS apps, and the identities that are used to access them, are clearly the weakest link – and therefore the lowest-hanging fruit for attackers to reach for. ",{"data":25762,"content":25763,"nodeType":866},{},[25764],{"data":25765,"marks":25766,"value":25767,"nodeType":865},{},[],"This makes resources like the SaaS attack matrix more relevant than ever – both for red teams seeking to emulate the latest offensive techniques, and blue teams trying to defend against them. Understanding these techniques is essential for building effective defenses, and identifying where new platforms and controls are required to do so. ",{"data":25769,"content":25770,"nodeType":866},{},[25771],{"data":25772,"marks":25773,"value":25774,"nodeType":865},{},[],"Let’s take a look at what we’ve learned so far.",{"data":25776,"content":25777,"nodeType":938},{},[],{"data":25779,"content":25780,"nodeType":948},{},[25781],{"data":25782,"marks":25783,"value":25784,"nodeType":865},{},[],"Hot right now: Initial access techniques",{"data":25786,"content":25787,"nodeType":866},{},[25788,25792,25799,25802,25810,25813,25821,25824,25832,25835,25844,25848,25857,25860,25868],{"data":25789,"marks":25790,"value":25791,"nodeType":865},{},[],"The majority of techniques we've seen rise to prominence in 2023/4 sit predominantly in the initial access phase. Since the matrix first launched, we’ve added more techniques to initial access than any other category, including ",{"data":25793,"content":25794,"nodeType":1102},{"uri":5377},[25795],{"data":25796,"marks":25797,"value":5383,"nodeType":865},{},[25798],{"type":4537},{"data":25800,"marks":25801,"value":3531,"nodeType":865},{},[],{"data":25803,"content":25804,"nodeType":1102},{"uri":14243},[25805],{"data":25806,"marks":25807,"value":25809,"nodeType":865},{},[25808],{"type":4537},"AitM phishing",{"data":25811,"marks":25812,"value":3531,"nodeType":865},{},[],{"data":25814,"content":25815,"nodeType":1102},{"uri":14271},[25816],{"data":25817,"marks":25818,"value":25820,"nodeType":865},{},[25819],{"type":4537},"session cookie theft",{"data":25822,"marks":25823,"value":3531,"nodeType":865},{},[],{"data":25825,"content":25826,"nodeType":1102},{"uri":11198},[25827],{"data":25828,"marks":25829,"value":25831,"nodeType":865},{},[25830],{"type":4537},"MFA downgrade attacks",{"data":25833,"marks":25834,"value":8940,"nodeType":865},{},[],{"data":25836,"content":25838,"nodeType":1102},{"uri":25837},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/guest_access_abuse/description.md",[25839],{"data":25840,"marks":25841,"value":25843,"nodeType":865},{},[25842],{"type":4537},"guest access abuse,",{"data":25845,"marks":25846,"value":25847,"nodeType":865},{},[]," all of which are methods of account takeover – complementing the classics like ",{"data":25849,"content":25851,"nodeType":1102},{"uri":25850},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/credential_stuffing/description.md",[25852],{"data":25853,"marks":25854,"value":25856,"nodeType":865},{},[25855],{"type":4537},"credential stuffing",{"data":25858,"marks":25859,"value":1913,"nodeType":865},{},[],{"data":25861,"content":25863,"nodeType":1102},{"uri":25862},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/email_phishing/description.md",[25864],{"data":25865,"marks":25866,"value":25867,"nodeType":865},{},[],"email phishing",{"data":25869,"marks":25870,"value":1151,"nodeType":865},{},[],{"data":25872,"content":25873,"nodeType":866},{},[25874],{"data":25875,"marks":25876,"value":25877,"nodeType":865},{},[],"We’ll spend a bit of time delving into these techniques in the next section, but let’s first consider what this tells us about SaaS attacks. ",{"data":25879,"content":25880,"nodeType":1218},{},[25881],{"data":25882,"marks":25883,"value":25884,"nodeType":865},{},[],"Identity attacks are the leading cause of SaaS breaches",{"data":25886,"content":25887,"nodeType":866},{},[25888],{"data":25889,"marks":25890,"value":25891,"nodeType":865},{},[],"The initial identity attack designed to achieve account takeover is the most important part of the SaaS attack chain. The fact that attackers are focused on finding new ways of compromising identities illustrates the value, but also the fragility of the identity controls that most organizations are relying on (which may also be one of the reasons attackers are fixated on it). Whether we’re talking about anti-phishing protections, conditional access policies, or MFA – attackers are continually finding new ways of getting around them.",{"data":25893,"content":25894,"nodeType":866},{},[25895,25899,25904],{"data":25896,"marks":25897,"value":25898,"nodeType":865},{},[],"And, if all an attacker really needs to do to cause harm is log into an app and abuse its legitimate features and functions, there really is no margin for error – you need to successfully stop the initial identity attack ",{"data":25900,"marks":25901,"value":25903,"nodeType":865},{},[25902],{"type":946},"every time",{"data":25905,"marks":25906,"value":1677,"nodeType":865},{},[],{"data":25908,"content":25909,"nodeType":866},{},[25910,25914,25922],{"data":25911,"marks":25912,"value":25913,"nodeType":865},{},[],"You can’t rely on your endpoint and network controls to catch them later like you used to. Equally, it’s unlikely that your CASB or DLP solution can stop a legitimate app using legitimate features like ",{"data":25915,"content":25916,"nodeType":1102},{"uri":17081},[25917],{"data":25918,"marks":25919,"value":25921,"nodeType":865},{},[25920],{"type":4537},"API-based workflows",{"data":25923,"marks":25924,"value":25925,"nodeType":865},{},[]," from sending data to attacker-controlled infrastructure. ",{"data":25927,"content":25928,"nodeType":866},{},[25929],{"data":25930,"marks":25931,"value":25932,"nodeType":865},{},[],"It’s a classic case of attackers only needing to win once. And right now, it’s a numbers game that they’re winning enough to keep them coming back for more. ",{"data":25934,"content":25935,"nodeType":938},{},[],{"data":25937,"content":25938,"nodeType":948},{},[25939],{"data":25940,"marks":25941,"value":25942,"nodeType":865},{},[],"Most wanted: Techniques gaining notoriety in the wild",{"data":25944,"content":25945,"nodeType":866},{},[25946],{"data":25947,"marks":25948,"value":25949,"nodeType":865},{},[],"Let’s take a closer look at some of the techniques we’ve seen rise to prominence in 2023/4. ",{"data":25951,"content":25952,"nodeType":1218},{},[25953],{"data":25954,"marks":25955,"value":395,"nodeType":865},{},[],{"data":25957,"content":25958,"nodeType":866},{},[25959,25962,25969],{"data":25960,"marks":25961,"value":21,"nodeType":865},{},[],{"data":25963,"content":25964,"nodeType":1102},{"uri":5377},[25965],{"data":25966,"marks":25967,"value":395,"nodeType":865},{},[25968],{"type":4537},{"data":25970,"marks":25971,"value":25972,"nodeType":865},{},[]," is a technique that exploits the fact that SaaS user accounts often enable multiple simultaneous logins using different sign-in methods. ",{"data":25974,"content":25975,"nodeType":866},{},[25976,25980,25985,25988,25993],{"data":25977,"marks":25978,"value":25979,"nodeType":865},{},[],"Ghost logins can be used for both the ",{"data":25981,"marks":25982,"value":25984,"nodeType":865},{},[25983],{"type":946},"initial access",{"data":25986,"marks":25987,"value":1913,"nodeType":865},{},[],{"data":25989,"marks":25990,"value":25992,"nodeType":865},{},[25991],{"type":946},"persistence",{"data":25994,"marks":25995,"value":25996,"nodeType":865},{},[]," stages of a cyber attack, doubling up as a defense evasion technique because of low login method visibility.",{"data":25998,"content":25999,"nodeType":866},{},[26000],{"data":26001,"marks":26002,"value":26003,"nodeType":865},{},[],"For initial access, the technique exploits the fact that local and SSO logins can exist simultaneously. Given that many apps are self-adopted by users, it’s likely that many users will default to a local username and password login at this stage. If the app is later adopted companywide and brought into SSO, the original local login will continue to exist unless explicitly disabled or deleted. ",{"data":26005,"content":26006,"nodeType":866},{},[26007],{"data":26008,"marks":26009,"value":26010,"nodeType":865},{},[],"Because MFA is applied at the app and IdP level independently, it is possible to end up with an SSO login that requires MFA (via the IdP login), but a local login that does not. This creates an easy target identity for attackers to look for. When combined with other identity vulnerabilities such as weak, breached, and/or reused passwords, attackers can easily automate ghost login discovery and exploitation at scale.  ",{"data":26012,"content":26013,"nodeType":866},{},[26014,26018,26026,26030,26039],{"data":26015,"marks":26016,"value":26017,"nodeType":865},{},[],"We saw the impact of ghost logins for initial access with ",{"data":26019,"content":26020,"nodeType":1102},{"uri":6965},[26021],{"data":26022,"marks":26023,"value":26025,"nodeType":865},{},[26024],{"type":4537},"the recent ShinyHunters campaign against Snowflake customers",{"data":26027,"marks":26028,"value":26029,"nodeType":865},{},[],". Because Snowflake accounts did not require mandatory MFA for accounts, or give admins the ability to enforce MFA by default, attackers were able to find and exploit a large number of Snowflake accounts using breached credentials from historical data breach dumps. Much of the industry response focused on ensuring SSO and MFA were deployed, but ",{"data":26031,"content":26033,"nodeType":1102},{"uri":26032},"https://pushsecurity.com/resources/video/demonstrating-ghost-logins-in-snowflake-and-how-to-remediate-them/",[26034],{"data":26035,"marks":26036,"value":26038,"nodeType":865},{},[26037],{"type":4537},"the practicalities of gathering data and manually unsetting local passwords in Snowflake",{"data":26040,"marks":26041,"value":26042,"nodeType":865},{},[]," meant that ghost logins were easy to overlook by organizations responding to the attacks.   ",{"data":26044,"content":26045,"nodeType":866},{},[26046,26050,26058,26062,26070],{"data":26047,"marks":26048,"value":26049,"nodeType":865},{},[],"Ghost logins can also be created after an attacker has established access to an app. For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. If the account has sufficient privileges, it may also be possible to ",{"data":26051,"content":26052,"nodeType":1102},{"uri":14098},[26053],{"data":26054,"marks":26055,"value":26057,"nodeType":865},{},[26056],{"type":4537},"set up or change the SAML login settings to inject a malicious URL",{"data":26059,"marks":26060,"value":26061,"nodeType":865},{},[]," (for example to an attacker controlled tenant) or simply ",{"data":26063,"content":26064,"nodeType":1102},{"uri":6472},[26065],{"data":26066,"marks":26067,"value":26069,"nodeType":865},{},[26068],{"type":4537},"configure API access",{"data":26071,"marks":26072,"value":26073,"nodeType":865},{},[]," to forgo the need to log in entirely. ",{"data":26075,"content":26076,"nodeType":1218},{},[26077],{"data":26078,"marks":26079,"value":26080,"nodeType":865},{},[],"AitM phishing ",{"data":26082,"content":26083,"nodeType":866},{},[26084,26087,26095],{"data":26085,"marks":26086,"value":21,"nodeType":865},{},[],{"data":26088,"content":26089,"nodeType":1102},{"uri":14243},[26090],{"data":26091,"marks":26092,"value":26094,"nodeType":865},{},[26093],{"type":4537},"Adversary-in-the-Middle (AitM) phishing",{"data":26096,"marks":26097,"value":26098,"nodeType":865},{},[]," is a newer variant of phishing that uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection (with the victim responding to the MFA request as part of the attack).",{"data":26100,"content":26101,"nodeType":866},{},[26102],{"data":26103,"marks":26104,"value":26105,"nodeType":865},{},[],"As it’s a proxy to the real application, the page will appear exactly as the user expects, because they are logging into the legitimate site – just taking a detour via the attacker’s device. For example, if accessing their webmail, the user will see all their real emails; if accessing their cloud file store then all their real files will be present, etc. ",{"data":26107,"content":26108,"nodeType":866},{},[26109],{"data":26110,"marks":26111,"value":26112,"nodeType":865},{},[],"This gives AitM an increased sense of authenticity and makes the compromise less obvious to the user. Because the attacker is sitting in the middle of this connection, they are able to observe all interactions and take control of the authenticated session. ",{"data":26114,"content":26115,"nodeType":866},{},[26116],{"data":26117,"marks":26118,"value":26119,"nodeType":865},{},[],"Alongside AitM phishing is Browser-in-the-Middle (BitM), really a form of sub-technique. Rather than act as a reverse web proxy, this technique tricks a target into directly controlling the attacker’s own browser remotely using desktop screen sharing and control approaches (such as VNC and RDP). ",{"data":26121,"content":26122,"nodeType":866},{},[26123],{"data":26124,"marks":26125,"value":26127,"nodeType":865},{},[26126],{"type":946},"This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to login to Okta for them, and then taking their laptop back afterwards.",{"data":26129,"content":26130,"nodeType":866},{},[26131],{"data":26132,"marks":26133,"value":26134,"nodeType":865},{},[],"A growing majority of modern phishing attacks typically leverage AitM or BitM tooling – they are now the standard choice for threat actors, offering the ability to bypass MFA without any real tradeoff. ",{"data":26136,"content":26137,"nodeType":866},{},[26138,26142,26150,26153,26161],{"data":26139,"marks":26140,"value":26141,"nodeType":865},{},[],"For more information you can ",{"data":26143,"content":26144,"nodeType":1102},{"uri":15218},[26145],{"data":26146,"marks":26147,"value":26149,"nodeType":865},{},[26148],{"type":4537},"read our recent blog post",{"data":26151,"marks":26152,"value":1773,"nodeType":865},{},[],{"data":26154,"content":26155,"nodeType":1102},{"uri":24992},[26156],{"data":26157,"marks":26158,"value":26160,"nodeType":865},{},[26159],{"type":4537},"watch our on-demand webinar on Phishing 2.0 to see AitM and BitM tools like Evilginx and EvilnoVNC in action",{"data":26162,"marks":26163,"value":7361,"nodeType":865},{},[],{"data":26165,"content":26166,"nodeType":1218},{},[26167],{"data":26168,"marks":26169,"value":333,"nodeType":865},{},[],{"data":26171,"content":26172,"nodeType":866},{},[26173,26176,26183],{"data":26174,"marks":26175,"value":21,"nodeType":865},{},[],{"data":26177,"content":26178,"nodeType":1102},{"uri":25850},[26179],{"data":26180,"marks":26181,"value":333,"nodeType":865},{},[26182],{"type":4537},{"data":26184,"marks":26185,"value":26186,"nodeType":865},{},[]," attacks continue to pose a risk to organizations. Despite the fact that MFA has now become an expected control, accounts without MFA continue to be hacked as a result of using weak, reused, and/or previously breached credentials. ",{"data":26188,"content":26189,"nodeType":866},{},[26190,26194,26202,26206,26215],{"data":26191,"marks":26192,"value":26193,"nodeType":865},{},[],"Credential stuffing is being fed by an increase in the number of ",{"data":26195,"content":26197,"nodeType":1102},{"uri":26196},"https://pushsecurity.com/blog/what-the-rise-of-infostealers-says-about-identity-attacks/?utm_source=ebook&utm_medium=organic",[26198],{"data":26199,"marks":26200,"value":423,"nodeType":865},{},[26201],{"type":4537},{"data":26203,"marks":26204,"value":26205,"nodeType":865},{},[]," attacks designed to harvest credentials to be sold on criminal marketplaces. Infostealers have been boosted by the success of the Snowflake attacks (",{"data":26207,"content":26209,"nodeType":1102},{"uri":26208},"https://pushsecurity.com/blog/identity-attacks-in-the-wild/#id-snowflake-june-2024?utm_source=ebook&utm_medium=organic",[26210],{"data":26211,"marks":26212,"value":26214,"nodeType":865},{},[26213],{"type":4537},"where 80% of the credentials used to access accounts could be traced back to infostealer infections dating back to 2020",{"data":26216,"marks":26217,"value":1106,"nodeType":865},{},[],{"data":26219,"content":26220,"nodeType":1218},{},[26221],{"data":26222,"marks":26223,"value":26224,"nodeType":865},{},[],"Session cookie theft",{"data":26226,"content":26227,"nodeType":866},{},[26228,26232,26240],{"data":26229,"marks":26230,"value":26231,"nodeType":865},{},[],"Attackers are increasingly ",{"data":26233,"content":26234,"nodeType":1102},{"uri":14271},[26235],{"data":26236,"marks":26237,"value":26239,"nodeType":865},{},[26238],{"type":4537},"targeting session cookies",{"data":26241,"marks":26242,"value":26243,"nodeType":865},{},[]," to be able to hijack live user sessions as a means of getting around MFA. Although session cookies are predominantly stolen via infostealers, techniques like AitM and BitM phishing described above are also methods of stealing session cookies and hijacking sessions.",{"data":26245,"content":26246,"nodeType":866},{},[26247],{"data":26248,"marks":26249,"value":26250,"nodeType":865},{},[],"While the majority of infostealer data dumps result in credential stuffing attacks rather than session hijacking, as the infostealer marketplace continues to heat up, it’s likely that more instances of session cookie theft will be the cause of breaches going forward. ",{"data":26252,"content":26253,"nodeType":1218},{},[26254],{"data":26255,"marks":26256,"value":14221,"nodeType":865},{},[],{"data":26258,"content":26259,"nodeType":866},{},[26260,26264,26271],{"data":26261,"marks":26262,"value":26263,"nodeType":865},{},[],"While many organizations are waking up to the fact that it’s not enough to have any old MFA method, it’s still often overlooked that you need to actually remove or disable the phishable methods. Otherwise, in many cases they remain valid, opening affected identities up to ",{"data":26265,"content":26266,"nodeType":1102},{"uri":11198},[26267],{"data":26268,"marks":26269,"value":14221,"nodeType":865},{},[26270],{"type":4537},{"data":26272,"marks":26273,"value":26274,"nodeType":865},{},[]," attacks. ",{"data":26276,"content":26277,"nodeType":866},{},[26278],{"data":26279,"marks":26280,"value":26281,"nodeType":865},{},[],"Just because a user has a phishing-resistant factor setup (such as passkeys) and may use them by default, it does not mean they are necessarily enforced. Often, services support the use of multiple authentication options, particularly for second factors. In particular, passkeys are device-bound and so enforcing their use prevents logins from other devices and can cause recovery issues in a lost/broken device scenario. Therefore, it’s common for the default case to be that passkey authentication is optional, rather than required.",{"data":26283,"content":26284,"nodeType":866},{},[26285],{"data":26286,"marks":26287,"value":26288,"nodeType":865},{},[],"When used in combination with AitM phishing tools, it’s possible for attackers to modify requests/responses so as to prevent the ability of passkeys to be selected as a login option and prompting the user to use vulnerable factors, such as passwords, TOTPs and push notifications instead. Since the server-side supports other authentication options, if the user continues and enters one of these alternative factors then their authenticated session will be compromised – despite the fact they usually use phishing-resistant MFA methods like passkeys or similar.",{"data":26290,"content":26291,"nodeType":938},{},[],{"data":26293,"content":26294,"nodeType":948},{},[26295],{"data":26296,"marks":26297,"value":26298,"nodeType":865},{},[],"Use case inspo: How red teamers are using the SaaS attack matrix",{"data":26300,"content":26301,"nodeType":866},{},[26302],{"data":26303,"marks":26304,"value":26305,"nodeType":865},{},[],"The techniques that advanced red teams are using to (ethically) hack into their clients are always a good indicator of what direction hackers in the real world are headed.  ",{"data":26307,"content":26308,"nodeType":866},{},[26309],{"data":26310,"marks":26311,"value":26312,"nodeType":865},{},[],"We spoke to a few of the best red teams around to see how they are using the matrix: Let’s see what they had to say. ",{"data":26314,"content":26315,"nodeType":938},{},[],{"data":26317,"content":26318,"nodeType":1218},{},[26319],{"data":26320,"marks":26321,"value":26322,"nodeType":865},{},[],"Rob Maslen | Managing Principal Consultant | MDSec",{"data":26324,"content":26325,"nodeType":866},{},[26326],{"data":26327,"marks":26328,"value":26329,"nodeType":865},{},[],"“We use the matrix throughout our engagements: When scoping and proposing projects to clients, during testing to assist our consultants in successfully utilizing novel SaaS-attack techniques, and for reporting to provide a common language across the vendors that they work with. ",{"data":26331,"content":26332,"nodeType":866},{},[26333],{"data":26334,"marks":26335,"value":26336,"nodeType":865},{},[],"It’s been most useful to us when performing engagements on more modern Zero Trust Environments where macOS is predominantly the Operating System of choice. The objectives tend to be either access to critical applications that reside within the cloud and require the compromise of SaaS credentials, or to gain privileged access to a SaaS application. Whilst resources like the MITRE ATT&CK Framework can help to describe the techniques that have been used against a more traditional environment, the SaaS Matrix aids with performing and describing attacks against a more modern infrastructure.  ",{"data":26338,"content":26339,"nodeType":866},{},[26340,26344,26352],{"data":26341,"marks":26342,"value":26343,"nodeType":865},{},[],"The technique we’ve seen most success with, across both traditional Active Directory attacks and more modern Zero Trust Environments, is ",{"data":26345,"content":26346,"nodeType":1102},{"uri":14271},[26347],{"data":26348,"marks":26349,"value":26351,"nodeType":865},{},[26350],{"type":4537},"Session Cookie Theft",{"data":26353,"marks":26354,"value":26355,"nodeType":865},{},[],". The protection of browser cookies (for inexplicable reasons) has had less engineering attention than it should have, opening up opportunities for lateral movement using session cookies, credentials, or API keys recovered from a host becomes a key technique. In our experience defensive tooling has yet to catch up with this threat. ",{"data":26357,"content":26358,"nodeType":866},{},[26359,26363,26372,26375,26384,26387,26396,26399,26406,26409,26416,26419,26427,26430,26437,26440,26449,26452,26460,26464,26473,26476,26485],{"data":26360,"marks":26361,"value":26362,"nodeType":865},{},[],"We’ve also seen success with various techniques across Kill Chain stages, including ",{"data":26364,"content":26366,"nodeType":1102},{"uri":26365},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/subdomain_tenant_discovery/description.md",[26367],{"data":26368,"marks":26369,"value":26371,"nodeType":865},{},[26370],{"type":4537},"Subdomain tenant discovery",{"data":26373,"marks":26374,"value":3531,"nodeType":865},{},[],{"data":26376,"content":26378,"nodeType":1102},{"uri":26377},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/dns_reconnaissance/description.md",[26379],{"data":26380,"marks":26381,"value":26383,"nodeType":865},{},[26382],{"type":4537},"DNS reconnaissance",{"data":26385,"marks":26386,"value":3531,"nodeType":865},{},[],{"data":26388,"content":26390,"nodeType":1102},{"uri":26389},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/username_enumeration/description.md",[26391],{"data":26392,"marks":26393,"value":26395,"nodeType":865},{},[26394],{"type":4537},"username enumeration",{"data":26397,"marks":26398,"value":3531,"nodeType":865},{},[],{"data":26400,"content":26401,"nodeType":1102},{"uri":6497},[26402],{"data":26403,"marks":26404,"value":6503,"nodeType":865},{},[26405],{"type":4537},{"data":26407,"marks":26408,"value":3531,"nodeType":865},{},[],{"data":26410,"content":26411,"nodeType":1102},{"uri":11718},[26412],{"data":26413,"marks":26414,"value":1147,"nodeType":865},{},[26415],{"type":4537},{"data":26417,"marks":26418,"value":3531,"nodeType":865},{},[],{"data":26420,"content":26421,"nodeType":1102},{"uri":25837},[26422],{"data":26423,"marks":26424,"value":26426,"nodeType":865},{},[26425],{"type":4537},"guest access abuse",{"data":26428,"marks":26429,"value":3531,"nodeType":865},{},[],{"data":26431,"content":26432,"nodeType":1102},{"uri":17081},[26433],{"data":26434,"marks":26435,"value":17087,"nodeType":865},{},[26436],{"type":4537},{"data":26438,"marks":26439,"value":3531,"nodeType":865},{},[],{"data":26441,"content":26443,"nodeType":1102},{"uri":26442},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_tokens/description.md",[26444],{"data":26445,"marks":26446,"value":26448,"nodeType":865},{},[26447],{"type":4537},"OAuth tokens",{"data":26450,"marks":26451,"value":3531,"nodeType":865},{},[],{"data":26453,"content":26454,"nodeType":1102},{"uri":6472},[26455],{"data":26456,"marks":26457,"value":26459,"nodeType":865},{},[26458],{"type":4537},"API keys",{"data":26461,"marks":26462,"value":26463,"nodeType":865},{},[]," (as long as you ensure the target isn't notified – make sure you delete the notification of creation email!), ",{"data":26465,"content":26467,"nodeType":1102},{"uri":26466},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/api_secret_theft/description.md",[26468],{"data":26469,"marks":26470,"value":26472,"nodeType":865},{},[26471],{"type":4537},"API secret theft",{"data":26474,"marks":26475,"value":8940,"nodeType":865},{},[],{"data":26477,"content":26479,"nodeType":1102},{"uri":26478},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_backdooring/description.md",[26480],{"data":26481,"marks":26482,"value":26484,"nodeType":865},{},[26483],{"type":4537},"link backdooring",{"data":26486,"marks":26487,"value":7361,"nodeType":865},{},[],{"data":26489,"content":26490,"nodeType":866},{},[26491],{"data":26492,"marks":26493,"value":26494,"nodeType":865},{},[],"Embracing the modern Zero Trust architecture with its greater SaaS usage does not come without security risks, and while it does invalidate a large number of the attacks that can be performed within an AD environment, the SaaS attack matrix is a great way of illustrating how these attacks work, as well as helping red and blue teams respectively to simulate and defend against them.\" ",{"data":26496,"content":26497,"nodeType":938},{},[],{"data":26499,"content":26500,"nodeType":1218},{},[26501],{"data":26502,"marks":26503,"value":26504,"nodeType":865},{},[],"Tom Ellson | Head of Offensive Security | Stripe OLT",{"data":26506,"content":26507,"nodeType":866},{},[26508],{"data":26509,"marks":26510,"value":26511,"nodeType":865},{},[],"“We've used the SaaS attack matrix across several cloud-native engagements, for both initial access and lateral movement. My go-to techniques so far have been:",{"data":26513,"content":26514,"nodeType":891},{},[26515,26542,26564,26586],{"data":26516,"content":26517,"nodeType":880},{},[26518],{"data":26519,"content":26520,"nodeType":866},{},[26521,26524,26534,26538],{"data":26522,"marks":26523,"value":21,"nodeType":865},{},[],{"data":26525,"content":26527,"nodeType":1102},{"uri":26526},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/im_phishing/description.md",[26528],{"data":26529,"marks":26530,"value":26533,"nodeType":865},{},[26531,26532],{"type":4537},{"type":946},"IM phishing:",{"data":26535,"marks":26536,"value":6192,"nodeType":865},{},[26537],{"type":946},{"data":26539,"marks":26540,"value":26541,"nodeType":865},{},[],"Phishing via Microsoft Teams in particular has been highly successful, especially when paired with a number of abusable “features” (working as intended, clearly). ",{"data":26543,"content":26544,"nodeType":880},{},[26545],{"data":26546,"content":26547,"nodeType":866},{},[26548,26551,26560],{"data":26549,"marks":26550,"value":21,"nodeType":865},{},[],{"data":26552,"content":26553,"nodeType":1102},{"uri":11718},[26554],{"data":26555,"marks":26556,"value":26559,"nodeType":865},{},[26557,26558],{"type":4537},{"type":946},"Device code phishing:",{"data":26561,"marks":26562,"value":26563,"nodeType":865},{},[]," We use this for both initial access and persistence. It’s a great way of getting around MFA by tricking the victim into following the device approval process for our device, but using their device. ",{"data":26565,"content":26566,"nodeType":880},{},[26567],{"data":26568,"content":26569,"nodeType":866},{},[26570,26573,26582],{"data":26571,"marks":26572,"value":21,"nodeType":865},{},[],{"data":26574,"content":26575,"nodeType":1102},{"uri":14243},[26576],{"data":26577,"marks":26578,"value":26581,"nodeType":865},{},[26579,26580],{"type":4537},{"type":946},"AitM phishing:",{"data":26583,"marks":26584,"value":26585,"nodeType":865},{},[]," This is now a staple for credential harvesting. Better security controls force us to abuse other avenues to bypass conditional access policies, such as extraction of the PRT token from the end user device, thus granting us claimed access, which can be achieved using AitM and BitM techniques.",{"data":26587,"content":26588,"nodeType":880},{},[26589],{"data":26590,"content":26591,"nodeType":866},{},[26592,26595,26605,26609],{"data":26593,"marks":26594,"value":21,"nodeType":865},{},[],{"data":26596,"content":26598,"nodeType":1102},{"uri":26597},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/oauth_token_enumeration/description.md",[26599],{"data":26600,"marks":26601,"value":26604,"nodeType":865},{},[26602,26603],{"type":4537},{"type":946},"OAuth token enumeration:",{"data":26606,"marks":26607,"value":6192,"nodeType":865},{},[26608],{"type":946},{"data":26610,"marks":26611,"value":26612,"nodeType":865},{},[],"Once an account has been compromised, the Myapps portal is commonly used to validate the accessible applications and further target downstream apps to access data and functionality. ",{"data":26614,"content":26615,"nodeType":866},{},[26616],{"data":26617,"marks":26618,"value":26619,"nodeType":865},{},[],"We’re usually targeting M365 environments but have still found these attack techniques to be highly effective. In some cases, we’ve leveraged other SaaS applications such as abusing in-app phishing via GitHub to compromise development pipelines. The matrix is particularly useful as a playbook of further attacks once initial access has been established. Even just the awareness of how to pivot from SaaS to SaaS (and sometimes back to Microsoft or Google) is really eye-opening for red teams, and adds a new dimension to the security testing that our clients are used to experiencing. ",{"data":26621,"content":26622,"nodeType":866},{},[26623],{"data":26624,"marks":26625,"value":26626,"nodeType":865},{},[],"Because of the success of using these methods, we’ve now incorporated the SaaS attack matrix techniques into our purple teaming methodology to ensure that our clients can build awareness of their detection visibility gaps when it comes to identity attacks, and are routinely benchmarked against them.”  ",{"data":26628,"content":26629,"nodeType":938},{},[],{"data":26631,"content":26632,"nodeType":1218},{},[26633],{"data":26634,"marks":26635,"value":26636,"nodeType":865},{},[],"Max Corbridge | Head of Adversarial Simulation | JUMPSEC",{"data":26638,"content":26639,"nodeType":866},{},[26640],{"data":26641,"marks":26642,"value":26643,"nodeType":865},{},[],"“I’ve been a big fan of the matrix from day one. We use it for two main purposes – as a catalog of TTPs to apply during threat modeling exercises with cloud-native clients, and as a guide for how to apply novel TTPs to different apps and situations. The wiki descriptions, video demonstrations and references help enormously with this. ",{"data":26645,"content":26646,"nodeType":866},{},[26647,26651,26659,26662,26669,26672,26681,26684,26692],{"data":26648,"marks":26649,"value":26650,"nodeType":865},{},[],"We’ve mostly relied on ",{"data":26652,"content":26653,"nodeType":1102},{"uri":26526},[26654],{"data":26655,"marks":26656,"value":26658,"nodeType":865},{},[26657],{"type":4537},"IM phishing",{"data":26660,"marks":26661,"value":3531,"nodeType":865},{},[],{"data":26663,"content":26664,"nodeType":1102},{"uri":14243},[26665],{"data":26666,"marks":26667,"value":25809,"nodeType":865},{},[26668],{"type":4537},{"data":26670,"marks":26671,"value":3531,"nodeType":865},{},[],{"data":26673,"content":26675,"nodeType":1102},{"uri":26674},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/abuse_existing_oauth_integrations/description.md",[26676],{"data":26677,"marks":26678,"value":26680,"nodeType":865},{},[26679],{"type":4537},"abusing OAuth integrations",{"data":26682,"marks":26683,"value":8940,"nodeType":865},{},[],{"data":26685,"content":26687,"nodeType":1102},{"uri":26686},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/samljacking/description.md",[26688],{"data":26689,"marks":26690,"value":14104,"nodeType":865},{},[26691],{"type":4537},{"data":26693,"marks":26694,"value":26695,"nodeType":865},{},[],". In one recent engagement, we were able to compromise a cloud identity with limited permissions in the target Azure environment. We were able to enumerate additional OAuth integrations to laterally move to a third-party IT Service Management SaaS application, which presented a much easier target to elevate privileges. We actually ended up finding a number of 0-days in the application, which we then used as a trusted platform to launch a covert spear-phishing campaign against specific high-privilege users, communicating back-and-forth as though we were a genuine support team, and hiding risky changes to cover our tracks. Ultimately we were able to pivot back into the target Azure estate, but now with administrative privileges. ",{"data":26697,"content":26698,"nodeType":866},{},[26699],{"data":26700,"marks":26701,"value":26702,"nodeType":865},{},[],"This really shows how third-party identities and apps are often the soft underbelly for a lot of otherwise pretty secure orgs that we work with, and we’re enjoying the challenge of finding new ways of getting to the crown jewels. ",{"data":26704,"content":26705,"nodeType":866},{},[26706],{"data":26707,"marks":26708,"value":26709,"nodeType":865},{},[],"In my eyes the world of cloud and SaaS-native attack techniques is under-researched for how increasingly relevant it is becoming. Many of the older TTPs and tradecraft are no longer relevant in a cloud-native world, and even when the techniques are consistent with the ways we used to target networks and endpoints, the context and how it actually works is completely different. So, resources like the SaaS attack matrix will continue to be needed for both offensive and defensive security practitioners going forwards”.",{"data":26711,"content":26712,"nodeType":938},{},[],{"data":26714,"content":26715,"nodeType":948},{},[26716],{"data":26717,"marks":26718,"value":26719,"nodeType":865},{},[],"Get involved!",{"data":26721,"content":26722,"nodeType":866},{},[26723],{"data":26724,"marks":26725,"value":26726,"nodeType":865},{},[],"Hopefully you're now feeling inspired to get involved and start applying the SaaS attack matrix yourself. And if you’ve been using the matrix and want to share your experience with us, we’d love to hear from you. ",{"data":26728,"content":26729,"nodeType":866},{},[26730,26734,26742],{"data":26731,"marks":26732,"value":26733,"nodeType":865},{},[],"We hope to see your comments, discussions, or PRs on ",{"data":26735,"content":26736,"nodeType":1102},{"uri":22038},[26737],{"data":26738,"marks":26739,"value":26741,"nodeType":865},{},[26740],{"type":4537},"GitHub",{"data":26743,"marks":26744,"value":26745,"nodeType":865},{},[],"!",{"data":26747,"content":26748,"nodeType":866},{},[26749,26753,26762],{"data":26750,"marks":26751,"value":26752,"nodeType":865},{},[],"If this has piqued your interest, we’ve just released a 2024 edition of our SaaS attacks report: ",{"data":26754,"content":26756,"nodeType":1102},{"uri":26755},"https://pushsecurity.com/resources/book/saas-attacks-report/",[26757],{"data":26758,"marks":26759,"value":26761,"nodeType":865},{},[26760],{"type":4537},"get your copy here",{"data":26763,"marks":26764,"value":7361,"nodeType":865},{},[],{"data":26766,"content":26770,"nodeType":907},{"target":26767},{"sys":26768},{"id":26769,"type":904,"linkType":905},"J11G6XCdDAYu0GQbKGCnm",[],{"data":26772,"content":26773,"nodeType":866},{},[26774],{"data":26775,"marks":26776,"value":21,"nodeType":865},{},[],"The SaaS attack matrix: A year in review","It’s been almost exactly a year since we released our open source repository of SaaS-native attack techniques. Let's reflect on what’s changed. ","2024-08-27T00:00:00.000Z","the-saas-attack-matrix-one-year-on",{"items":26782},[26783,26785],{"sys":26784,"name":2524},{"id":2523},{"sys":26786,"name":342},{"id":2527},{"items":26788},[26789],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":26790},{"url":6031},"blog/shifting-detection-left-for-more-effective-threat-detection",{"json":26793},{"data":26794,"content":26795,"nodeType":2232},{},[26796],{"data":26797,"content":26798,"nodeType":866},{},[26799],{"data":26800,"marks":26801,"value":26802,"nodeType":865},{},[],"This is the second blog in our series looking at the ‘why’ behind the ‘what’ at Push. In this entry, we’re exploring the idea of shifting detection and response left in the face of modern attacks. ",{"id":21928,"publishedAt":26804},"2026-08-12T11:54:56.314Z",{"items":26806},[26807,26809],{"sys":26808,"name":342},{"id":2527},{"sys":26810,"name":2524},{"id":2523},{"items":26812},[26813,26815,26817,26819,26821,26823,26825,26827,26829,26831,26833,26835,26837,26839],{"sys":26814,"name":342,"slug":343,"tier":31},{"id":339},{"sys":26816,"name":279,"slug":280,"tier":31},{"id":276},{"sys":26818,"name":297,"slug":298,"tier":31},{"id":294},{"sys":26820,"name":413,"slug":414,"tier":31},{"id":410},{"sys":26822,"name":519,"slug":520,"tier":31},{"id":516},{"sys":26824,"name":351,"slug":352,"tier":45},{"id":348},{"sys":26826,"name":261,"slug":262,"tier":45},{"id":258},{"sys":26828,"name":324,"slug":325,"tier":45},{"id":321},{"sys":26830,"name":571,"slug":572,"tier":45},{"id":568},{"sys":26832,"name":422,"slug":423,"tier":45},{"id":419},{"sys":26834,"name":333,"slug":334,"tier":45},{"id":330},{"sys":26836,"name":624,"slug":625,"tier":45},{"id":621},{"sys":26838,"name":598,"slug":599,"tier":45},{"id":595},{"sys":26840,"name":377,"slug":378,"tier":45},{"id":374},"WqLI4ex55T2BBZsNDP_NW5IbAa7A2KBFIxwJtYqQAvc",{"id":26843,"title":26844,"authorsCollection":26845,"content":26849,"extension":228,"faqItemsCollection":27386,"faqTitle":59,"featured":6,"hashTags":59,"meta":27388,"metaTitle":27389,"ogImage":59,"postType":3355,"publishedDate":27390,"relatedBlogPostsCollection":27391,"slug":28027,"stem":28028,"subtitle":59,"summary":28029,"synopsis":28040,"sys":28041,"tagsCollection":28044,"topicsCollection":28050,"__hash__":28064},"blog/blog/product-release-july-2024.json","Product release: July 2024",{"items":26846},[26847],{"fullName":2573,"firstName":2574,"jobTitle":2575,"socialLinks":59,"profilePicture":26848},{"url":2577},{"json":26850,"links":27328},{"data":26851,"content":26852,"nodeType":2232},{},[26853,26859,26922,26929,26953,26968,26974,26992,26999,27028,27035,27054,27061,27100,27107,27113,27131,27138,27154,27169,27175,27192,27199,27215,27247,27252,27270,27277,27301,27316,27322],{"data":26854,"content":26855,"nodeType":1218},{},[26856],{"data":26857,"marks":26858,"value":3372,"nodeType":865},{},[],{"data":26860,"content":26861,"nodeType":891},{},[26862,26872,26882,26892,26902,26912],{"data":26863,"content":26864,"nodeType":880},{},[26865],{"data":26866,"content":26867,"nodeType":866},{},[26868],{"data":26869,"marks":26870,"value":26871,"nodeType":865},{},[],"New Events page",{"data":26873,"content":26874,"nodeType":880},{},[26875],{"data":26876,"content":26877,"nodeType":866},{},[26878],{"data":26879,"marks":26880,"value":26881,"nodeType":865},{},[],"Arc browser support",{"data":26883,"content":26884,"nodeType":880},{},[26885],{"data":26886,"content":26887,"nodeType":866},{},[26888],{"data":26889,"marks":26890,"value":26891,"nodeType":865},{},[],"Warn and block modes for phishing tool detection",{"data":26893,"content":26894,"nodeType":880},{},[26895],{"data":26896,"content":26897,"nodeType":866},{},[26898],{"data":26899,"marks":26900,"value":26901,"nodeType":865},{},[],"Admin audit events now available",{"data":26903,"content":26904,"nodeType":880},{},[26905],{"data":26906,"content":26907,"nodeType":866},{},[26908],{"data":26909,"marks":26910,"value":26911,"nodeType":865},{},[],"Add custom labels to apps",{"data":26913,"content":26914,"nodeType":880},{},[26915],{"data":26916,"content":26917,"nodeType":866},{},[26918],{"data":26919,"marks":26920,"value":26921,"nodeType":865},{},[],"Improved Browsers page",{"data":26923,"content":26924,"nodeType":1218},{},[26925],{"data":26926,"marks":26927,"value":26928,"nodeType":865},{},[],"Get a snapshot of your Push activity with Events",{"data":26930,"content":26931,"nodeType":866},{},[26932,26936,26940,26944,26949],{"data":26933,"marks":26934,"value":26935,"nodeType":865},{},[],"To help you visualize and plan how you can use Push telemetry, we now provide an ",{"data":26937,"marks":26938,"value":2058,"nodeType":865},{},[26939],{"type":946},{"data":26941,"marks":26942,"value":26943,"nodeType":865},{},[]," page in the Push admin console. It shows a rolling ",{"data":26945,"marks":26946,"value":26948,"nodeType":865},{},[26947],{"type":946},"7-day snapshot of all the events in your environment",{"data":26950,"marks":26951,"value":26952,"nodeType":865},{},[],", including security controls being activated, new apps being discovered, and more.",{"data":26954,"content":26955,"nodeType":866},{},[26956,26960,26965],{"data":26957,"marks":26958,"value":26959,"nodeType":865},{},[],"Click on an event to see its attributes and then ingest this data into your SIEM or other platform to create your own ",{"data":26961,"marks":26962,"value":26964,"nodeType":865},{},[26963],{"type":946},"custom detections or automations",{"data":26966,"marks":26967,"value":1151,"nodeType":865},{},[],{"data":26969,"content":26973,"nodeType":907},{"target":26970},{"sys":26971},{"id":26972,"type":904,"linkType":905},"2a3bJ5sN8dJ0c1kQtZiag7",[],{"data":26975,"content":26976,"nodeType":866},{},[26977,26980,26989],{"data":26978,"marks":26979,"value":21,"nodeType":865},{},[],{"data":26981,"content":26985,"nodeType":1038},{"target":26982},{"sys":26983},{"id":26984,"type":904,"linkType":905},"20FcoPvHu7zXkTQyv9MmK0",[26986],{"data":26987,"marks":26988,"value":2777,"nodeType":865},{},[],{"data":26990,"marks":26991,"value":21,"nodeType":865},{},[],{"data":26993,"content":26994,"nodeType":1218},{},[26995],{"data":26996,"marks":26997,"value":26998,"nodeType":865},{},[],"Push now supports Arc browser",{"data":27000,"content":27001,"nodeType":866},{},[27002,27006,27011,27015,27025],{"data":27003,"marks":27004,"value":27005,"nodeType":865},{},[],"In keeping with our philosophy of securing users wherever they like to work, we’ve added support for the ",{"data":27007,"marks":27008,"value":27010,"nodeType":865},{},[27009],{"type":946},"increasingly popular Arc browser",{"data":27012,"marks":27013,"value":27014,"nodeType":865},{},[],". You can now install the Push browser agent on Arc, and do a managed deployment to Arc on macOS using your MDM. (Push already supports all major browsers. You can find the list in our ",{"data":27016,"content":27020,"nodeType":1038},{"target":27017},{"sys":27018},{"id":27019,"type":904,"linkType":905},"2grGlYU1UQns5CKgLtGUMk",[27021],{"data":27022,"marks":27023,"value":27024,"nodeType":865},{},[],"Help Center",{"data":27026,"marks":27027,"value":11761,"nodeType":865},{},[],{"data":27029,"content":27030,"nodeType":866},{},[27031],{"data":27032,"marks":27033,"value":27034,"nodeType":865},{},[],"Are there other browsers you’d like Push to support? Let us know!",{"data":27036,"content":27037,"nodeType":866},{},[27038,27041,27051],{"data":27039,"marks":27040,"value":21,"nodeType":865},{},[],{"data":27042,"content":27046,"nodeType":1038},{"target":27043},{"sys":27044},{"id":27045,"type":904,"linkType":905},"6U8oU6ximN4fg27xrs3StI",[27047],{"data":27048,"marks":27049,"value":27050,"nodeType":865},{},[],"MDM documentation",{"data":27052,"marks":27053,"value":21,"nodeType":865},{},[],{"data":27055,"content":27056,"nodeType":1218},{},[27057],{"data":27058,"marks":27059,"value":27060,"nodeType":865},{},[],"Warn or block users when Push detects phishing toolkits",{"data":27062,"content":27063,"nodeType":866},{},[27064,27068,27072,27075,27079,27083,27088,27092,27097],{"data":27065,"marks":27066,"value":27067,"nodeType":865},{},[],"You can now set a ",{"data":27069,"marks":27070,"value":2080,"nodeType":865},{},[27071],{"type":946},{"data":27073,"marks":27074,"value":1773,"nodeType":865},{},[],{"data":27076,"marks":27077,"value":2088,"nodeType":865},{},[27078],{"type":946},{"data":27080,"marks":27081,"value":27082,"nodeType":865},{},[]," mode on Push’s ",{"data":27084,"marks":27085,"value":27087,"nodeType":865},{},[27086],{"type":946},"Phishing toolkit detection",{"data":27089,"marks":27090,"value":27091,"nodeType":865},{},[]," feature. Phishing toolkit detection identifies when employees visit webpages that use advanced phishing tools such as Evilginx, EvilNoVNC, and others. These adversary-in-the-middle (AitM) tools can mimic legitimate login screens, such as an Okta login page, to ",{"data":27093,"marks":27094,"value":27096,"nodeType":865},{},[27095],{"type":946},"steal credentials and MFA codes",{"data":27098,"marks":27099,"value":1151,"nodeType":865},{},[],{"data":27101,"content":27102,"nodeType":866},{},[27103],{"data":27104,"marks":27105,"value":27106,"nodeType":865},{},[],"When you configure a Warn or Block mode for this control, you can add your custom message to end-users on the warn/block page. Then get alerted to positive detections using Push’s webhook events.",{"data":27108,"content":27112,"nodeType":907},{"target":27109},{"sys":27110},{"id":27111,"type":904,"linkType":905},"1LdHJjTDlOiie5mctbAVvZ",[],{"data":27114,"content":27115,"nodeType":866},{},[27116,27119,27128],{"data":27117,"marks":27118,"value":21,"nodeType":865},{},[],{"data":27120,"content":27123,"nodeType":1038},{"target":27121},{"sys":27122},{"id":13637,"type":904,"linkType":905},[27124],{"data":27125,"marks":27126,"value":27127,"nodeType":865},{},[],"How it works",{"data":27129,"marks":27130,"value":21,"nodeType":865},{},[],{"data":27132,"content":27133,"nodeType":1218},{},[27134],{"data":27135,"marks":27136,"value":27137,"nodeType":865},{},[],"Stay on top of admin actions",{"data":27139,"content":27140,"nodeType":866},{},[27141,27145,27150],{"data":27142,"marks":27143,"value":27144,"nodeType":865},{},[],"We recently added ",{"data":27146,"marks":27147,"value":27149,"nodeType":865},{},[27148],{"type":946},"events for administrative actions",{"data":27151,"marks":27152,"value":27153,"nodeType":865},{},[]," on the Push platform, so you can get visibility when admins assign or remove licenses, configure security controls, or add or remove API keys, among other actions. ",{"data":27155,"content":27156,"nodeType":866},{},[27157,27161,27165],{"data":27158,"marks":27159,"value":27160,"nodeType":865},{},[],"You’ll see admin events show up on the ",{"data":27162,"marks":27163,"value":2058,"nodeType":865},{},[27164],{"type":946},{"data":27166,"marks":27167,"value":27168,"nodeType":865},{},[]," page in the admin console. Send these events to your SIEM or other system to create custom alerts.",{"data":27170,"content":27174,"nodeType":907},{"target":27171},{"sys":27172},{"id":27173,"type":904,"linkType":905},"1qZHyxVEVFQs16kcIiufRm",[],{"data":27176,"content":27177,"nodeType":866},{},[27178,27181,27189],{"data":27179,"marks":27180,"value":21,"nodeType":865},{},[],{"data":27182,"content":27184,"nodeType":1102},{"uri":27183},"https://pushsecurity.redoc.ly/webhooks-v1#tag/Audit",[27185],{"data":27186,"marks":27187,"value":27188,"nodeType":865},{},[],"See list of admin events",{"data":27190,"marks":27191,"value":21,"nodeType":865},{},[],{"data":27193,"content":27194,"nodeType":1218},{},[27195],{"data":27196,"marks":27197,"value":27198,"nodeType":865},{},[],"Custom labels to organize your app inventory",{"data":27200,"content":27201,"nodeType":866},{},[27202,27206,27211],{"data":27203,"marks":27204,"value":27205,"nodeType":865},{},[],"Create your own custom labels and apply them to apps in your inventory using our new ",{"data":27207,"marks":27208,"value":27210,"nodeType":865},{},[27209],{"type":946},"Labels",{"data":27212,"marks":27213,"value":27214,"nodeType":865},{},[]," feature. This feature has been a popular request from customers, and we’re excited to get it into your hands. ",{"data":27216,"content":27217,"nodeType":866},{},[27218,27222,27227,27230,27235,27238,27243],{"data":27219,"marks":27220,"value":27221,"nodeType":865},{},[],"A few ideas on how you might want to use app labels: To designate what kind of data is stored in an app; to note the ",{"data":27223,"marks":27224,"value":27226,"nodeType":865},{},[27225],{"type":946},"confidentiality",{"data":27228,"marks":27229,"value":3531,"nodeType":865},{},[],{"data":27231,"marks":27232,"value":27234,"nodeType":865},{},[27233],{"type":946},"integrity",{"data":27236,"marks":27237,"value":8940,"nodeType":865},{},[],{"data":27239,"marks":27240,"value":27242,"nodeType":865},{},[27241],{"type":946},"availability status",{"data":27244,"marks":27245,"value":27246,"nodeType":865},{},[]," of an app; to capture whether an app is IT-managed, or anything else you can think of!",{"data":27248,"content":27251,"nodeType":907},{"target":27249},{"sys":27250},{"id":20587,"type":904,"linkType":905},[],{"data":27253,"content":27254,"nodeType":866},{},[27255,27258,27267],{"data":27256,"marks":27257,"value":21,"nodeType":865},{},[],{"data":27259,"content":27263,"nodeType":1038},{"target":27260},{"sys":27261},{"id":27262,"type":904,"linkType":905},"6vxd2k7cGU7ToDGI7goaur",[27264],{"data":27265,"marks":27266,"value":2777,"nodeType":865},{},[],{"data":27268,"marks":27269,"value":21,"nodeType":865},{},[],{"data":27271,"content":27272,"nodeType":1218},{},[27273],{"data":27274,"marks":27275,"value":27276,"nodeType":865},{},[],"Redesigned Browsers page",{"data":27278,"content":27279,"nodeType":866},{},[27280,27284,27288,27292,27297],{"data":27281,"marks":27282,"value":27283,"nodeType":865},{},[],"We’ve updated the ",{"data":27285,"marks":27286,"value":3692,"nodeType":865},{},[27287],{"type":946},{"data":27289,"marks":27290,"value":27291,"nodeType":865},{},[]," page in the admin console to make it possible to ",{"data":27293,"marks":27294,"value":27296,"nodeType":865},{},[27295],{"type":946},"filter and export the data",{"data":27298,"marks":27299,"value":27300,"nodeType":865},{},[],", as well as to help you better extract useful information about enrolled browsers, such as their extension version, first and last check-in dates, and browser types.",{"data":27302,"content":27303,"nodeType":866},{},[27304,27308,27312],{"data":27305,"marks":27306,"value":27307,"nodeType":865},{},[],"This page also now appears as a data table, similar to the other pages in the ",{"data":27309,"marks":27310,"value":2719,"nodeType":865},{},[27311],{"type":946},{"data":27313,"marks":27314,"value":27315,"nodeType":865},{},[]," section of the platform.",{"data":27317,"content":27321,"nodeType":907},{"target":27318},{"sys":27319},{"id":27320,"type":904,"linkType":905},"7yuZTKsdMSEIxK1RYtGNa",[],{"data":27323,"content":27324,"nodeType":866},{},[27325],{"data":27326,"marks":27327,"value":21,"nodeType":865},{},[],{"entries":27329},{"inline":27330,"hyperlink":27331,"block":27356},[],[27332,27336,27341,27347,27351],{"sys":27333,"__typename":2239,"title":27334,"slug":27335},{"id":26984},"Introducing set-and-forget controls that stop real-world identity attacks","introducing-set-and-forget-controls-that-stop-real-world-identity-attacks",{"sys":27337,"__typename":2256,"title":27338,"slug":27339,"articleId":27340},{"id":27019},"What browsers does Push support?","what-browsers-does-push-support",10091,{"sys":27342,"__typename":3313,"title":27343,"slug":27344,"audience":3316,"linkedFromParent":27345},{"id":27045},"Managed deployment using an MDM on macOS","managed-deployment-using-an-mdm-on-macos",{"slug":27346},"install-the-browser-extension",{"sys":27348,"__typename":2239,"title":27349,"slug":27350},{"id":13637},"Introducing AitM phishing toolkit detection, powered by the Push browser agent","introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser",{"sys":27352,"__typename":2256,"title":27353,"slug":27354,"articleId":27355},{"id":27262},"Can I use my own labels to categorize apps in Push?","can-i-use-my-own-labels-to-categorize-apps-in-push",10116,[27357,27364,27371,27377,27380],{"sys":27358,"__typename":2366,"title":27359,"caption":59,"layoutMode":59,"file":27360},{"id":26972},"Events page - event details - docs - Connect to SIEM or SOAR",{"url":27361,"width":27362,"height":27363},"https://images.ctfassets.net/y1cdw1ablpvd/l6JvepRcU8ZCviZaSWM4T/2b0288c3080c3aa0040de13d73f4c782/events_page_filtered_20260305.png",3016,1726,{"sys":27365,"__typename":2366,"title":27366,"caption":27367,"layoutMode":59,"file":27368},{"id":27111},"Phishing toolkit block page - KB 10113","Customizable block page",{"url":27369,"width":12338,"height":27370},"https://images.ctfassets.net/y1cdw1ablpvd/7hGVqcQYa0xqDQa8uVBFim/665e8f7141bd272ea7b88ecf6a28de67/phishing_tool_blockpage.png",767,{"sys":27372,"__typename":2366,"title":27373,"caption":59,"layoutMode":59,"file":27374},{"id":27173},"Filter by admin audit events - Events page - docs - Administering Push",{"url":27375,"width":27376,"height":27363},"https://images.ctfassets.net/y1cdw1ablpvd/3CQxrWtRhUCq59PLEXY7aS/31f1a9bbbb439ba7c9476f4d05244685/events_page_audit_filtered_20260305.png",3020,{"sys":27378,"__typename":2366,"title":21278,"caption":59,"layoutMode":59,"file":27379},{"id":20587},{"url":21280,"width":21281,"height":21282},{"sys":27381,"__typename":2366,"title":27382,"caption":59,"layoutMode":59,"file":27383},{"id":27320},"Redesigned browsers page - July 2024 release notes",{"url":27384,"width":12338,"height":27385},"https://images.ctfassets.net/y1cdw1ablpvd/709L09QPWPIZBqLy3Z0uEH/43341660e566fa40f9611bc7095964eb/browsers_table.png",780,{"items":27387},[],{},"Push Security new product features for July 2024","2024-07-16T00:00:00.000Z",{"items":27392},[27393,27833],{"__typename":2239,"sys":27394,"content":27396,"title":27821,"synopsis":27822,"hashTags":59,"publishedDate":27823,"slug":27824,"tagsCollection":27825,"authorsCollection":27829},{"id":27395},"liumWpzvwXGmwbtKrvJdO",{"json":27397},{"data":27398,"content":27399,"nodeType":2232},{},[27400,27406,27466,27473,27489,27503,27510,27516,27535,27542,27558,27565,27571,27588,27595,27620,27635,27652,27659,27674,27690,27696,27714,27721,27745,27751,27768,27775,27805],{"data":27401,"content":27402,"nodeType":1218},{},[27403],{"data":27404,"marks":27405,"value":3372,"nodeType":865},{},[],{"data":27407,"content":27408,"nodeType":891},{},[27409,27418,27427,27437,27446,27456],{"data":27410,"content":27411,"nodeType":880},{},[27412],{"data":27413,"content":27414,"nodeType":866},{},[27415],{"data":27416,"marks":27417,"value":15108,"nodeType":865},{},[],{"data":27419,"content":27420,"nodeType":880},{},[27421],{"data":27422,"content":27423,"nodeType":866},{},[27424],{"data":27425,"marks":27426,"value":19926,"nodeType":865},{},[],{"data":27428,"content":27429,"nodeType":880},{},[27430],{"data":27431,"content":27432,"nodeType":866},{},[27433],{"data":27434,"marks":27435,"value":27436,"nodeType":865},{},[],"Session token theft detection",{"data":27438,"content":27439,"nodeType":880},{},[27440],{"data":27441,"content":27442,"nodeType":866},{},[27443],{"data":27444,"marks":27445,"value":20770,"nodeType":865},{},[],{"data":27447,"content":27448,"nodeType":880},{},[27449],{"data":27450,"content":27451,"nodeType":866},{},[27452],{"data":27453,"marks":27454,"value":27455,"nodeType":865},{},[],"Require a reason for app usage",{"data":27457,"content":27458,"nodeType":880},{},[27459],{"data":27460,"content":27461,"nodeType":866},{},[27462],{"data":27463,"marks":27464,"value":27465,"nodeType":865},{},[],"Expanded API and webhooks options",{"data":27467,"content":27468,"nodeType":1218},{},[27469],{"data":27470,"marks":27471,"value":27472,"nodeType":865},{},[],"Prevent SSO password reuse",{"data":27474,"content":27475,"nodeType":866},{},[27476,27480,27485],{"data":27477,"marks":27478,"value":27479,"nodeType":865},{},[],"Instead of trying to detect phishing websites and domains that constantly change, Push can now ",{"data":27481,"marks":27482,"value":27484,"nodeType":865},{},[27483],{"type":946},"detect (and block!) SSO password reuse",{"data":27486,"marks":27487,"value":27488,"nodeType":865},{},[]," based on directly observing user behavior in the browser.",{"data":27490,"content":27491,"nodeType":866},{},[27492,27495,27499],{"data":27493,"marks":27494,"value":4693,"nodeType":865},{},[],{"data":27496,"marks":27497,"value":15108,"nodeType":865},{},[27498],{"type":946},{"data":27500,"marks":27501,"value":27502,"nodeType":865},{},[]," feature detects and blocks when a user enters their identity provider password on a webpage that does not belong to the IdP (e.g. Okta, Google Workspace, Microsoft 365, etc.)",{"data":27504,"content":27505,"nodeType":866},{},[27506],{"data":27507,"marks":27508,"value":27509,"nodeType":865},{},[],"You can choose to warn or block SSO password reuse and customize the message that end-users see.",{"data":27511,"content":27515,"nodeType":907},{"target":27512},{"sys":27513},{"id":27514,"type":904,"linkType":905},"74l82HIeaumFX4u9AMjj79",[],{"data":27517,"content":27518,"nodeType":866},{},[27519,27522,27532],{"data":27520,"marks":27521,"value":21,"nodeType":865},{},[],{"data":27523,"content":27527,"nodeType":1038},{"target":27524},{"sys":27525},{"id":27526,"type":904,"linkType":905},"4UtRVoFElDduWJBx9Sa4Cw",[27528],{"data":27529,"marks":27530,"value":27531,"nodeType":865},{},[],"See how it works",{"data":27533,"marks":27534,"value":21,"nodeType":865},{},[],{"data":27536,"content":27537,"nodeType":1218},{},[27538],{"data":27539,"marks":27540,"value":27541,"nodeType":865},{},[],"Detect Adversary-in-the-Middle phishing toolkits",{"data":27543,"content":27544,"nodeType":866},{},[27545,27549,27554],{"data":27546,"marks":27547,"value":27548,"nodeType":865},{},[],"The Push browser agent can now ",{"data":27550,"marks":27551,"value":27553,"nodeType":865},{},[27552],{"type":946},"detect when employees visit websites that are using phishing toolkits",{"data":27555,"marks":27556,"value":27557,"nodeType":865},{},[]," such as EvilNoVNC and Evilginx. These tools can mimic legitimate login screens in order to steal credentials and bypass MFA.",{"data":27559,"content":27560,"nodeType":866},{},[27561],{"data":27562,"marks":27563,"value":27564,"nodeType":865},{},[],"Send detections to your SIEM or similar monitoring tool and add malicious sites to a blocklist in Push.",{"data":27566,"content":27570,"nodeType":907},{"target":27567},{"sys":27568},{"id":27569,"type":904,"linkType":905},"450I6V31ET3EbfgMiVBPBR",[],{"data":27572,"content":27573,"nodeType":866},{},[27574,27577,27585],{"data":27575,"marks":27576,"value":21,"nodeType":865},{},[],{"data":27578,"content":27581,"nodeType":1038},{"target":27579},{"sys":27580},{"id":1483,"type":904,"linkType":905},[27582],{"data":27583,"marks":27584,"value":2777,"nodeType":865},{},[],{"data":27586,"marks":27587,"value":21,"nodeType":865},{},[],{"data":27589,"content":27590,"nodeType":1218},{},[27591],{"data":27592,"marks":27593,"value":27594,"nodeType":865},{},[],"Identify session token theft ",{"data":27596,"content":27597,"nodeType":866},{},[27598,27602,27607,27611,27616],{"data":27599,"marks":27600,"value":27601,"nodeType":865},{},[],"You can now use the Push browser agent to ",{"data":27603,"marks":27604,"value":27606,"nodeType":865},{},[27605],{"type":946},"inject a unique marker to the user agent string",{"data":27608,"marks":27609,"value":27610,"nodeType":865},{},[]," of sessions that occur in browsers enrolled in Push. By analyzing logs from your identity provider (e.g. Okta, Microsoft 365, etc.) or other app, you can use the marker to help you ",{"data":27612,"marks":27613,"value":27615,"nodeType":865},{},[27614],{"type":946},"find suspicious activity that indicates a stolen session cookie",{"data":27617,"marks":27618,"value":27619,"nodeType":865},{},[]," in use.",{"data":27621,"content":27622,"nodeType":866},{},[27623,27627,27632],{"data":27624,"marks":27625,"value":27626,"nodeType":865},{},[],"Detecting session hijacking is extremely difficult when relying on device-based monitoring using EDR and network traffic. But by giving legitimate sessions a stamp of approval using the Push browser agent, you can easily ",{"data":27628,"marks":27629,"value":27631,"nodeType":865},{},[27630],{"type":946},"identify access to apps from untrusted devices",{"data":27633,"marks":27634,"value":1151,"nodeType":865},{},[],{"data":27636,"content":27637,"nodeType":866},{},[27638,27641,27649],{"data":27639,"marks":27640,"value":21,"nodeType":865},{},[],{"data":27642,"content":27645,"nodeType":1038},{"target":27643},{"sys":27644},{"id":13505,"type":904,"linkType":905},[27646],{"data":27647,"marks":27648,"value":27531,"nodeType":865},{},[],{"data":27650,"marks":27651,"value":21,"nodeType":865},{},[],{"data":27653,"content":27654,"nodeType":1218},{},[27655],{"data":27656,"marks":27657,"value":27658,"nodeType":865},{},[],"Configure a custom blocklist of URLs",{"data":27660,"content":27661,"nodeType":866},{},[27662,27666,27670],{"data":27663,"marks":27664,"value":27665,"nodeType":865},{},[],"Prevent employees from visiting malicious sites you detect by configuring a custom blocklist of URLs in Push using the ",{"data":27667,"marks":27668,"value":20770,"nodeType":865},{},[27669],{"type":946},{"data":27671,"marks":27672,"value":27673,"nodeType":865},{},[]," feature. You can customize the message shown to end-users by adding your own links and instructions. Use Push’s REST API to programmatically manage URL blocking as part of responding to a phishing incident.",{"data":27675,"content":27676,"nodeType":866},{},[27677,27681,27686],{"data":27678,"marks":27679,"value":27680,"nodeType":865},{},[],"You can use this alongside other Push features like phishing tool detection to ",{"data":27682,"marks":27683,"value":27685,"nodeType":865},{},[27684],{"type":946},"block access to known-bad sites",{"data":27687,"marks":27688,"value":27689,"nodeType":865},{},[]," you find. ",{"data":27691,"content":27695,"nodeType":907},{"target":27692},{"sys":27693},{"id":27694,"type":904,"linkType":905},"1S7cuS7qo5jTcEg7RPPZu6",[],{"data":27697,"content":27698,"nodeType":866},{},[27699,27702,27711],{"data":27700,"marks":27701,"value":21,"nodeType":865},{},[],{"data":27703,"content":27707,"nodeType":1038},{"target":27704},{"sys":27705},{"id":27706,"type":904,"linkType":905},"P0coHgQAdRL0YTu4Rwd4z",[27708],{"data":27709,"marks":27710,"value":2777,"nodeType":865},{},[],{"data":27712,"marks":27713,"value":21,"nodeType":865},{},[],{"data":27715,"content":27716,"nodeType":1218},{},[27717],{"data":27718,"marks":27719,"value":27720,"nodeType":865},{},[],"Require end-users to submit a reason when using an app",{"data":27722,"content":27723,"nodeType":866},{},[27724,27728,27732,27736,27741],{"data":27725,"marks":27726,"value":27727,"nodeType":865},{},[],"We’ve expanded our popular app banners feature to include a ",{"data":27729,"marks":27730,"value":20817,"nodeType":865},{},[27731],{"type":946},{"data":27733,"marks":27734,"value":27735,"nodeType":865},{},[]," mode that allows you to configure a custom message and require employees to submit a reason ",{"data":27737,"marks":27738,"value":27740,"nodeType":865},{},[27739],{"type":946},"why they need to use a specific app",{"data":27742,"marks":27743,"value":27744,"nodeType":865},{},[]," before they can proceed to log in.",{"data":27746,"content":27750,"nodeType":907},{"target":27747},{"sys":27748},{"id":27749,"type":904,"linkType":905},"6Q7kU16LZdTm8RsyLy660J",[],{"data":27752,"content":27753,"nodeType":866},{},[27754,27757,27765],{"data":27755,"marks":27756,"value":21,"nodeType":865},{},[],{"data":27758,"content":27761,"nodeType":1038},{"target":27759},{"sys":27760},{"id":1802,"type":904,"linkType":905},[27762],{"data":27763,"marks":27764,"value":2777,"nodeType":865},{},[],{"data":27766,"marks":27767,"value":21,"nodeType":865},{},[],{"data":27769,"content":27770,"nodeType":1218},{},[27771],{"data":27772,"marks":27773,"value":27774,"nodeType":865},{},[],"Monitor ‘other apps’ list via Push API and webhooks",{"data":27776,"content":27777,"nodeType":866},{},[27778,27782,27787,27791,27801],{"data":27779,"marks":27780,"value":27781,"nodeType":865},{},[],"You can now keep a closer eye on ",{"data":27783,"marks":27784,"value":27786,"nodeType":865},{},[27785],{"type":946},"all new observed cloud apps",{"data":27788,"marks":27789,"value":27790,"nodeType":865},{},[]," by using the Push API and webhooks to notify you of new entries on the ",{"data":27792,"content":27796,"nodeType":1038},{"target":27793},{"sys":27794},{"id":27795,"type":904,"linkType":905},"WciLKam7PCkbAASOdfiEw",[27797],{"data":27798,"marks":27799,"value":27800,"nodeType":865},{},[],"“other apps” list",{"data":27802,"marks":27803,"value":27804,"nodeType":865},{},[]," or to retrieve specific details about accounts on these apps. The “other apps” list consists of apps accessed by employees that Push doesn’t recognize as work apps but that may still be relevant to your operations. ",{"data":27806,"content":27807,"nodeType":866},{},[27808,27811,27817],{"data":27809,"marks":27810,"value":21,"nodeType":865},{},[],{"data":27812,"content":27813,"nodeType":1102},{"uri":24833},[27814],{"data":27815,"marks":27816,"value":2777,"nodeType":865},{},[],{"data":27818,"marks":27819,"value":27820,"nodeType":865},{},[],"\n","Product release: May 2024","Here’s what’s new on the Push platform for May 2024.","2024-05-22T00:00:00.000Z","product-release-may-2024",{"items":27826},[27827],{"sys":27828,"name":3915},{"id":3914},{"items":27830},[27831],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":27832},{"url":2577},{"__typename":2239,"sys":27834,"content":27836,"title":28015,"synopsis":28016,"hashTags":59,"publishedDate":28017,"slug":28018,"tagsCollection":28019,"authorsCollection":28023},{"id":27835},"3xoO1mzZMMQO8Q2vHuYLFt",{"json":27837},{"data":27838,"content":27839,"nodeType":2232},{},[27840,27847,27880,27886,27902,27908,27924,27931,27946,27952,27969,27976,27992,27998],{"data":27841,"content":27842,"nodeType":1218},{},[27843],{"data":27844,"marks":27845,"value":27846,"nodeType":865},{},[],"Here's what's new on the Push platform this month:",{"data":27848,"content":27849,"nodeType":891},{},[27850,27860,27870],{"data":27851,"content":27852,"nodeType":880},{},[27853],{"data":27854,"content":27855,"nodeType":866},{},[27856],{"data":27857,"marks":27858,"value":27859,"nodeType":865},{},[],"Faster insights with the Push dashboard",{"data":27861,"content":27862,"nodeType":880},{},[27863],{"data":27864,"content":27865,"nodeType":866},{},[27866],{"data":27867,"marks":27868,"value":27869,"nodeType":865},{},[],"Integrate with Okta",{"data":27871,"content":27872,"nodeType":880},{},[27873],{"data":27874,"content":27875,"nodeType":866},{},[27876],{"data":27877,"marks":27878,"value":27879,"nodeType":865},{},[],"App banner acknowledge mode",{"data":27881,"content":27882,"nodeType":1218},{},[27883],{"data":27884,"marks":27885,"value":27859,"nodeType":865},{},[],{"data":27887,"content":27888,"nodeType":866},{},[27889,27893,27898],{"data":27890,"marks":27891,"value":27892,"nodeType":865},{},[],"Get an overview of the ",{"data":27894,"marks":27895,"value":27897,"nodeType":865},{},[27896],{"type":946},"actionable insights ",{"data":27899,"marks":27900,"value":27901,"nodeType":865},{},[],"from across your ecosystem of accounts, apps, and identities using the Push dashboard, now available in the Push admin console. Pinpoint vulnerable identities at risk of account takeover, see SSO trends across all accounts, and get a snapshot of your identity inventory.",{"data":27903,"content":27907,"nodeType":907},{"target":27904},{"sys":27905},{"id":27906,"type":904,"linkType":905},"1AbJEm5rHOxwYer519AT9C",[],{"data":27909,"content":27910,"nodeType":866},{},[27911,27914,27921],{"data":27912,"marks":27913,"value":21,"nodeType":865},{},[],{"data":27915,"content":27917,"nodeType":1102},{"uri":27916},"/help/audience/administrators/docs/view-saas-apps-and-employee-activity/#dashboard",[27918],{"data":27919,"marks":27920,"value":2777,"nodeType":865},{},[],{"data":27922,"marks":27923,"value":21,"nodeType":865},{},[],{"data":27925,"content":27926,"nodeType":1218},{},[27927],{"data":27928,"marks":27929,"value":27930,"nodeType":865},{},[],"Integrate with Okta to enrich your Push data",{"data":27932,"content":27933,"nodeType":866},{},[27934,27937,27942],{"data":27935,"marks":27936,"value":3594,"nodeType":865},{},[],{"data":27938,"marks":27939,"value":27941,"nodeType":865},{},[27940],{"type":946},"integrate with Okta",{"data":27943,"marks":27944,"value":27945,"nodeType":865},{},[]," to sync employee records and pull in a list of your SSO apps to the Push platform, providing a valuable source of truth for data on your workforce accounts and approved apps. By integrating with Okta, you will also be able to capture additional login methods used by employees, such as Okta SWA.",{"data":27947,"content":27951,"nodeType":907},{"target":27948},{"sys":27949},{"id":27950,"type":904,"linkType":905},"2p7QbcSx8G2R8DVpCEZWYk",[],{"data":27953,"content":27954,"nodeType":866},{},[27955,27958,27966],{"data":27956,"marks":27957,"value":21,"nodeType":865},{},[],{"data":27959,"content":27961,"nodeType":1102},{"uri":27960},"/help/audience/administrators/docs/add-employees/#integrate-with-okta",[27962],{"data":27963,"marks":27964,"value":27965,"nodeType":865},{},[],"How to integrate",{"data":27967,"marks":27968,"value":21,"nodeType":865},{},[],{"data":27970,"content":27971,"nodeType":1218},{},[27972],{"data":27973,"marks":27974,"value":27975,"nodeType":865},{},[],"New ‘Acknowledge’ mode for app banners",{"data":27977,"content":27978,"nodeType":866},{},[27979,27983,27988],{"data":27980,"marks":27981,"value":27982,"nodeType":865},{},[],"You can now configure app banners to show a larger central message and also ",{"data":27984,"marks":27985,"value":27987,"nodeType":865},{},[27986],{"type":946},"require that an end-user acknowledge the message",{"data":27989,"marks":27990,"value":27991,"nodeType":865},{},[]," before proceeding to use an app, providing stronger in-browser guidance. You may wish to use this mode for GenAI apps or to strongly steer employees away from unapproved file-sharing apps, for example.",{"data":27993,"content":27997,"nodeType":907},{"target":27994},{"sys":27995},{"id":27996,"type":904,"linkType":905},"7chqbwof9wgjdc7642zUbf",[],{"data":27999,"content":28000,"nodeType":866},{},[28001,28004,28012],{"data":28002,"marks":28003,"value":21,"nodeType":865},{},[],{"data":28005,"content":28008,"nodeType":1038},{"target":28006},{"sys":28007},{"id":1802,"type":904,"linkType":905},[28009],{"data":28010,"marks":28011,"value":2777,"nodeType":865},{},[],{"data":28013,"marks":28014,"value":21,"nodeType":865},{},[],"Product release: April 2024","Here’s what’s new on the Push platform for April 2024.","2024-04-17T00:00:00.000Z","product-release-april-2024",{"items":28020},[28021],{"sys":28022,"name":3915},{"id":3914},{"items":28024},[28025],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":28026},{"url":2577},"product-release-july-2024","blog/product-release-july-2024",{"json":28030},{"data":28031,"content":28032,"nodeType":2232},{},[28033],{"data":28034,"content":28035,"nodeType":866},{},[28036],{"data":28037,"marks":28038,"value":28039,"nodeType":865},{},[],"Our latest development sprint focused on providing important context on the unique telemetry provided by the Push platform; expanding core functionality for both security controls and app management; and adding Arc to our list of supported browsers, so you can continue to deploy Push anywhere your employees like to work.","Here’s what’s new on the Push platform for July 2024.",{"id":28042,"publishedAt":28043},"eyUyEsAObqyzg68JradWU","2026-08-12T11:55:10.312Z",{"items":28045},[28046,28048],{"sys":28047,"name":297},{"id":11129},{"sys":28049,"name":3915},{"id":3914},{"items":28051},[28052,28054,28056,28058,28060,28062],{"sys":28053,"name":297,"slug":298,"tier":31},{"id":294},{"sys":28055,"name":342,"slug":343,"tier":31},{"id":339},{"sys":28057,"name":519,"slug":520,"tier":31},{"id":516},{"sys":28059,"name":261,"slug":262,"tier":45},{"id":258},{"sys":28061,"name":589,"slug":590,"tier":45},{"id":586},{"sys":28063,"name":598,"slug":599,"tier":45},{"id":595},"CIjqaxd4J2bs-w01i9bWybma-b1clqGWtm-yeqVqX7w",{"id":28066,"title":28067,"authorsCollection":28068,"content":28073,"extension":228,"faqItemsCollection":29463,"faqTitle":59,"featured":6,"hashTags":59,"meta":29465,"metaTitle":29466,"ogImage":59,"postType":5061,"publishedDate":29467,"relatedBlogPostsCollection":29468,"slug":34033,"stem":34034,"subtitle":59,"summary":34035,"synopsis":34053,"sys":34054,"tagsCollection":34057,"topicsCollection":34063,"__hash__":34109},"blog/blog/5-reasons-why-push-security-shouldnt-exist.json","5 reasons why Push Security shouldn’t exist",{"items":28069},[28070],{"fullName":6027,"firstName":6028,"jobTitle":6029,"socialLinks":28071,"profilePicture":28072},[13796],{"url":6031},{"json":28074,"links":29441},{"data":28075,"content":28076,"nodeType":2232},{},[28077,28097,28103,28110,28117,28138,28145,28148,28155,28162,28169,28176,28264,28271,28362,28370,28377,28384,28392,28395,28402,28409,28416,28445,28478,28507,28514,28521,28551,28558,28590,28597,28625,28632,28639,28666,28678,28685,28704,28735,28747,28750,28757,28777,28789,28807,28822,28829,28847,28877,28896,28903,28910,28928,28935,28943,28946,28953,28960,28998,29006,29013,29020,29027,29113,29137,29144,29151,29163,29183,29195,29198,29205,29212,29275,29293,29299,29302,29309,29338,29345,29352,29430,29435],{"data":28078,"content":28079,"nodeType":866},{},[28080,28084,28093],{"data":28081,"marks":28082,"value":28083,"nodeType":865},{},[],"If you caught ",{"data":28085,"content":28087,"nodeType":1102},{"uri":28086},"https://cisoseries.com/securing-identities-in-the-cloud/",[28088],{"data":28089,"marks":28090,"value":28092,"nodeType":865},{},[28091],{"type":4537},"our CEO Adam’s recent appearance on the Defense in Depth podcast",{"data":28094,"marks":28095,"value":28096,"nodeType":865},{},[]," you’ll have heard some top-tier banter between Geoff and David on the problem of identity security – and how, in Geoff’s words, “way too many people” think they’ve got it covered when it comes to identity attacks.",{"data":28098,"content":28102,"nodeType":907},{"target":28099},{"sys":28100},{"id":28101,"type":904,"linkType":905},"UcfFq2lOiMMJKaDfaNBqx",[],{"data":28104,"content":28105,"nodeType":866},{},[28106],{"data":28107,"marks":28108,"value":28109,"nodeType":865},{},[],"At Push, we’re constantly exploring the limits of controls against the latest threats. But naturally, security teams with hundreds of priorities can’t afford to dedicate the same amount of research time to this problem that we can. This means we come across a lot of common misconceptions about how controls like MFA, SSO and EDR perform against current identity attack techniques. ",{"data":28111,"content":28112,"nodeType":866},{},[28113],{"data":28114,"marks":28115,"value":28116,"nodeType":865},{},[],"These common misconceptions are severely impacting the ability of security teams to plan for, and defend against, identity-based attacks – giving attackers the window of opportunity they need to continue exploiting people and businesses. ",{"data":28118,"content":28119,"nodeType":866},{},[28120,28124,28129,28133],{"data":28121,"marks":28122,"value":28123,"nodeType":865},{},[],"So, we hope that this allows you a clearer perspective when building your identity security strategy, with a realistic view of what a particular control will give you – and what it won’t. ",{"data":28125,"marks":28126,"value":28128,"nodeType":865},{},[28127],{"type":946},"That isn’t to say you should discard any of these controls; they all have an important part to play! ",{"data":28130,"marks":28131,"value":28132,"nodeType":865},{},[],"But, it’s important to be aware of their limitations to be able to build a resilient security model, ",{"data":28134,"marks":28135,"value":28137,"nodeType":865},{},[28136],{"type":946},"with strategic defense in depth to compensate for known weaknesses. ",{"data":28139,"content":28140,"nodeType":866},{},[28141],{"data":28142,"marks":28143,"value":28144,"nodeType":865},{},[],"Without further ado, here are the top reasons why Push Security shouldn’t exist. ",{"data":28146,"content":28147,"nodeType":938},{},[],{"data":28149,"content":28150,"nodeType":948},{},[28151],{"data":28152,"marks":28153,"value":28154,"nodeType":865},{},[],"Reason 1: “Browser-based attacks aren’t a priority”",{"data":28156,"content":28157,"nodeType":866},{},[28158],{"data":28159,"marks":28160,"value":28161,"nodeType":865},{},[],"Particularly in the current economic climate, with many security teams feeling the squeeze, organizations often haven’t budgeted (mentally or financially) for a new kind of threat to factor into their modelling. ",{"data":28163,"content":28164,"nodeType":866},{},[28165],{"data":28166,"marks":28167,"value":28168,"nodeType":865},{},[],"We get it, now isn’t a great time to be tackling a new problem. Getting the budget to do the same as last year is difficult enough, never mind adding something new. ",{"data":28170,"content":28171,"nodeType":866},{},[28172],{"data":28173,"marks":28174,"value":28175,"nodeType":865},{},[],"But, there’s clear evidence that we're facing something a new kind of security problem. Modern attacks are consciously evading the network and endpoint, and are increasingly playing out entirely over the internet in the form of account takeover. ",{"data":28177,"content":28178,"nodeType":891},{},[28179,28200,28221,28243],{"data":28180,"content":28181,"nodeType":880},{},[28182],{"data":28183,"content":28184,"nodeType":866},{},[28185,28189,28196],{"data":28186,"marks":28187,"value":28188,"nodeType":865},{},[],"Stolen creds are the #1 breach vector in 79% of web app attacks (",{"data":28190,"content":28191,"nodeType":1102},{"uri":15408},[28192],{"data":28193,"marks":28194,"value":5844,"nodeType":865},{},[28195],{"type":4537},{"data":28197,"marks":28198,"value":28199,"nodeType":865},{},[],").  ",{"data":28201,"content":28202,"nodeType":880},{},[28203],{"data":28204,"content":28205,"nodeType":866},{},[28206,28210,28218],{"data":28207,"marks":28208,"value":28209,"nodeType":865},{},[],"147,000 token replay attacks in 2023, 111% increase year-over-year (",{"data":28211,"content":28213,"nodeType":1102},{"uri":28212},"https://techcommunity.microsoft.com/t5/microsoft-entra-blog/how-to-break-the-token-theft-cyber-attack-chain/ba-p/4062700",[28214],{"data":28215,"marks":28216,"value":5800,"nodeType":865},{},[28217],{"type":4537},{"data":28219,"marks":28220,"value":14366,"nodeType":865},{},[],{"data":28222,"content":28223,"nodeType":880},{},[28224],{"data":28225,"content":28226,"nodeType":866},{},[28227,28231,28240],{"data":28228,"marks":28229,"value":28230,"nodeType":865},{},[],"80% of attacks involve identity and compromised credentials (",{"data":28232,"content":28234,"nodeType":1102},{"uri":28233},"https://www.crowdstrike.com/blog/relentless-threat-activity-puts-identities-in-the-crosshairs/",[28235],{"data":28236,"marks":28237,"value":28239,"nodeType":865},{},[28238],{"type":4537},"Crowdstrike",{"data":28241,"marks":28242,"value":28199,"nodeType":865},{},[],{"data":28244,"content":28245,"nodeType":880},{},[28246],{"data":28247,"content":28248,"nodeType":866},{},[28249,28253,28261],{"data":28250,"marks":28251,"value":28252,"nodeType":865},{},[],"4,000 password-based attacks per second observed (",{"data":28254,"content":28256,"nodeType":1102},{"uri":28255},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023",[28257],{"data":28258,"marks":28259,"value":5800,"nodeType":865},{},[28260],{"type":4537},{"data":28262,"marks":28263,"value":6459,"nodeType":865},{},[],{"data":28265,"content":28266,"nodeType":866},{},[28267],{"data":28268,"marks":28269,"value":28270,"nodeType":865},{},[],"It’s also telling that the cyber crime ecosystem itself seems to be leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":28272,"content":28273,"nodeType":891},{},[28274,28295,28318,28340],{"data":28275,"content":28276,"nodeType":880},{},[28277],{"data":28278,"content":28279,"nodeType":866},{},[28280,28283,28291],{"data":28281,"marks":28282,"value":21,"nodeType":865},{},[],{"data":28284,"content":28285,"nodeType":1102},{"uri":15408},[28286],{"data":28287,"marks":28288,"value":28290,"nodeType":865},{},[28289],{"type":4537},"According to the 2024 DBIR",{"data":28292,"marks":28293,"value":28294,"nodeType":865},{},[],", more than 1000 credentials appear on criminal forums and marketplaces every day, with the majority (65%) appearing less than a day after first being discovered. ",{"data":28296,"content":28297,"nodeType":880},{},[28298],{"data":28299,"content":28300,"nodeType":866},{},[28301,28305,28314],{"data":28302,"marks":28303,"value":28304,"nodeType":865},{},[],"In June, ",{"data":28306,"content":28308,"nodeType":1102},{"uri":28307},"https://www.troyhunt.com/telegram-combolists-and-361m-email-addresses/",[28309],{"data":28310,"marks":28311,"value":28313,"nodeType":865},{},[28312],{"type":4537},"Troy Hunt at Have I Been Pwned (HIBP) wrote about the impact of channels like Telegram",{"data":28315,"marks":28316,"value":28317,"nodeType":865},{},[]," and the sale of combolists (username, password, login portal URL), after being sent 122GB of data scraped out of thousands of Telegram channels, containing 361M unique email addresses (of which 151M had never been seen in HIBP before). ",{"data":28319,"content":28320,"nodeType":880},{},[28321],{"data":28322,"content":28323,"nodeType":866},{},[28324,28328,28337],{"data":28325,"marks":28326,"value":28327,"nodeType":865},{},[],"In July, ",{"data":28329,"content":28331,"nodeType":1102},{"uri":28330},"https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/",[28332],{"data":28333,"marks":28334,"value":28336,"nodeType":865},{},[28335],{"type":4537},"10 billion passwords were leaked in the RockYou2024 compilation",{"data":28338,"marks":28339,"value":7361,"nodeType":865},{},[],{"data":28341,"content":28342,"nodeType":880},{},[28343],{"data":28344,"content":28345,"nodeType":866},{},[28346,28350,28358],{"data":28347,"marks":28348,"value":28349,"nodeType":865},{},[],"And ultimately, ",{"data":28351,"content":28352,"nodeType":1102},{"uri":24560},[28353],{"data":28354,"marks":28355,"value":28357,"nodeType":865},{},[28356],{"type":4537},"high-profile breaches",{"data":28359,"marks":28360,"value":28361,"nodeType":865},{},[]," of Snowflake customers, Microsoft, Okta, and others reinforce the threat behind the numbers, all of which are the result of identity attacks. ",{"data":28363,"content":28364,"nodeType":866},{},[28365],{"data":28366,"marks":28367,"value":28369,"nodeType":865},{},[28368],{"type":946},"So, if a business uses any third-party provided web applications or services, then its workforce identities are the lowest-hanging fruit for attackers to pick, and the risk of account takeover should be high up on the risk register. ",{"data":28371,"content":28372,"nodeType":866},{},[28373],{"data":28374,"marks":28375,"value":28376,"nodeType":865},{},[],"Yes, it’s tough to redo budgets on the fly or rip up a five year plan. But, asymmetrical cyber TTPs have always sought to undermine the best laid plans of CISOs – attackers usually look in the places that defenders aren't. ",{"data":28378,"content":28379,"nodeType":866},{},[28380],{"data":28381,"marks":28382,"value":28383,"nodeType":865},{},[],"When looking at the evidence, is securing the identity attack surface really a lower priority than adding a CASB, CSPM, or shiny new AI tool? Even when we look at historical recurring spend on things like EDR or vulnerability management, it’s arguable that the risk of identity attacks has overtaken software-based exploits for many organizations whose traditional networks are shrinking, while their cloud app estate grows. ",{"data":28385,"content":28386,"nodeType":866},{},[28387],{"data":28388,"marks":28389,"value":28391,"nodeType":865},{},[28390],{"type":946},"It’s important to consider what’s right for your business, but the evidence shows us that securing the identity attack surface promises real risk reduction in the face of a genuine threat. ",{"data":28393,"content":28394,"nodeType":938},{},[],{"data":28396,"content":28397,"nodeType":948},{},[28398],{"data":28399,"marks":28400,"value":28401,"nodeType":865},{},[],"Reason 2: “Our business apps are all behind SSO”",{"data":28403,"content":28404,"nodeType":866},{},[28405],{"data":28406,"marks":28407,"value":28408,"nodeType":865},{},[],"SSO is often seen as a utopia where each employee has a single, secure digital identity that is used to access all of their work applications. When businesses are using SSO, we usually hear:",{"data":28410,"content":28411,"nodeType":1218},{},[28412],{"data":28413,"marks":28414,"value":28415,"nodeType":865},{},[],"“Everything is behind SSO, there are no apps outside of it.”",{"data":28417,"content":28418,"nodeType":866},{},[28419,28423,28432,28436,28441],{"data":28420,"marks":28421,"value":28422,"nodeType":865},{},[],"Unfortunately, organizations are always using more apps than they realize. The impact of ",{"data":28424,"content":28426,"nodeType":1102},{"uri":28425},"https://productled.com/blog/product-led-growth-definition",[28427],{"data":28428,"marks":28429,"value":28431,"nodeType":865},{},[28430],{"type":4537},"product-led growth",{"data":28433,"marks":28434,"value":28435,"nodeType":865},{},[]," on the self adoption of cloud services is well documented, and we see that ",{"data":28437,"marks":28438,"value":28440,"nodeType":865},{},[28439],{"type":946},"even SMEs typically have 100+ apps in their estate",{"data":28442,"marks":28443,"value":28444,"nodeType":865},{},[],", and the number of apps per business continues to grow year on year. ",{"data":28446,"content":28447,"nodeType":866},{},[28448,28452,28457,28461,28465,28469,28474],{"data":28449,"marks":28450,"value":28451,"nodeType":865},{},[],"So, while every ",{"data":28453,"marks":28454,"value":28456,"nodeType":865},{},[28455],{"type":946},"known ",{"data":28458,"marks":28459,"value":28460,"nodeType":865},{},[],"app",{"data":28462,"marks":28463,"value":6192,"nodeType":865},{},[28464],{"type":946},{"data":28466,"marks":28467,"value":28468,"nodeType":865},{},[],"might be behind SSO, this still leaves tens or hundreds of ",{"data":28470,"marks":28471,"value":28473,"nodeType":865},{},[28472],{"type":946},"unknown",{"data":28475,"marks":28476,"value":28477,"nodeType":865},{},[]," apps, with thousands of associated identities. ",{"data":28479,"content":28480,"nodeType":866},{},[28481,28485,28490,28494,28503],{"data":28482,"marks":28483,"value":28484,"nodeType":865},{},[],"But even if you did know about every app, the fact of the matter is ",{"data":28486,"marks":28487,"value":28489,"nodeType":865},{},[28488],{"type":946},"that fewer than 1 in 3 apps actually support SAML SSO",{"data":28491,"marks":28492,"value":28493,"nodeType":865},{},[],", and many of those ",{"data":28495,"content":28497,"nodeType":1102},{"uri":28496},"https://sso.tax/",[28498],{"data":28499,"marks":28500,"value":28502,"nodeType":865},{},[28501],{"type":4537},"only at the premium tier",{"data":28504,"marks":28505,"value":28506,"nodeType":865},{},[],". Our data shows that the proportion of apps actually behind SSO is even lower, at 1 in 5. So getting everything behind SSO just isn’t a realistic goal for any organization. ",{"data":28508,"content":28509,"nodeType":1218},{},[28510],{"data":28511,"marks":28512,"value":28513,"nodeType":865},{},[],"“Everything important is behind SSO, and the apps that aren’t don’t pose a risk.” ",{"data":28515,"content":28516,"nodeType":866},{},[28517],{"data":28518,"marks":28519,"value":28520,"nodeType":865},{},[],"There’s often a view that if it wasn’t centrally procured, IT wasn’t involved, and it’s not behind SSO, then it’s just not a concern. But apps can have complex integrations and permissions that increase the potential blast radius of an app compromise. ",{"data":28522,"content":28523,"nodeType":866},{},[28524,28528,28536,28540,28547],{"data":28525,"marks":28526,"value":28527,"nodeType":865},{},[],"We’ve published ",{"data":28529,"content":28530,"nodeType":1102},{"uri":22038},[28531],{"data":28532,"marks":28533,"value":28535,"nodeType":865},{},[28534],{"type":4537},"extensive research on SaaS-native attack techniques",{"data":28537,"marks":28538,"value":28539,"nodeType":865},{},[]," and documented many of the scenarios in which attackers can expand from hijacking a single SaaS app with a small number of users into a larger-scale compromise, for example through ",{"data":28541,"content":28542,"nodeType":1102},{"uri":14098},[28543],{"data":28544,"marks":28545,"value":14104,"nodeType":865},{},[28546],{"type":4537},{"data":28548,"marks":28549,"value":28550,"nodeType":865},{},[],": Modifying SAML for a compromised app to redirect users to a malicious domain during the authentication process that proxies a legitimate authentication service (e.g. Google, Okta or Microsoft) – effectively acting as a watering hole for further credential harvesting. ",{"data":28552,"content":28553,"nodeType":866},{},[28554],{"data":28555,"marks":28556,"value":28557,"nodeType":865},{},[],"Also, the value of an app is not necessarily tied to the number of users it has in the business. A sales and marketing app can contain huge amounts of sensitive data, as can developer apps – just look at Snowflake! It only takes a single account to be created, a single integration to be set up, to result in a major data breach down the line. ",{"data":28559,"content":28560,"nodeType":866},{},[28561,28565,28574,28577,28586],{"data":28562,"marks":28563,"value":28564,"nodeType":865},{},[],"You can check out our ",{"data":28566,"content":28568,"nodeType":1102},{"uri":28567},"https://pushsecurity.com/blog/",[28569],{"data":28570,"marks":28571,"value":28573,"nodeType":865},{},[28572],{"type":4537},"blog page",{"data":28575,"marks":28576,"value":1773,"nodeType":865},{},[],{"data":28578,"content":28580,"nodeType":1102},{"uri":28579},"https://www.youtube.com/watch?v=xZIQd_0v9sE&t=12s",[28581],{"data":28582,"marks":28583,"value":28585,"nodeType":865},{},[28584],{"type":4537},"watch one of our videos",{"data":28587,"marks":28588,"value":28589,"nodeType":865},{},[]," for more information.   ",{"data":28591,"content":28592,"nodeType":1218},{},[28593],{"data":28594,"marks":28595,"value":28596,"nodeType":865},{},[],"Ghost logins: A nightmare for SSO, dreamy for attackers",{"data":28598,"content":28599,"nodeType":866},{},[28600,28604,28609,28613,28621],{"data":28601,"marks":28602,"value":28603,"nodeType":865},{},[],"You might already be feeling a bit deflated that SSO isn’t going to give you everything you wanted, and we’re sorry to be the bearer of bad news. Unfortunately, ",{"data":28605,"marks":28606,"value":28608,"nodeType":865},{},[28607],{"type":946},"even if you are using SSO, additional login methods can still exist alongside SSO",{"data":28610,"marks":28611,"value":28612,"nodeType":865},{},[],". We call these ",{"data":28614,"content":28615,"nodeType":1102},{"uri":5377},[28616],{"data":28617,"marks":28618,"value":5383,"nodeType":865},{},[28619,28620],{"type":4537},{"type":946},{"data":28622,"marks":28623,"value":7361,"nodeType":865},{},[28624],{"type":946},{"data":28626,"content":28627,"nodeType":866},{},[28628],{"data":28629,"marks":28630,"value":28631,"nodeType":865},{},[],"Ghost logins are effectively any alternative login method. In addition to SSO, you could have a local password, a social login (e.g., login with Google, Facebook, etc.), backup emails, or API-based login methods. ",{"data":28633,"content":28634,"nodeType":866},{},[28635],{"data":28636,"marks":28637,"value":28638,"nodeType":865},{},[],"Multiple methods are often enabled by default and need to be explicitly disabled at the app level. Further, migrating an existing app to SSO doesn’t automatically remove local accounts, but effectively adds an SSO layer on top. ",{"data":28640,"content":28641,"nodeType":866},{},[28642,28646,28651,28655,28663],{"data":28643,"marks":28644,"value":28645,"nodeType":865},{},[],"The final problem here is that because MFA is applied separately at the app level and SSO level, ",{"data":28647,"marks":28648,"value":28650,"nodeType":865},{},[28649],{"type":946},"you can have local logins without MFA, at the same time as SSO logins with MFA — that can be used concurrently.",{"data":28652,"marks":28653,"value":28654,"nodeType":865},{},[]," This was acutely felt during the recent Snowflake breaches, ",{"data":28656,"content":28657,"nodeType":1102},{"uri":26032},[28658],{"data":28659,"marks":28660,"value":28662,"nodeType":865},{},[28661],{"type":4537},"where in-app identification and disabling of non-SSO logins proved to be particularly error-prone",{"data":28664,"marks":28665,"value":6360,"nodeType":865},{},[],{"data":28667,"content":28668,"nodeType":866},{},[28669,28673],{"data":28670,"marks":28671,"value":28672,"nodeType":865},{},[],"The result here is that credential stuffing attacks can still prove successful against your SSO-joined apps if local logins exist, and MFA hasn’t been specifically set at the app level. ",{"data":28674,"marks":28675,"value":28677,"nodeType":865},{},[28676],{"type":946},"And unless you’ve specifically disabled them and unset every non-SSO login for every app, they probably do. ",{"data":28679,"content":28680,"nodeType":1218},{},[28681],{"data":28682,"marks":28683,"value":28684,"nodeType":865},{},[],"The verdict: SSO is great, but it's no silver bullet",{"data":28686,"content":28687,"nodeType":866},{},[28688,28692,28700],{"data":28689,"marks":28690,"value":28691,"nodeType":865},{},[],"While SSO is invariably a beneficial security control, ",{"data":28693,"content":28695,"nodeType":1102},{"uri":28694},"https://pushsecurity.com/blog/ghost-logins-when-forgotten-identities-come-back-to-haunt-you/#id-how-can-ghost-logins-be-abused-by-attackers_id-ghost-logins-for-persistence-and-defense-evasion",[28696],{"data":28697,"marks":28698,"value":28699,"nodeType":865},{},[],"attackers can also naturally exploit it to gain access to a large number of downstream applications",{"data":28701,"marks":28702,"value":28703,"nodeType":865},{},[],". If you compromise an IdP account like Okta, you can then access any connected app, often without requiring any further authentication.",{"data":28705,"content":28706,"nodeType":866},{},[28707,28711,28719,28723,28732],{"data":28708,"marks":28709,"value":28710,"nodeType":865},{},[],"We’ve seen this recently, with an ",{"data":28712,"content":28713,"nodeType":1102},{"uri":17417},[28714],{"data":28715,"marks":28716,"value":28718,"nodeType":865},{},[28717],{"type":4537},"unprecedented spike in credential stuffing attacks reported by Okta",{"data":28720,"marks":28721,"value":28722,"nodeType":865},{},[],", as well as ",{"data":28724,"content":28726,"nodeType":1102},{"uri":28725},"https://www.bleepingcomputer.com/news/security/okta-warns-of-credential-stuffing-attacks-targeting-its-cors-feature/",[28727],{"data":28728,"marks":28729,"value":28731,"nodeType":865},{},[28730],{"type":4537},"attacks looking to exploit Okta’s CORS feature",{"data":28733,"marks":28734,"value":7361,"nodeType":865},{},[],{"data":28736,"content":28737,"nodeType":866},{},[28738,28743],{"data":28739,"marks":28740,"value":28742,"nodeType":865},{},[28741],{"type":946},"Ultimately, the promised land of a 1:1 employee to identity ratio just isn’t realistic. ",{"data":28744,"marks":28745,"value":28746,"nodeType":865},{},[],"So while SSO is a big part of the solution to identity attacks, it’s not a silver bullet.   ",{"data":28748,"content":28749,"nodeType":938},{},[],{"data":28751,"content":28752,"nodeType":948},{},[28753],{"data":28754,"marks":28755,"value":28756,"nodeType":865},{},[],"Reason 3: “We’ve got MFA deployed everywhere”",{"data":28758,"content":28759,"nodeType":866},{},[28760,28764,28773],{"data":28761,"marks":28762,"value":28763,"nodeType":865},{},[],"Microsoft famously stated that ",{"data":28765,"content":28767,"nodeType":1102},{"uri":28766},"https://www.microsoft.com/en-us/security/security-insider/microsoft-digital-defense-report-2023#:~:text=Outlier%20attacks%20make%20up%20just,of%20compromise%20by%2099.2%20percent.",[28768],{"data":28769,"marks":28770,"value":28772,"nodeType":865},{},[28771],{"type":4537},"MFA reduces the risk of compromise by 99.2%",{"data":28774,"marks":28775,"value":28776,"nodeType":865},{},[],". But this doesn’t mean that it stops 99% of attacks. Or, that it should make up 99% of your defense. ",{"data":28778,"content":28779,"nodeType":866},{},[28780,28784],{"data":28781,"marks":28782,"value":28783,"nodeType":865},{},[],"MFA unarguably raises the bar for attackers, even if that bar is still pretty low. Naturally, accounts without MFA are an easier target. ",{"data":28785,"marks":28786,"value":28788,"nodeType":865},{},[28787],{"type":946},"But the problem is that MFA isn’t an enterprise-wide castle wall. It’s more like a row of hurdles with gaps in-between. ",{"data":28790,"content":28791,"nodeType":866},{},[28792,28796,28804],{"data":28793,"marks":28794,"value":28795,"nodeType":865},{},[],"MFA is usually handled separately at the SSO level and app level. For apps that are self-adopted by end users, they can't be relied on to add in a security control that will introduce friction to their user experience. Building on the aforementioned ghost logins, even if MFA is adopted at the SSO level, local logins can exist without MFA unless also applied at the app level. ",{"data":28797,"content":28798,"nodeType":1102},{"uri":26032},[28799],{"data":28800,"marks":28801,"value":28803,"nodeType":865},{},[28802],{"type":4537},"The recent Snowflake breach is a perfect example of this problem",{"data":28805,"marks":28806,"value":7361,"nodeType":865},{},[],{"data":28808,"content":28809,"nodeType":866},{},[28810,28814,28819],{"data":28811,"marks":28812,"value":28813,"nodeType":865},{},[],"Because of this, ",{"data":28815,"marks":28816,"value":28818,"nodeType":865},{},[28817],{"type":946},"we find that only around 1 in 3 identities actually have MFA enabled",{"data":28820,"marks":28821,"value":7361,"nodeType":865},{},[],{"data":28823,"content":28824,"nodeType":1218},{},[28825],{"data":28826,"marks":28827,"value":28828,"nodeType":865},{},[],"\"MFA protects us against phishing attacks\"",{"data":28830,"content":28831,"nodeType":866},{},[28832,28836,28843],{"data":28833,"marks":28834,"value":28835,"nodeType":865},{},[],"Even where MFA is deployed, most MFA methods are proven to be phishable or otherwise bypassable. SMS and push-based MFA are susceptible to well known bypasses including SIM swapping and ",{"data":28837,"content":28838,"nodeType":1102},{"uri":5321},[28839],{"data":28840,"marks":28841,"value":5326,"nodeType":865},{},[28842],{"type":4537},{"data":28844,"marks":28845,"value":28846,"nodeType":865},{},[]," attacks. TOTP is a little better, but still vulnerable. ",{"data":28848,"content":28849,"nodeType":866},{},[28850,28854,28862,28866,28874],{"data":28851,"marks":28852,"value":28853,"nodeType":865},{},[],"Many attacks are simply cutting out the middleman and focusing on ",{"data":28855,"content":28856,"nodeType":1102},{"uri":14271},[28857],{"data":28858,"marks":28859,"value":28861,"nodeType":865},{},[28860],{"type":4537},"using stolen session tokens",{"data":28863,"marks":28864,"value":28865,"nodeType":865},{},[]," to bypass MFA. The most common method for this is via infostealers, which typically scrape all credentials (e.g. usernames, passwords, login pages, session tokens) as well as other information stored in the browser of an infected device. ",{"data":28867,"content":28868,"nodeType":1102},{"uri":19285},[28869],{"data":28870,"marks":28871,"value":28873,"nodeType":865},{},[28872],{"type":4537},"Infostealers played a major role in the recent Snowflake breach",{"data":28875,"marks":28876,"value":7361,"nodeType":865},{},[],{"data":28878,"content":28879,"nodeType":866},{},[28880,28884,28892],{"data":28881,"marks":28882,"value":28883,"nodeType":865},{},[],"Additionally, ",{"data":28885,"content":28886,"nodeType":1102},{"uri":15218},[28887],{"data":28888,"marks":28889,"value":28891,"nodeType":865},{},[28890],{"type":4537},"modern phishing techniques like adversary-in-the-middle (AitM) and browser-in-the-middle (BitM)",{"data":28893,"marks":28894,"value":28895,"nodeType":865},{},[]," see the attacker steal the live session and associated tokens from the victim, with the victim prompted to complete the MFA process as part of the attack. ",{"data":28897,"content":28898,"nodeType":1218},{},[28899],{"data":28900,"marks":28901,"value":28902,"nodeType":865},{},[],"“We’re using passkeys”",{"data":28904,"content":28905,"nodeType":866},{},[28906],{"data":28907,"marks":28908,"value":28909,"nodeType":865},{},[],"Great! Passkey users are in a better position than 99% of other businesses. Passkeys are widely accepted to be phishing resistant – at least for now, although as more businesses use them, new ways of getting around them will no doubt be discovered by attackers. ",{"data":28911,"content":28912,"nodeType":866},{},[28913,28917,28925],{"data":28914,"marks":28915,"value":28916,"nodeType":865},{},[],"But, MFA downgrade attacks are possible. There are often backup MFA methods set that can be selected by canceling the authentication prompt and selecting a different method. Even when these aren’t selectable, ",{"data":28918,"content":28919,"nodeType":1102},{"uri":6350},[28920],{"data":28921,"marks":28922,"value":28924,"nodeType":865},{},[28923],{"type":4537},"researchers have demonstrated ways of downgrading authentication to use a phishable method",{"data":28926,"marks":28927,"value":7361,"nodeType":865},{},[],{"data":28929,"content":28930,"nodeType":866},{},[28931],{"data":28932,"marks":28933,"value":28934,"nodeType":865},{},[],"Most apps are designed primarily for user flexibility, not security. And backup methods have a legitimate use-case – what if the authenticator device is lost or stops working? If passkeys are the only authentication method, you just got locked out of all of your accounts. But at least no hackers can access them either, right?",{"data":28936,"content":28937,"nodeType":866},{},[28938],{"data":28939,"marks":28940,"value":28942,"nodeType":865},{},[28941],{"type":946},"Like SSO, unless backup MFA methods are disabled for all identities and apps, and all users have enabled MFA across all their accounts and login methods, this isn’t a silver bullet either.  ",{"data":28944,"content":28945,"nodeType":938},{},[],{"data":28947,"content":28948,"nodeType":948},{},[28949],{"data":28950,"marks":28951,"value":28952,"nodeType":865},{},[],"Reason 4: “We’ve got anti-phishing controls already”",{"data":28954,"content":28955,"nodeType":866},{},[28956],{"data":28957,"marks":28958,"value":28959,"nodeType":865},{},[],"Identity attacks have evolved significantly in recent years, as have the environments being targeted by attackers with the shift to cloud services and decentralized business IT. Unfortunately, traditional anti-phishing controls weren’t designed for this reality. ",{"data":28961,"content":28962,"nodeType":891},{},[28963,28983],{"data":28964,"content":28965,"nodeType":880},{},[28966],{"data":28967,"content":28968,"nodeType":866},{},[28969,28974,28979],{"data":28970,"marks":28971,"value":28973,"nodeType":865},{},[28972],{"type":946},"A",{"data":28975,"marks":28976,"value":28978,"nodeType":865},{},[28977],{"type":946},"ttacks used to be focused on a single VPN/webmail endpoint ",{"data":28980,"marks":28981,"value":28982,"nodeType":865},{},[],"that was naturally easier to protect than 100+ SaaS apps (especially if the security team isn’t even aware of them). Attackers now have 1000s of sprawled identities to target per enterprise, increasing the chance that weak or reused passwords will be found. ",{"data":28984,"content":28985,"nodeType":880},{},[28986],{"data":28987,"content":28988,"nodeType":866},{},[28989,28994],{"data":28990,"marks":28991,"value":28993,"nodeType":865},{},[28992],{"type":946},"Likewise, security teams only needed to care about a small set of credentials ",{"data":28995,"marks":28996,"value":28997,"nodeType":865},{},[],"relating to user directory accounts and VPN/remote access tooling used to tunnel into the corporate network. Now, business functions and data are dispersed across cloud apps rather than being neatly contained in on-prem apps and databases.",{"data":28999,"content":29000,"nodeType":866},{},[29001],{"data":29002,"marks":29003,"value":29005,"nodeType":865},{},[29004],{"type":946},"Now, attackers have more platforms on which to phish your users, more credentials to choose from, and more apps to spray them across, while security teams have a much larger surface to defend.",{"data":29007,"content":29008,"nodeType":1218},{},[29009],{"data":29010,"marks":29011,"value":29012,"nodeType":865},{},[],"“Our email and content filtering controls stop phishing attacks”",{"data":29014,"content":29015,"nodeType":866},{},[29016],{"data":29017,"marks":29018,"value":29019,"nodeType":865},{},[],"Existing phishing prevention solutions have tried to solve the problem by protecting the inbox, a common (but not the only) attack vector, or by blocking lists of known-bad domains. ",{"data":29021,"content":29022,"nodeType":866},{},[29023],{"data":29024,"marks":29025,"value":29026,"nodeType":865},{},[],"But, these approaches have major shortcomings:",{"data":29028,"content":29029,"nodeType":891},{},[29030,29070,29085],{"data":29031,"content":29032,"nodeType":880},{},[29033],{"data":29034,"content":29035,"nodeType":866},{},[29036,29041,29045,29054,29057,29066],{"data":29037,"marks":29038,"value":29040,"nodeType":865},{},[29039],{"type":946},"Incomplete coverage: ",{"data":29042,"marks":29043,"value":29044,"nodeType":865},{},[],"Email-based phishing prevention tools can catch general spray-and-pray email phishing campaigns, but it only takes a small amount of tailoring to fly under their radar. The use of LLM tools to tailor phishing emails for their intended victims already makes this possible at scale. Email-based tools also fail to cover phishing attacks beyond the inbox, such as ",{"data":29046,"content":29048,"nodeType":1102},{"uri":29047},"https://pushsecurity.com/blog/slack-phishing-for-initial-access/",[29049],{"data":29050,"marks":29051,"value":29053,"nodeType":865},{},[29052],{"type":4537},"Slack",{"data":29055,"marks":29056,"value":1913,"nodeType":865},{},[],{"data":29058,"content":29060,"nodeType":1102},{"uri":29059},"https://pushsecurity.com/blog/phishing-microsoft-teams-for-initial-access/",[29061],{"data":29062,"marks":29063,"value":29065,"nodeType":865},{},[29064],{"type":4537},"Teams",{"data":29067,"marks":29068,"value":29069,"nodeType":865},{},[]," phishing.",{"data":29071,"content":29072,"nodeType":880},{},[29073],{"data":29074,"content":29075,"nodeType":866},{},[29076,29081],{"data":29077,"marks":29078,"value":29080,"nodeType":865},{},[29079],{"type":946},"Expired intel: ",{"data":29082,"marks":29083,"value":29084,"nodeType":865},{},[],"Tools that rely on known-bad domains always have an incomplete picture because a domain must be reported as malicious in order to get added to a blocklist. Meanwhile, attackers can spin up new sites or host phishing pages on existing sites by exploiting vulnerabilities in them, bypassing rules around preventing visits to newly registered domains. It’s like trying to hit a moving target.",{"data":29086,"content":29087,"nodeType":880},{},[29088],{"data":29089,"content":29090,"nodeType":866},{},[29091,29096,29100,29109],{"data":29092,"marks":29093,"value":29095,"nodeType":865},{},[29094],{"type":946},"Web-based obfuscation: ",{"data":29097,"marks":29098,"value":29099,"nodeType":865},{},[],"Attacker tools and malicious implants running on webpages are constantly evolving to evade fingerprinting, and attackers are using techniques like ",{"data":29101,"content":29103,"nodeType":1102},{"uri":29102},"https://www.cyfirma.com/research/html-smuggling-a-stealthier-approach-to-deliver-malware/",[29104],{"data":29105,"marks":29106,"value":29108,"nodeType":865},{},[29107],{"type":4537},"HTML smuggling",{"data":29110,"marks":29111,"value":29112,"nodeType":865},{},[]," to get around web-based controls put in place by developers. ",{"data":29114,"content":29115,"nodeType":866},{},[29116,29120,29125,29129,29134],{"data":29117,"marks":29118,"value":29119,"nodeType":865},{},[],"Even if these controls are sometimes successful, attackers have reliably demonstrated ways to get around them, ",{"data":29121,"marks":29122,"value":29124,"nodeType":865},{},[29123],{"type":946},"it really is a cat-and-mouse game at this point",{"data":29126,"marks":29127,"value":29128,"nodeType":865},{},[],". There usually needs to be a compromise before the attacker's infrastructure or tooling can be tagged and blocked, but ",{"data":29130,"marks":29131,"value":29133,"nodeType":865},{},[29132],{"type":946},"they evolve so rapidly that defenders are always one step behind",{"data":29135,"marks":29136,"value":7361,"nodeType":865},{},[],{"data":29138,"content":29139,"nodeType":1218},{},[29140],{"data":29141,"marks":29142,"value":29143,"nodeType":865},{},[],"“All our employees use a password manager”",{"data":29145,"content":29146,"nodeType":866},{},[29147],{"data":29148,"marks":29149,"value":29150,"nodeType":865},{},[],"Password managers are increasingly necessary due to the large number of credentials that users now have to juggle. Since the majority of apps don’t support SAML SSO, the need for separate credentials per app isn’t going away any time soon. ",{"data":29152,"content":29153,"nodeType":866},{},[29154,29158],{"data":29155,"marks":29156,"value":29157,"nodeType":865},{},[],"We often find 2 or more password managers in use per organization (not exactly optimal), but despite increased password manager adoption we see consistently high levels of password reuse, ",{"data":29159,"marks":29160,"value":29162,"nodeType":865},{},[29161],{"type":946},"with 1 in 3 users reusing passwords – including their sensitive IdP credentials. ",{"data":29164,"content":29165,"nodeType":866},{},[29166,29170,29179],{"data":29167,"marks":29168,"value":29169,"nodeType":865},{},[],"High levels of password reuse shows us that password managers don’t automatically result in secure employee behaviors, while widespread credential reuse significantly increases exposure to ",{"data":29171,"content":29173,"nodeType":1102},{"uri":29172},"https://pushsecurity.com/blog/what-is-credential-stuffing/",[29174],{"data":29175,"marks":29176,"value":29178,"nodeType":865},{},[29177],{"type":4537},"credential stuffing attacks",{"data":29180,"marks":29181,"value":29182,"nodeType":865},{},[]," where attackers spray known username and password combinations across a range of app login pages.  ",{"data":29184,"content":29185,"nodeType":866},{},[29186,29191],{"data":29187,"marks":29188,"value":29190,"nodeType":865},{},[29189],{"type":946},"Generally, businesses have very limited visibility into employee password data",{"data":29192,"marks":29193,"value":29194,"nodeType":865},{},[]," to be able to enforce good practice or accurately respond to data breaches involving credential dumps, even if employees are using a password manager (or several, as the case may be).  ",{"data":29196,"content":29197,"nodeType":938},{},[],{"data":29199,"content":29200,"nodeType":948},{},[29201],{"data":29202,"marks":29203,"value":29204,"nodeType":865},{},[],"Reason 5: “We’ve got all the security data we need”",{"data":29206,"content":29207,"nodeType":866},{},[29208],{"data":29209,"marks":29210,"value":29211,"nodeType":865},{},[],"Organizations looking to protect themselves from modern identity attacks suffer from a pretty substantial telemetry gap. ",{"data":29213,"content":29214,"nodeType":891},{},[29215,29230,29245,29260],{"data":29216,"content":29217,"nodeType":880},{},[29218],{"data":29219,"content":29220,"nodeType":866},{},[29221,29226],{"data":29222,"marks":29223,"value":29225,"nodeType":865},{},[29224],{"type":946},"Endpoint logs ",{"data":29227,"marks":29228,"value":29229,"nodeType":865},{},[],"won’t show anything meaningful because most identity attacks don’t need to target the endpoint – no malware is deployed, everything happens in the browser, over the internet. ",{"data":29231,"content":29232,"nodeType":880},{},[29233],{"data":29234,"content":29235,"nodeType":866},{},[29236,29241],{"data":29237,"marks":29238,"value":29240,"nodeType":865},{},[29239],{"type":946},"Application logs",{"data":29242,"marks":29243,"value":29244,"nodeType":865},{},[]," are limited in availability, scope, and ease of ingestion, with most app vendors providing substandard logging, and requiring complex custom integrations to get what little data is available. ",{"data":29246,"content":29247,"nodeType":880},{},[29248],{"data":29249,"content":29250,"nodeType":866},{},[29251,29256],{"data":29252,"marks":29253,"value":29255,"nodeType":865},{},[29254],{"type":946},"Network logs",{"data":29257,"marks":29258,"value":29259,"nodeType":865},{},[]," (such as via web proxy) struggle to gather and piece together identity data points at-scale, across different apps, due to the sheer volume and broken format of the data post-TLS-termination. ",{"data":29261,"content":29262,"nodeType":880},{},[29263],{"data":29264,"content":29265,"nodeType":866},{},[29266,29271],{"data":29267,"marks":29268,"value":29270,"nodeType":865},{},[29269],{"type":946},"Identity provider logs",{"data":29272,"marks":29273,"value":29274,"nodeType":865},{},[]," naturally only cover SSO integrated apps (and therefore don’t cover ⅔ of your business apps) and look exclusively at authentication, and so are blind to client side attacks like phishing. ",{"data":29276,"content":29277,"nodeType":866},{},[29278,29282,29290],{"data":29279,"marks":29280,"value":29281,"nodeType":865},{},[],"Unless you’re ingesting data from a browser-based solution like Push, it’s unlikely you have a full monitoring visibility of your identity attack surface. ",{"data":29283,"content":29284,"nodeType":1102},{"uri":7446},[29285],{"data":29286,"marks":29287,"value":29289,"nodeType":865},{},[29288],{"type":4537},"Read more on the value of browser telemetry here. ",{"data":29291,"marks":29292,"value":21,"nodeType":865},{},[],{"data":29294,"content":29298,"nodeType":907},{"target":29295},{"sys":29296},{"id":29297,"type":904,"linkType":905},"5jPCGPO1tnIkoI7MKW4oUi",[],{"data":29300,"content":29301,"nodeType":938},{},[],{"data":29303,"content":29304,"nodeType":948},{},[29305],{"data":29306,"marks":29307,"value":29308,"nodeType":865},{},[],"Maybe there’s a reason for Push to exist after all!",{"data":29310,"content":29311,"nodeType":866},{},[29312,29317,29321,29326,29329,29334],{"data":29313,"marks":29314,"value":29316,"nodeType":865},{},[29315],{"type":946},"The key takeaway here is that there are no quick fixes or silver bullets. ",{"data":29318,"marks":29319,"value":29320,"nodeType":865},{},[],"Things like SSO, MFA, and password managers are all part of the solution, ",{"data":29322,"marks":29323,"value":29325,"nodeType":865},{},[29324],{"type":946},"but",{"data":29327,"marks":29328,"value":6192,"nodeType":865},{},[],{"data":29330,"marks":29331,"value":29333,"nodeType":865},{},[29332],{"type":946},"aren’t set-and-forget controls",{"data":29335,"marks":29336,"value":29337,"nodeType":865},{},[],". They need to be continually monitored and maintained to ensure they remain effective.",{"data":29339,"content":29340,"nodeType":866},{},[29341],{"data":29342,"marks":29343,"value":29344,"nodeType":865},{},[],"Push stops identity attacks by continually finding and fixing identity vulnerabilities, providing deep context to manage the identity attack surface without looking through blinkers at the IdP or individual apps. ",{"data":29346,"content":29347,"nodeType":866},{},[29348],{"data":29349,"marks":29350,"value":29351,"nodeType":865},{},[],"Push helps businesses to get the most out of their identity controls (and bridge the gaps they leave) by:",{"data":29353,"content":29354,"nodeType":891},{},[29355,29370,29385,29400,29415],{"data":29356,"content":29357,"nodeType":880},{},[29358],{"data":29359,"content":29360,"nodeType":866},{},[29361,29366],{"data":29362,"marks":29363,"value":29365,"nodeType":865},{},[29364],{"type":946},"Locating all business apps",{"data":29367,"marks":29368,"value":29369,"nodeType":865},{},[],", not just those plugged into your IdP, so they can be put behind SSO (where possible) or at least securely managed and configured.",{"data":29371,"content":29372,"nodeType":880},{},[29373],{"data":29374,"content":29375,"nodeType":866},{},[29376,29381],{"data":29377,"marks":29378,"value":29380,"nodeType":865},{},[29379],{"type":946},"Identifying all workforce identities, associated login types, and MFA methods",{"data":29382,"marks":29383,"value":29384,"nodeType":865},{},[]," to more clearly pinpoint gaps, harden identities, and remediate vulnerabilities like ghost logins.",{"data":29386,"content":29387,"nodeType":880},{},[29388],{"data":29389,"content":29390,"nodeType":866},{},[29391,29396],{"data":29392,"marks":29393,"value":29395,"nodeType":865},{},[29394],{"type":946},"Stopping account takeover attempts",{"data":29397,"marks":29398,"value":29399,"nodeType":865},{},[]," by detecting and blocking AitM and BitM phishing toolkits running on webpages, blocking sensitive credential reuse to prevent credential phishing, and identifying stolen sessions running in attacker browsers. ",{"data":29401,"content":29402,"nodeType":880},{},[29403],{"data":29404,"content":29405,"nodeType":866},{},[29406,29411],{"data":29407,"marks":29408,"value":29410,"nodeType":865},{},[29409],{"type":946},"Preventing password-based attacks",{"data":29412,"marks":29413,"value":29414,"nodeType":865},{},[]," by detecting the use of weak, reused, and breached passwords across the app estate.  ",{"data":29416,"content":29417,"nodeType":880},{},[29418],{"data":29419,"content":29420,"nodeType":866},{},[29421,29426],{"data":29422,"marks":29423,"value":29425,"nodeType":865},{},[29424],{"type":946},"Providing unique telemetry in the browser",{"data":29427,"marks":29428,"value":29429,"nodeType":865},{},[]," to build both proactive and reactive security operations workflows, or add missing context to other data sources, such as IdP, application, or endpoint logs.",{"data":29431,"content":29434,"nodeType":907},{"target":29432},{"sys":29433},{"id":17710,"type":904,"linkType":905},[],{"data":29436,"content":29437,"nodeType":866},{},[29438],{"data":29439,"marks":29440,"value":21,"nodeType":865},{},[],{"entries":29442},{"hyperlink":29443,"inline":29444,"block":29445},[],[],[29446,29453,29461],{"sys":29447,"__typename":2366,"title":29448,"caption":29449,"layoutMode":59,"file":29450},{"id":28101},"Nobody has any identity problems, right?","Push Security’s cheekiest advisor, Geoff Belknap.",{"url":29451,"width":29452,"height":29452},"https://images.ctfassets.net/y1cdw1ablpvd/28qcLq225o8kusjQQQUnCC/98b10fe4f9e6916eb7657f60ab869062/Geoff_Ad__1_.png",1210,{"sys":29454,"__typename":2366,"title":29455,"caption":29456,"layoutMode":59,"file":29457},{"id":29297},"Telemetry comparison table","The browser presents a significant advantage over other sources of identity attack data.",{"url":29458,"width":29459,"height":29460},"https://images.ctfassets.net/y1cdw1ablpvd/4feAEpfP6tetyTjcLIopwG/5bec8c8c10e6e328ebe258bc59bc3cb6/Frame_627570__7_.png",2444,894,{"sys":29462,"__typename":4959,"type":17743,"ctaText":17744,"buttonLabel":17745,"buttonColour":4963,"buttonUrl":59},{"id":17710},{"items":29464},[],{},"Tackling common browser & identity security misconceptions","2024-07-11T00:00:00.000Z",{"items":29469},[29470,32428,33200],{"__typename":2239,"sys":29471,"content":29473,"title":32414,"synopsis":32415,"hashTags":59,"publishedDate":32416,"slug":32417,"tagsCollection":32418,"authorsCollection":32424},{"id":29472},"6XIts2UEnrsJDki8gKDXyI",{"json":29474},{"data":29475,"content":29476,"nodeType":2232},{},[29477,29484,29516,29523,29529,29536,29556,29579,29586,29593,29617,29633,29640,29652,29659,29662,29669,29676,29692,29704,29715,29747,29750,29757,29775,29782,29790,29882,29889,30025,30032,30150,30157,30164,30335,30342,30349,30432,30435,30442,30449,30456,30519,30526,30559,30566,30609,30615,30621,30854,30860,30868,30875,30878,30885,30892,30899,30952,30959,31002,31009,31042,31048,31054,31220,31226,31234,31241,31249,31256,31264,31271,31274,31281,31288,31295,31358,31365,31398,31405,31438,31444,31450,31556,31559,31566,31573,31580,31643,31650,31683,31690,31723,31729,31735,31909,31912,31919,31926,31933,32006,32013,32046,32053,32086,32092,32098,32328,32331,32338,32345,32352,32359,32362,32369,32376,32383,32386,32393,32400,32407],{"data":29478,"content":29479,"nodeType":948},{},[29480],{"data":29481,"marks":29482,"value":29483,"nodeType":865},{},[],"Browser-based Identity attacks on the rise?",{"data":29485,"content":29486,"nodeType":866},{},[29487,29491,29500,29504,29513],{"data":29488,"marks":29489,"value":29490,"nodeType":865},{},[],"Identity has been recorded as the #1 cyber attack vector since forever. You don’t have to look particularly hard to find statistics to support this. In 2023, one source reports that ",{"data":29492,"content":29494,"nodeType":1102},{"uri":29493},"https://www.csoonline.com/article/648894/identity-based-security-threats-are-growing-rapidly-report.html",[29495],{"data":29496,"marks":29497,"value":29499,"nodeType":865},{},[29498],{"type":4537},"4/5 breaches involved identity and compromised credentials",{"data":29501,"marks":29502,"value":29503,"nodeType":865},{},[],", while another suggests that ",{"data":29505,"content":29507,"nodeType":1102},{"uri":29506},"https://rakgarg.substack.com/p/identity-crisis-the-biggest-prize",[29508],{"data":29509,"marks":29510,"value":29512,"nodeType":865},{},[29511],{"type":4537},"75% of breaches are caused by mismanaged identity, access, or privileges",{"data":29514,"marks":29515,"value":1151,"nodeType":865},{},[],{"data":29517,"content":29518,"nodeType":866},{},[29519],{"data":29520,"marks":29521,"value":29522,"nodeType":865},{},[],"Phishing, social engineering, credential stuffing, and business email compromise have morphed into a homogenous understanding of identity threats that are generally tackled through a combination of email security tooling, content access controls, and user awareness. ",{"data":29524,"content":29528,"nodeType":907},{"target":29525},{"sys":29526},{"id":29527,"type":904,"linkType":905},"5NRWvCl0xsoWcpgHbcQIkf",[],{"data":29530,"content":29531,"nodeType":866},{},[29532],{"data":29533,"marks":29534,"value":29535,"nodeType":865},{},[],"The fact that such attacks have been reported as the top security threat for so long probably means that people pay less attention to identity threats. Ransomware grabs the headlines, and rightly so in many cases, but phishing feels like a “known known” that we have a plan for (even if the plan often fails). ",{"data":29537,"content":29538,"nodeType":866},{},[29539,29543,29552],{"data":29540,"marks":29541,"value":29542,"nodeType":865},{},[],"In fact, there’s a problem with messaging generally. The ",{"data":29544,"content":29546,"nodeType":1102},{"uri":29545},"https://www.verizon.com/business/resources/T78/reports/data-breach-investigation-report_2015.pdf",[29547],{"data":29548,"marks":29549,"value":29551,"nodeType":865},{},[29550],{"type":4537},"2015 Verizon DBIR",{"data":29553,"marks":29554,"value":29555,"nodeType":865},{},[]," contains plenty of stats that still ring largely true today. For example:",{"data":29557,"content":29558,"nodeType":891},{},[29559,29569],{"data":29560,"content":29561,"nodeType":880},{},[29562],{"data":29563,"content":29564,"nodeType":866},{},[29565],{"data":29566,"marks":29567,"value":29568,"nodeType":865},{},[],"In the 2013 DBIR, phishing was associated with over 95% of incidents attributed to state sponsored actors, and for two years running, more than two-thirds of incidents have featured phishing",{"data":29570,"content":29571,"nodeType":880},{},[29572],{"data":29573,"content":29574,"nodeType":866},{},[29575],{"data":29576,"marks":29577,"value":29578,"nodeType":865},{},[],"In 60% of cases, attackers are able to compromise an organization within minutes",{"data":29580,"content":29581,"nodeType":866},{},[29582],{"data":29583,"marks":29584,"value":29585,"nodeType":865},{},[],"Remove the dates and a lot of the report still stands up. ",{"data":29587,"content":29588,"nodeType":1218},{},[29589],{"data":29590,"marks":29591,"value":29592,"nodeType":865},{},[],"Bad then, worse now",{"data":29594,"content":29595,"nodeType":866},{},[29596,29600,29605,29609,29614],{"data":29597,"marks":29598,"value":29599,"nodeType":865},{},[],"But browser-based identity attacks ",{"data":29601,"marks":29602,"value":29604,"nodeType":865},{},[29603],{"type":946},"are",{"data":29606,"marks":29607,"value":29608,"nodeType":865},{},[]," worse than they used to be. Yes, credential stuffing, phishing, and SIM swapping may not be the most sophisticated attacks, but they remain as effective as ever. ",{"data":29610,"marks":29611,"value":29613,"nodeType":865},{},[29612],{"type":979},"As the saying goes, if it ain’t broke — don’t fix it.",{"data":29615,"marks":29616,"value":16789,"nodeType":865},{},[],{"data":29618,"content":29619,"nodeType":866},{},[29620,29624,29629],{"data":29621,"marks":29622,"value":29623,"nodeType":865},{},[],"Recent attacks have moved toward a broader targeting of the ",{"data":29625,"marks":29626,"value":29628,"nodeType":865},{},[29627],{"type":946},"identity infrastructure",{"data":29630,"marks":29631,"value":29632,"nodeType":865},{},[],". While phishing and social engineering was once primarily a delivery mechanism for malicious payloads to be executed on endpoint, it is now used to harvest credentials and secrets for identity-based attacks against cloud apps and services. ",{"data":29634,"content":29635,"nodeType":866},{},[29636],{"data":29637,"marks":29638,"value":29639,"nodeType":865},{},[],"And because businesses have migrated to more cloud-based services and infrastructure, the compromise of an identity now has different consequences.",{"data":29641,"content":29642,"nodeType":866},{},[29643,29647],{"data":29644,"marks":29645,"value":29646,"nodeType":865},{},[],"The data and functionality that attackers seek has moved off endpoints and internal networks and onto cloud systems and SaaS applications, which organizations are using in large numbers (tens to hundreds). The modern way of working means that applications are more often than not directly exposed to the internet — and the only thing needed to access these apps are identities. ",{"data":29648,"marks":29649,"value":29651,"nodeType":865},{},[29650],{"type":946},"Naturally, it's much harder to stop credential stuffing attacks against 100 SaaS apps than the single centralized external VPN/webmail endpoint of yesteryear. ",{"data":29653,"content":29654,"nodeType":866},{},[29655],{"data":29656,"marks":29657,"value":29658,"nodeType":865},{},[],"It’s clear that stats alone don’t adequately capture the identity threat. So we have to look beyond the numbers to find out why. ",{"data":29660,"content":29661,"nodeType":938},{},[],{"data":29663,"content":29664,"nodeType":948},{},[29665],{"data":29666,"marks":29667,"value":29668,"nodeType":865},{},[],"Using this resource",{"data":29670,"content":29671,"nodeType":866},{},[29672],{"data":29673,"marks":29674,"value":29675,"nodeType":865},{},[],"To cut through some of the noise, we’ve compiled this list of reported attacks and explored what they mean for the identity threat landscape. ",{"data":29677,"content":29678,"nodeType":866},{},[29679,29683,29688],{"data":29680,"marks":29681,"value":29682,"nodeType":865},{},[],"This is not intended to be an exhaustive list of all attacks involving the compromise of digital identities (the list would be endless!). Nor is it something you should read all in one go (unless you ",{"data":29684,"marks":29685,"value":29687,"nodeType":865},{},[29686],{"type":979},"really",{"data":29689,"marks":29690,"value":29691,"nodeType":865},{},[]," want to, we won’t stop you). We want it to be a resource that you can refer back to, that we will continue to update as new attacks are recorded. ",{"data":29693,"content":29694,"nodeType":866},{},[29695,29699],{"data":29696,"marks":29697,"value":29698,"nodeType":865},{},[],"In this context we define identity attacks as ",{"data":29700,"marks":29701,"value":29703,"nodeType":865},{},[29702],{"type":946},"attacks targeting cloud identities and their associated identity management systems, protocols, applications, and infrastructure. ",{"data":29705,"content":29706,"nodeType":866},{},[29707,29711],{"data":29708,"marks":29709,"value":29710,"nodeType":865},{},[],"The attacks recorded below are high profile examples of browser-based identity attacks",{"data":29712,"marks":29713,"value":29714,"nodeType":865},{},[]," that demonstrate how threat actors are leveraging the cloud identity plane to evade established cyber defenses and traverse new attack paths to achieve their goals. We’ve focused on attacks targeting identity infrastructure itself that are notable for their bypassing of traditional environments and established controls (e.g. Networkless or SaaS-to-SaaS attack paths). ",{"data":29716,"content":29717,"nodeType":866},{},[29718,29722,29731,29735,29744],{"data":29719,"marks":29720,"value":29721,"nodeType":865},{},[],"As with all publicly disclosed breaches, the level of detail and transparency we see varies. Where possible, we've mapped the threat actor Tactics, Techniques and Procedures to our ",{"data":29723,"content":29725,"nodeType":1102},{"uri":29724},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/",[29726],{"data":29727,"marks":29728,"value":29730,"nodeType":865},{},[29729],{"type":4537},"Browser & Identity Attacks Matrix",{"data":29732,"marks":29733,"value":29734,"nodeType":865},{},[]," (previously the SaaS Attack Matrix). To learn more about SaaS attack techniques ",{"data":29736,"content":29738,"nodeType":1102},{"uri":29737},"https://pushsecurity.com/blog/saas-attack-techniques/#id-problems-with-observing-saas-attacks",[29739],{"data":29740,"marks":29741,"value":29743,"nodeType":865},{},[29742],{"type":4537},"read the blog",{"data":29745,"marks":29746,"value":1677,"nodeType":865},{},[],{"data":29748,"content":29749,"nodeType":938},{},[],{"data":29751,"content":29752,"nodeType":948},{},[29753],{"data":29754,"marks":29755,"value":29756,"nodeType":865},{},[],"Snowflake – June 2024",{"data":29758,"content":29759,"nodeType":866},{},[29760,29764,29772],{"data":29761,"marks":29762,"value":29763,"nodeType":865},{},[],"The threat group known as ShinyHunters (also tracked as UNC5537) has claimed responsibility for breaching multiple organizations using Snowflake, a cloud-based data warehousing and analytics platform. The breach stems from the historical compromise of credentials used to access customer-specific Snowflake tenants, via infostealer infections. These credentials were used as part of a targeted campaign against Snowflake customers, which was exacerbated by the widespread absence of MFA due to the lack of MFA enforcement by default. At the time of writing, approximately 165 customers have been impacted globally ",{"data":29765,"content":29766,"nodeType":1102},{"uri":18932},[29767],{"data":29768,"marks":29769,"value":29771,"nodeType":865},{},[29770],{"type":4537},"according to a report by Mandiant",{"data":29773,"marks":29774,"value":7361,"nodeType":865},{},[],{"data":29776,"content":29777,"nodeType":1218},{},[29778],{"data":29779,"marks":29780,"value":29781,"nodeType":865},{},[],"How did Snowflake get breached?",{"data":29783,"content":29784,"nodeType":866},{},[29785],{"data":29786,"marks":29787,"value":29789,"nodeType":865},{},[29788],{"type":979},"It’s worth noting that customers/users of Snowflake were breached via their Snowflake tenants, and no central breach of Snowflake's own systems occurred.",{"data":29791,"content":29792,"nodeType":891},{},[29793,29803,29825,29835,29844,29853,29862,29872],{"data":29794,"content":29795,"nodeType":880},{},[29796],{"data":29797,"content":29798,"nodeType":866},{},[29799],{"data":29800,"marks":29801,"value":29802,"nodeType":865},{},[],"Snowflake users were infected with infostealer malware that harvested credentials from user devices over an extended period. The threat actor used Snowflake customer credentials that were previously exposed via several infostealer malware variants, including; VIDAR, RISEPRO, REDLINE, RACOON STEALER, LUMMA and METASTEALER.",{"data":29804,"content":29805,"nodeType":880},{},[29806],{"data":29807,"content":29808,"nodeType":866},{},[29809,29813,29821],{"data":29810,"marks":29811,"value":29812,"nodeType":865},{},[],"Credentials appeared on criminal marketplaces e.g. dark web forums and ",{"data":29814,"content":29815,"nodeType":1102},{"uri":28307},[29816],{"data":29817,"marks":29818,"value":29820,"nodeType":865},{},[29819],{"type":4537},"Telegram channels",{"data":29822,"marks":29823,"value":29824,"nodeType":865},{},[]," as combolists (username, password, and login portal combinations). ",{"data":29826,"content":29827,"nodeType":880},{},[29828],{"data":29829,"content":29830,"nodeType":866},{},[29831],{"data":29832,"marks":29833,"value":29834,"nodeType":865},{},[],"Criminal groups (either ShinyHunters or another organization) saw the potential in targeting Snowflake users, based on the availability of credentials, number of customer organizations, and the value of the data that can be accessed in Snowflake. ",{"data":29836,"content":29837,"nodeType":880},{},[29838],{"data":29839,"content":29840,"nodeType":866},{},[29841],{"data":29842,"marks":29843,"value":19120,"nodeType":865},{},[],{"data":29845,"content":29846,"nodeType":880},{},[29847],{"data":29848,"content":29849,"nodeType":866},{},[29850],{"data":29851,"marks":29852,"value":19130,"nodeType":865},{},[],{"data":29854,"content":29855,"nodeType":880},{},[29856],{"data":29857,"content":29858,"nodeType":866},{},[29859],{"data":29860,"marks":29861,"value":19140,"nodeType":865},{},[],{"data":29863,"content":29864,"nodeType":880},{},[29865],{"data":29866,"content":29867,"nodeType":866},{},[29868],{"data":29869,"marks":29870,"value":29871,"nodeType":865},{},[],"ShinyHunters acquired massive quantities of Snowflake data based on the information that each customer stored in Snowflake or connected apps. The most sensitive data declared so far pertains to end-customers of each victim, for example PII, bank account and card information, etc.  ",{"data":29873,"content":29874,"nodeType":880},{},[29875],{"data":29876,"content":29877,"nodeType":866},{},[29878],{"data":29879,"marks":29880,"value":29881,"nodeType":865},{},[],"ShinyHunters began attempts to extort Snowflake and end-customers using the data acquired. ",{"data":29883,"content":29884,"nodeType":1218},{},[29885],{"data":29886,"marks":29887,"value":29888,"nodeType":865},{},[],"What was the impact of the Snowflake breach?",{"data":29890,"content":29891,"nodeType":891},{},[29892,29911,29940,29968,29987,30006],{"data":29893,"content":29894,"nodeType":880},{},[29895],{"data":29896,"content":29897,"nodeType":866},{},[29898,29902,29907],{"data":29899,"marks":29900,"value":29901,"nodeType":865},{},[],"Approximately ",{"data":29903,"marks":29904,"value":29906,"nodeType":865},{},[29905],{"type":946},"165 victims were identified by Mandiant",{"data":29908,"marks":29909,"value":29910,"nodeType":865},{},[],". Organizations are gradually coming forward to declare the breach and release customer communications accordingly, but not all victims have been named.",{"data":29912,"content":29913,"nodeType":880},{},[29914],{"data":29915,"content":29916,"nodeType":866},{},[29917,29921,29926,29930,29937],{"data":29918,"marks":29919,"value":29920,"nodeType":865},{},[],"Based on the figures being suggested so far, the impact upon end-customers is huge, with the data of ",{"data":29922,"marks":29923,"value":29925,"nodeType":865},{},[29924],{"type":946},"hundreds of millions of people exposed",{"data":29927,"marks":29928,"value":29929,"nodeType":865},{},[],", and has been touted by some news outlets as ‘",{"data":29931,"content":29932,"nodeType":1102},{"uri":6977},[29933],{"data":29934,"marks":29935,"value":18881,"nodeType":865},{},[29936],{"type":4537},{"data":29938,"marks":29939,"value":18885,"nodeType":865},{},[],{"data":29941,"content":29942,"nodeType":880},{},[29943],{"data":29944,"content":29945,"nodeType":866},{},[29946,29950,29955,29959,29964],{"data":29947,"marks":29948,"value":29949,"nodeType":865},{},[],"The impact on the affected businesses is largely unknown at this stage. It’s clear that the victims will suffer ",{"data":29951,"marks":29952,"value":29954,"nodeType":865},{},[29953],{"type":946},"reputational damage",{"data":29956,"marks":29957,"value":29958,"nodeType":865},{},[]," based on the extent of their individual breaches, and possibly face other ",{"data":29960,"marks":29961,"value":29963,"nodeType":865},{},[29962],{"type":946},"penalties and sanctions",{"data":29965,"marks":29966,"value":29967,"nodeType":865},{},[]," if they are found to be at fault by their respective regulators and/or national information security authorities. ",{"data":29969,"content":29970,"nodeType":880},{},[29971],{"data":29972,"content":29973,"nodeType":866},{},[29974,29978,29983],{"data":29975,"marks":29976,"value":29977,"nodeType":865},{},[],"The impact upon individuals will be significant, with high potential for further targeting in terms of ",{"data":29979,"marks":29980,"value":29982,"nodeType":865},{},[29981],{"type":946},"identity theft, blackmail, financial crime",{"data":29984,"marks":29985,"value":29986,"nodeType":865},{},[],", etc.  ",{"data":29988,"content":29989,"nodeType":880},{},[29990],{"data":29991,"content":29992,"nodeType":866},{},[29993,29997,30002],{"data":29994,"marks":29995,"value":29996,"nodeType":865},{},[],"It is unclear what data has been exposed in addition to personal data affecting end-customers. If other sensitive commercial or business data pertaining to ",{"data":29998,"marks":29999,"value":30001,"nodeType":865},{},[30000],{"type":946},"Intellectual Property",{"data":30003,"marks":30004,"value":30005,"nodeType":865},{},[]," has been exposed then this data may also be sold on via other nefarious channels, with a potential future impact.",{"data":30007,"content":30008,"nodeType":880},{},[30009],{"data":30010,"content":30011,"nodeType":866},{},[30012,30016,30021],{"data":30013,"marks":30014,"value":30015,"nodeType":865},{},[],"Given the lack of MFA for the compromised accounts, there has been a general criticism of the ‘opt-in’ nature of MFA for SaaS services, with many security professionals suggesting that ",{"data":30017,"marks":30018,"value":30020,"nodeType":865},{},[30019],{"type":946},"Snowflake should enforce MFA by default",{"data":30022,"marks":30023,"value":30024,"nodeType":865},{},[]," given the critical nature of the service. ",{"data":30026,"content":30027,"nodeType":1218},{},[30028],{"data":30029,"marks":30030,"value":30031,"nodeType":865},{},[],"What stands out in the Snowflake breach?",{"data":30033,"content":30034,"nodeType":891},{},[30035,30054,30095,30122],{"data":30036,"content":30037,"nodeType":880},{},[30038],{"data":30039,"content":30040,"nodeType":866},{},[30041,30045,30050],{"data":30042,"marks":30043,"value":30044,"nodeType":865},{},[],"The breach ",{"data":30046,"marks":30047,"value":30049,"nodeType":865},{},[30048],{"type":946},"was achieved by using stolen credentials dating back as far as 2020",{"data":30051,"marks":30052,"value":30053,"nodeType":865},{},[],", that had not been rotated or changed. This indicates that many of the credentials used were not necessarily the result of any recent data sharing. This highlights the potential risk of breached credentials already in the public domain; particularly in the case of cloud services that may not be subject to the same levels of credential hygiene as other traditional network logins. ",{"data":30055,"content":30056,"nodeType":880},{},[30057],{"data":30058,"content":30059,"nodeType":866},{},[30060,30064,30072,30075,30080,30084,30092],{"data":30061,"marks":30062,"value":30063,"nodeType":865},{},[],"Much of the industry response has focused on ensuring that accounts are using SSO (and therefore are protected by MFA at the IdP level). However, due to the existence of ",{"data":30065,"content":30067,"nodeType":1102},{"uri":30066},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/ghost-logins",[30068],{"data":30069,"marks":30070,"value":5383,"nodeType":865},{},[30071],{"type":4537},{"data":30073,"marks":30074,"value":3531,"nodeType":865},{},[],{"data":30076,"marks":30077,"value":30079,"nodeType":865},{},[30078],{"type":946},"local logins without MFA can exist simultaneously with the SSO login unless expressly disabled",{"data":30081,"marks":30082,"value":30083,"nodeType":865},{},[],". Organizations using Snowflake that are looking to lock down their accounts can ",{"data":30085,"content":30086,"nodeType":1102},{"uri":26032},[30087],{"data":30088,"marks":30089,"value":30091,"nodeType":865},{},[30090],{"type":4537},"watch our recent demo of how to effectively remediate this vulnerability in Snowflake",{"data":30093,"marks":30094,"value":6360,"nodeType":865},{},[],{"data":30096,"content":30097,"nodeType":880},{},[30098],{"data":30099,"content":30100,"nodeType":866},{},[30101,30106,30110,30118],{"data":30102,"marks":30103,"value":30105,"nodeType":865},{},[30104],{"type":946},"80% of the credentials were gathered through infostealer malware",{"data":30107,"marks":30108,"value":30109,"nodeType":865},{},[],". Typically, this occurs when unmanaged devices are used to access company resources, or personal browser profiles are synchronized on both work and personal devices. Malware deployed to an insecure personal device can then access and steal credentials for company resources. This situation usually occurs when working with third-party contractors on a BYOD basis; ",{"data":30111,"content":30112,"nodeType":1102},{"uri":19285},[30113],{"data":30114,"marks":30115,"value":30117,"nodeType":865},{},[30116],{"type":4537},"a recent article indicates that Ukraine-based EPAM Systems",{"data":30119,"marks":30120,"value":30121,"nodeType":865},{},[],", an engineering and digital service provider and “Elite Tier Partner” of Snowflake, was one such organization breached in this way. Organizations consuming Snowflake-related services from EPAM were then subsequently affected, as the compromise of EPAM users granted access to a large number of Snowflake credentials for various company tenants.  ",{"data":30123,"content":30124,"nodeType":880},{},[30125],{"data":30126,"content":30127,"nodeType":866},{},[30128,30132,30137,30141,30146],{"data":30129,"marks":30130,"value":30131,"nodeType":865},{},[],"While attacker activity has focused on Snowflake to date, the success of this attack will signal the potential for further credential based attacks against similar apps. ",{"data":30133,"marks":30134,"value":30136,"nodeType":865},{},[30135],{"type":946},"There may already be a 'Snowflake 2.0' among the credentials already available online",{"data":30138,"marks":30139,"value":30140,"nodeType":865},{},[],". Further, credentials can be used against a wide range of apps to capitalize on potential ",{"data":30142,"marks":30143,"value":30145,"nodeType":865},{},[30144],{"type":946},"password reuse (which we see for 1 in 3 employees)",{"data":30147,"marks":30148,"value":30149,"nodeType":865},{},[],", so the exact creds for a particular app don’t have to be explicitly breached, so long as the domain for the login portal can be guessed or has been exposed elsewhere.   ",{"data":30151,"content":30152,"nodeType":1218},{},[30153],{"data":30154,"marks":30155,"value":30156,"nodeType":865},{},[],"Browser & Identity Attacks Matrix mapping",{"data":30158,"content":30159,"nodeType":866},{},[30160],{"data":30161,"marks":30162,"value":30163,"nodeType":865},{},[],"For more information on each TTP please navigate to the entries linked in the table below. ",{"data":30165,"content":30166,"nodeType":1197},{},[30167,30210,30272],{"data":30168,"content":30169,"nodeType":1014},{},[30170,30180,30190,30200],{"data":30171,"content":30172,"nodeType":1002},{},[30173],{"data":30174,"content":30175,"nodeType":866},{},[30176],{"data":30177,"marks":30178,"value":30179,"nodeType":865},{},[],"ID",{"data":30181,"content":30182,"nodeType":1002},{},[30183],{"data":30184,"content":30185,"nodeType":866},{},[30186],{"data":30187,"marks":30188,"value":30189,"nodeType":865},{},[],"Name",{"data":30191,"content":30192,"nodeType":1002},{},[30193],{"data":30194,"content":30195,"nodeType":866},{},[30196],{"data":30197,"marks":30198,"value":30199,"nodeType":865},{},[],"Stage",{"data":30201,"content":30202,"nodeType":1002},{},[30203],{"data":30204,"content":30205,"nodeType":866},{},[30206],{"data":30207,"marks":30208,"value":30209,"nodeType":865},{},[],"Description",{"data":30211,"content":30212,"nodeType":1014},{},[30213,30233,30252,30262],{"data":30214,"content":30215,"nodeType":1043},{},[30216],{"data":30217,"content":30218,"nodeType":866},{},[30219,30222,30230],{"data":30220,"marks":30221,"value":21,"nodeType":865},{},[],{"data":30223,"content":30224,"nodeType":1102},{"uri":5377},[30225],{"data":30226,"marks":30227,"value":30229,"nodeType":865},{},[30228],{"type":4537},"SAT1017",{"data":30231,"marks":30232,"value":21,"nodeType":865},{},[],{"data":30234,"content":30235,"nodeType":1043},{},[30236],{"data":30237,"content":30238,"nodeType":866},{},[30239,30242,30249],{"data":30240,"marks":30241,"value":21,"nodeType":865},{},[],{"data":30243,"content":30244,"nodeType":1102},{"uri":30066},[30245],{"data":30246,"marks":30247,"value":395,"nodeType":865},{},[30248],{"type":4537},{"data":30250,"marks":30251,"value":21,"nodeType":865},{},[],{"data":30253,"content":30254,"nodeType":1043},{},[30255],{"data":30256,"content":30257,"nodeType":866},{},[30258],{"data":30259,"marks":30260,"value":30261,"nodeType":865},{},[],"Initial Access; Persistence; Defense Evasion",{"data":30263,"content":30264,"nodeType":1043},{},[30265],{"data":30266,"content":30267,"nodeType":866},{},[30268],{"data":30269,"marks":30270,"value":30271,"nodeType":865},{},[],"Abusing non-SSO additional login methods such as password-based authentication (local to the SaaS app), social logins, API access, etc. ",{"data":30273,"content":30274,"nodeType":1014},{},[30275,30295,30315,30325],{"data":30276,"content":30277,"nodeType":1043},{},[30278],{"data":30279,"content":30280,"nodeType":866},{},[30281,30284,30292],{"data":30282,"marks":30283,"value":21,"nodeType":865},{},[],{"data":30285,"content":30286,"nodeType":1102},{"uri":14271},[30287],{"data":30288,"marks":30289,"value":30291,"nodeType":865},{},[30290],{"type":4537},"SAT1044",{"data":30293,"marks":30294,"value":21,"nodeType":865},{},[],{"data":30296,"content":30297,"nodeType":1043},{},[30298],{"data":30299,"content":30300,"nodeType":866},{},[30301,30304,30312],{"data":30302,"marks":30303,"value":21,"nodeType":865},{},[],{"data":30305,"content":30307,"nodeType":1102},{"uri":30306},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/session-cookie-theft",[30308],{"data":30309,"marks":30310,"value":26224,"nodeType":865},{},[30311],{"type":4537},{"data":30313,"marks":30314,"value":21,"nodeType":865},{},[],{"data":30316,"content":30317,"nodeType":1043},{},[30318],{"data":30319,"content":30320,"nodeType":866},{},[30321],{"data":30322,"marks":30323,"value":30324,"nodeType":865},{},[],"Lateral Movement; Defense Evasion",{"data":30326,"content":30327,"nodeType":1043},{},[30328],{"data":30329,"content":30330,"nodeType":866},{},[30331],{"data":30332,"marks":30333,"value":30334,"nodeType":865},{},[],"Session cookies are used to pivot from an endpoint compromise and laterally move to downstream SaaS applications.",{"data":30336,"content":30337,"nodeType":1218},{},[30338],{"data":30339,"marks":30340,"value":30341,"nodeType":865},{},[],"Related breaches",{"data":30343,"content":30344,"nodeType":866},{},[30345],{"data":30346,"marks":30347,"value":30348,"nodeType":865},{},[],"Named victims are listed below:",{"data":30350,"content":30351,"nodeType":891},{},[30352,30362,30372,30382,30392,30402,30412,30422],{"data":30353,"content":30354,"nodeType":880},{},[30355],{"data":30356,"content":30357,"nodeType":866},{},[30358],{"data":30359,"marks":30360,"value":30361,"nodeType":865},{},[],"Ticketmaster",{"data":30363,"content":30364,"nodeType":880},{},[30365],{"data":30366,"content":30367,"nodeType":866},{},[30368],{"data":30369,"marks":30370,"value":30371,"nodeType":865},{},[],"Santander",{"data":30373,"content":30374,"nodeType":880},{},[30375],{"data":30376,"content":30377,"nodeType":866},{},[30378],{"data":30379,"marks":30380,"value":30381,"nodeType":865},{},[],"Neiman Marcus",{"data":30383,"content":30384,"nodeType":880},{},[30385],{"data":30386,"content":30387,"nodeType":866},{},[30388],{"data":30389,"marks":30390,"value":30391,"nodeType":865},{},[],"Los Angeles Unified",{"data":30393,"content":30394,"nodeType":880},{},[30395],{"data":30396,"content":30397,"nodeType":866},{},[30398],{"data":30399,"marks":30400,"value":30401,"nodeType":865},{},[],"Pure Storage",{"data":30403,"content":30404,"nodeType":880},{},[30405],{"data":30406,"content":30407,"nodeType":866},{},[30408],{"data":30409,"marks":30410,"value":30411,"nodeType":865},{},[],"Advance Auto Parts",{"data":30413,"content":30414,"nodeType":880},{},[30415],{"data":30416,"content":30417,"nodeType":866},{},[30418],{"data":30419,"marks":30420,"value":30421,"nodeType":865},{},[],"Truist Bank",{"data":30423,"content":30424,"nodeType":880},{},[30425],{"data":30426,"content":30427,"nodeType":866},{},[30428],{"data":30429,"marks":30430,"value":30431,"nodeType":865},{},[],"Lending Tree",{"data":30433,"content":30434,"nodeType":938},{},[],{"data":30436,"content":30437,"nodeType":948},{},[30438],{"data":30439,"marks":30440,"value":30441,"nodeType":865},{},[],"Microsoft — January 2024",{"data":30443,"content":30444,"nodeType":866},{},[30445],{"data":30446,"marks":30447,"value":30448,"nodeType":865},{},[],"The threat group known as APT29 (also known as “The Dukes”, “Cozy Bear”, and labeled “Midnight Blizzard” by Microsoft) executed a cleverly executed password-guessing attack to compromise test cloud identities that were also lacking MFA. Attackers then leveraged this access to compromise some OAuth applications that allowed lateral movement to Microsoft’s corporate environment and the creation of other malicious OAuth applications to achieve persistence.",{"data":30450,"content":30451,"nodeType":1218},{},[30452],{"data":30453,"marks":30454,"value":30455,"nodeType":865},{},[],"How did Microsoft get breached?",{"data":30457,"content":30458,"nodeType":891},{},[30459,30469,30479,30489,30499,30509],{"data":30460,"content":30461,"nodeType":880},{},[30462],{"data":30463,"content":30464,"nodeType":866},{},[30465],{"data":30466,"marks":30467,"value":30468,"nodeType":865},{},[],"APT29 utilized password spraying / credential stuffing attacks to compromise test cloud identities that were also lacking MFA, attached to a non-production test tenant.",{"data":30470,"content":30471,"nodeType":880},{},[30472],{"data":30473,"content":30474,"nodeType":866},{},[30475],{"data":30476,"marks":30477,"value":30478,"nodeType":865},{},[],"APT29 leveraged their initial access to the test tenant to identify and compromise a test OAuth application that had access to the Microsoft corporate environment by leveraging permissive Entra ID roles in the test tenant.",{"data":30480,"content":30481,"nodeType":880},{},[30482],{"data":30483,"content":30484,"nodeType":866},{},[30485],{"data":30486,"marks":30487,"value":30488,"nodeType":865},{},[],"APT29 used the existing configurations to access the Microsoft corporate Entra ID tenant whereupon the app registration from the test tenant was installed as a service principal in the corporate tenant, granting the equivalent of global admin rights.",{"data":30490,"content":30491,"nodeType":880},{},[30492],{"data":30493,"content":30494,"nodeType":866},{},[30495],{"data":30496,"marks":30497,"value":30498,"nodeType":865},{},[],"Using these new permissions, APT29 registered additional malicious OAuth applications in the Microsoft corporate environment, and created a new user in the Microsoft corporate tenant to grant consent to the new malicious OAuth apps, thereby achieving persistent access to the environment.",{"data":30500,"content":30501,"nodeType":880},{},[30502],{"data":30503,"content":30504,"nodeType":866},{},[30505],{"data":30506,"marks":30507,"value":30508,"nodeType":865},{},[],"APT29 leveraged the elevated (maximum) privileges assigned to the ‘test’ app service principal to grant app roles to other newly created app service principals, granting them the Office 365 Exchange Online full_access_as_app role in the corporate tenant, which allows access to mailboxes.",{"data":30510,"content":30511,"nodeType":880},{},[30512],{"data":30513,"content":30514,"nodeType":866},{},[30515],{"data":30516,"marks":30517,"value":30518,"nodeType":865},{},[],"APT29 leveraged these malicious OAuth applications to authenticate to Microsoft Exchange Online and target Microsoft corporate email accounts.",{"data":30520,"content":30521,"nodeType":1218},{},[30522],{"data":30523,"marks":30524,"value":30525,"nodeType":865},{},[],"What was the impact of the Microsoft breach?",{"data":30527,"content":30528,"nodeType":891},{},[30529,30539,30549],{"data":30530,"content":30531,"nodeType":880},{},[30532],{"data":30533,"content":30534,"nodeType":866},{},[30535],{"data":30536,"marks":30537,"value":30538,"nodeType":865},{},[],"APT29 had access to Microsoft corporate email accounts, including members of the senior leadership team and employees in the cybersecurity, legal, and other functions, resulting in sensitive data leakage.",{"data":30540,"content":30541,"nodeType":880},{},[30542],{"data":30543,"content":30544,"nodeType":866},{},[30545],{"data":30546,"marks":30547,"value":30548,"nodeType":865},{},[],"Microsoft has not disclosed any further impacts at this time, but it is likely that the adversary had complete, unmitigated control of the Microsoft corporate tenant for a period of time, with global administrator level access.",{"data":30550,"content":30551,"nodeType":880},{},[30552],{"data":30553,"content":30554,"nodeType":866},{},[30555],{"data":30556,"marks":30557,"value":30558,"nodeType":865},{},[],"Since the initial attack there has been evidence of continued targeting, with password spraying attacks reportedly increasing tenfold, likely informed by stolen information.",{"data":30560,"content":30561,"nodeType":1218},{},[30562],{"data":30563,"marks":30564,"value":30565,"nodeType":865},{},[],"What stands out in the Microsoft breach?",{"data":30567,"content":30568,"nodeType":891},{},[30569,30579,30589,30599],{"data":30570,"content":30571,"nodeType":880},{},[30572],{"data":30573,"content":30574,"nodeType":866},{},[30575],{"data":30576,"marks":30577,"value":30578,"nodeType":865},{},[],"The attack was covert and targeted, with APT29 tailoring the attack to a limited number of accounts and using a low number of attempts to evade detection and avoid account blocks based on the volume of failures.",{"data":30580,"content":30581,"nodeType":880},{},[30582],{"data":30583,"content":30584,"nodeType":866},{},[30585],{"data":30586,"marks":30587,"value":30588,"nodeType":865},{},[],"APT29 used residential proxy networks when interacting with the compromised tenant and, subsequently, with Exchange Online to obfuscate the source of their attack and avoid impossible travel detections. ",{"data":30590,"content":30591,"nodeType":880},{},[30592],{"data":30593,"content":30594,"nodeType":866},{},[30595],{"data":30596,"marks":30597,"value":30598,"nodeType":865},{},[],"APT29 demonstrated mature and in-depth understanding of cloud infrastructure, protocols, and workflows, particularly in terms of privilege escalation and lateral movement.",{"data":30600,"content":30601,"nodeType":880},{},[30602],{"data":30603,"content":30604,"nodeType":866},{},[30605],{"data":30606,"marks":30607,"value":30608,"nodeType":865},{},[],"If even Microsoft (an organization with pretty much unrivaled security resources) can’t ensure that all their accounts are protected by MFA and that there are no weak links between test/dev and prod systems, this should be a wake-up call for any company that thinks their MFA implementation is flawless. ",{"data":30610,"content":30611,"nodeType":1218},{},[30612],{"data":30613,"marks":30614,"value":30156,"nodeType":865},{},[],{"data":30616,"content":30617,"nodeType":866},{},[30618],{"data":30619,"marks":30620,"value":30163,"nodeType":865},{},[],{"data":30622,"content":30623,"nodeType":1197},{},[30624,30664,30727,30790],{"data":30625,"content":30626,"nodeType":1014},{},[30627,30636,30646,30655],{"data":30628,"content":30629,"nodeType":1002},{},[30630],{"data":30631,"content":30632,"nodeType":866},{},[30633],{"data":30634,"marks":30635,"value":30179,"nodeType":865},{},[],{"data":30637,"content":30638,"nodeType":1002},{},[30639],{"data":30640,"content":30641,"nodeType":866},{},[30642],{"data":30643,"marks":30644,"value":30645,"nodeType":865},{},[],"Technique",{"data":30647,"content":30648,"nodeType":1002},{},[30649],{"data":30650,"content":30651,"nodeType":866},{},[30652],{"data":30653,"marks":30654,"value":30199,"nodeType":865},{},[],{"data":30656,"content":30657,"nodeType":1002},{},[30658],{"data":30659,"content":30660,"nodeType":866},{},[30661],{"data":30662,"marks":30663,"value":30209,"nodeType":865},{},[],{"data":30665,"content":30666,"nodeType":1014},{},[30667,30687,30707,30717],{"data":30668,"content":30669,"nodeType":1043},{},[30670],{"data":30671,"content":30672,"nodeType":866},{},[30673,30676,30684],{"data":30674,"marks":30675,"value":21,"nodeType":865},{},[],{"data":30677,"content":30678,"nodeType":1102},{"uri":25850},[30679],{"data":30680,"marks":30681,"value":30683,"nodeType":865},{},[30682],{"type":4537},"SAT1011",{"data":30685,"marks":30686,"value":21,"nodeType":865},{},[],{"data":30688,"content":30689,"nodeType":1043},{},[30690],{"data":30691,"content":30692,"nodeType":866},{},[30693,30696,30704],{"data":30694,"marks":30695,"value":21,"nodeType":865},{},[],{"data":30697,"content":30699,"nodeType":1102},{"uri":30698},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/credential-stuffing",[30700],{"data":30701,"marks":30702,"value":333,"nodeType":865},{},[30703],{"type":4537},{"data":30705,"marks":30706,"value":21,"nodeType":865},{},[],{"data":30708,"content":30709,"nodeType":1043},{},[30710],{"data":30711,"content":30712,"nodeType":866},{},[30713],{"data":30714,"marks":30715,"value":30716,"nodeType":865},{},[],"Initial Access",{"data":30718,"content":30719,"nodeType":1043},{},[30720],{"data":30721,"content":30722,"nodeType":866},{},[30723],{"data":30724,"marks":30725,"value":30726,"nodeType":865},{},[],"Attempt to authenticate to a SaaS account by guessing a large number of passwords ",{"data":30728,"content":30729,"nodeType":1014},{},[30730,30750,30770,30780],{"data":30731,"content":30732,"nodeType":1043},{},[30733],{"data":30734,"content":30735,"nodeType":866},{},[30736,30739,30747],{"data":30737,"marks":30738,"value":21,"nodeType":865},{},[],{"data":30740,"content":30741,"nodeType":1102},{"uri":26442},[30742],{"data":30743,"marks":30744,"value":30746,"nodeType":865},{},[30745],{"type":4537},"SAT1027",{"data":30748,"marks":30749,"value":21,"nodeType":865},{},[],{"data":30751,"content":30752,"nodeType":1043},{},[30753],{"data":30754,"content":30755,"nodeType":866},{},[30756,30759,30767],{"data":30757,"marks":30758,"value":21,"nodeType":865},{},[],{"data":30760,"content":30762,"nodeType":1102},{"uri":30761},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/oauth-tokens",[30763],{"data":30764,"marks":30765,"value":26448,"nodeType":865},{},[30766],{"type":4537},{"data":30768,"marks":30769,"value":21,"nodeType":865},{},[],{"data":30771,"content":30772,"nodeType":1043},{},[30773],{"data":30774,"content":30775,"nodeType":866},{},[30776],{"data":30777,"marks":30778,"value":30779,"nodeType":865},{},[],"Execution; Persistence; Defense Evasion",{"data":30781,"content":30782,"nodeType":1043},{},[30783],{"data":30784,"content":30785,"nodeType":866},{},[30786],{"data":30787,"marks":30788,"value":30789,"nodeType":865},{},[],"Use a malicious OAuth app to create an OAuth token, using arbitrary permissions to maintain long-term programmatic access to a compromised user account.",{"data":30791,"content":30792,"nodeType":1014},{},[30793,30813,30834,30844],{"data":30794,"content":30795,"nodeType":1043},{},[30796],{"data":30797,"content":30798,"nodeType":866},{},[30799,30802,30810],{"data":30800,"marks":30801,"value":21,"nodeType":865},{},[],{"data":30803,"content":30804,"nodeType":1102},{"uri":26674},[30805],{"data":30806,"marks":30807,"value":30809,"nodeType":865},{},[30808],{"type":4537},"SAT1001",{"data":30811,"marks":30812,"value":21,"nodeType":865},{},[],{"data":30814,"content":30815,"nodeType":1043},{},[30816],{"data":30817,"content":30818,"nodeType":866},{},[30819,30822,30831],{"data":30820,"marks":30821,"value":21,"nodeType":865},{},[],{"data":30823,"content":30825,"nodeType":1102},{"uri":30824},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/abuse-existing-oauth-integrations",[30826],{"data":30827,"marks":30828,"value":30830,"nodeType":865},{},[30829],{"type":4537},"Abuse existing OAuth integrations",{"data":30832,"marks":30833,"value":21,"nodeType":865},{},[],{"data":30835,"content":30836,"nodeType":1043},{},[30837],{"data":30838,"content":30839,"nodeType":866},{},[30840],{"data":30841,"marks":30842,"value":30843,"nodeType":865},{},[],"Privilege Escalation;\nLateral Movement",{"data":30845,"content":30846,"nodeType":1043},{},[30847],{"data":30848,"content":30849,"nodeType":866},{},[30850],{"data":30851,"marks":30852,"value":30853,"nodeType":865},{},[],"If an adversary compromises a SaaS account integrated with other apps, they can escalate privileges and move laterally to other apps.",{"data":30855,"content":30856,"nodeType":1218},{},[30857],{"data":30858,"marks":30859,"value":30341,"nodeType":865},{},[],{"data":30861,"content":30862,"nodeType":866},{},[30863],{"data":30864,"marks":30865,"value":30867,"nodeType":865},{},[30866],{"type":946},"Hewlett Packard Enterprise (HPE) — May 2023",{"data":30869,"content":30870,"nodeType":866},{},[30871],{"data":30872,"marks":30873,"value":30874,"nodeType":865},{},[],"At the time of the Microsoft breach becoming public knowledge, HPE disclosed that they had become aware of a historical incident in Dec 2023, involving unauthorized access to and exfiltration of a limited number of SharePoint files as early as May 2023. Hackers accessed and exfiltrated data from HPE mailboxes belonging to individuals in the cybersecurity, go-to-market, business segments, and other functions. No further information is available on the techniques used or impact of the breach. ",{"data":30876,"content":30877,"nodeType":938},{},[],{"data":30879,"content":30880,"nodeType":948},{},[30881],{"data":30882,"marks":30883,"value":30884,"nodeType":865},{},[],"Okta — October 2023",{"data":30886,"content":30887,"nodeType":866},{},[30888],{"data":30889,"marks":30890,"value":30891,"nodeType":865},{},[],"An unknown threat group compromised an Okta employee's personal Google account that was being used on a company-managed device, granting the threat actor access to a service account for Okta’s customer support system, that included session tokens for 134 customers. This was then used to hijack the legitimate Okta sessions of five customers. ",{"data":30893,"content":30894,"nodeType":1218},{},[30895],{"data":30896,"marks":30897,"value":30898,"nodeType":865},{},[],"How did Okta get breached?",{"data":30900,"content":30901,"nodeType":891},{},[30902,30912,30922,30932,30942],{"data":30903,"content":30904,"nodeType":880},{},[30905],{"data":30906,"content":30907,"nodeType":866},{},[30908],{"data":30909,"marks":30910,"value":30911,"nodeType":865},{},[],"The threat actor compromised a personal Google account that the user had accessed from their Okta-managed work device by signing into their personal profile from the Chrome browser.",{"data":30913,"content":30914,"nodeType":880},{},[30915],{"data":30916,"content":30917,"nodeType":866},{},[30918],{"data":30919,"marks":30920,"value":30921,"nodeType":865},{},[],"The personal account credentials are likely to have been compromised in a historical data breach and did not have MFA enabled.",{"data":30923,"content":30924,"nodeType":880},{},[30925],{"data":30926,"content":30927,"nodeType":866},{},[30928],{"data":30929,"marks":30930,"value":30931,"nodeType":865},{},[],"The username and password of a service account for Okta’s customer support system had been saved into the employee’s personal Google account and was therefore compromised.",{"data":30933,"content":30934,"nodeType":880},{},[30935],{"data":30936,"content":30937,"nodeType":866},{},[30938],{"data":30939,"marks":30940,"value":30941,"nodeType":865},{},[],"The threat actor was able to access the service account by logging in using the stolen credentials, which again likely did not have MFA deployed as a service account.",{"data":30943,"content":30944,"nodeType":880},{},[30945],{"data":30946,"content":30947,"nodeType":866},{},[30948],{"data":30949,"marks":30950,"value":30951,"nodeType":865},{},[],"The threat actor was able to use session tokens in the HAR files to impersonate staff and hijack the legitimate Okta sessions of five customers, including 1Password, BeyondTrust, and Cloudflare.",{"data":30953,"content":30954,"nodeType":1218},{},[30955],{"data":30956,"marks":30957,"value":30958,"nodeType":865},{},[],"What was the impact of the Okta breach?",{"data":30960,"content":30961,"nodeType":891},{},[30962,30972,30982,30992],{"data":30963,"content":30964,"nodeType":880},{},[30965],{"data":30966,"content":30967,"nodeType":866},{},[30968],{"data":30969,"marks":30970,"value":30971,"nodeType":865},{},[],"The threat actor gained unauthorized access to files inside Okta’s customer support system associated with 134 Okta customers.",{"data":30973,"content":30974,"nodeType":880},{},[30975],{"data":30976,"content":30977,"nodeType":866},{},[30978],{"data":30979,"marks":30980,"value":30981,"nodeType":865},{},[],"The threat actor was able to use these session tokens to hijack the legitimate Okta sessions of 5 (publicly disclosed) customers.",{"data":30983,"content":30984,"nodeType":880},{},[30985],{"data":30986,"content":30987,"nodeType":866},{},[30988],{"data":30989,"marks":30990,"value":30991,"nodeType":865},{},[],"Okta originally claimed the breach had impacted only 1% of customers, but later found that a report run and downloaded by the threat actor contained the names and email addresses of all 18,400 Okta customer support users, as well as some Okta employee information, meaning 100% of customer support users were impacted.",{"data":30993,"content":30994,"nodeType":880},{},[30995],{"data":30996,"content":30997,"nodeType":866},{},[30998],{"data":30999,"marks":31000,"value":31001,"nodeType":865},{},[],"Okta users are at higher risk of phishing and credential stuffing attacks based on the data stolen by the threat actor, increasing the importance of robust MFA implementation.",{"data":31003,"content":31004,"nodeType":1218},{},[31005],{"data":31006,"marks":31007,"value":31008,"nodeType":865},{},[],"What stands out in the Okta breach?",{"data":31010,"content":31011,"nodeType":891},{},[31012,31022,31032],{"data":31013,"content":31014,"nodeType":880},{},[31015],{"data":31016,"content":31017,"nodeType":866},{},[31018],{"data":31019,"marks":31020,"value":31021,"nodeType":865},{},[],"This attack demonstrates the risk associated with cloud Identity Providers and the potential goldmine that they are to attackers. Much in the same way that the manufacturers of physical and virtual network appliances are continuously probed for software vulnerabilities, cloud IdPs like Okta present a huge potential opportunity, both in terms of targeting specific organizational instances as well as the Okta organization. This attack showcases the possibility of third-party supply chain attacks to target downstream organizations using IdP services. ",{"data":31023,"content":31024,"nodeType":880},{},[31025],{"data":31026,"content":31027,"nodeType":866},{},[31028],{"data":31029,"marks":31030,"value":31031,"nodeType":865},{},[],"Similar to the Microsoft breach, gaps were discovered and exploited in Okta’s MFA coverage and implementation, highlighting that there are gaps in even the most mature organizations. ",{"data":31033,"content":31034,"nodeType":880},{},[31035],{"data":31036,"content":31037,"nodeType":866},{},[31038],{"data":31039,"marks":31040,"value":31041,"nodeType":865},{},[],"The subsequent attack on Cloudflare (see below) and the scale of the recovery effort demonstrates the significant operational overhead in responding to and recovering from a breach of identity infrastructure, with a similar or greater scale than a traditional Active Directory compromise. While addressing the incident, Cloudflare's staff rotated all production credentials (over 5,000 unique ones), physically segmented test and staging systems, performed forensic triage on 4,893 systems, reimaged and rebooted all systems on the company's global network, including all Atlassian servers (Jira, Confluence, and Bitbucket) and machines accessed by the threat actor. All equipment in Cloudflare's Brazil data center, which was unsuccessfully targeted by the threat actor, was later returned to the manufacturers to ensure that the data center was secure.",{"data":31043,"content":31044,"nodeType":1218},{},[31045],{"data":31046,"marks":31047,"value":30156,"nodeType":865},{},[],{"data":31049,"content":31050,"nodeType":866},{},[31051],{"data":31052,"marks":31053,"value":30163,"nodeType":865},{},[],{"data":31055,"content":31056,"nodeType":1197},{},[31057,31096,31155],{"data":31058,"content":31059,"nodeType":1014},{},[31060,31069,31078,31087],{"data":31061,"content":31062,"nodeType":1002},{},[31063],{"data":31064,"content":31065,"nodeType":866},{},[31066],{"data":31067,"marks":31068,"value":30179,"nodeType":865},{},[],{"data":31070,"content":31071,"nodeType":1002},{},[31072],{"data":31073,"content":31074,"nodeType":866},{},[31075],{"data":31076,"marks":31077,"value":30645,"nodeType":865},{},[],{"data":31079,"content":31080,"nodeType":1002},{},[31081],{"data":31082,"content":31083,"nodeType":866},{},[31084],{"data":31085,"marks":31086,"value":30199,"nodeType":865},{},[],{"data":31088,"content":31089,"nodeType":1002},{},[31090],{"data":31091,"content":31092,"nodeType":866},{},[31093],{"data":31094,"marks":31095,"value":30209,"nodeType":865},{},[],{"data":31097,"content":31098,"nodeType":1014},{},[31099,31118,31137,31146],{"data":31100,"content":31101,"nodeType":1043},{},[31102],{"data":31103,"content":31104,"nodeType":866},{},[31105,31108,31115],{"data":31106,"marks":31107,"value":21,"nodeType":865},{},[],{"data":31109,"content":31110,"nodeType":1102},{"uri":25850},[31111],{"data":31112,"marks":31113,"value":30683,"nodeType":865},{},[31114],{"type":4537},{"data":31116,"marks":31117,"value":21,"nodeType":865},{},[],{"data":31119,"content":31120,"nodeType":1043},{},[31121],{"data":31122,"content":31123,"nodeType":866},{},[31124,31127,31134],{"data":31125,"marks":31126,"value":21,"nodeType":865},{},[],{"data":31128,"content":31129,"nodeType":1102},{"uri":30698},[31130],{"data":31131,"marks":31132,"value":333,"nodeType":865},{},[31133],{"type":4537},{"data":31135,"marks":31136,"value":21,"nodeType":865},{},[],{"data":31138,"content":31139,"nodeType":1043},{},[31140],{"data":31141,"content":31142,"nodeType":866},{},[31143],{"data":31144,"marks":31145,"value":30716,"nodeType":865},{},[],{"data":31147,"content":31148,"nodeType":1043},{},[31149],{"data":31150,"content":31151,"nodeType":866},{},[31152],{"data":31153,"marks":31154,"value":30726,"nodeType":865},{},[],{"data":31156,"content":31157,"nodeType":1014},{},[31158,31179,31200,31210],{"data":31159,"content":31160,"nodeType":1043},{},[31161],{"data":31162,"content":31163,"nodeType":866},{},[31164,31167,31176],{"data":31165,"marks":31166,"value":21,"nodeType":865},{},[],{"data":31168,"content":31170,"nodeType":1102},{"uri":31169},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/password_scraping/description.md",[31171],{"data":31172,"marks":31173,"value":31175,"nodeType":865},{},[31174],{"type":4537},"SAT1028",{"data":31177,"marks":31178,"value":21,"nodeType":865},{},[],{"data":31180,"content":31181,"nodeType":1043},{},[31182],{"data":31183,"content":31184,"nodeType":866},{},[31185,31188,31197],{"data":31186,"marks":31187,"value":21,"nodeType":865},{},[],{"data":31189,"content":31191,"nodeType":1102},{"uri":31190},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/password-scraping",[31192],{"data":31193,"marks":31194,"value":31196,"nodeType":865},{},[31195],{"type":4537},"Password Scraping",{"data":31198,"marks":31199,"value":21,"nodeType":865},{},[],{"data":31201,"content":31202,"nodeType":1043},{},[31203],{"data":31204,"content":31205,"nodeType":866},{},[31206],{"data":31207,"marks":31208,"value":31209,"nodeType":865},{},[],"Credential Access",{"data":31211,"content":31212,"nodeType":1043},{},[31213],{"data":31214,"content":31215,"nodeType":866},{},[31216],{"data":31217,"marks":31218,"value":31219,"nodeType":865},{},[],"Collection of credentials and secrets from repositories e.g. password managers, SaaS file stores, etc.",{"data":31221,"content":31222,"nodeType":1218},{},[31223],{"data":31224,"marks":31225,"value":30341,"nodeType":865},{},[],{"data":31227,"content":31228,"nodeType":866},{},[31229],{"data":31230,"marks":31231,"value":31233,"nodeType":865},{},[31232],{"type":946},"Cloudflare — November 2023",{"data":31235,"content":31236,"nodeType":866},{},[31237],{"data":31238,"marks":31239,"value":31240,"nodeType":865},{},[],"The threat actor used tokens and credentials that had not been rotated to breach Cloudflare’s internal Atlassian server and access its Confluence wiki, Jira bug database, and Bitbucket source code management system. The threat actor first gained access to Cloudflare's self-hosted Atlassian server and then accessed the company's Confluence and Jira systems following a reconnaissance stage. Cloudflare says that this breach did not impact customer data or systems or the provision of services.",{"data":31242,"content":31243,"nodeType":866},{},[31244],{"data":31245,"marks":31246,"value":31248,"nodeType":865},{},[31247],{"type":946},"1Password — October 2023",{"data":31250,"content":31251,"nodeType":866},{},[31252],{"data":31253,"marks":31254,"value":31255,"nodeType":865},{},[],"1Password reported unsolicited activity in their Okta environment which was traced to a suspicious IP address. Later it was confirmed that an threat actor had accessed 1Password’s Okta environment using administrative privileges. They attempted to access the IT team member’s user dashboard, but that attempt was blocked by Okta. They also requested a report of administrative users, which was identified as suspicious and triggered an investigation. 1Password says it terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.",{"data":31257,"content":31258,"nodeType":866},{},[31259],{"data":31260,"marks":31261,"value":31263,"nodeType":865},{},[31262],{"type":946},"BeyondTrust - October 2023",{"data":31265,"content":31266,"nodeType":866},{},[31267],{"data":31268,"marks":31269,"value":31270,"nodeType":865},{},[],"BeyondTrust security teams detected an identity-centric attack on an in-house Okta administrator account. BeyondTrust blocked all access to the threat actor, and verified that they did not gain access to any systems. BeyondTrust has confirmed that there was no additional exposure to our internal systems or BeyondTrust’s customers.",{"data":31272,"content":31273,"nodeType":938},{},[],{"data":31275,"content":31276,"nodeType":948},{},[31277],{"data":31278,"marks":31279,"value":31280,"nodeType":865},{},[],"MGM Resorts — September 2023",{"data":31282,"content":31283,"nodeType":866},{},[31284],{"data":31285,"marks":31286,"value":31287,"nodeType":865},{},[],"The threat group known as Scattered Spider socially engineered MGM help desk personnel to grant ‘super admin’ access to the Okta tenant, which was then used to steal data and deploy ransomware, resulting in significant business disruption. ",{"data":31289,"content":31290,"nodeType":1218},{},[31291],{"data":31292,"marks":31293,"value":31294,"nodeType":865},{},[],"How did MGM get breached?",{"data":31296,"content":31297,"nodeType":891},{},[31298,31308,31318,31328,31338,31348],{"data":31299,"content":31300,"nodeType":880},{},[31301],{"data":31302,"content":31303,"nodeType":866},{},[31304],{"data":31305,"marks":31306,"value":31307,"nodeType":865},{},[],"Scattered Spider researched MGM employees on LinkedIn to identify individuals likely to have privileged Okta access, specifically Super Administrator privileges. ",{"data":31309,"content":31310,"nodeType":880},{},[31311],{"data":31312,"content":31313,"nodeType":866},{},[31314],{"data":31315,"marks":31316,"value":31317,"nodeType":865},{},[],"Scattered Spider contacted the IT help desk impersonating an employee with a privileged account asking for an authentication reset (password and MFA).",{"data":31319,"content":31320,"nodeType":880},{},[31321],{"data":31322,"content":31323,"nodeType":866},{},[31324],{"data":31325,"marks":31326,"value":31327,"nodeType":865},{},[],"With privileged access, the compromised Super Administrator accounts were used to assign higher privileges to other accounts, circumventing MFA by removing enrolled authenticators and/or removing MFA from authentication policies.",{"data":31329,"content":31330,"nodeType":880},{},[31331],{"data":31332,"content":31333,"nodeType":866},{},[31334],{"data":31335,"marks":31336,"value":31337,"nodeType":865},{},[],"Scattered Spider registered a second, attacker-controlled IdP via Org2Org using inbound federation, granting the ability to impersonate users and access applications on their behalf. By matching the username of target accounts in the second IdP to the original, the attacker was able to SSO into target applications. ",{"data":31339,"content":31340,"nodeType":880},{},[31341],{"data":31342,"content":31343,"nodeType":866},{},[31344],{"data":31345,"marks":31346,"value":31347,"nodeType":865},{},[],"Through inbound federation, Scattered Spider obtained global admin rights in Azure, effectively granting full control over connected systems and granting domain admin privileges in target environments.",{"data":31349,"content":31350,"nodeType":880},{},[31351],{"data":31352,"content":31353,"nodeType":866},{},[31354],{"data":31355,"marks":31356,"value":31357,"nodeType":865},{},[],"Scattered Spider deployed encryption software to around 100 ESXi servers and exfiltrated data, disrupting core business operations.",{"data":31359,"content":31360,"nodeType":1218},{},[31361],{"data":31362,"marks":31363,"value":31364,"nodeType":865},{},[],"What was the impact of the MGM breach?",{"data":31366,"content":31367,"nodeType":891},{},[31368,31378,31388],{"data":31369,"content":31370,"nodeType":880},{},[31371],{"data":31372,"content":31373,"nodeType":866},{},[31374],{"data":31375,"marks":31376,"value":31377,"nodeType":865},{},[],"Led to a 36-hour outage of multiple MGM IT systems and affected a number of its casinos on the Las Vegas strip, including the Bellagio, Excalibur, Luxor, Mandalay Bay and New York New York.",{"data":31379,"content":31380,"nodeType":880},{},[31381],{"data":31382,"content":31383,"nodeType":866},{},[31384],{"data":31385,"marks":31386,"value":31387,"nodeType":865},{},[],"Personal data compromise of an unspecified number of customers including various contact information, dates of births, genders, driver’s license numbers, social security numbers, and passport information. ",{"data":31389,"content":31390,"nodeType":880},{},[31391],{"data":31392,"content":31393,"nodeType":866},{},[31394],{"data":31395,"marks":31396,"value":31397,"nodeType":865},{},[],"MGM reported that the attack would cause a $100 million hit to its third-quarter results, including $10 million in one-time cyber security consulting fees. ",{"data":31399,"content":31400,"nodeType":1218},{},[31401],{"data":31402,"marks":31403,"value":31404,"nodeType":865},{},[],"What stands out in the MGM breach?",{"data":31406,"content":31407,"nodeType":891},{},[31408,31418,31428],{"data":31409,"content":31410,"nodeType":880},{},[31411],{"data":31412,"content":31413,"nodeType":866},{},[31414],{"data":31415,"marks":31416,"value":31417,"nodeType":865},{},[],"The MGM breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":31419,"content":31420,"nodeType":880},{},[31421],{"data":31422,"content":31423,"nodeType":866},{},[31424],{"data":31425,"marks":31426,"value":31427,"nodeType":865},{},[],"The MGM breach is notable for being a hybrid attack that ended in what has become a typical “actions on objective” for ransomware operators and their affiliates - the propagation of malware and encryption of core business servers. In this way attackers are leveraging the newer functionality that cloud services provide them to target non-cloud/on-premise resources. This potentially indicates that attackers see cloud applications and services as the path of least resistance to achieving their goals, exploiting more limited security team visibility and understanding of these services compared to more traditional (now well protected) targets. ",{"data":31429,"content":31430,"nodeType":880},{},[31431],{"data":31432,"content":31433,"nodeType":866},{},[31434],{"data":31435,"marks":31436,"value":31437,"nodeType":865},{},[],"While attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (vishing) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":31439,"content":31440,"nodeType":1218},{},[31441],{"data":31442,"marks":31443,"value":30156,"nodeType":865},{},[],{"data":31445,"content":31446,"nodeType":866},{},[31447],{"data":31448,"marks":31449,"value":30163,"nodeType":865},{},[],{"data":31451,"content":31452,"nodeType":1197},{},[31453,31492],{"data":31454,"content":31455,"nodeType":1014},{},[31456,31465,31474,31483],{"data":31457,"content":31458,"nodeType":1002},{},[31459],{"data":31460,"content":31461,"nodeType":866},{},[31462],{"data":31463,"marks":31464,"value":30179,"nodeType":865},{},[],{"data":31466,"content":31467,"nodeType":1002},{},[31468],{"data":31469,"content":31470,"nodeType":866},{},[31471],{"data":31472,"marks":31473,"value":30645,"nodeType":865},{},[],{"data":31475,"content":31476,"nodeType":1002},{},[31477],{"data":31478,"content":31479,"nodeType":866},{},[31480],{"data":31481,"marks":31482,"value":30199,"nodeType":865},{},[],{"data":31484,"content":31485,"nodeType":1002},{},[31486],{"data":31487,"content":31488,"nodeType":866},{},[31489],{"data":31490,"marks":31491,"value":30209,"nodeType":865},{},[],{"data":31493,"content":31494,"nodeType":1014},{},[31495,31515,31536,31546],{"data":31496,"content":31497,"nodeType":1043},{},[31498],{"data":31499,"content":31500,"nodeType":866},{},[31501,31504,31512],{"data":31502,"marks":31503,"value":21,"nodeType":865},{},[],{"data":31505,"content":31506,"nodeType":1102},{"uri":5533},[31507],{"data":31508,"marks":31509,"value":31511,"nodeType":865},{},[31510],{"type":4537},"SAT1041",{"data":31513,"marks":31514,"value":21,"nodeType":865},{},[],{"data":31516,"content":31517,"nodeType":1043},{},[31518],{"data":31519,"content":31520,"nodeType":866},{},[31521,31524,31533],{"data":31522,"marks":31523,"value":21,"nodeType":865},{},[],{"data":31525,"content":31527,"nodeType":1102},{"uri":31526},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/inbound-federation",[31528],{"data":31529,"marks":31530,"value":31532,"nodeType":865},{},[31531],{"type":4537},"Inbound Federation",{"data":31534,"marks":31535,"value":21,"nodeType":865},{},[],{"data":31537,"content":31538,"nodeType":1043},{},[31539],{"data":31540,"content":31541,"nodeType":866},{},[31542],{"data":31543,"marks":31544,"value":31545,"nodeType":865},{},[],"Persistence; Lateral Movement",{"data":31547,"content":31548,"nodeType":1043},{},[31549],{"data":31550,"content":31551,"nodeType":866},{},[31552],{"data":31553,"marks":31554,"value":31555,"nodeType":865},{},[],"Inbound federation allows users to login to a target identity provider by authenticating with a source identity provider",{"data":31557,"content":31558,"nodeType":938},{},[],{"data":31560,"content":31561,"nodeType":948},{},[31562],{"data":31563,"marks":31564,"value":31565,"nodeType":865},{},[],"Retool — August 2023",{"data":31567,"content":31568,"nodeType":866},{},[31569],{"data":31570,"marks":31571,"value":31572,"nodeType":865},{},[],"Software development company Retool disclosed that the accounts of 27 of its cloud customers were compromised following a targeted SMS-based social engineering attack, which was enabled by Google Authenticator’s default synchronization of MFA tokens with the associated Google account.  ",{"data":31574,"content":31575,"nodeType":1218},{},[31576],{"data":31577,"marks":31578,"value":31579,"nodeType":865},{},[],"How did Retool get breached?",{"data":31581,"content":31582,"nodeType":891},{},[31583,31593,31603,31613,31623,31633],{"data":31584,"content":31585,"nodeType":880},{},[31586],{"data":31587,"content":31588,"nodeType":866},{},[31589],{"data":31590,"marks":31591,"value":31592,"nodeType":865},{},[],"The threat actor launched a targeted SMS-based phishing campaign against Retool employees with a custom lure relating to their workplace healthcare coverage.",{"data":31594,"content":31595,"nodeType":880},{},[31596],{"data":31597,"content":31598,"nodeType":866},{},[31599],{"data":31600,"marks":31601,"value":31602,"nodeType":865},{},[],"The timing coincided with a recently announced migration of logins to Okta, and the message contained a url disguised to look like their internal identity portal.",{"data":31604,"content":31605,"nodeType":880},{},[31606],{"data":31607,"content":31608,"nodeType":866},{},[31609],{"data":31610,"marks":31611,"value":31612,"nodeType":865},{},[],"After logging into the fake portal – which included an MFA form – the threat actor called the employee impersonating an IT team member, deepfaking the IT employee’s real voice and using real information about the company to build trust.",{"data":31614,"content":31615,"nodeType":880},{},[31616],{"data":31617,"content":31618,"nodeType":866},{},[31619],{"data":31620,"marks":31621,"value":31622,"nodeType":865},{},[],"The phished employee shared an MFA OTP token which allowed the threat actor to add their own personal device to the employee’s Okta account and enabled their own Okta MFA from that point forward.",{"data":31624,"content":31625,"nodeType":880},{},[31626],{"data":31627,"content":31628,"nodeType":866},{},[31629],{"data":31630,"marks":31631,"value":31632,"nodeType":865},{},[],"Due to the Google Authenticator synchronization feature that syncs MFA codes to the cloud by default, meaning that access to a Google account immediately gave access to all MFA tokens held within that account.",{"data":31634,"content":31635,"nodeType":880},{},[31636],{"data":31637,"content":31638,"nodeType":866},{},[31639],{"data":31640,"marks":31641,"value":31642,"nodeType":865},{},[],"This enabled the threat actor to take over a number of identities associated with a range of target apps and change the credentials.",{"data":31644,"content":31645,"nodeType":1218},{},[31646],{"data":31647,"marks":31648,"value":31649,"nodeType":865},{},[],"What was the impact of the Retool breach?",{"data":31651,"content":31652,"nodeType":891},{},[31653,31663,31673],{"data":31654,"content":31655,"nodeType":880},{},[31656],{"data":31657,"content":31658,"nodeType":866},{},[31659],{"data":31660,"marks":31661,"value":31662,"nodeType":865},{},[],"A total of 27 customers were impacted, with the threat actor specifically targeting customers in the Crypto industry.",{"data":31664,"content":31665,"nodeType":880},{},[31666],{"data":31667,"content":31668,"nodeType":866},{},[31669],{"data":31670,"marks":31671,"value":31672,"nodeType":865},{},[],"After taking over the accounts, the threat actor was observed gathering information and exploring the Retool apps.",{"data":31674,"content":31675,"nodeType":880},{},[31676],{"data":31677,"content":31678,"nodeType":866},{},[31679],{"data":31680,"marks":31681,"value":31682,"nodeType":865},{},[],"After learning of the attack, Retool revoked all internal authenticated sessions (Okta, GSuite, etc.) for employees, locked down access to the affected accounts, notified the affected customers, and restored their accounts to their original state.",{"data":31684,"content":31685,"nodeType":1218},{},[31686],{"data":31687,"marks":31688,"value":31689,"nodeType":865},{},[],"What stands out in the Retool breach?",{"data":31691,"content":31692,"nodeType":891},{},[31693,31703,31713],{"data":31694,"content":31695,"nodeType":880},{},[31696],{"data":31697,"content":31698,"nodeType":866},{},[31699],{"data":31700,"marks":31701,"value":31702,"nodeType":865},{},[],"Like the MGM breach, the Retool breach demonstrates how financially motivated organized criminal groups are specifically targeting the identity infrastructure of an organization (e.g. the chosen IdP solution) and leveraging cloud-native functionality. ",{"data":31704,"content":31705,"nodeType":880},{},[31706],{"data":31707,"content":31708,"nodeType":866},{},[31709],{"data":31710,"marks":31711,"value":31712,"nodeType":865},{},[],"A further similarity with the MGM breach, while attackers were focused on taking control of the cloud IdP, the initial access vector was notable for being a more traditional method (SMS phishing in this case) to bypass the need to acquire credentials (password and MFA token). This type of technique remains consistently effective, regardless of the technology landscape and whether MFA is correctly implemented or not.    ",{"data":31714,"content":31715,"nodeType":880},{},[31716],{"data":31717,"content":31718,"nodeType":866},{},[31719],{"data":31720,"marks":31721,"value":31722,"nodeType":865},{},[],"In this case, the attacker abused inherent weaknesses in Google Authenticator, which came under fire following the breach for its default synchronization of MFA codes to the cloud when connected to an account, in order to move laterally and compromise other target apps. ",{"data":31724,"content":31725,"nodeType":1218},{},[31726],{"data":31727,"marks":31728,"value":30156,"nodeType":865},{},[],{"data":31730,"content":31731,"nodeType":866},{},[31732],{"data":31733,"marks":31734,"value":30163,"nodeType":865},{},[],{"data":31736,"content":31737,"nodeType":1197},{},[31738,31777,31842],{"data":31739,"content":31740,"nodeType":1014},{},[31741,31750,31759,31768],{"data":31742,"content":31743,"nodeType":1002},{},[31744],{"data":31745,"content":31746,"nodeType":866},{},[31747],{"data":31748,"marks":31749,"value":30179,"nodeType":865},{},[],{"data":31751,"content":31752,"nodeType":1002},{},[31753],{"data":31754,"content":31755,"nodeType":866},{},[31756],{"data":31757,"marks":31758,"value":30645,"nodeType":865},{},[],{"data":31760,"content":31761,"nodeType":1002},{},[31762],{"data":31763,"content":31764,"nodeType":866},{},[31765],{"data":31766,"marks":31767,"value":30199,"nodeType":865},{},[],{"data":31769,"content":31770,"nodeType":1002},{},[31771],{"data":31772,"content":31773,"nodeType":866},{},[31774],{"data":31775,"marks":31776,"value":30209,"nodeType":865},{},[],{"data":31778,"content":31779,"nodeType":1014},{},[31780,31801,31823,31832],{"data":31781,"content":31782,"nodeType":1043},{},[31783],{"data":31784,"content":31785,"nodeType":866},{},[31786,31790,31798],{"data":31787,"marks":31788,"value":21,"nodeType":865},{},[31789],{"type":4537},{"data":31791,"content":31792,"nodeType":1102},{"uri":14243},[31793],{"data":31794,"marks":31795,"value":31797,"nodeType":865},{},[31796],{"type":4537},"SAT1042",{"data":31799,"marks":31800,"value":21,"nodeType":865},{},[],{"data":31802,"content":31803,"nodeType":1043},{},[31804],{"data":31805,"content":31806,"nodeType":866},{},[31807,31811,31820],{"data":31808,"marks":31809,"value":21,"nodeType":865},{},[31810],{"type":4537},{"data":31812,"content":31814,"nodeType":1102},{"uri":31813},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/aitm-phishing",[31815],{"data":31816,"marks":31817,"value":31819,"nodeType":865},{},[31818],{"type":4537},"AiTM Phishing",{"data":31821,"marks":31822,"value":21,"nodeType":865},{},[],{"data":31824,"content":31825,"nodeType":1043},{},[31826],{"data":31827,"content":31828,"nodeType":866},{},[31829],{"data":31830,"marks":31831,"value":30716,"nodeType":865},{},[],{"data":31833,"content":31834,"nodeType":1043},{},[31835],{"data":31836,"content":31837,"nodeType":866},{},[31838],{"data":31839,"marks":31840,"value":31841,"nodeType":865},{},[],"Attacker-in-the-Middle (AiTM) phishing uses dedicated tooling to act as a web proxy between the victim and a legitimate login portal for an application the victim has access to, principally to make it easier to defeat MFA protection.",{"data":31843,"content":31844,"nodeType":1014},{},[31845,31866,31889,31899],{"data":31846,"content":31847,"nodeType":1043},{},[31848],{"data":31849,"content":31850,"nodeType":866},{},[31851,31854,31863],{"data":31852,"marks":31853,"value":21,"nodeType":865},{},[],{"data":31855,"content":31857,"nodeType":1102},{"uri":31856},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/device_enrollment/description.md",[31858],{"data":31859,"marks":31860,"value":31862,"nodeType":865},{},[31861],{"type":4537},"SAT1043",{"data":31864,"marks":31865,"value":21,"nodeType":865},{},[],{"data":31867,"content":31868,"nodeType":1043},{},[31869],{"data":31870,"content":31871,"nodeType":866},{},[31872,31876,31885],{"data":31873,"marks":31874,"value":21,"nodeType":865},{},[31875],{"type":4537},{"data":31877,"content":31879,"nodeType":1102},{"uri":31878},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/device-enrollment",[31880],{"data":31881,"marks":31882,"value":31884,"nodeType":865},{},[31883],{"type":4537},"Device Enrollment",{"data":31886,"marks":31887,"value":21,"nodeType":865},{},[31888],{"type":4537},{"data":31890,"content":31891,"nodeType":1043},{},[31892],{"data":31893,"content":31894,"nodeType":866},{},[31895],{"data":31896,"marks":31897,"value":31898,"nodeType":865},{},[],"Initial Access; Persistence",{"data":31900,"content":31901,"nodeType":1043},{},[31902],{"data":31903,"content":31904,"nodeType":866},{},[31905],{"data":31906,"marks":31907,"value":31908,"nodeType":865},{},[],"Enrollment of a new MFA device in order to allow an adversary to complete MFA challenges for future authentication. ",{"data":31910,"content":31911,"nodeType":938},{},[],{"data":31913,"content":31914,"nodeType":948},{},[31915],{"data":31916,"marks":31917,"value":31918,"nodeType":865},{},[],"GitHub / Heroku / Travis-CI / npm — April 2022",{"data":31920,"content":31921,"nodeType":866},{},[31922],{"data":31923,"marks":31924,"value":31925,"nodeType":865},{},[],"An unknown threat actor used stolen OAuth user tokens (issued to Heroku and Travis-CI) to download data from private repositories. The threat actor then compromised an internal Heroku customer database as well as accessed and stole data from dozens of downstream organizations using Heroku and Travis-CI-maintained OAuth apps.",{"data":31927,"content":31928,"nodeType":1218},{},[31929],{"data":31930,"marks":31931,"value":31932,"nodeType":865},{},[],"How did they get breached?",{"data":31934,"content":31935,"nodeType":891},{},[31936,31946,31956,31966,31976,31986,31996],{"data":31937,"content":31938,"nodeType":880},{},[31939],{"data":31940,"content":31941,"nodeType":866},{},[31942],{"data":31943,"marks":31944,"value":31945,"nodeType":865},{},[],"The threat actor obtained access to two third-party OAuth integrators, Heroku and Travis-CI, accessing databases and downloading stored customer GitHub integration OAuth tokens. These tokens had earlier been used by Travis-CI and Heroku OAuth applications to integrate with GitHub to deploy applications.",{"data":31947,"content":31948,"nodeType":880},{},[31949],{"data":31950,"content":31951,"nodeType":866},{},[31952],{"data":31953,"marks":31954,"value":31955,"nodeType":865},{},[],"Access to the environment was gained by leveraging a compromised token for a Heroku machine account, but it is not disclosed how the threat actor achieved this. ",{"data":31957,"content":31958,"nodeType":880},{},[31959],{"data":31960,"content":31961,"nodeType":866},{},[31962],{"data":31963,"marks":31964,"value":31965,"nodeType":865},{},[],"The threat actor authenticated to the GitHub API using the stolen OAuth tokens issued to Heroku and Travis CI.",{"data":31967,"content":31968,"nodeType":880},{},[31969],{"data":31970,"content":31971,"nodeType":866},{},[31972],{"data":31973,"marks":31974,"value":31975,"nodeType":865},{},[],"For users who had the affected Heroku or Travis CI OAuth apps authorized in their GitHub accounts, the threat actor listed all the user's organizations.",{"data":31977,"content":31978,"nodeType":880},{},[31979],{"data":31980,"content":31981,"nodeType":866},{},[31982],{"data":31983,"marks":31984,"value":31985,"nodeType":865},{},[],"The threat actor then selected targets based on the listed organizations.",{"data":31987,"content":31988,"nodeType":880},{},[31989],{"data":31990,"content":31991,"nodeType":866},{},[31992],{"data":31993,"marks":31994,"value":31995,"nodeType":865},{},[],"The threat actor listed the private repositories for user accounts of interest and proceeded to clone private repositories of interest.",{"data":31997,"content":31998,"nodeType":880},{},[31999],{"data":32000,"content":32001,"nodeType":866},{},[32002],{"data":32003,"marks":32004,"value":32005,"nodeType":865},{},[],"GitHub identified unauthorized access to their npm production infrastructure using a compromised AWS API key, obtained by the threat actor when they downloaded a set of private npm repositories using a stolen OAuth token from one of the two affected third-party OAuth applications.",{"data":32007,"content":32008,"nodeType":1218},{},[32009],{"data":32010,"marks":32011,"value":32012,"nodeType":865},{},[],"What was the impact?",{"data":32014,"content":32015,"nodeType":891},{},[32016,32026,32036],{"data":32017,"content":32018,"nodeType":880},{},[32019],{"data":32020,"content":32021,"nodeType":866},{},[32022],{"data":32023,"marks":32024,"value":32025,"nodeType":865},{},[],"By stealing these OAuth tokens, the threat actor could access and download data from GitHub repositories belonging to those who authorized the compromised Heroku or Travis CI OAuth apps with their accounts. ",{"data":32027,"content":32028,"nodeType":880},{},[32029],{"data":32030,"content":32031,"nodeType":866},{},[32032],{"data":32033,"marks":32034,"value":32035,"nodeType":865},{},[],"The threat actor was able to mine the downloaded private repositories for secrets that could be used to pivot to other infrastructure, stealing data from dozens of organizations. ",{"data":32037,"content":32038,"nodeType":880},{},[32039],{"data":32040,"content":32041,"nodeType":866},{},[32042],{"data":32043,"marks":32044,"value":32045,"nodeType":865},{},[],"In addition to user repo’s downstream, the compromised token for a Heroku machine account obtained by threat actors also allowed unauthorized access into Heroku's internal database of customer accounts, enabling the threat actor to extract the hashed and salted passwords. ",{"data":32047,"content":32048,"nodeType":1218},{},[32049],{"data":32050,"marks":32051,"value":32052,"nodeType":865},{},[],"What stands out in the Github breach?",{"data":32054,"content":32055,"nodeType":891},{},[32056,32066,32076],{"data":32057,"content":32058,"nodeType":880},{},[32059],{"data":32060,"content":32061,"nodeType":866},{},[32062],{"data":32063,"marks":32064,"value":32065,"nodeType":865},{},[],"Similar to the Okta breach, this attack showcases the possibility of third-party supply chain attacks to target downstream organizations using cloud SaaS services. In this case, targeting OAuth integrators as opposed to IdP providers, but with a similar goal and impact of compromising the real target organizations downstream. ",{"data":32067,"content":32068,"nodeType":880},{},[32069],{"data":32070,"content":32071,"nodeType":866},{},[32072],{"data":32073,"marks":32074,"value":32075,"nodeType":865},{},[],"Applications like Github are an obvious target for attackers due to their widespread adoption. There have been numerous attacks leveraging Github as the vehicle for attacks by compromising repo’s to insert malicious code, or registering malicious copycat repo’s to dupe users into using them. ",{"data":32077,"content":32078,"nodeType":880},{},[32079],{"data":32080,"content":32081,"nodeType":866},{},[32082],{"data":32083,"marks":32084,"value":32085,"nodeType":865},{},[],"Unlike the attacks abusing the functionality of Github (repo poisoning) which target the legitimate developer processes when using the app, this attack could have been prevented at the identity layer before the attacker was able to breach the Heroku/Travis-CI accounts. ",{"data":32087,"content":32088,"nodeType":1218},{},[32089],{"data":32090,"marks":32091,"value":30156,"nodeType":865},{},[],{"data":32093,"content":32094,"nodeType":866},{},[32095],{"data":32096,"marks":32097,"value":30163,"nodeType":865},{},[],{"data":32099,"content":32100,"nodeType":1197},{},[32101,32140,32200,32263],{"data":32102,"content":32103,"nodeType":1014},{},[32104,32113,32122,32131],{"data":32105,"content":32106,"nodeType":1002},{},[32107],{"data":32108,"content":32109,"nodeType":866},{},[32110],{"data":32111,"marks":32112,"value":30179,"nodeType":865},{},[],{"data":32114,"content":32115,"nodeType":1002},{},[32116],{"data":32117,"content":32118,"nodeType":866},{},[32119],{"data":32120,"marks":32121,"value":30645,"nodeType":865},{},[],{"data":32123,"content":32124,"nodeType":1002},{},[32125],{"data":32126,"content":32127,"nodeType":866},{},[32128],{"data":32129,"marks":32130,"value":30199,"nodeType":865},{},[],{"data":32132,"content":32133,"nodeType":1002},{},[32134],{"data":32135,"content":32136,"nodeType":866},{},[32137],{"data":32138,"marks":32139,"value":30209,"nodeType":865},{},[],{"data":32141,"content":32142,"nodeType":1014},{},[32143,32162,32181,32191],{"data":32144,"content":32145,"nodeType":1043},{},[32146],{"data":32147,"content":32148,"nodeType":866},{},[32149,32152,32159],{"data":32150,"marks":32151,"value":21,"nodeType":865},{},[],{"data":32153,"content":32154,"nodeType":1102},{"uri":26674},[32155],{"data":32156,"marks":32157,"value":30809,"nodeType":865},{},[32158],{"type":4537},{"data":32160,"marks":32161,"value":21,"nodeType":865},{},[],{"data":32163,"content":32164,"nodeType":1043},{},[32165],{"data":32166,"content":32167,"nodeType":866},{},[32168,32171,32178],{"data":32169,"marks":32170,"value":21,"nodeType":865},{},[],{"data":32172,"content":32173,"nodeType":1102},{"uri":30824},[32174],{"data":32175,"marks":32176,"value":30830,"nodeType":865},{},[32177],{"type":4537},{"data":32179,"marks":32180,"value":21,"nodeType":865},{},[],{"data":32182,"content":32183,"nodeType":1043},{},[32184],{"data":32185,"content":32186,"nodeType":866},{},[32187],{"data":32188,"marks":32189,"value":32190,"nodeType":865},{},[],"Privilege Escalation; Lateral Movement",{"data":32192,"content":32193,"nodeType":1043},{},[32194],{"data":32195,"content":32196,"nodeType":866},{},[32197],{"data":32198,"marks":32199,"value":30853,"nodeType":865},{},[],{"data":32201,"content":32202,"nodeType":1014},{},[32203,32223,32243,32253],{"data":32204,"content":32205,"nodeType":1043},{},[32206],{"data":32207,"content":32208,"nodeType":866},{},[32209,32212,32220],{"data":32210,"marks":32211,"value":21,"nodeType":865},{},[],{"data":32213,"content":32214,"nodeType":1102},{"uri":6472},[32215],{"data":32216,"marks":32217,"value":32219,"nodeType":865},{},[32218],{"type":4537},"SAT1004",{"data":32221,"marks":32222,"value":21,"nodeType":865},{},[],{"data":32224,"content":32225,"nodeType":1043},{},[32226],{"data":32227,"content":32228,"nodeType":866},{},[32229,32232,32240],{"data":32230,"marks":32231,"value":21,"nodeType":865},{},[],{"data":32233,"content":32235,"nodeType":1102},{"uri":32234},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/api-keys",[32236],{"data":32237,"marks":32238,"value":26459,"nodeType":865},{},[32239],{"type":4537},{"data":32241,"marks":32242,"value":21,"nodeType":865},{},[],{"data":32244,"content":32245,"nodeType":1043},{},[32246],{"data":32247,"content":32248,"nodeType":866},{},[32249],{"data":32250,"marks":32251,"value":32252,"nodeType":865},{},[],"Persistence; Defense Evasion",{"data":32254,"content":32255,"nodeType":1043},{},[32256],{"data":32257,"content":32258,"nodeType":866},{},[32259],{"data":32260,"marks":32261,"value":32262,"nodeType":865},{},[],"An adversary that has compromised an account could then read existing API keys from the app settings, if the app allows this, or create a new API key.",{"data":32264,"content":32265,"nodeType":1014},{},[32266,32287,32308,32318],{"data":32267,"content":32268,"nodeType":1043},{},[32269],{"data":32270,"content":32271,"nodeType":866},{},[32272,32275,32284],{"data":32273,"marks":32274,"value":21,"nodeType":865},{},[],{"data":32276,"content":32278,"nodeType":1102},{"uri":32277},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/app_directory_lookup/description.md#app-directory-lookup",[32279],{"data":32280,"marks":32281,"value":32283,"nodeType":865},{},[32282],{"type":4537},"SAT1006",{"data":32285,"marks":32286,"value":21,"nodeType":865},{},[],{"data":32288,"content":32289,"nodeType":1043},{},[32290],{"data":32291,"content":32292,"nodeType":866},{},[32293,32296,32305],{"data":32294,"marks":32295,"value":21,"nodeType":865},{},[],{"data":32297,"content":32299,"nodeType":1102},{"uri":32298},"https://pushsecurity.com/resources/browser-identity-attacks-matrix/app-directory-lookup",[32300],{"data":32301,"marks":32302,"value":32304,"nodeType":865},{},[32303],{"type":4537},"App directory lookup",{"data":32306,"marks":32307,"value":21,"nodeType":865},{},[],{"data":32309,"content":32310,"nodeType":1043},{},[32311],{"data":32312,"content":32313,"nodeType":866},{},[32314],{"data":32315,"marks":32316,"value":32317,"nodeType":865},{},[],"Discovery",{"data":32319,"content":32320,"nodeType":1043},{},[32321],{"data":32322,"content":32323,"nodeType":866},{},[32324],{"data":32325,"marks":32326,"value":32327,"nodeType":865},{},[],"An adversary who has gained a foothold via a SaaS app could download the list of users accessible to them in order to better target attacks against other users.",{"data":32329,"content":32330,"nodeType":938},{},[],{"data":32332,"content":32333,"nodeType":948},{},[32334],{"data":32335,"marks":32336,"value":32337,"nodeType":865},{},[],"Other notable attacks",{"data":32339,"content":32340,"nodeType":1218},{},[32341],{"data":32342,"marks":32343,"value":32344,"nodeType":865},{},[],"SEC X hack — January 2024",{"data":32346,"content":32347,"nodeType":866},{},[32348],{"data":32349,"marks":32350,"value":32351,"nodeType":865},{},[],"The X account for the U.S. Securities and Exchange Commission was victim to a SIM swapping attack, whereupon the attacker used the social media platform to issue a fake announcement on the approval of Bitcoin ETFs on security exchanges.",{"data":32353,"content":32354,"nodeType":866},{},[32355],{"data":32356,"marks":32357,"value":32358,"nodeType":865},{},[],"Once the threat actors controlled the number, they reset the password for the @SECGov account, and created the fake announcement. The SEC also confirmed that multi-factor authentication was not enabled on the account, as they had asked X support to disable it when they encountered problems logging into the account.",{"data":32360,"content":32361,"nodeType":938},{},[],{"data":32363,"content":32364,"nodeType":1218},{},[32365],{"data":32366,"marks":32367,"value":32368,"nodeType":865},{},[],"Mandiant X hack — January 2024",{"data":32370,"content":32371,"nodeType":866},{},[32372],{"data":32373,"marks":32374,"value":32375,"nodeType":865},{},[],"The X account for Mandiant was hacked by a Drainer-as-a-Service (DaaS) gang in a brute force attack. MFA was not enabled on the account. The threat actor used the social media account to share links redirecting to a phishing page to steal cryptocurrency. ",{"data":32377,"content":32378,"nodeType":866},{},[32379],{"data":32380,"marks":32381,"value":32382,"nodeType":865},{},[],"The attacker used a wallet drainer dubbed CLINKSINK. This same drainer has been used since December to steal funds and tokens from users of Solana cryptocurrency as part of a large-scale campaign involving at least 35 affiliate IDs linked to a shared DaaS.",{"data":32384,"content":32385,"nodeType":938},{},[],{"data":32387,"content":32388,"nodeType":1218},{},[32389],{"data":32390,"marks":32391,"value":32392,"nodeType":865},{},[],"23andMe data breach — April 2023",{"data":32394,"content":32395,"nodeType":866},{},[32396],{"data":32397,"marks":32398,"value":32399,"nodeType":865},{},[],"Genetic testing provider 23andMe confirmed that hackers downloaded the data of 6.9 million people of the existing 14 million customers after breaching around 14,000 user accounts. ",{"data":32401,"content":32402,"nodeType":866},{},[32403],{"data":32404,"marks":32405,"value":32406,"nodeType":865},{},[],"The attacker stole health reports and raw genotype data of customers affected by a credential stuffing attack that went unnoticed for five months, from April 29 to September 27. ",{"data":32408,"content":32409,"nodeType":866},{},[32410],{"data":32411,"marks":32412,"value":32413,"nodeType":865},{},[],"The credentials used by the attackers to breach the customers' accounts were stolen in other data breaches or used on previously compromised online platforms, and targeted accounts without MFA. ","Tracking identity-based attacks in the wild","To help organizations keep track of how browser-based identity attacks are evolving, we've put together this index of recent breaches.","2024-03-21T00:00:00.000Z","identity-attacks-in-the-wild",{"items":32419},[32420,32422],{"sys":32421,"name":2524},{"id":2523},{"sys":32423,"name":342},{"id":2527},{"items":32425},[32426],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":32427},{"url":6031},{"__typename":2239,"sys":32429,"content":32430,"title":27334,"synopsis":33188,"hashTags":59,"publishedDate":33189,"slug":27335,"tagsCollection":33190,"authorsCollection":33196},{"id":26984},{"json":32431},{"data":32432,"content":32433,"nodeType":2232},{},[32434,32440,32447,32498,32505,32512,32527,32534,32541,32621,32628,32633,32640,32647,32662,32669,32675,32698,32720,32725,32743,32749,32756,32786,32793,32800,32806,32823,32829,32836,32843,32850,32856,32873,32879,32886,32893,32900,32906,32923,32929,32936,32942,32959,32966,32973,32980,33022,33029,33099,33114,33119,33126,33133,33140,33147,33165,33171],{"data":32435,"content":32439,"nodeType":907},{"target":32436},{"sys":32437},{"id":32438,"type":904,"linkType":905},"7rud2H1hcTAOhxh9zHzxP6",[],{"data":32441,"content":32442,"nodeType":866},{},[32443],{"data":32444,"marks":32445,"value":32446,"nodeType":865},{},[],"If someone asked you where you work, you probably wouldn’t answer, “My browser.” But that would be the truth.",{"data":32448,"content":32449,"nodeType":866},{},[32450,32454,32462,32465,32473,32476,32483,32486,32494],{"data":32451,"marks":32452,"value":32453,"nodeType":865},{},[],"(Threat actors already know where you work, of course, and they’ve been capitalizing on the massive shift to cloud-based workforces. Just look at any of the ",{"data":32455,"content":32457,"nodeType":1102},{"uri":32456},"https://www.crowdstrike.com/global-threat-report/",[32458],{"data":32459,"marks":32460,"value":32461,"nodeType":865},{},[],"latest",{"data":32463,"marks":32464,"value":6192,"nodeType":865},{},[],{"data":32466,"content":32468,"nodeType":1102},{"uri":32467},"https://redcanary.com/threat-detection-report/techniques/cloud-accounts/",[32469],{"data":32470,"marks":32471,"value":32472,"nodeType":865},{},[],"threat",{"data":32474,"marks":32475,"value":6192,"nodeType":865},{},[],{"data":32477,"content":32478,"nodeType":1102},{"uri":2328},[32479],{"data":32480,"marks":32481,"value":32482,"nodeType":865},{},[],"research",{"data":32484,"marks":32485,"value":6192,"nodeType":865},{},[],{"data":32487,"content":32489,"nodeType":1102},{"uri":32488},"https://www.lab539.com/blog/6-months-tracking-aitm-campaigns",[32490],{"data":32491,"marks":32492,"value":32493,"nodeType":865},{},[],"reports",{"data":32495,"marks":32496,"value":32497,"nodeType":865},{},[]," on identity-based attacks to see how good a job they’ve been doing.)",{"data":32499,"content":32500,"nodeType":866},{},[32501],{"data":32502,"marks":32503,"value":32504,"nodeType":865},{},[],"To get visibility of your infrastructure in order to build a strong detection and response program, the equation used to look something like:",{"data":32506,"content":32507,"nodeType":866},{},[32508],{"data":32509,"marks":32510,"value":32511,"nodeType":865},{},[],"Network traffic + Logs + Endpoints = Profit!",{"data":32513,"content":32514,"nodeType":866},{},[32515,32519,32524],{"data":32516,"marks":32517,"value":32518,"nodeType":865},{},[],"But now there’s a missing piece, as identity infrastructure sprawls across IdPs, core apps, shadow SaaS and third-party integrations: ",{"data":32520,"marks":32521,"value":32523,"nodeType":865},{},[32522],{"type":946},"Browser telemetry",{"data":32525,"marks":32526,"value":1151,"nodeType":865},{},[],{"data":32528,"content":32529,"nodeType":866},{},[32530],{"data":32531,"marks":32532,"value":32533,"nodeType":865},{},[],"As a browser agent, Push is uniquely positioned to provide telemetry you can’t easily get anywhere else. We believe that this missing piece is the key to stopping identity attacks by providing the context both for first-class detections and security controls, as well as key correlations for events you observe in traditional log sources.",{"data":32535,"content":32536,"nodeType":866},{},[32537],{"data":32538,"marks":32539,"value":32540,"nodeType":865},{},[],"Now we have a better way to bring Push’s data to life to solve meaningful security challenges:",{"data":32542,"content":32543,"nodeType":891},{},[32544,32573],{"data":32545,"content":32546,"nodeType":880},{},[32547],{"data":32548,"content":32549,"nodeType":866},{},[32550,32555,32559,32569],{"data":32551,"marks":32552,"value":32554,"nodeType":865},{},[32553],{"type":946},"Plug-and-play security controls",{"data":32556,"marks":32557,"value":32558,"nodeType":865},{},[],", accessible from the new ",{"data":32560,"content":32564,"nodeType":1038},{"target":32561},{"sys":32562},{"id":32563,"type":904,"linkType":905},"BtDLgVZRWQ3Ov4WgDQX1W",[32565],{"data":32566,"marks":32567,"value":2821,"nodeType":865},{},[32568],{"type":946},{"data":32570,"marks":32571,"value":32572,"nodeType":865},{},[]," page in the Push platform",{"data":32574,"content":32575,"nodeType":880},{},[32576],{"data":32577,"content":32578,"nodeType":866},{},[32579,32584,32588,32595,32598,32605,32609,32617],{"data":32580,"marks":32581,"value":32583,"nodeType":865},{},[32582],{"type":946},"Choose-your-own-adventure tooling",{"data":32585,"marks":32586,"value":32587,"nodeType":865},{},[],", including a ",{"data":32589,"content":32590,"nodeType":1102},{"uri":24833},[32591],{"data":32592,"marks":32593,"value":32594,"nodeType":865},{},[],"REST API",{"data":32596,"marks":32597,"value":3531,"nodeType":865},{},[],{"data":32599,"content":32600,"nodeType":1102},{"uri":13248},[32601],{"data":32602,"marks":32603,"value":32604,"nodeType":865},{},[],"webhooks",{"data":32606,"marks":32607,"value":32608,"nodeType":865},{},[],", and a new ",{"data":32610,"content":32612,"nodeType":1102},{"uri":32611},"/help/audience/administrators/docs/connect-to-siem-or-soar/#using-the-events-page",[32613],{"data":32614,"marks":32615,"value":2058,"nodeType":865},{},[32616],{"type":946},{"data":32618,"marks":32619,"value":32620,"nodeType":865},{},[]," page to help you visualize and build custom detections and automations.",{"data":32622,"content":32623,"nodeType":866},{},[32624],{"data":32625,"marks":32626,"value":32627,"nodeType":865},{},[],"Let’s take a closer look.",{"data":32629,"content":32632,"nodeType":907},{"target":32630},{"sys":32631},{"id":18832,"type":904,"linkType":905},[],{"data":32634,"content":32635,"nodeType":948},{},[32636],{"data":32637,"marks":32638,"value":32639,"nodeType":865},{},[],"Plug-and-play controls",{"data":32641,"content":32642,"nodeType":866},{},[32643],{"data":32644,"marks":32645,"value":32646,"nodeType":865},{},[],"Security visibility without security control is a recipe for a stress headache, so we’re big believers in providing meaningful interventions that are easy to use.",{"data":32648,"content":32649,"nodeType":866},{},[32650,32654,32658],{"data":32651,"marks":32652,"value":32653,"nodeType":865},{},[],"With the new ",{"data":32655,"marks":32656,"value":2821,"nodeType":865},{},[32657],{"type":946},{"data":32659,"marks":32660,"value":32661,"nodeType":865},{},[]," page in the Push admin console, you can now find these preconfigured detections and interventions in one place. They cover use cases that any organization can benefit from, and take a unique browser-based approach to solving some thorny issues.",{"data":32663,"content":32664,"nodeType":866},{},[32665],{"data":32666,"marks":32667,"value":32668,"nodeType":865},{},[],"These controls include:",{"data":32670,"content":32671,"nodeType":1218},{},[32672],{"data":32673,"marks":32674,"value":19926,"nodeType":865},{},[],{"data":32676,"content":32677,"nodeType":866},{},[32678,32682,32687,32690,32695],{"data":32679,"marks":32680,"value":32681,"nodeType":865},{},[],"Detect and block when employees visit webpages that use advanced phishing tools such as Evilginx or EvilNoVNC, among others. These adversary-in-the-middle (AitM) toolkits can mimic legitimate login screens, such as an Okta login page, to steal ",{"data":32683,"marks":32684,"value":32686,"nodeType":865},{},[32685],{"type":946},"credentials",{"data":32688,"marks":32689,"value":1913,"nodeType":865},{},[],{"data":32691,"marks":32692,"value":32694,"nodeType":865},{},[32693],{"type":946},"MFA codes",{"data":32696,"marks":32697,"value":1151,"nodeType":865},{},[],{"data":32699,"content":32700,"nodeType":866},{},[32701,32705,32709,32712,32716],{"data":32702,"marks":32703,"value":32704,"nodeType":865},{},[],"Push emits a webhook event when the browser agent detects attributes of these malware. You can also set Push to ",{"data":32706,"marks":32707,"value":2080,"nodeType":865},{},[32708],{"type":946},{"data":32710,"marks":32711,"value":1773,"nodeType":865},{},[],{"data":32713,"marks":32714,"value":2088,"nodeType":865},{},[32715],{"type":946},{"data":32717,"marks":32718,"value":32719,"nodeType":865},{},[]," mode to display a customizable message to end-users when they encounter a phishing site.",{"data":32721,"content":32724,"nodeType":907},{"target":32722},{"sys":32723},{"id":19934,"type":904,"linkType":905},[],{"data":32726,"content":32727,"nodeType":866},{},[32728,32732,32740],{"data":32729,"marks":32730,"value":32731,"nodeType":865},{},[],"More about ",{"data":32733,"content":32736,"nodeType":1038},{"target":32734},{"sys":32735},{"id":1483,"type":904,"linkType":905},[32737],{"data":32738,"marks":32739,"value":4311,"nodeType":865},{},[],{"data":32741,"marks":32742,"value":21,"nodeType":865},{},[],{"data":32744,"content":32745,"nodeType":1218},{},[32746],{"data":32747,"marks":32748,"value":15108,"nodeType":865},{},[],{"data":32750,"content":32751,"nodeType":866},{},[32752],{"data":32753,"marks":32754,"value":32755,"nodeType":865},{},[],"Prevent employees from reusing their corporate SSO password on any page that doesn’t belong to the identity provider, including phishing sites. This means that even if that employee was the first person to get phished using a new attacker site, Push still detects it and blocks it.",{"data":32757,"content":32758,"nodeType":866},{},[32759,32763,32767,32770,32774,32778,32782],{"data":32760,"marks":32761,"value":32762,"nodeType":865},{},[],"Customize the message that end-users see in ",{"data":32764,"marks":32765,"value":2080,"nodeType":865},{},[32766],{"type":946},{"data":32768,"marks":32769,"value":1773,"nodeType":865},{},[],{"data":32771,"marks":32772,"value":2088,"nodeType":865},{},[32773],{"type":946},{"data":32775,"marks":32776,"value":32777,"nodeType":865},{},[]," mode, or start out in ",{"data":32779,"marks":32780,"value":2041,"nodeType":865},{},[32781],{"type":946},{"data":32783,"marks":32784,"value":32785,"nodeType":865},{},[]," mode to catch any false positives before you enforce the control.",{"data":32787,"content":32788,"nodeType":866},{},[32789],{"data":32790,"marks":32791,"value":32792,"nodeType":865},{},[],"This feature supports the following identity providers: Okta, Microsoft 365, Google Workspace, JumpCloud, Duo, and Ping Identity.",{"data":32794,"content":32795,"nodeType":866},{},[32796],{"data":32797,"marks":32798,"value":32799,"nodeType":865},{},[],"Push will also emit a webhook event when an SSO password is used, and if an employee clicks through the warning screen.",{"data":32801,"content":32805,"nodeType":907},{"target":32802},{"sys":32803},{"id":32804,"type":904,"linkType":905},"25c8M2gWYFST7yYxGEji2s",[],{"data":32807,"content":32808,"nodeType":866},{},[32809,32812,32820],{"data":32810,"marks":32811,"value":32731,"nodeType":865},{},[],{"data":32813,"content":32816,"nodeType":1038},{"target":32814},{"sys":32815},{"id":1740,"type":904,"linkType":905},[32817],{"data":32818,"marks":32819,"value":15108,"nodeType":865},{},[],{"data":32821,"marks":32822,"value":21,"nodeType":865},{},[],{"data":32824,"content":32825,"nodeType":1218},{},[32826],{"data":32827,"marks":32828,"value":20770,"nodeType":865},{},[],{"data":32830,"content":32831,"nodeType":866},{},[32832],{"data":32833,"marks":32834,"value":32835,"nodeType":865},{},[],"When you find malicious sites you want to block, such as when responding to a phishing incident, add them to a blocklist and prevent other employees from accessing those sites. ",{"data":32837,"content":32838,"nodeType":866},{},[32839],{"data":32840,"marks":32841,"value":32842,"nodeType":865},{},[],"URL blocking can be used in tandem with Push’s anti-phishing controls, so that as you discover malicious sites, you can block them from a central blocklist. This offers a kind of herd immunity where you can block other users from visiting a malicious site as soon as you have a single incident.",{"data":32844,"content":32845,"nodeType":866},{},[32846],{"data":32847,"marks":32848,"value":32849,"nodeType":865},{},[],"You can programmatically manage the blocklist using the Push REST API or sync to other threat intelligence sources you consume.",{"data":32851,"content":32855,"nodeType":907},{"target":32852},{"sys":32853},{"id":32854,"type":904,"linkType":905},"3m00cFiUDAnddsOBOpkeiZ",[],{"data":32857,"content":32858,"nodeType":866},{},[32859,32862,32870],{"data":32860,"marks":32861,"value":32731,"nodeType":865},{},[],{"data":32863,"content":32866,"nodeType":1038},{"target":32864},{"sys":32865},{"id":27706,"type":904,"linkType":905},[32867],{"data":32868,"marks":32869,"value":20770,"nodeType":865},{},[],{"data":32871,"marks":32872,"value":21,"nodeType":865},{},[],{"data":32874,"content":32875,"nodeType":1218},{},[32876],{"data":32877,"marks":32878,"value":27436,"nodeType":865},{},[],{"data":32880,"content":32881,"nodeType":866},{},[32882],{"data":32883,"marks":32884,"value":32885,"nodeType":865},{},[],"Inject a unique marker provided by the Push browser agent into the User Agent string of sessions that occur in browsers enrolled in Push. ",{"data":32887,"content":32888,"nodeType":866},{},[32889],{"data":32890,"marks":32891,"value":32892,"nodeType":865},{},[],"By analyzing logs from your IdP, you can identify activity from the same session that both has the Push marker and that lacks the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":32894,"content":32895,"nodeType":866},{},[32896],{"data":32897,"marks":32898,"value":32899,"nodeType":865},{},[],"This is a high-fidelity signal that a session token has been stolen and is being used.",{"data":32901,"content":32905,"nodeType":907},{"target":32902},{"sys":32903},{"id":32904,"type":904,"linkType":905},"43rk3TCqN269Vr2YWT4llP",[],{"data":32907,"content":32908,"nodeType":866},{},[32909,32912,32920],{"data":32910,"marks":32911,"value":32731,"nodeType":865},{},[],{"data":32913,"content":32916,"nodeType":1038},{"target":32914},{"sys":32915},{"id":13505,"type":904,"linkType":905},[32917],{"data":32918,"marks":32919,"value":13511,"nodeType":865},{},[],{"data":32921,"marks":32922,"value":21,"nodeType":865},{},[],{"data":32924,"content":32925,"nodeType":1218},{},[32926],{"data":32927,"marks":32928,"value":1971,"nodeType":865},{},[],{"data":32930,"content":32931,"nodeType":866},{},[32932],{"data":32933,"marks":32934,"value":32935,"nodeType":865},{},[],"Add guardrails to employees’ use of SaaS apps with in-browser app banner messages you customize with your own text. You can require users to acknowledge having read a message before they can access an app, or even require them to submit a reason for using an app before they can log in.",{"data":32937,"content":32941,"nodeType":907},{"target":32938},{"sys":32939},{"id":32940,"type":904,"linkType":905},"5nEKTBz6mauHI5mg8jB4ea",[],{"data":32943,"content":32944,"nodeType":866},{},[32945,32948,32956],{"data":32946,"marks":32947,"value":32731,"nodeType":865},{},[],{"data":32949,"content":32952,"nodeType":1038},{"target":32950},{"sys":32951},{"id":1802,"type":904,"linkType":905},[32953],{"data":32954,"marks":32955,"value":15907,"nodeType":865},{},[],{"data":32957,"marks":32958,"value":21,"nodeType":865},{},[],{"data":32960,"content":32961,"nodeType":948},{},[32962],{"data":32963,"marks":32964,"value":32965,"nodeType":865},{},[],"Choose your own adventure",{"data":32967,"content":32968,"nodeType":866},{},[32969],{"data":32970,"marks":32971,"value":32972,"nodeType":865},{},[],"Want to do something creative? We've got you covered. Push provides a wealth of raw telemetry via the Push REST API and webhook events. Use this data to build both proactive and reactive security operations workflows, or add missing context to other sources, such as your IdP, application, or endpoint logs.",{"data":32974,"content":32975,"nodeType":866},{},[32976],{"data":32977,"marks":32978,"value":32979,"nodeType":865},{},[],"You can use this browser telemetry to:",{"data":32981,"content":32982,"nodeType":891},{},[32983,32996,33009],{"data":32984,"content":32985,"nodeType":880},{},[32986],{"data":32987,"content":32988,"nodeType":866},{},[32989,32993],{"data":32990,"marks":32991,"value":21082,"nodeType":865},{},[32992],{"type":946},{"data":32994,"marks":32995,"value":21086,"nodeType":865},{},[],{"data":32997,"content":32998,"nodeType":880},{},[32999],{"data":33000,"content":33001,"nodeType":866},{},[33002,33006],{"data":33003,"marks":33004,"value":21097,"nodeType":865},{},[33005],{"type":946},{"data":33007,"marks":33008,"value":21101,"nodeType":865},{},[],{"data":33010,"content":33011,"nodeType":880},{},[33012],{"data":33013,"content":33014,"nodeType":866},{},[33015,33019],{"data":33016,"marks":33017,"value":21112,"nodeType":865},{},[33018],{"type":946},{"data":33020,"marks":33021,"value":21116,"nodeType":865},{},[],{"data":33023,"content":33024,"nodeType":866},{},[33025],{"data":33026,"marks":33027,"value":33028,"nodeType":865},{},[],"In the “make my life easier” category, you can also use Push telemetry to:",{"data":33030,"content":33031,"nodeType":891},{},[33032,33050,33069,33084],{"data":33033,"content":33034,"nodeType":880},{},[33035],{"data":33036,"content":33037,"nodeType":866},{},[33038,33042,33047],{"data":33039,"marks":33040,"value":33041,"nodeType":865},{},[],"Automate a workflow ",{"data":33043,"marks":33044,"value":33046,"nodeType":865},{},[33045],{"type":946},"showing you all the accounts and apps used by an offboarded employee",{"data":33048,"marks":33049,"value":21150,"nodeType":865},{},[],{"data":33051,"content":33052,"nodeType":880},{},[33053],{"data":33054,"content":33055,"nodeType":866},{},[33056,33060,33065],{"data":33057,"marks":33058,"value":33059,"nodeType":865},{},[],"Automate a workflow to",{"data":33061,"marks":33062,"value":33064,"nodeType":865},{},[33063],{"type":946}," revoke licenses on SaaS after a period of inactivity",{"data":33066,"marks":33067,"value":33068,"nodeType":865},{},[],", saving money.",{"data":33070,"content":33071,"nodeType":880},{},[33072],{"data":33073,"content":33074,"nodeType":866},{},[33075,33080],{"data":33076,"marks":33077,"value":33079,"nodeType":865},{},[33078],{"type":946},"Build an approved apps list in your company wiki",{"data":33081,"marks":33082,"value":33083,"nodeType":865},{},[],", synced from Push’s source of truth.",{"data":33085,"content":33086,"nodeType":880},{},[33087],{"data":33088,"content":33089,"nodeType":866},{},[33090,33095],{"data":33091,"marks":33092,"value":33094,"nodeType":865},{},[33093],{"type":946},"Force-reset an IdP password if Push finds a compromised password",{"data":33096,"marks":33097,"value":33098,"nodeType":865},{},[]," on an employee account.",{"data":33100,"content":33101,"nodeType":866},{},[33102,33106,33110],{"data":33103,"marks":33104,"value":33105,"nodeType":865},{},[],"To help you visualize and plan how you will use this telemetry, Push also provides an ",{"data":33107,"marks":33108,"value":2058,"nodeType":865},{},[33109],{"type":946},{"data":33111,"marks":33112,"value":33113,"nodeType":865},{},[]," page in the admin console with a rolling 7-day snapshot of all the events in your environment.",{"data":33115,"content":33118,"nodeType":907},{"target":33116},{"sys":33117},{"id":26972,"type":904,"linkType":905},[],{"data":33120,"content":33121,"nodeType":866},{},[33122],{"data":33123,"marks":33124,"value":33125,"nodeType":865},{},[],"The Events page can help you see real-world examples, understand the attributes of each event, and gauge event volume before you ingest data into a SIEM or other platform.",{"data":33127,"content":33128,"nodeType":948},{},[33129],{"data":33130,"marks":33131,"value":33132,"nodeType":865},{},[],"What if you don’t have a SIEM?",{"data":33134,"content":33135,"nodeType":866},{},[33136],{"data":33137,"marks":33138,"value":33139,"nodeType":865},{},[],"While you’d need a SIEM for writing detections and performing log correlations, you can still get a lot of value out of Push telemetry if you don’t have one.",{"data":33141,"content":33142,"nodeType":866},{},[33143],{"data":33144,"marks":33145,"value":33146,"nodeType":865},{},[],"Use Push’s webhook events to send alerts directly to your Slack, Teams, or other chat platform, or build workflows that hook into your ticketing system or SOAR platform.",{"data":33148,"content":33149,"nodeType":866},{},[33150,33154,33161],{"data":33151,"marks":33152,"value":33153,"nodeType":865},{},[],"Review our ",{"data":33155,"content":33156,"nodeType":1102},{"uri":13248},[33157],{"data":33158,"marks":33159,"value":33160,"nodeType":865},{},[],"webhooks documentation",{"data":33162,"marks":33163,"value":33164,"nodeType":865},{},[]," for a list of events.",{"data":33166,"content":33167,"nodeType":948},{},[33168],{"data":33169,"marks":33170,"value":6796,"nodeType":865},{},[],{"data":33172,"content":33173,"nodeType":866},{},[33174,33178,33184],{"data":33175,"marks":33176,"value":33177,"nodeType":865},{},[],"If you want to see Push in action, ",{"data":33179,"content":33180,"nodeType":1102},{"uri":13707},[33181],{"data":33182,"marks":33183,"value":11104,"nodeType":865},{},[],{"data":33185,"marks":33186,"value":33187,"nodeType":865},{},[],". We’ll be happy to show you these features, along with how we discover all the apps your employees are using — even the ones not behind SSO.","Enable detections and interventions in the browser using Push’s new security controls.","2024-07-02T00:00:00.000Z",{"items":33191},[33192,33194],{"sys":33193,"name":3915},{"id":3914},{"sys":33195,"name":342},{"id":2527},{"items":33197},[33198],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":33199},{"url":853},{"__typename":2239,"sys":33201,"content":33202,"title":21219,"synopsis":34021,"hashTags":59,"publishedDate":34022,"slug":21220,"tagsCollection":34023,"authorsCollection":34029},{"id":20444},{"json":33203},{"data":33204,"content":33205,"nodeType":2232},{},[33206,33213,33220,33227,33255,33262,33269,33286,33293,33300,33318,33325,33332,33339,33345,33352,33395,33402,33409,33416,33439,33446,33453,33460,33508,33515,33522,33529,33536,33548,33555,33563,33570,33603,33610,33617,33624,33631,33696,33704,33711,33718,33752,33759,33767,33774,33781,33793,33809,33838,33856,33863,33880,33887,33894,33911,33918,33925,33932,33965,33972,33991,34009,34015],{"data":33207,"content":33208,"nodeType":866},{},[33209],{"data":33210,"marks":33211,"value":33212,"nodeType":865},{},[],"Identity attacks like phishing, credential stuffing, and session hijacking are now the leading cause of cyber security breaches, as attackers shift their attention to the sprawl of third-party applications and services that has become the backbone of business IT. ",{"data":33214,"content":33215,"nodeType":866},{},[33216],{"data":33217,"marks":33218,"value":33219,"nodeType":865},{},[],"The attacker’s goal in these attacks is account takeover: logging into a user account to access your company app tenant. From there, the attacker can usually achieve all of their objectives from inside the compromised app, usually involving dumping sensitive data with which to hold the company to ransom, or selling the data on underground criminal marketplaces. ",{"data":33221,"content":33222,"nodeType":866},{},[33223],{"data":33224,"marks":33225,"value":33226,"nodeType":865},{},[],"These attack techniques have been commonplace for over a decade — but the shift in attack context away from attacking endpoints (user devices and servers) to cloud services is seeing something of an identity attack renaissance. ",{"data":33228,"content":33229,"nodeType":866},{},[33230,33233,33240,33244,33251],{"data":33231,"marks":33232,"value":21,"nodeType":865},{},[],{"data":33234,"content":33235,"nodeType":1102},{"uri":5377},[33236],{"data":33237,"marks":33238,"value":395,"nodeType":865},{},[33239],{"type":4537},{"data":33241,"marks":33242,"value":33243,"nodeType":865},{},[]," are one of the leading factors in successful ",{"data":33245,"content":33246,"nodeType":1102},{"uri":25850},[33247],{"data":33248,"marks":33249,"value":25856,"nodeType":865},{},[33250],{"type":4537},{"data":33252,"marks":33253,"value":33254,"nodeType":865},{},[]," attacks driving account takeover.",{"data":33256,"content":33257,"nodeType":948},{},[33258],{"data":33259,"marks":33260,"value":33261,"nodeType":865},{},[],"Ghost logins 101",{"data":33263,"content":33264,"nodeType":866},{},[33265],{"data":33266,"marks":33267,"value":33268,"nodeType":865},{},[],"Simply put, ghost logins are often-forgotten alternative login methods that are tricky for security teams to manage and secure — because they don’t know about them. Because of this, they’re likely to possess weak configurations that make them susceptible to account takeover attacks. ",{"data":33270,"content":33271,"nodeType":866},{},[33272,33276,33283],{"data":33273,"marks":33274,"value":33275,"nodeType":865},{},[],"We found that ",{"data":33277,"content":33278,"nodeType":1102},{"uri":6406},[33279],{"data":33280,"marks":33281,"value":33282,"nodeType":865},{},[],"ghost logins are present in ~10% of the accounts per organization",{"data":33284,"marks":33285,"value":1677,"nodeType":865},{},[],{"data":33287,"content":33288,"nodeType":1218},{},[33289],{"data":33290,"marks":33291,"value":33292,"nodeType":865},{},[],"Why do ghost logins exist?",{"data":33294,"content":33295,"nodeType":866},{},[33296],{"data":33297,"marks":33298,"value":33299,"nodeType":865},{},[],"Identity management used to be something that was centrally contained and managed using an enterprise identity service like Active Directory. Most users probably only had one or two identities that you really cared about: the one they used to log into their company laptop and domain, and maybe also to log into a VPN. ",{"data":33301,"content":33302,"nodeType":866},{},[33303,33307,33314],{"data":33304,"marks":33305,"value":33306,"nodeType":865},{},[],"Now, there are ",{"data":33308,"content":33309,"nodeType":1102},{"uri":6406},[33310],{"data":33311,"marks":33312,"value":33313,"nodeType":865},{},[],"200+ business apps in use per company, creating 1000s of sprawled identities",{"data":33315,"marks":33316,"value":33317,"nodeType":865},{},[]," across an ecosystem of business apps and services accessed over the internet.",{"data":33319,"content":33320,"nodeType":866},{},[33321],{"data":33322,"marks":33323,"value":33324,"nodeType":865},{},[],"Most businesses have tried to solve this problem with single sign on (SSO). The logic being that if you can use a single set of credentials (and therefore, a single identity) to access all of your business apps, and then secure those credentials with MFA, then this problem goes away. However…",{"data":33326,"content":33327,"nodeType":1218},{},[33328],{"data":33329,"marks":33330,"value":33331,"nodeType":865},{},[],"SSO expectations versus reality",{"data":33333,"content":33334,"nodeType":866},{},[33335],{"data":33336,"marks":33337,"value":33338,"nodeType":865},{},[],"Unfortunately, the reality of SSO implementation is flawed. Most apps accept multiple login methods that can be configured — and used — simultaneously (yes, most apps don’t have proper session controls).  ",{"data":33340,"content":33344,"nodeType":907},{"target":33341},{"sys":33342},{"id":33343,"type":904,"linkType":905},"3sOz3HkiyJpY9nFtGCWEOV",[],{"data":33346,"content":33347,"nodeType":866},{},[33348],{"data":33349,"marks":33350,"value":33351,"nodeType":865},{},[],"This is made worse by the fact that:",{"data":33353,"content":33354,"nodeType":891},{},[33355,33365,33375,33385],{"data":33356,"content":33357,"nodeType":880},{},[33358],{"data":33359,"content":33360,"nodeType":866},{},[33361],{"data":33362,"marks":33363,"value":33364,"nodeType":865},{},[],"Most apps can't be locked down to restrict which login methods are accepted.",{"data":33366,"content":33367,"nodeType":880},{},[33368],{"data":33369,"content":33370,"nodeType":866},{},[33371],{"data":33372,"marks":33373,"value":33374,"nodeType":865},{},[],"Users often self-adopt apps, and default to a username and password (and typically miss out MFA). ",{"data":33376,"content":33377,"nodeType":880},{},[33378],{"data":33379,"content":33380,"nodeType":866},{},[33381],{"data":33382,"marks":33383,"value":33384,"nodeType":865},{},[],"SSO isn’t always possible if you aren’t using a supported IdP — and only one in three apps support SAML, the preferred enterprise-grade protocol.",{"data":33386,"content":33387,"nodeType":880},{},[33388],{"data":33389,"content":33390,"nodeType":866},{},[33391],{"data":33392,"marks":33393,"value":33394,"nodeType":865},{},[],"Even where SSO is possible, configuring an app for SSO doesn't automatically delete any legacy local logins.",{"data":33396,"content":33397,"nodeType":866},{},[33398],{"data":33399,"marks":33400,"value":33401,"nodeType":865},{},[],"Inevitably, this means that there are many situations in which users will create local accounts — typically with a username and password, and without MFA. This is how ghost logins are born.",{"data":33403,"content":33404,"nodeType":1218},{},[33405],{"data":33406,"marks":33407,"value":33408,"nodeType":865},{},[],"How are ghost logins created? ",{"data":33410,"content":33411,"nodeType":866},{},[33412],{"data":33413,"marks":33414,"value":33415,"nodeType":865},{},[],"Ghost logins can be created in the following ways:",{"data":33417,"content":33418,"nodeType":891},{},[33419,33429],{"data":33420,"content":33421,"nodeType":880},{},[33422],{"data":33423,"content":33424,"nodeType":866},{},[33425],{"data":33426,"marks":33427,"value":33428,"nodeType":865},{},[],"A user self-adopts an app, setting up an account with a local username and password. The app is later adopted companywide and brought under SSO. This creates an additional SSO login method, likely as the default, but the local login will continue to exist unless explicitly disabled or deleted. ",{"data":33430,"content":33431,"nodeType":880},{},[33432],{"data":33433,"content":33434,"nodeType":866},{},[33435],{"data":33436,"marks":33437,"value":33438,"nodeType":865},{},[],"Secondary/backup login methods can often be added later in the app settings after logging in. This includes things like setting up a secondary email to send a login link to, or setting up API access to remove the need to authenticate altogether. ",{"data":33440,"content":33441,"nodeType":866},{},[33442],{"data":33443,"marks":33444,"value":33445,"nodeType":865},{},[],"So, ghost logins are very easily introduced through the normal course of app adoption and use by employees. ",{"data":33447,"content":33448,"nodeType":1218},{},[33449],{"data":33450,"marks":33451,"value":33452,"nodeType":865},{},[],"Why do ghost logins pose a risk? ",{"data":33454,"content":33455,"nodeType":866},{},[33456],{"data":33457,"marks":33458,"value":33459,"nodeType":865},{},[],"Ghost logins pose a risk for a number of reasons, as they: ",{"data":33461,"content":33462,"nodeType":891},{},[33463,33478,33493],{"data":33464,"content":33465,"nodeType":880},{},[33466],{"data":33467,"content":33468,"nodeType":866},{},[33469,33474],{"data":33470,"marks":33471,"value":33473,"nodeType":865},{},[33472],{"type":946},"Typically have less secure configurations ",{"data":33475,"marks":33476,"value":33477,"nodeType":865},{},[],"than your preferred login method – and may be missing key controls like MFA.  ",{"data":33479,"content":33480,"nodeType":880},{},[33481],{"data":33482,"content":33483,"nodeType":866},{},[33484,33489],{"data":33485,"marks":33486,"value":33488,"nodeType":865},{},[33487],{"type":946},"Are effectively shadow logins",{"data":33490,"marks":33491,"value":33492,"nodeType":865},{},[]," – IT/security don’t know about them, and if using an IdP as your primary identity security interface, they won’t necessarily be visible without taking a deeper look at individual apps. ",{"data":33494,"content":33495,"nodeType":880},{},[33496],{"data":33497,"content":33498,"nodeType":866},{},[33499,33504],{"data":33500,"marks":33501,"value":33503,"nodeType":865},{},[33502],{"type":946},"Can be used simultaneously with SSO",{"data":33505,"marks":33506,"value":33507,"nodeType":865},{},[]," – so you can have an unrestricted number of concurrent sessions with SSO and non SSO logins active at the same time, without the user being kicked out of the previous session.",{"data":33509,"content":33510,"nodeType":866},{},[33511],{"data":33512,"marks":33513,"value":33514,"nodeType":865},{},[],"Ghost logins provide opportunities for attackers to bypass security controls for initial access and persistence in an application (which we’ll come onto in more detail later). They also provide an opportunity for malicious insiders, e.g. a disgruntled employee, to access systems even after SSO access is revoked. If the security team relies on IdP logs to audit app logins, these accounts can go undetected.",{"data":33516,"content":33517,"nodeType":866},{},[33518],{"data":33519,"marks":33520,"value":33521,"nodeType":865},{},[],"To be able to identify them, you’d need to log into the app admin dashboard. But depending on how the app was adopted, you (as a security admin) may not even be an app-level admin — it’s not unusual for individual teams to administer their own apps. And even if you do have access, it’s not always easy (or possible) to gather this level of information about user account configuration. ",{"data":33523,"content":33524,"nodeType":866},{},[33525],{"data":33526,"marks":33527,"value":33528,"nodeType":865},{},[],"It’s very easy to see how these vulnerable login methods can be overlooked by security teams – let’s look at how they can be identified and exploited by attackers. ",{"data":33530,"content":33531,"nodeType":948},{},[33532],{"data":33533,"marks":33534,"value":33535,"nodeType":865},{},[],"How can ghost logins be exploited by attackers?",{"data":33537,"content":33538,"nodeType":866},{},[33539,33544],{"data":33540,"marks":33541,"value":33543,"nodeType":865},{},[33542],{"type":946},"Let’s take an example scenario:",{"data":33545,"marks":33546,"value":33547,"nodeType":865},{},[]," You’re using an IdP solution like Okta or Microsoft/Entra with SAML SSO as the default login method for your core business apps. Via your IdP you require MFA when authenticating to your IdP apps page, and also potentially when signing into an individual connected app. ",{"data":33549,"content":33550,"nodeType":866},{},[33551],{"data":33552,"marks":33553,"value":33554,"nodeType":865},{},[],"However, you only recently introduced your IdP solution, and your users previously accessed this app with a local username and password. Although you asked your users to configure MFA in the app itself, not all of them did. And when you deployed your IdP solution, you didn’t manually unset all the local password-based logins for the apps you connected to it. ",{"data":33556,"content":33557,"nodeType":866},{},[33558],{"data":33559,"marks":33560,"value":33562,"nodeType":865},{},[33561],{"type":946},"Unknown to you, there are now hundreds of local accounts for core business apps which lack MFA. ",{"data":33564,"content":33565,"nodeType":866},{},[33566],{"data":33567,"marks":33568,"value":33569,"nodeType":865},{},[],"There are two main scenarios in which ghost logins can be utilized by an attacker:",{"data":33571,"content":33572,"nodeType":891},{},[33573,33588],{"data":33574,"content":33575,"nodeType":880},{},[33576],{"data":33577,"content":33578,"nodeType":866},{},[33579,33584],{"data":33580,"marks":33581,"value":33583,"nodeType":865},{},[33582],{"type":946},"To bypass robustly configured login methods",{"data":33585,"marks":33586,"value":33587,"nodeType":865},{},[]," such as SSO to compromise an app identity during the initial access phase of an attack. ",{"data":33589,"content":33590,"nodeType":880},{},[33591],{"data":33592,"content":33593,"nodeType":866},{},[33594,33599],{"data":33595,"marks":33596,"value":33598,"nodeType":865},{},[33597],{"type":946},"To create additional login methods for an already compromised account to ensure persistent access",{"data":33600,"marks":33601,"value":33602,"nodeType":865},{},[]," – even if the original compromised login method is revoked or disabled. This could be either the result of compromising an identity belonging to a specific app, or having previously compromised an IdP account (e.g. Okta).",{"data":33604,"content":33605,"nodeType":866},{},[33606],{"data":33607,"marks":33608,"value":33609,"nodeType":865},{},[],"Let's look at these use cases in more detail. ",{"data":33611,"content":33612,"nodeType":1218},{},[33613],{"data":33614,"marks":33615,"value":33616,"nodeType":865},{},[],"Ghost logins for initial access",{"data":33618,"content":33619,"nodeType":866},{},[33620],{"data":33621,"marks":33622,"value":33623,"nodeType":865},{},[],"Arguably the most dangerous use case for ghost logins is to conduct credential attacks against accounts using a username and password. Logins with a weak or guessable password, or a reused password that has appeared in a public data breach dump, are primed for account takeover. ",{"data":33625,"content":33626,"nodeType":866},{},[33627],{"data":33628,"marks":33629,"value":33630,"nodeType":865},{},[],"The cyber crime ecosystem is leaning toward the theft, sale, and use of stolen credentials (not just emails and passwords, but session tokens too). ",{"data":33632,"content":33633,"nodeType":891},{},[33634,33654,33674],{"data":33635,"content":33636,"nodeType":880},{},[33637],{"data":33638,"content":33639,"nodeType":866},{},[33640,33644,33651],{"data":33641,"marks":33642,"value":33643,"nodeType":865},{},[],"There are 600 million identity attacks per day, with 99% involving passwords (",{"data":33645,"content":33646,"nodeType":1102},{"uri":15238},[33647],{"data":33648,"marks":33649,"value":5800,"nodeType":865},{},[33650],{"type":4537},{"data":33652,"marks":33653,"value":6459,"nodeType":865},{},[],{"data":33655,"content":33656,"nodeType":880},{},[33657],{"data":33658,"content":33659,"nodeType":866},{},[33660,33664,33671],{"data":33661,"marks":33662,"value":33663,"nodeType":865},{},[],"Over 1000 credentials are posted online per day, per marketplace with an average sale price of $10, and 65% posted less than one day after being collected (",{"data":33665,"content":33666,"nodeType":1102},{"uri":15408},[33667],{"data":33668,"marks":33669,"value":5844,"nodeType":865},{},[33670],{"type":4537},{"data":33672,"marks":33673,"value":6459,"nodeType":865},{},[],{"data":33675,"content":33676,"nodeType":880},{},[33677],{"data":33678,"content":33679,"nodeType":866},{},[33680,33684,33693],{"data":33681,"marks":33682,"value":33683,"nodeType":865},{},[],"One million new stealer logs are distributed every month, with an estimated 3-5% containing credentials and session cookies to corporate IT environments (",{"data":33685,"content":33687,"nodeType":1102},{"uri":33686},"https://www.bleepingcomputer.com/news/security/single-sign-on-and-the-cybercrime-ecosystem/",[33688],{"data":33689,"marks":33690,"value":33692,"nodeType":865},{},[33691],{"type":4537},"Flare",{"data":33694,"marks":33695,"value":6459,"nodeType":865},{},[],{"data":33697,"content":33698,"nodeType":866},{},[33699],{"data":33700,"marks":33701,"value":33703,"nodeType":865},{},[33702],{"type":946},"So, it’s easier than ever for attackers to gather breached credentials and weaponize them at scale. ",{"data":33705,"content":33706,"nodeType":866},{},[33707],{"data":33708,"marks":33709,"value":33710,"nodeType":865},{},[],"Realistically, any username and password combination for addresses belonging to a specific organization/domain can be attempted on any app. Breached credential data will often provide a strong indicator of other apps also in use for that organization. And for apps with a custom tenant URL (that cannot be easily guessed) data dumps often helpfully include the URLs for those login pages, too.  ",{"data":33712,"content":33713,"nodeType":866},{},[33714],{"data":33715,"marks":33716,"value":33717,"nodeType":865},{},[],"The risk posed by the massive amounts of leaked credentials available is heightened because: ",{"data":33719,"content":33720,"nodeType":891},{},[33721,33742],{"data":33722,"content":33723,"nodeType":880},{},[33724],{"data":33725,"content":33726,"nodeType":866},{},[33727,33731,33738],{"data":33728,"marks":33729,"value":33730,"nodeType":865},{},[],"Many employees reuse passwords, with ",{"data":33732,"content":33733,"nodeType":1102},{"uri":6406},[33734],{"data":33735,"marks":33736,"value":33737,"nodeType":865},{},[],"~9% of all accounts using a breached, weak, or reused password",{"data":33739,"marks":33740,"value":33741,"nodeType":865},{},[],". This isn’t just for low-risk apps either, and includes the reuse of highly sensitive IdP creds. ",{"data":33743,"content":33744,"nodeType":880},{},[33745],{"data":33746,"content":33747,"nodeType":866},{},[33748],{"data":33749,"marks":33750,"value":33751,"nodeType":865},{},[],"Organizations don’t typically rotate or enforce changes to SaaS app passwords in the same way they might for company account/device login connected to Active Directory.  ",{"data":33753,"content":33754,"nodeType":866},{},[33755],{"data":33756,"marks":33757,"value":33758,"nodeType":865},{},[],"Ghost logins aren’t limited to just username and password either. For example, a breached social account such as Facebook or Google can result in a broader compromise if those accounts have been connected to any corporate apps.   ",{"data":33760,"content":33761,"nodeType":866},{},[33762],{"data":33763,"marks":33764,"value":33766,"nodeType":865},{},[33765],{"type":946},"So, exploiting ghost logins can be a highly effective method for attackers to gain initial access to a user account from which to launch further attacks.  ",{"data":33768,"content":33769,"nodeType":1218},{},[33770],{"data":33771,"marks":33772,"value":33773,"nodeType":865},{},[],"Ghost logins for persistence and defense evasion",{"data":33775,"content":33776,"nodeType":866},{},[33777],{"data":33778,"marks":33779,"value":33780,"nodeType":865},{},[],"Now, we’ll take a look at how attackers can leverage ghost logins as part of the later stages of an attack, having already established an initial foothold via account compromise. ",{"data":33782,"content":33783,"nodeType":866},{},[33784,33788],{"data":33785,"marks":33786,"value":33787,"nodeType":865},{},[],"If an organization has a reasonable level of security monitoring in-place (depending on log availability from the particular app vendor), or a victim receives a notification about an unusual login (e.g. from a new device or unusual IP) then access to an account can be short-lived. ",{"data":33789,"marks":33790,"value":33792,"nodeType":865},{},[33791],{"type":946},"However, ghost logins can provide attackers with the tools to maintain persistent access to a compromised account, even if the initial compromised login method is disabled or revoked. ",{"data":33794,"content":33795,"nodeType":866},{},[33796,33800,33805],{"data":33797,"marks":33798,"value":33799,"nodeType":865},{},[],"For example, if a social login is used to access an account, an adversary may be able to configure a separate username/password login, or even (though much less commonly) connect a second social account that the adversary controls. This allows the adversary to maintain persistent access to the user account ",{"data":33801,"marks":33802,"value":33804,"nodeType":865},{},[33803],{"type":946},"even in the event of password changes or MFA changes",{"data":33806,"marks":33807,"value":33808,"nodeType":865},{},[],". The attack will go unnoticed if the victim organization relies on SSO logs for auditing access to SaaS applications because the attack bypasses SSO, as the login remains local to the SaaS app or, in the case of an OIDC SSO login, the adversary’s own social account.",{"data":33810,"content":33811,"nodeType":866},{},[33812,33816,33823,33827,33835],{"data":33813,"marks":33814,"value":33815,"nodeType":865},{},[],"Another quirk is that it’s common for ordinary users to become app-level admins when an app is self-adopted by an individual or team. If an attacker is able to gain control of such an account, it can then be used to target other users without needing to deliver phishing links by hijacking SAML-based authentication. In this scenario, users attempting to sign in using SAML SSO are directed it to an attacker-controlled tenant in a watering hole attack (also known as ",{"data":33817,"content":33818,"nodeType":1102},{"uri":26686},[33819],{"data":33820,"marks":33821,"value":14104,"nodeType":865},{},[33822],{"type":4537},{"data":33824,"marks":33825,"value":33826,"nodeType":865},{},[],", which you can ",{"data":33828,"content":33829,"nodeType":1102},{"uri":14098},[33830],{"data":33831,"marks":33832,"value":33834,"nodeType":865},{},[33833],{"type":4537},"read more about in another blog post",{"data":33836,"marks":33837,"value":14366,"nodeType":865},{},[],{"data":33839,"content":33840,"nodeType":866},{},[33841,33845,33853],{"data":33842,"marks":33843,"value":33844,"nodeType":865},{},[],"If you're curious as to how an attacker might be able to compromise an IdP account such as Okta, ",{"data":33846,"content":33847,"nodeType":1102},{"uri":15218},[33848],{"data":33849,"marks":33850,"value":33852,"nodeType":865},{},[33851],{"type":4537},"you should check out our blog post on AitM and BitM phishing techniques",{"data":33854,"marks":33855,"value":6360,"nodeType":865},{},[],{"data":33857,"content":33858,"nodeType":948},{},[33859],{"data":33860,"marks":33861,"value":33862,"nodeType":865},{},[],"Case study: Snowflake",{"data":33864,"content":33865,"nodeType":866},{},[33866,33869,33876],{"data":33867,"marks":33868,"value":13846,"nodeType":865},{},[],{"data":33870,"content":33871,"nodeType":1102},{"uri":6965},[33872],{"data":33873,"marks":33874,"value":33875,"nodeType":865},{},[],"recent attacks on 165 Snowflake customers",{"data":33877,"marks":33878,"value":33879,"nodeType":865},{},[],", resulting in hundreds of millions of breached customer records, were the product of a credential stuffing campaign using stolen credentials from infostealer infections dating back to 2020. ",{"data":33881,"content":33882,"nodeType":866},{},[33883],{"data":33884,"marks":33885,"value":33886,"nodeType":865},{},[],"The industry response to Snowflake was typical: check whether Snowflake has been set up for SSO, and if so, job done — we’re protected by MFA.",{"data":33888,"content":33889,"nodeType":866},{},[33890],{"data":33891,"marks":33892,"value":33893,"nodeType":865},{},[],"The reality was that MFA was not — and could not — be centrally enforced for username and password accounts. Even if MFA was applied at the IdP level for SSO logins, it was not enforced for local username and password logins. It needed to be opted-into by the user. ",{"data":33895,"content":33896,"nodeType":866},{},[33897,33901,33908],{"data":33898,"marks":33899,"value":33900,"nodeType":865},{},[],"This meant the most logical thing to do was to disable local accounts. But because Snowflake is essentially a cloud-hosted SQL database, there was no easy-to-use GUI to access local account config data. Once you’d managed to get an admin account with the right permissions, you needed to run various commands to find and unset the accounts. ",{"data":33902,"content":33903,"nodeType":1102},{"uri":26032},[33904],{"data":33905,"marks":33906,"value":33907,"nodeType":865},{},[],"But if you didn’t have the exact type of admin account, misleading results would be returned — and even after you had fixed the vulnerability it took hours to update the database. ",{"data":33909,"marks":33910,"value":21,"nodeType":865},{},[],{"data":33912,"content":33913,"nodeType":866},{},[33914],{"data":33915,"marks":33916,"value":33917,"nodeType":865},{},[],"This meant that organizations were exposed to these attacks for a prolonged period, and were left uncertain as to whether they had addressed the vulnerabilities or not. ",{"data":33919,"content":33920,"nodeType":948},{},[33921],{"data":33922,"marks":33923,"value":33924,"nodeType":865},{},[],"Using Push to find and fix ghost logins across your app inventory",{"data":33926,"content":33927,"nodeType":866},{},[33928],{"data":33929,"marks":33930,"value":33931,"nodeType":865},{},[],"Finding and fixing ghost logins is a challenge for most organizations. Since you can’t rely on the view provided by your IdP, you need to:",{"data":33933,"content":33934,"nodeType":891},{},[33935,33945,33955],{"data":33936,"content":33937,"nodeType":880},{},[33938],{"data":33939,"content":33940,"nodeType":866},{},[33941],{"data":33942,"marks":33943,"value":33944,"nodeType":865},{},[],"Discover the apps in use across your organization",{"data":33946,"content":33947,"nodeType":880},{},[33948],{"data":33949,"content":33950,"nodeType":866},{},[33951],{"data":33952,"marks":33953,"value":33954,"nodeType":865},{},[],"Get admin rights, audit each app, and unset any local credentials (enforcing MFA at the app-level too if you can, for good measure)",{"data":33956,"content":33957,"nodeType":880},{},[33958],{"data":33959,"content":33960,"nodeType":866},{},[33961],{"data":33962,"marks":33963,"value":33964,"nodeType":865},{},[],"Configure the app to prevent local accounts being created (again, if possible)",{"data":33966,"content":33967,"nodeType":866},{},[33968],{"data":33969,"marks":33970,"value":33971,"nodeType":865},{},[],"Not only is this a sisyphean task with continually moving goalposts, but depending on which apps you use, and how they’ve been designed, it may not be possible to remediate every instance of ghost logins. For that reason, it’s important to also invest in your identity threat detection and response capabilities — for when, not if, an account takeover attempt occurs. ",{"data":33973,"content":33974,"nodeType":866},{},[33975,33979,33988],{"data":33976,"marks":33977,"value":33978,"nodeType":865},{},[],"Push helps organizations to defend against ghost logins and other identity threats with a defense-in-depth approach: Using a browser-based agent to generate visibility of all logins (not just via IdP logs) while also detecting, intercepting, and shutting down account takeover attempts via phishing, credential stuffing, and session hijacking. ",{"data":33980,"content":33982,"nodeType":1102},{"uri":33981},"https://pushsecurity.com/",[33983],{"data":33984,"marks":33985,"value":33987,"nodeType":865},{},[33986],{"type":4537},"Learn more here.",{"data":33989,"marks":33990,"value":21,"nodeType":865},{},[],{"data":33992,"content":33993,"nodeType":866},{},[33994,33998,34006],{"data":33995,"marks":33996,"value":33997,"nodeType":865},{},[],"And if you'd like to learn more about ghost logins and other identity attack techniques, ",{"data":33999,"content":34001,"nodeType":1102},{"uri":34000},"https://github.com/pushsecurity/saas-attacks?tab=readme-ov-file",[34002],{"data":34003,"marks":34004,"value":34005,"nodeType":865},{},[],"check out the SaaS attack matrix on GitHub",{"data":34007,"marks":34008,"value":1677,"nodeType":865},{},[],{"data":34010,"content":34014,"nodeType":907},{"target":34011},{"sys":34012},{"id":34013,"type":904,"linkType":905},"1VMpMgZvx9hgps2OoxCTmF",[],{"data":34016,"content":34017,"nodeType":866},{},[34018],{"data":34019,"marks":34020,"value":21,"nodeType":865},{},[],"How ghost logins can be used by cyber attackers for account takeover and persistence.","2024-07-10T00:00:00.000Z",{"items":34024},[34025,34027],{"sys":34026,"name":2524},{"id":2523},{"sys":34028,"name":342},{"id":2527},{"items":34030},[34031],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":34032},{"url":6031},"5-reasons-why-push-security-shouldnt-exist","blog/5-reasons-why-push-security-shouldnt-exist",{"json":34036},{"data":34037,"content":34038,"nodeType":2232},{},[34039,34046],{"data":34040,"content":34041,"nodeType":866},{},[34042],{"data":34043,"marks":34044,"value":34045,"nodeType":865},{},[],"If current security controls worked perfectly, Push wouldn't need to exist – unfortunately, they don't, so here we are!",{"data":34047,"content":34048,"nodeType":866},{},[34049],{"data":34050,"marks":34051,"value":34052,"nodeType":865},{},[],"In this article, we break down common misconceptions about identity controls like MFA, SSO, passkeys, and password managers, exploring some of the gaps they leave and how to fill them to achieve defense in depth.","Breaking down common misconceptions about identity threats and controls like MFA, SSO, passkeys, password managers, and more.",{"id":34055,"publishedAt":34056},"1fp5aOCIcGHDbdQ0amCYOf","2026-08-12T11:55:11.772Z",{"items":34058},[34059,34061],{"sys":34060,"name":342},{"id":2527},{"sys":34062,"name":297},{"id":11129},{"items":34064},[34065,34067,34069,34071,34073,34075,34077,34079,34081,34083,34085,34087,34089,34091,34093,34095,34097,34099,34101,34103,34105,34107],{"sys":34066,"name":413,"slug":414,"tier":31},{"id":410},{"sys":34068,"name":297,"slug":298,"tier":31},{"id":294},{"sys":34070,"name":279,"slug":280,"tier":31},{"id":276},{"sys":34072,"name":519,"slug":520,"tier":31},{"id":516},{"sys":34074,"name":545,"slug":546,"tier":31},{"id":542},{"sys":34076,"name":342,"slug":343,"tier":31},{"id":339},{"sys":34078,"name":395,"slug":396,"tier":45},{"id":392},{"sys":34080,"name":457,"slug":458,"tier":45},{"id":454},{"sys":34082,"name":466,"slug":467,"tier":45},{"id":463},{"sys":34084,"name":333,"slug":334,"tier":45},{"id":330},{"sys":34086,"name":589,"slug":590,"tier":45},{"id":586},{"sys":34088,"name":261,"slug":262,"tier":45},{"id":258},{"sys":34090,"name":571,"slug":572,"tier":45},{"id":568},{"sys":34092,"name":422,"slug":423,"tier":45},{"id":419},{"sys":34094,"name":502,"slug":503,"tier":45},{"id":499},{"sys":34096,"name":493,"slug":494,"tier":45},{"id":490},{"sys":34098,"name":404,"slug":405,"tier":45},{"id":401},{"sys":34100,"name":377,"slug":378,"tier":45},{"id":374},{"sys":34102,"name":624,"slug":625,"tier":45},{"id":621},{"sys":34104,"name":306,"slug":307,"tier":45},{"id":303},{"sys":34106,"name":598,"slug":599,"tier":45},{"id":595},{"sys":34108,"name":475,"slug":476,"tier":45},{"id":472},"7ekz7o6jH_LJs1GGrGDh2SvoDhuQmK1UIytQMiVACOw",{"id":34111,"title":27334,"authorsCollection":34112,"content":34116,"extension":228,"faqItemsCollection":34852,"faqTitle":59,"featured":6,"hashTags":59,"meta":34854,"metaTitle":34855,"ogImage":59,"postType":10139,"publishedDate":33189,"relatedBlogPostsCollection":34856,"slug":27335,"stem":36679,"subtitle":59,"summary":36680,"synopsis":33188,"sys":36691,"tagsCollection":36693,"topicsCollection":36699,"__hash__":36725},"blog/blog/introducing-set-and-forget-controls-that-stop-real-world-identity-attacks.json",{"items":34113},[34114],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":34115},{"url":853},{"json":34117,"links":34793},{"data":34118,"content":34119,"nodeType":2232},{},[34120,34125,34131,34173,34179,34185,34198,34204,34210,34279,34285,34290,34296,34302,34315,34321,34327,34347,34367,34372,34389,34395,34401,34428,34434,34440,34445,34462,34468,34474,34480,34486,34491,34508,34514,34520,34526,34532,34537,34554,34560,34566,34571,34588,34594,34600,34606,34648,34654,34715,34728,34733,34739,34745,34751,34757,34772,34778],{"data":34121,"content":34124,"nodeType":907},{"target":34122},{"sys":34123},{"id":32438,"type":904,"linkType":905},[],{"data":34126,"content":34127,"nodeType":866},{},[34128],{"data":34129,"marks":34130,"value":32446,"nodeType":865},{},[],{"data":34132,"content":34133,"nodeType":866},{},[34134,34137,34143,34146,34152,34155,34161,34164,34170],{"data":34135,"marks":34136,"value":32453,"nodeType":865},{},[],{"data":34138,"content":34139,"nodeType":1102},{"uri":32456},[34140],{"data":34141,"marks":34142,"value":32461,"nodeType":865},{},[],{"data":34144,"marks":34145,"value":6192,"nodeType":865},{},[],{"data":34147,"content":34148,"nodeType":1102},{"uri":32467},[34149],{"data":34150,"marks":34151,"value":32472,"nodeType":865},{},[],{"data":34153,"marks":34154,"value":6192,"nodeType":865},{},[],{"data":34156,"content":34157,"nodeType":1102},{"uri":2328},[34158],{"data":34159,"marks":34160,"value":32482,"nodeType":865},{},[],{"data":34162,"marks":34163,"value":6192,"nodeType":865},{},[],{"data":34165,"content":34166,"nodeType":1102},{"uri":32488},[34167],{"data":34168,"marks":34169,"value":32493,"nodeType":865},{},[],{"data":34171,"marks":34172,"value":32497,"nodeType":865},{},[],{"data":34174,"content":34175,"nodeType":866},{},[34176],{"data":34177,"marks":34178,"value":32504,"nodeType":865},{},[],{"data":34180,"content":34181,"nodeType":866},{},[34182],{"data":34183,"marks":34184,"value":32511,"nodeType":865},{},[],{"data":34186,"content":34187,"nodeType":866},{},[34188,34191,34195],{"data":34189,"marks":34190,"value":32518,"nodeType":865},{},[],{"data":34192,"marks":34193,"value":32523,"nodeType":865},{},[34194],{"type":946},{"data":34196,"marks":34197,"value":1151,"nodeType":865},{},[],{"data":34199,"content":34200,"nodeType":866},{},[34201],{"data":34202,"marks":34203,"value":32533,"nodeType":865},{},[],{"data":34205,"content":34206,"nodeType":866},{},[34207],{"data":34208,"marks":34209,"value":32540,"nodeType":865},{},[],{"data":34211,"content":34212,"nodeType":891},{},[34213,34238],{"data":34214,"content":34215,"nodeType":880},{},[34216],{"data":34217,"content":34218,"nodeType":866},{},[34219,34223,34226,34235],{"data":34220,"marks":34221,"value":32554,"nodeType":865},{},[34222],{"type":946},{"data":34224,"marks":34225,"value":32558,"nodeType":865},{},[],{"data":34227,"content":34230,"nodeType":1038},{"target":34228},{"sys":34229},{"id":32563,"type":904,"linkType":905},[34231],{"data":34232,"marks":34233,"value":2821,"nodeType":865},{},[34234],{"type":946},{"data":34236,"marks":34237,"value":32572,"nodeType":865},{},[],{"data":34239,"content":34240,"nodeType":880},{},[34241],{"data":34242,"content":34243,"nodeType":866},{},[34244,34248,34251,34257,34260,34266,34269,34276],{"data":34245,"marks":34246,"value":32583,"nodeType":865},{},[34247],{"type":946},{"data":34249,"marks":34250,"value":32587,"nodeType":865},{},[],{"data":34252,"content":34253,"nodeType":1102},{"uri":24833},[34254],{"data":34255,"marks":34256,"value":32594,"nodeType":865},{},[],{"data":34258,"marks":34259,"value":3531,"nodeType":865},{},[],{"data":34261,"content":34262,"nodeType":1102},{"uri":13248},[34263],{"data":34264,"marks":34265,"value":32604,"nodeType":865},{},[],{"data":34267,"marks":34268,"value":32608,"nodeType":865},{},[],{"data":34270,"content":34271,"nodeType":1102},{"uri":32611},[34272],{"data":34273,"marks":34274,"value":2058,"nodeType":865},{},[34275],{"type":946},{"data":34277,"marks":34278,"value":32620,"nodeType":865},{},[],{"data":34280,"content":34281,"nodeType":866},{},[34282],{"data":34283,"marks":34284,"value":32627,"nodeType":865},{},[],{"data":34286,"content":34289,"nodeType":907},{"target":34287},{"sys":34288},{"id":18832,"type":904,"linkType":905},[],{"data":34291,"content":34292,"nodeType":948},{},[34293],{"data":34294,"marks":34295,"value":32639,"nodeType":865},{},[],{"data":34297,"content":34298,"nodeType":866},{},[34299],{"data":34300,"marks":34301,"value":32646,"nodeType":865},{},[],{"data":34303,"content":34304,"nodeType":866},{},[34305,34308,34312],{"data":34306,"marks":34307,"value":32653,"nodeType":865},{},[],{"data":34309,"marks":34310,"value":2821,"nodeType":865},{},[34311],{"type":946},{"data":34313,"marks":34314,"value":32661,"nodeType":865},{},[],{"data":34316,"content":34317,"nodeType":866},{},[34318],{"data":34319,"marks":34320,"value":32668,"nodeType":865},{},[],{"data":34322,"content":34323,"nodeType":1218},{},[34324],{"data":34325,"marks":34326,"value":19926,"nodeType":865},{},[],{"data":34328,"content":34329,"nodeType":866},{},[34330,34333,34337,34340,34344],{"data":34331,"marks":34332,"value":32681,"nodeType":865},{},[],{"data":34334,"marks":34335,"value":32686,"nodeType":865},{},[34336],{"type":946},{"data":34338,"marks":34339,"value":1913,"nodeType":865},{},[],{"data":34341,"marks":34342,"value":32694,"nodeType":865},{},[34343],{"type":946},{"data":34345,"marks":34346,"value":1151,"nodeType":865},{},[],{"data":34348,"content":34349,"nodeType":866},{},[34350,34353,34357,34360,34364],{"data":34351,"marks":34352,"value":32704,"nodeType":865},{},[],{"data":34354,"marks":34355,"value":2080,"nodeType":865},{},[34356],{"type":946},{"data":34358,"marks":34359,"value":1773,"nodeType":865},{},[],{"data":34361,"marks":34362,"value":2088,"nodeType":865},{},[34363],{"type":946},{"data":34365,"marks":34366,"value":32719,"nodeType":865},{},[],{"data":34368,"content":34371,"nodeType":907},{"target":34369},{"sys":34370},{"id":19934,"type":904,"linkType":905},[],{"data":34373,"content":34374,"nodeType":866},{},[34375,34378,34386],{"data":34376,"marks":34377,"value":32731,"nodeType":865},{},[],{"data":34379,"content":34382,"nodeType":1038},{"target":34380},{"sys":34381},{"id":1483,"type":904,"linkType":905},[34383],{"data":34384,"marks":34385,"value":4311,"nodeType":865},{},[],{"data":34387,"marks":34388,"value":21,"nodeType":865},{},[],{"data":34390,"content":34391,"nodeType":1218},{},[34392],{"data":34393,"marks":34394,"value":15108,"nodeType":865},{},[],{"data":34396,"content":34397,"nodeType":866},{},[34398],{"data":34399,"marks":34400,"value":32755,"nodeType":865},{},[],{"data":34402,"content":34403,"nodeType":866},{},[34404,34407,34411,34414,34418,34421,34425],{"data":34405,"marks":34406,"value":32762,"nodeType":865},{},[],{"data":34408,"marks":34409,"value":2080,"nodeType":865},{},[34410],{"type":946},{"data":34412,"marks":34413,"value":1773,"nodeType":865},{},[],{"data":34415,"marks":34416,"value":2088,"nodeType":865},{},[34417],{"type":946},{"data":34419,"marks":34420,"value":32777,"nodeType":865},{},[],{"data":34422,"marks":34423,"value":2041,"nodeType":865},{},[34424],{"type":946},{"data":34426,"marks":34427,"value":32785,"nodeType":865},{},[],{"data":34429,"content":34430,"nodeType":866},{},[34431],{"data":34432,"marks":34433,"value":32792,"nodeType":865},{},[],{"data":34435,"content":34436,"nodeType":866},{},[34437],{"data":34438,"marks":34439,"value":32799,"nodeType":865},{},[],{"data":34441,"content":34444,"nodeType":907},{"target":34442},{"sys":34443},{"id":32804,"type":904,"linkType":905},[],{"data":34446,"content":34447,"nodeType":866},{},[34448,34451,34459],{"data":34449,"marks":34450,"value":32731,"nodeType":865},{},[],{"data":34452,"content":34455,"nodeType":1038},{"target":34453},{"sys":34454},{"id":1740,"type":904,"linkType":905},[34456],{"data":34457,"marks":34458,"value":15108,"nodeType":865},{},[],{"data":34460,"marks":34461,"value":21,"nodeType":865},{},[],{"data":34463,"content":34464,"nodeType":1218},{},[34465],{"data":34466,"marks":34467,"value":20770,"nodeType":865},{},[],{"data":34469,"content":34470,"nodeType":866},{},[34471],{"data":34472,"marks":34473,"value":32835,"nodeType":865},{},[],{"data":34475,"content":34476,"nodeType":866},{},[34477],{"data":34478,"marks":34479,"value":32842,"nodeType":865},{},[],{"data":34481,"content":34482,"nodeType":866},{},[34483],{"data":34484,"marks":34485,"value":32849,"nodeType":865},{},[],{"data":34487,"content":34490,"nodeType":907},{"target":34488},{"sys":34489},{"id":32854,"type":904,"linkType":905},[],{"data":34492,"content":34493,"nodeType":866},{},[34494,34497,34505],{"data":34495,"marks":34496,"value":32731,"nodeType":865},{},[],{"data":34498,"content":34501,"nodeType":1038},{"target":34499},{"sys":34500},{"id":27706,"type":904,"linkType":905},[34502],{"data":34503,"marks":34504,"value":20770,"nodeType":865},{},[],{"data":34506,"marks":34507,"value":21,"nodeType":865},{},[],{"data":34509,"content":34510,"nodeType":1218},{},[34511],{"data":34512,"marks":34513,"value":27436,"nodeType":865},{},[],{"data":34515,"content":34516,"nodeType":866},{},[34517],{"data":34518,"marks":34519,"value":32885,"nodeType":865},{},[],{"data":34521,"content":34522,"nodeType":866},{},[34523],{"data":34524,"marks":34525,"value":32892,"nodeType":865},{},[],{"data":34527,"content":34528,"nodeType":866},{},[34529],{"data":34530,"marks":34531,"value":32899,"nodeType":865},{},[],{"data":34533,"content":34536,"nodeType":907},{"target":34534},{"sys":34535},{"id":32904,"type":904,"linkType":905},[],{"data":34538,"content":34539,"nodeType":866},{},[34540,34543,34551],{"data":34541,"marks":34542,"value":32731,"nodeType":865},{},[],{"data":34544,"content":34547,"nodeType":1038},{"target":34545},{"sys":34546},{"id":13505,"type":904,"linkType":905},[34548],{"data":34549,"marks":34550,"value":13511,"nodeType":865},{},[],{"data":34552,"marks":34553,"value":21,"nodeType":865},{},[],{"data":34555,"content":34556,"nodeType":1218},{},[34557],{"data":34558,"marks":34559,"value":1971,"nodeType":865},{},[],{"data":34561,"content":34562,"nodeType":866},{},[34563],{"data":34564,"marks":34565,"value":32935,"nodeType":865},{},[],{"data":34567,"content":34570,"nodeType":907},{"target":34568},{"sys":34569},{"id":32940,"type":904,"linkType":905},[],{"data":34572,"content":34573,"nodeType":866},{},[34574,34577,34585],{"data":34575,"marks":34576,"value":32731,"nodeType":865},{},[],{"data":34578,"content":34581,"nodeType":1038},{"target":34579},{"sys":34580},{"id":1802,"type":904,"linkType":905},[34582],{"data":34583,"marks":34584,"value":15907,"nodeType":865},{},[],{"data":34586,"marks":34587,"value":21,"nodeType":865},{},[],{"data":34589,"content":34590,"nodeType":948},{},[34591],{"data":34592,"marks":34593,"value":32965,"nodeType":865},{},[],{"data":34595,"content":34596,"nodeType":866},{},[34597],{"data":34598,"marks":34599,"value":32972,"nodeType":865},{},[],{"data":34601,"content":34602,"nodeType":866},{},[34603],{"data":34604,"marks":34605,"value":32979,"nodeType":865},{},[],{"data":34607,"content":34608,"nodeType":891},{},[34609,34622,34635],{"data":34610,"content":34611,"nodeType":880},{},[34612],{"data":34613,"content":34614,"nodeType":866},{},[34615,34619],{"data":34616,"marks":34617,"value":21082,"nodeType":865},{},[34618],{"type":946},{"data":34620,"marks":34621,"value":21086,"nodeType":865},{},[],{"data":34623,"content":34624,"nodeType":880},{},[34625],{"data":34626,"content":34627,"nodeType":866},{},[34628,34632],{"data":34629,"marks":34630,"value":21097,"nodeType":865},{},[34631],{"type":946},{"data":34633,"marks":34634,"value":21101,"nodeType":865},{},[],{"data":34636,"content":34637,"nodeType":880},{},[34638],{"data":34639,"content":34640,"nodeType":866},{},[34641,34645],{"data":34642,"marks":34643,"value":21112,"nodeType":865},{},[34644],{"type":946},{"data":34646,"marks":34647,"value":21116,"nodeType":865},{},[],{"data":34649,"content":34650,"nodeType":866},{},[34651],{"data":34652,"marks":34653,"value":33028,"nodeType":865},{},[],{"data":34655,"content":34656,"nodeType":891},{},[34657,34673,34689,34702],{"data":34658,"content":34659,"nodeType":880},{},[34660],{"data":34661,"content":34662,"nodeType":866},{},[34663,34666,34670],{"data":34664,"marks":34665,"value":33041,"nodeType":865},{},[],{"data":34667,"marks":34668,"value":33046,"nodeType":865},{},[34669],{"type":946},{"data":34671,"marks":34672,"value":21150,"nodeType":865},{},[],{"data":34674,"content":34675,"nodeType":880},{},[34676],{"data":34677,"content":34678,"nodeType":866},{},[34679,34682,34686],{"data":34680,"marks":34681,"value":33059,"nodeType":865},{},[],{"data":34683,"marks":34684,"value":33064,"nodeType":865},{},[34685],{"type":946},{"data":34687,"marks":34688,"value":33068,"nodeType":865},{},[],{"data":34690,"content":34691,"nodeType":880},{},[34692],{"data":34693,"content":34694,"nodeType":866},{},[34695,34699],{"data":34696,"marks":34697,"value":33079,"nodeType":865},{},[34698],{"type":946},{"data":34700,"marks":34701,"value":33083,"nodeType":865},{},[],{"data":34703,"content":34704,"nodeType":880},{},[34705],{"data":34706,"content":34707,"nodeType":866},{},[34708,34712],{"data":34709,"marks":34710,"value":33094,"nodeType":865},{},[34711],{"type":946},{"data":34713,"marks":34714,"value":33098,"nodeType":865},{},[],{"data":34716,"content":34717,"nodeType":866},{},[34718,34721,34725],{"data":34719,"marks":34720,"value":33105,"nodeType":865},{},[],{"data":34722,"marks":34723,"value":2058,"nodeType":865},{},[34724],{"type":946},{"data":34726,"marks":34727,"value":33113,"nodeType":865},{},[],{"data":34729,"content":34732,"nodeType":907},{"target":34730},{"sys":34731},{"id":26972,"type":904,"linkType":905},[],{"data":34734,"content":34735,"nodeType":866},{},[34736],{"data":34737,"marks":34738,"value":33125,"nodeType":865},{},[],{"data":34740,"content":34741,"nodeType":948},{},[34742],{"data":34743,"marks":34744,"value":33132,"nodeType":865},{},[],{"data":34746,"content":34747,"nodeType":866},{},[34748],{"data":34749,"marks":34750,"value":33139,"nodeType":865},{},[],{"data":34752,"content":34753,"nodeType":866},{},[34754],{"data":34755,"marks":34756,"value":33146,"nodeType":865},{},[],{"data":34758,"content":34759,"nodeType":866},{},[34760,34763,34769],{"data":34761,"marks":34762,"value":33153,"nodeType":865},{},[],{"data":34764,"content":34765,"nodeType":1102},{"uri":13248},[34766],{"data":34767,"marks":34768,"value":33160,"nodeType":865},{},[],{"data":34770,"marks":34771,"value":33164,"nodeType":865},{},[],{"data":34773,"content":34774,"nodeType":948},{},[34775],{"data":34776,"marks":34777,"value":6796,"nodeType":865},{},[],{"data":34779,"content":34780,"nodeType":866},{},[34781,34784,34790],{"data":34782,"marks":34783,"value":33177,"nodeType":865},{},[],{"data":34785,"content":34786,"nodeType":1102},{"uri":13707},[34787],{"data":34788,"marks":34789,"value":11104,"nodeType":865},{},[],{"data":34791,"marks":34792,"value":33187,"nodeType":865},{},[],{"entries":34794},{"inline":34795,"hyperlink":34796,"block":34817},[],[34797,34801,34803,34805,34810,34815],{"sys":34798,"__typename":3313,"linkedFromParent":59,"title":34799,"slug":34800,"audience":3316},{"id":32563},"Manage security controls","manage-security-controls",{"sys":34802,"__typename":2256,"title":2257,"slug":2258,"articleId":2259},{"id":1483},{"sys":34804,"__typename":2256,"title":2277,"slug":2278,"articleId":2279},{"id":1740},{"sys":34806,"__typename":2256,"title":34807,"slug":34808,"articleId":34809},{"id":27706},"Can Push block users from visiting websites?","can-push-block-users-from-visiting-websites",10112,{"sys":34811,"__typename":2256,"title":34812,"slug":34813,"articleId":34814},{"id":13505},"How does Push help detect session token theft?","how-does-push-help-detect-session-token-theft",10114,{"sys":34816,"__typename":2256,"title":2292,"slug":2293,"articleId":2294},{"id":1802},[34818,34827,34831,34833,34837,34841,34845,34849],{"sys":34819,"__typename":34820,"title":34821,"youTubeUrl":34822,"imagePlaceholder":34823},{"id":32438},"ExternalVideo","Introducing the Push set-and-forget controls page and events feed","https://www.youtube.com/watch?v=rdbEjLtHVeI",{"url":34824,"width":34825,"height":34826},"https://images.ctfassets.net/y1cdw1ablpvd/3erssFxQsawGjQYO1OgpaY/6dce14e1031c59a31c16fc3a4aef7052/Screenshot_2024-08-15_at_07.18.14.png",3330,1866,{"sys":34828,"__typename":4959,"type":17743,"ctaText":34829,"buttonLabel":34830,"buttonColour":4963,"buttonUrl":59},{"id":18832},"Learn how Push can help you secure identities across your org","Book a demo!",{"sys":34832,"__typename":2341,"title":21232,"arcadeDemoUrl":21233,"playText":21234},{"id":19934},{"sys":34834,"__typename":2341,"title":34835,"arcadeDemoUrl":34836,"playText":2344},{"id":32804},"SSO password protection demo","https://demo.arcade.software/tydMEka88g65V2KMU018?embed",{"sys":34838,"__typename":2341,"title":34839,"arcadeDemoUrl":34840,"playText":2344},{"id":32854},"URL blocking demo","https://demo.arcade.software/A6pdxTOHjVl2BaPJ98Vj?embed",{"sys":34842,"__typename":2341,"title":34843,"arcadeDemoUrl":34844,"playText":2344},{"id":32904},"Session theft detection demo","https://demo.arcade.software/ALltBFZnFbBmVFUgx7z5?embed",{"sys":34846,"__typename":2341,"title":34847,"arcadeDemoUrl":34848,"playText":2344},{"id":32940},"App banners demo","https://demo.arcade.software/TlBO2p8454bN4szY4Jxq?embed",{"sys":34850,"__typename":2366,"title":27359,"caption":59,"layoutMode":59,"file":34851},{"id":26972},{"url":27361,"width":27362,"height":27363},{"items":34853},[],{},"Stop identity attacks with Push's security controls",{"items":34857},[34858,35355,36190],{"__typename":2239,"sys":34859,"content":34860,"title":35342,"synopsis":35343,"hashTags":59,"publishedDate":13735,"slug":35344,"tagsCollection":35345,"authorsCollection":35351},{"id":13469},{"json":34861},{"data":34862,"content":34863,"nodeType":2232},{},[34864,34870,34877,34910,34917,34936,34943,34988,34995,35002,35009,35014,35021,35108,35115,35122,35145,35152,35159,35166,35173,35180,35186,35235,35242,35247,35264,35270,35277,35284,35291,35298,35305,35312,35319,35325],{"data":34865,"content":34869,"nodeType":907},{"target":34866},{"sys":34867},{"id":34868,"type":904,"linkType":905},"2HffP4X7owzpfj41jnzXmV",[],{"data":34871,"content":34872,"nodeType":866},{},[34873],{"data":34874,"marks":34875,"value":34876,"nodeType":865},{},[],"To detect session token theft, you need three things:",{"data":34878,"content":34879,"nodeType":891},{},[34880,34890,34900],{"data":34881,"content":34882,"nodeType":880},{},[34883],{"data":34884,"content":34885,"nodeType":866},{},[34886],{"data":34887,"marks":34888,"value":34889,"nodeType":865},{},[],"Robust logs that provide an identifier to help tie activity to a specific session",{"data":34891,"content":34892,"nodeType":880},{},[34893],{"data":34894,"content":34895,"nodeType":866},{},[34896],{"data":34897,"marks":34898,"value":34899,"nodeType":865},{},[],"A well-oiled SOC to correlate observed activity in those logs",{"data":34901,"content":34902,"nodeType":880},{},[34903],{"data":34904,"content":34905,"nodeType":866},{},[34906],{"data":34907,"marks":34908,"value":34909,"nodeType":865},{},[],"And telemetry to tie those logs to a trusted endpoint",{"data":34911,"content":34912,"nodeType":866},{},[34913],{"data":34914,"marks":34915,"value":34916,"nodeType":865},{},[],"The only problem? That third thing didn’t really exist. So we created it.",{"data":34918,"content":34919,"nodeType":866},{},[34920,34924,34932],{"data":34921,"marks":34922,"value":34923,"nodeType":865},{},[],"In this article, we’ll cover how Push’s recently released ",{"data":34925,"content":34927,"nodeType":1102},{"uri":34926},"https://pushsecurity.com/help/10114#start",[34928],{"data":34929,"marks":34930,"value":15596,"nodeType":865},{},[34931],{"type":4537},{"data":34933,"marks":34934,"value":34935,"nodeType":865},{},[]," feature works, why we built it, and why the unique control point provided by a browser agent unlocks new capabilities for blue teams fighting the effects of infostealer malware and other stolen credential-based attacks.",{"data":34937,"content":34938,"nodeType":948},{},[34939],{"data":34940,"marks":34941,"value":34942,"nodeType":865},{},[],"(You probably already know) Why this matters",{"data":34944,"content":34945,"nodeType":866},{},[34946,34950,34959,34963,34972,34976,34984],{"data":34947,"marks":34948,"value":34949,"nodeType":865},{},[],"Session token theft is a ",{"data":34951,"content":34953,"nodeType":1102},{"uri":34952},"https://owasp.org/www-community/attacks/Session_hijacking_attack",[34954],{"data":34955,"marks":34956,"value":34958,"nodeType":865},{},[34957],{"type":4537},"session hijacking",{"data":34960,"marks":34961,"value":34962,"nodeType":865},{},[]," technique where endpoint malware is used to extract sessions from an endpoint, and until recently it was ",{"data":34964,"content":34966,"nodeType":1102},{"uri":34965},"https://www.microsoft.com/en-us/security/blog/2022/11/16/token-tactics-how-to-prevent-detect-and-respond-to-cloud-token-theft/",[34967],{"data":34968,"marks":34969,"value":34971,"nodeType":865},{},[34970],{"type":4537},"relatively rare",{"data":34973,"marks":34974,"value":34975,"nodeType":865},{},[],". It’s easier to ",{"data":34977,"content":34978,"nodeType":1102},{"uri":29172},[34979],{"data":34980,"marks":34981,"value":34983,"nodeType":865},{},[34982],{"type":4537},"gain access via a password",{"data":34985,"marks":34986,"value":34987,"nodeType":865},{},[]," than it is to steal a session cookie. ",{"data":34989,"content":34990,"nodeType":866},{},[34991],{"data":34992,"marks":34993,"value":34994,"nodeType":865},{},[],"But there’s an inverse relationship between session-based attacks and MFA adoption. As MFA becomes widespread, adversaries turn to new effective methods of initial entry.",{"data":34996,"content":34997,"nodeType":866},{},[34998],{"data":34999,"marks":35000,"value":35001,"nodeType":865},{},[],"An increasingly common approach involves the use of infostealer malware, which can extract saved credentials, browser cookies, cryptowallets, and other valuable data from the infected endpoint.",{"data":35003,"content":35004,"nodeType":866},{},[35005],{"data":35006,"marks":35007,"value":35008,"nodeType":865},{},[],"Using stolen tokens, adversaries don’t need to bypass MFA directly. They can simply import the tokens into their browser and assume an already authorized session.",{"data":35010,"content":35013,"nodeType":907},{"target":35011},{"sys":35012},{"id":25087,"type":904,"linkType":905},[],{"data":35015,"content":35016,"nodeType":866},{},[35017],{"data":35018,"marks":35019,"value":35020,"nodeType":865},{},[],"A few recent stats show the scope of the problem:",{"data":35022,"content":35023,"nodeType":891},{},[35024,35045,35067,35088],{"data":35025,"content":35026,"nodeType":880},{},[35027],{"data":35028,"content":35029,"nodeType":866},{},[35030,35034,35042],{"data":35031,"marks":35032,"value":35033,"nodeType":865},{},[],"Nearly half of the malware detected last year by Sophos targeted victims’ data specifically, and the majority of that malware was classified as infostealers. Source: ",{"data":35035,"content":35036,"nodeType":1102},{"uri":16484},[35037],{"data":35038,"marks":35039,"value":35041,"nodeType":865},{},[35040],{"type":4537},"2024 Sophos Threat Report",{"data":35043,"marks":35044,"value":21,"nodeType":865},{},[],{"data":35046,"content":35047,"nodeType":880},{},[35048],{"data":35049,"content":35050,"nodeType":866},{},[35051,35055,35064],{"data":35052,"marks":35053,"value":35054,"nodeType":865},{},[],"Information-stealing malware accounted for nearly 10 percent of activity that Red Canary was able to associate with named threats last year. They also found a rise in stealer malware targeting macOS compared to previous years. Source: ",{"data":35056,"content":35058,"nodeType":1102},{"uri":35057},"https://redcanary.com/threat-detection-report/trends/info-stealers/",[35059],{"data":35060,"marks":35061,"value":35063,"nodeType":865},{},[35062],{"type":4537},"2024 Red Canary Threat Detection Report",{"data":35065,"marks":35066,"value":21,"nodeType":865},{},[],{"data":35068,"content":35069,"nodeType":880},{},[35070],{"data":35071,"content":35072,"nodeType":866},{},[35073,35077,35085],{"data":35074,"marks":35075,"value":35076,"nodeType":865},{},[],"Stolen credentials continued to rank as the top initial access method for breaches analyzed by Verizon. Source: ",{"data":35078,"content":35079,"nodeType":1102},{"uri":2328},[35080],{"data":35081,"marks":35082,"value":35084,"nodeType":865},{},[35083],{"type":4537},"2024 Data Breach Investigations Report",{"data":35086,"marks":35087,"value":21,"nodeType":865},{},[],{"data":35089,"content":35090,"nodeType":880},{},[35091],{"data":35092,"content":35093,"nodeType":866},{},[35094,35098,35105],{"data":35095,"marks":35096,"value":35097,"nodeType":865},{},[],"The number of token replay attacks is increasing, with Microsoft detecting 147,000 attacks in 2023, a 111% increase year-over-year. Source: ",{"data":35099,"content":35100,"nodeType":1102},{"uri":28212},[35101],{"data":35102,"marks":35103,"value":35104,"nodeType":865},{},[],"Microsoft Blog",{"data":35106,"marks":35107,"value":21,"nodeType":865},{},[],{"data":35109,"content":35110,"nodeType":948},{},[35111],{"data":35112,"marks":35113,"value":35114,"nodeType":865},{},[],"What's missing from current defenses",{"data":35116,"content":35117,"nodeType":866},{},[35118],{"data":35119,"marks":35120,"value":35121,"nodeType":865},{},[],"When defending against infostealer malware or other forms of session and credential theft, there are a few common challenges that organizations may face:",{"data":35123,"content":35124,"nodeType":891},{},[35125,35135],{"data":35126,"content":35127,"nodeType":880},{},[35128],{"data":35129,"content":35130,"nodeType":866},{},[35131],{"data":35132,"marks":35133,"value":35134,"nodeType":865},{},[],"Their endpoint security tooling doesn’t provide complete coverage across their device fleet, though they thought it did.",{"data":35136,"content":35137,"nodeType":880},{},[35138],{"data":35139,"content":35140,"nodeType":866},{},[35141],{"data":35142,"marks":35143,"value":35144,"nodeType":865},{},[],"The malware is good enough to evade EDR detection, or it was able to execute and exfiltrate sessions or other data before it was stopped.",{"data":35146,"content":35147,"nodeType":866},{},[35148],{"data":35149,"marks":35150,"value":35151,"nodeType":865},{},[],"Existing approaches to detecting stolen sessions also pose a noisy problem. Relying on IP-based or geolocation-based signals can result in frequent false positives. (And not all identity provider logs include a session identifier that you can use to perform correlations in the first place.)",{"data":35153,"content":35154,"nodeType":866},{},[35155],{"data":35156,"marks":35157,"value":35158,"nodeType":865},{},[],"The missing piece is a trusted signal for legitimate sessions that you can use to correlate with other data in order to identify unexpected activity that indicates a compromised identity and device.",{"data":35160,"content":35161,"nodeType":948},{},[35162],{"data":35163,"marks":35164,"value":35165,"nodeType":865},{},[],"Generating unique telemetry via the browser",{"data":35167,"content":35168,"nodeType":866},{},[35169],{"data":35170,"marks":35171,"value":35172,"nodeType":865},{},[],"Push’s solution to detecting stolen sessions falls into the category of “so simple, why didn’t this already exist?”",{"data":35174,"content":35175,"nodeType":866},{},[35176],{"data":35177,"marks":35178,"value":35179,"nodeType":865},{},[],"The answer: Because you need to be in the browser to do it. The Push browser agent sits in a unique position that we can leverage to provide telemetry that otherwise would be extremely difficult to create.",{"data":35181,"content":35182,"nodeType":866},{},[35183],{"data":35184,"marks":35185,"value":18316,"nodeType":865},{},[],{"data":35187,"content":35188,"nodeType":891},{},[35189,35199,35209],{"data":35190,"content":35191,"nodeType":880},{},[35192],{"data":35193,"content":35194,"nodeType":866},{},[35195],{"data":35196,"marks":35197,"value":35198,"nodeType":865},{},[],"Via the Push browser agent, Push injects a unique marker into the user agent string of sessions that occur in browsers enrolled in Push.",{"data":35200,"content":35201,"nodeType":880},{},[35202],{"data":35203,"content":35204,"nodeType":866},{},[35205],{"data":35206,"marks":35207,"value":35208,"nodeType":865},{},[],"Administrators then add the list of domains where they wish to inject the marker into sessions, such as an identity provider like Okta or Microsoft.",{"data":35210,"content":35211,"nodeType":880},{},[35212],{"data":35213,"content":35214,"nodeType":866},{},[35215,35219,35223,35227,35231],{"data":35216,"marks":35217,"value":35218,"nodeType":865},{},[],"By analyzing logs from the IdP, you can identify activity from the same session that both ",{"data":35220,"marks":35221,"value":13546,"nodeType":865},{},[35222],{"type":979},{"data":35224,"marks":35225,"value":35226,"nodeType":865},{},[]," the Push marker and that ",{"data":35228,"marks":35229,"value":13555,"nodeType":865},{},[35230],{"type":979},{"data":35232,"marks":35233,"value":35234,"nodeType":865},{},[]," the marker. This can only ever happen when a session is extracted from a browser and maliciously imported into a different browser.",{"data":35236,"content":35237,"nodeType":866},{},[35238],{"data":35239,"marks":35240,"value":35241,"nodeType":865},{},[],"This is a high-fidelity signal that a stolen session token is in use.",{"data":35243,"content":35246,"nodeType":907},{"target":35244},{"sys":35245},{"id":13520,"type":904,"linkType":905},[],{"data":35248,"content":35249,"nodeType":866},{},[35250,35254,35261],{"data":35251,"marks":35252,"value":35253,"nodeType":865},{},[],"Learn more about configuring this feature in our ",{"data":35255,"content":35256,"nodeType":1102},{"uri":34926},[35257],{"data":35258,"marks":35259,"value":27024,"nodeType":865},{},[35260],{"type":4537},{"data":35262,"marks":35263,"value":1151,"nodeType":865},{},[],{"data":35265,"content":35269,"nodeType":907},{"target":35266},{"sys":35267},{"id":35268,"type":904,"linkType":905},"35dpGqNY6cTM0fSQRflLiO",[],{"data":35271,"content":35272,"nodeType":948},{},[35273],{"data":35274,"marks":35275,"value":35276,"nodeType":865},{},[],"Unlocking new capabilities for blue teams",{"data":35278,"content":35279,"nodeType":866},{},[35280],{"data":35281,"marks":35282,"value":35283,"nodeType":865},{},[],"As we’ve said before, we see browser telemetry and browser-based controls as the missing piece in security strategies to stop identity attacks — particularly for modern organizations with complex identity ecosystems that span IdPs, SaaS apps, OAuth-connected apps, and more.",{"data":35285,"content":35286,"nodeType":866},{},[35287],{"data":35288,"marks":35289,"value":35290,"nodeType":865},{},[],"Where the browser agent approach particularly shines is that it’s application-agnostic. ",{"data":35292,"content":35293,"nodeType":866},{},[35294],{"data":35295,"marks":35296,"value":35297,"nodeType":865},{},[],"As long as the app you want to monitor provides robust logs, you can inject the Push-supplied marker into any session on any app. ",{"data":35299,"content":35300,"nodeType":866},{},[35301],{"data":35302,"marks":35303,"value":35304,"nodeType":865},{},[],"This allows you to detect suspicious activity even on internal corporate assets, such as an intranet. ",{"data":35306,"content":35307,"nodeType":866},{},[35308],{"data":35309,"marks":35310,"value":35311,"nodeType":865},{},[],"A tidy side effect is that you can also use this feature to identify unmanaged devices accessing sensitive corporate internal resources because they will lack the Push browser agent-supplied marker.",{"data":35313,"content":35314,"nodeType":866},{},[35315],{"data":35316,"marks":35317,"value":35318,"nodeType":865},{},[],"There are probably a few other creative use cases for this feature, so we look forward to seeing what you come up with!",{"data":35320,"content":35321,"nodeType":948},{},[35322],{"data":35323,"marks":35324,"value":6796,"nodeType":865},{},[],{"data":35326,"content":35327,"nodeType":866},{},[35328,35331,35338],{"data":35329,"marks":35330,"value":13704,"nodeType":865},{},[],{"data":35332,"content":35333,"nodeType":1102},{"uri":10028},[35334],{"data":35335,"marks":35336,"value":11104,"nodeType":865},{},[35337],{"type":4537},{"data":35339,"marks":35340,"value":35341,"nodeType":865},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using, even the ones not behind SSO, and how we detect vulnerable identities and stop identity attacks with browser-based controls.","Introducing session token theft detection: Why browser is best","Push's browser agent identifies session token theft by adding telemetry to the user agent string to create a new high-fidelity signal for your security team.","introducing-session-token-theft-detection-why-browser-is-best",{"items":35346},[35347,35349],{"sys":35348,"name":342},{"id":2527},{"sys":35350,"name":3915},{"id":3914},{"items":35352},[35353],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":35354},{"url":853},{"__typename":2239,"sys":35356,"content":35358,"title":36176,"synopsis":36177,"hashTags":59,"publishedDate":36178,"slug":36179,"tagsCollection":36180,"authorsCollection":36186},{"id":35357},"7DJnckJxP4CXyXhPJJpby5",{"json":35359},{"data":35360,"content":35361,"nodeType":2232},{},[35362,35369,35376,35383,35390,35397,35404,35411,35418,35425,35431,35438,35445,35452,35501,35508,35515,35534,35541,35548,35555,35588,35604,35611,35618,35625,35632,35639,35646,35666,35685,35789,35796,35814,35821,35828,35835,35841,35848,35855,35862,35893,35900,35907,35940,35947,35954,36050,36067,36073,36080,36087,36094,36148,36155,36158,36165,36170],{"data":35363,"content":35364,"nodeType":866},{},[35365],{"data":35366,"marks":35367,"value":35368,"nodeType":865},{},[],"Phishing attacks have always been a go-to technique for both red teamers and real-world threat actors alike. Whether focused on harvesting creds or running malicious payloads, phishing has continued to be adapted to circumvent defenses and has remained highly effective due to this.",{"data":35370,"content":35371,"nodeType":866},{},[35372],{"data":35373,"marks":35374,"value":35375,"nodeType":865},{},[],"As MFA has become more common, classic password harvesting focused phishing attacks have become less effective. Typically, for a full account compromise, an MFA push notification or a one-time passcode (OTP) needs to be entered at the time of login. This means harvesting passwords and using them later is no longer effective alone, because an MFA factor is still required each time a valid login is performed.",{"data":35377,"content":35378,"nodeType":866},{},[35379],{"data":35380,"marks":35381,"value":35382,"nodeType":865},{},[],"Adversary-in-the-Middle (AitM) phishing is a newer variant of phishing that allows attackers to circumvent MFA protection. In this article, we’re going to look at what AitM phishing is, how it works, and what you can do about it.",{"data":35384,"content":35385,"nodeType":948},{},[35386],{"data":35387,"marks":35388,"value":35389,"nodeType":865},{},[],"What is AitM phishing?",{"data":35391,"content":35392,"nodeType":866},{},[35393],{"data":35394,"marks":35395,"value":35396,"nodeType":865},{},[],"AitM phishing is a technique that uses dedicated tooling to act as a proxy between the target and a legitimate login portal for an application, principally to make it easier to defeat MFA protection. ",{"data":35398,"content":35399,"nodeType":866},{},[35400],{"data":35401,"marks":35402,"value":35403,"nodeType":865},{},[],"While any login portal can be a target, attackers typically look for SSO login portals such as Microsoft Entra, Okta, or Google Workspace. This allows the target to log in successfully with a legitimate service they use and even continue to interact with it, while providing additional access to connected SSO apps if the attack is successful. ",{"data":35405,"content":35406,"nodeType":866},{},[35407],{"data":35408,"marks":35409,"value":35410,"nodeType":865},{},[],"As it’s a proxy to the real application, the page will appear exactly as the user expects, because they are logging into the legitimate site – just taking a detour via the attacker’s device. For example, if accessing their webmail, the user will see all their real emails; if accessing their cloud file store then all their real files will be present, etc. This gives the method an increased sense of authenticity and makes the compromise less obvious to the user. However, because the attacker is sitting in the middle of this connection, they are able to observe all interactions and also take control of the authenticated session to gain control of the user account. ",{"data":35412,"content":35413,"nodeType":866},{},[35414],{"data":35415,"marks":35416,"value":35417,"nodeType":865},{},[],"While this access is technically temporary, since the attacker is unable to re-authenticate in future without additional MFA prompts, in practice authenticated sessions can often last as long as 30 days or more if kept active. Additionally, there are a wide range of persistence techniques that allow an attacker to maintain some level of access to the user account and/or targeted application indefinitely. ",{"data":35419,"content":35420,"nodeType":866},{},[35421],{"data":35422,"marks":35423,"value":35424,"nodeType":865},{},[],"We’ll revisit this point later, but for now let’s consider the two main techniques that are used to implement AitM phishing: Reverse web proxies and Browser-in-the-Middle techniques.",{"data":35426,"content":35430,"nodeType":907},{"target":35427},{"sys":35428},{"id":35429,"type":904,"linkType":905},"6WEolDcviadCgAW4dCgTPW",[],{"data":35432,"content":35433,"nodeType":1218},{},[35434],{"data":35435,"marks":35436,"value":35437,"nodeType":865},{},[],"Reverse web proxy techniques",{"data":35439,"content":35440,"nodeType":866},{},[35441],{"data":35442,"marks":35443,"value":35444,"nodeType":865},{},[],"One common AitM phishing approach is to use tooling that acts as a reverse web proxy. For example, let’s say a victim is tricked into visiting a malicious domain. Under the hood, HTTP requests are passed between the victim’s browser and the real site via the malicious site. When the malicious site receives an HTTP request, it forwards this request on to the legitimate site it is impersonating, receives the response, and then forwards that on to the victim. ",{"data":35446,"content":35447,"nodeType":866},{},[35448],{"data":35449,"marks":35450,"value":35451,"nodeType":865},{},[],"In practice, there are many technical challenges, such as rewriting all links and references to the impersonated site to ensure everything continues to be sent to the attacker. However, at a high level, it really is just acting as a reverse web proxy.",{"data":35453,"content":35454,"nodeType":866},{},[35455,35459,35466,35469,35476,35480,35487,35491,35498],{"data":35456,"marks":35457,"value":35458,"nodeType":865},{},[],"This is arguably the most scalable and reliable approach from an attacker’s point of view. Open-source tools that demonstrate this method include ",{"data":35460,"content":35461,"nodeType":1102},{"uri":24934},[35462],{"data":35463,"marks":35464,"value":24939,"nodeType":865},{},[35465],{"type":4537},{"data":35467,"marks":35468,"value":3531,"nodeType":865},{},[],{"data":35470,"content":35471,"nodeType":1102},{"uri":24945},[35472],{"data":35473,"marks":35474,"value":24950,"nodeType":865},{},[35475],{"type":4537},{"data":35477,"marks":35478,"value":35479,"nodeType":865},{},[],", and the ever popular ",{"data":35481,"content":35482,"nodeType":1102},{"uri":24956},[35483],{"data":35484,"marks":35485,"value":24961,"nodeType":865},{},[35486],{"type":4537},{"data":35488,"marks":35489,"value":35490,"nodeType":865},{},[],". In the criminal world, there are also similar private toolsets available that have been used in many breaches in the past. A good example of this would be ",{"data":35492,"content":35493,"nodeType":1102},{"uri":24967},[35494],{"data":35495,"marks":35496,"value":24972,"nodeType":865},{},[35497],{"type":4537},{"data":35499,"marks":35500,"value":1151,"nodeType":865},{},[],{"data":35502,"content":35503,"nodeType":866},{},[35504],{"data":35505,"marks":35506,"value":35507,"nodeType":865},{},[],"One downside to this approach is that there are controls that can be put in place to block it. For example, application developers can hide obfuscated JavaScript code that will fail if the correct value is not produced, checking that the origin matches the expected (legitimate) domains or contains encrypted tokens including this material sent as part of the login process. ",{"data":35509,"content":35510,"nodeType":866},{},[35511],{"data":35512,"marks":35513,"value":35514,"nodeType":865},{},[],"While your average small website is not going to be implementing such checks, major identity providers have a strong vested interest in evolving their defenses to block these techniques. At this point, it’s a cat-and-mouse game. ",{"data":35516,"content":35517,"nodeType":866},{},[35518,35522,35531],{"data":35519,"marks":35520,"value":35521,"nodeType":865},{},[],"If you want to know more about this space, then definitely check out ",{"data":35523,"content":35525,"nodeType":1102},{"uri":35524},"https://www.youtube.com/watch?v=C-Fh4sIdY8c",[35526],{"data":35527,"marks":35528,"value":35530,"nodeType":865},{},[35529],{"type":4537},"Kuba Gretzky’s talk on this at x33fcon",{"data":35532,"marks":35533,"value":6360,"nodeType":865},{},[],{"data":35535,"content":35536,"nodeType":1218},{},[35537],{"data":35538,"marks":35539,"value":35540,"nodeType":865},{},[],"Browser-in-the-Middle (BitM) techniques ",{"data":35542,"content":35543,"nodeType":866},{},[35544],{"data":35545,"marks":35546,"value":35547,"nodeType":865},{},[],"Another common approach is known as Browser-in-the-Middle (BitM). Rather than act as a reverse web proxy, this technique tricks a target into directly controlling the attacker’s own browser remotely using desktop screen sharing and control approaches, much like VNC and RDP. This enables the attacker to harvest not just the username and password, but all other associated secrets and tokens that go along with the login. ",{"data":35549,"content":35550,"nodeType":866},{},[35551],{"data":35552,"marks":35553,"value":35554,"nodeType":865},{},[],"In this case, the victim isn’t interacting with a fake website clone or proxy. They are literally remotely controlling the attacker’s browser to log in to the legitimate application without realizing. This is the virtual equivalent of an attacker handing their laptop to their victim, asking them to login to Okta for them, and then taking their laptop back afterwards. Thanks very much!",{"data":35556,"content":35557,"nodeType":866},{},[35558,35562,35571,35575,35584],{"data":35559,"marks":35560,"value":35561,"nodeType":865},{},[],"Practically speaking, the most common approach for implementing this technique is using the open-source project noVNC, which is a JavaScript-based VNC client that allows VNC to be used in the browser. Probably the most well-known example of an offensive tool implementing this is ",{"data":35563,"content":35565,"nodeType":1102},{"uri":35564},"https://github.com/JoelGMSec/EvilnoVNC",[35566],{"data":35567,"marks":35568,"value":35570,"nodeType":865},{},[35569],{"type":4537},"EvilnoVNC",{"data":35572,"marks":35573,"value":35574,"nodeType":865},{},[],", which spins up Docker instances of VNC and proxies access to them, while also logging keystrokes and cookies to facilitate account compromise. Tools like ",{"data":35576,"content":35578,"nodeType":1102},{"uri":35577},"https://posts.specterops.io/phishing-with-dynamite-7d33d8fac038",[35579],{"data":35580,"marks":35581,"value":35583,"nodeType":865},{},[35582],{"type":4537},"Cuddlephish",{"data":35585,"marks":35586,"value":35587,"nodeType":865},{},[]," offer similar functionality using WebRTC. ",{"data":35589,"content":35590,"nodeType":866},{},[35591,35595,35600],{"data":35592,"marks":35593,"value":35594,"nodeType":865},{},[],"The advantage of this approach is that ",{"data":35596,"marks":35597,"value":35599,"nodeType":865},{},[35598],{"type":946},"it is incredibly difficult for the target websites to do anything to stop it",{"data":35601,"marks":35602,"value":35603,"nodeType":865},{},[],". From their perspective, all they see is a legitimate browser accessing their website and logging in. None of the JavaScript tricks for checking the origin will work. They aren’t in a position to be able to see that the browser is secretly being controlled remotely by the victim user without their knowledge. ",{"data":35605,"content":35606,"nodeType":866},{},[35607],{"data":35608,"marks":35609,"value":35610,"nodeType":865},{},[],"On the downside, while noVNC can be extremely convincing, the illusion can sometimes be broken due to it not behaving exactly like a real website would due it being a graphical rendering. For example, something as simple as resizing the browser window can introduce render resolution issues. It’s also more difficult to scale for attacking large numbers of users than a reverse proxy technique.",{"data":35612,"content":35613,"nodeType":866},{},[35614],{"data":35615,"marks":35616,"value":35617,"nodeType":865},{},[],"Footnote: BitM is not to be confused with Browser-in-the-Browser (BitB), which is more of a malicious pop-up (think when a login button spawns a new browser window). ",{"data":35619,"content":35620,"nodeType":948},{},[35621],{"data":35622,"marks":35623,"value":35624,"nodeType":865},{},[],"Beyond initial access",{"data":35626,"content":35627,"nodeType":866},{},[35628],{"data":35629,"marks":35630,"value":35631,"nodeType":865},{},[],"So maybe you’re thinking now “OK, sounds kinda bad, but I’m not that worried. Maybe some user accounts get compromised by this method despite all my MFA protections, but at least the attacker only has temporary access, right?” ",{"data":35633,"content":35634,"nodeType":866},{},[35635],{"data":35636,"marks":35637,"value":35638,"nodeType":865},{},[],"In theory, access is temporary as sessions time out. And if spotted, the security team can respond by killing the authenticated sessions and forcing password changes for the compromised users. Then the attacker is back to square one, right? Their session is lost, they still don’t have MFA, and even the password they keylogged has now been changed.",{"data":35640,"content":35641,"nodeType":866},{},[35642],{"data":35643,"marks":35644,"value":35645,"nodeType":865},{},[],"In practice, it’s not this simple. We mentioned earlier how SSO portals are often the most common targets for these attacks. For most modern organizations, this means their core identity provider, which just so happens to be the gateway to accessing many other web applications, whether internal applications or a multitude of SaaS applications. ",{"data":35647,"content":35648,"nodeType":866},{},[35649,35653,35662],{"data":35650,"marks":35651,"value":35652,"nodeType":865},{},[],"Let’s consider the example of an organization using Okta where their Okta login portal has been used as the target for AitM phishing. A smart attacker is going to immediately leverage this access to establish authenticated sessions on every single application that Okta provides the user access to. They are also going to ",{"data":35654,"content":35656,"nodeType":1102},{"uri":35655},"https://pushsecurity.com/blog/okta-swa/",[35657],{"data":35658,"marks":35659,"value":35661,"nodeType":865},{},[35660],{"type":4537},"abuse Okta SWA",{"data":35663,"marks":35664,"value":35665,"nodeType":865},{},[]," to steal valid credentials for whichever applications support this method. And if that’s not enough, there are a variety of simple methods to achieve persistence on most downstream SaaS applications and sometimes even identity providers themselves.",{"data":35667,"content":35668,"nodeType":866},{},[35669,35673,35681],{"data":35670,"marks":35671,"value":35672,"nodeType":865},{},[],"While the full details of these persistence attacks are outside the scope of this article, more details on some key attacks can be found in a resource we created called the ",{"data":35674,"content":35675,"nodeType":1102},{"uri":22038},[35676],{"data":35677,"marks":35678,"value":35680,"nodeType":865},{},[35679],{"type":4537},"SaaS attacks matrix",{"data":35682,"marks":35683,"value":35684,"nodeType":865},{},[],". Some of the most common techniques that apply here are: ",{"data":35686,"content":35687,"nodeType":891},{},[35688,35708,35729,35749,35769],{"data":35689,"content":35690,"nodeType":880},{},[35691],{"data":35692,"content":35693,"nodeType":866},{},[35694,35697,35705],{"data":35695,"marks":35696,"value":21,"nodeType":865},{},[],{"data":35698,"content":35699,"nodeType":1102},{"uri":6472},[35700],{"data":35701,"marks":35702,"value":35704,"nodeType":865},{},[35703],{"type":4537},"SAT1004 - API keys",{"data":35706,"marks":35707,"value":21,"nodeType":865},{},[],{"data":35709,"content":35710,"nodeType":880},{},[35711],{"data":35712,"content":35713,"nodeType":866},{},[35714,35717,35726],{"data":35715,"marks":35716,"value":21,"nodeType":865},{},[],{"data":35718,"content":35720,"nodeType":1102},{"uri":35719},"https://github.com/pushsecurity/saas-attacks/blob/main/techniques/link_sharing/description.md",[35721],{"data":35722,"marks":35723,"value":35725,"nodeType":865},{},[35724],{"type":4537},"SAT1022 - Link sharing",{"data":35727,"marks":35728,"value":21,"nodeType":865},{},[],{"data":35730,"content":35731,"nodeType":880},{},[35732],{"data":35733,"content":35734,"nodeType":866},{},[35735,35738,35746],{"data":35736,"marks":35737,"value":21,"nodeType":865},{},[],{"data":35739,"content":35740,"nodeType":1102},{"uri":5377},[35741],{"data":35742,"marks":35743,"value":35745,"nodeType":865},{},[35744],{"type":4537},"SAT1017 - Ghost logins",{"data":35747,"marks":35748,"value":21,"nodeType":865},{},[],{"data":35750,"content":35751,"nodeType":880},{},[35752],{"data":35753,"content":35754,"nodeType":866},{},[35755,35758,35766],{"data":35756,"marks":35757,"value":21,"nodeType":865},{},[],{"data":35759,"content":35760,"nodeType":1102},{"uri":26442},[35761],{"data":35762,"marks":35763,"value":35765,"nodeType":865},{},[35764],{"type":4537},"SAT1027 - OAuth tokens",{"data":35767,"marks":35768,"value":21,"nodeType":865},{},[],{"data":35770,"content":35771,"nodeType":880},{},[35772],{"data":35773,"content":35774,"nodeType":866},{},[35775,35778,35786],{"data":35776,"marks":35777,"value":21,"nodeType":865},{},[],{"data":35779,"content":35780,"nodeType":1102},{"uri":17081},[35781],{"data":35782,"marks":35783,"value":35785,"nodeType":865},{},[35784],{"type":4537},"SAT1033 - Shadow workflows",{"data":35787,"marks":35788,"value":21,"nodeType":865},{},[],{"data":35790,"content":35791,"nodeType":866},{},[35792],{"data":35793,"marks":35794,"value":35795,"nodeType":865},{},[],"Suddenly, containing the breach just got a LOT more complicated.",{"data":35797,"content":35798,"nodeType":866},{},[35799,35803,35810],{"data":35800,"marks":35801,"value":35802,"nodeType":865},{},[],"It’s not just application-level lateral movement and persistence to worry about, though. It’s possible the attacker can start moving laterally across other user accounts. If they have selected their targets well, they might even find they have admin access to some downstream SaaS application that has been configured for SAML logins using Okta. For example, maybe they compromise a finance employee who has admin access to their business expenses SaaS application. Then the attacker might be able to use a new technique like ",{"data":35804,"content":35805,"nodeType":1102},{"uri":26686},[35806],{"data":35807,"marks":35808,"value":14104,"nodeType":865},{},[35809],{"type":4537},{"data":35811,"marks":35812,"value":35813,"nodeType":865},{},[]," to start attacking other users in a watering hole attack to achieve lateral movement.",{"data":35815,"content":35816,"nodeType":948},{},[35817],{"data":35818,"marks":35819,"value":35820,"nodeType":865},{},[],"Video demo – chaining it all together",{"data":35822,"content":35823,"nodeType":866},{},[35824],{"data":35825,"marks":35826,"value":35827,"nodeType":865},{},[],"OK, so we’ve just jumped from an account compromise for initial access using an AitM phishing attack to bringing up a huge number of other connected techniques. Let’s look at a quick video demonstration of an AitM phishing attack chained together with post-exploitation steps for persistence and lateral movement so we can see how it all fits together.",{"data":35829,"content":35830,"nodeType":866},{},[35831],{"data":35832,"marks":35833,"value":35834,"nodeType":865},{},[],"In this case, we’ll use EvilnoVNC targeting Okta as the core example for the AitM phishing attack:",{"data":35836,"content":35840,"nodeType":907},{"target":35837},{"sys":35838},{"id":35839,"type":904,"linkType":905},"QGTEWzmOL1vrgjXPuV4Gg",[],{"data":35842,"content":35843,"nodeType":866},{},[35844],{"data":35845,"marks":35846,"value":35847,"nodeType":865},{},[],"We can see here that AitM phishing attacks are not only highly effective even in the presence of MFA, but that post-exploitation steps have become so numerous that effective response and containment for even a low-privileged user account are now a significant challenge.",{"data":35849,"content":35850,"nodeType":948},{},[35851],{"data":35852,"marks":35853,"value":35854,"nodeType":865},{},[],"Post-exploitation automation is coming",{"data":35856,"content":35857,"nodeType":866},{},[35858],{"data":35859,"marks":35860,"value":35861,"nodeType":865},{},[],"There is a saying that attacks only become more effective over time. In the past, toolsets like Metasploit and Cobalt Strike became increasingly focused on post-exploitation and automation to enable much more sophisticated compromises.",{"data":35863,"content":35864,"nodeType":866},{},[35865,35869,35880,35884,35889],{"data":35866,"marks":35867,"value":35868,"nodeType":865},{},[],"As AitM becomes increasingly popular (for example, researchers at Lab539 have reported ",{"data":35870,"content":35871,"nodeType":1102},{"uri":32488},[35872,35877],{"data":35873,"marks":35874,"value":35876,"nodeType":865},{},[35875],{"type":4537},"a significant ramp up in attacker infrastructure linked to AitM campaigns",{"data":35878,"marks":35879,"value":5804,"nodeType":865},{},[],{"data":35881,"marks":35882,"value":35883,"nodeType":865},{},[]," it’s only a matter of time now before we see AitM phishing frameworks moving in the same direction and performing many of the lateral movement and persistence steps we saw above – automatically on every successful account compromise. The threat will increase ",{"data":35885,"marks":35886,"value":35888,"nodeType":865},{},[35887],{"type":946},"significantly",{"data":35890,"marks":35891,"value":35892,"nodeType":865},{},[]," when this becomes the case.",{"data":35894,"content":35895,"nodeType":948},{},[35896],{"data":35897,"marks":35898,"value":35899,"nodeType":865},{},[],"Impact summary",{"data":35901,"content":35902,"nodeType":866},{},[35903],{"data":35904,"marks":35905,"value":35906,"nodeType":865},{},[],"We’ve covered a lot of ground here, so let’s take a step back and consider the key points of impact:",{"data":35908,"content":35909,"nodeType":891},{},[35910,35920,35930],{"data":35911,"content":35912,"nodeType":880},{},[35913],{"data":35914,"content":35915,"nodeType":866},{},[35916],{"data":35917,"marks":35918,"value":35919,"nodeType":865},{},[],"AitM phishing techniques are highly effective and increasingly common, and can bypass most common forms of MFA.",{"data":35921,"content":35922,"nodeType":880},{},[35923],{"data":35924,"content":35925,"nodeType":866},{},[35926],{"data":35927,"marks":35928,"value":35929,"nodeType":865},{},[],"These techniques are being used by real threat actors and red teamers alike, with both criminal and open-source tools available for performing these attacks.",{"data":35931,"content":35932,"nodeType":880},{},[35933],{"data":35934,"content":35935,"nodeType":866},{},[35936],{"data":35937,"marks":35938,"value":35939,"nodeType":865},{},[],"There are many options for lateral movement and persistence after an account compromise, so simple containment actions like password resets for SSO credentials are not nearly enough to contain a knowledgeable attacker.",{"data":35941,"content":35942,"nodeType":948},{},[35943],{"data":35944,"marks":35945,"value":35946,"nodeType":865},{},[],"What can blue teams do about it?",{"data":35948,"content":35949,"nodeType":866},{},[35950],{"data":35951,"marks":35952,"value":35953,"nodeType":865},{},[],"It’s important that organizations develop their capability to detect and respond to AitM attacks. Possible approaches include:",{"data":35955,"content":35956,"nodeType":891},{},[35957,35972,36007,36035],{"data":35958,"content":35959,"nodeType":880},{},[35960],{"data":35961,"content":35962,"nodeType":866},{},[35963,35968],{"data":35964,"marks":35965,"value":35967,"nodeType":865},{},[35966],{"type":946},"Move to FIDO MFA where possible",{"data":35969,"marks":35970,"value":35971,"nodeType":865},{},[]," (though, if no more susceptible backup methods are enabled, this does introduce operational challenges if passkeys are lost).",{"data":35973,"content":35974,"nodeType":880},{},[35975],{"data":35976,"content":35977,"nodeType":866},{},[35978,35983,35986,35991,35995,36004],{"data":35979,"marks":35980,"value":35982,"nodeType":865},{},[35981],{"type":946},"Detect and block known-bad malicious",{"data":35984,"marks":35985,"value":6192,"nodeType":865},{},[],{"data":35987,"marks":35988,"value":35990,"nodeType":865},{},[35989],{"type":946},"sites",{"data":35992,"marks":35993,"value":35994,"nodeType":865},{},[]," used in phishing campaigns. There are many threat intelligence feeds that can be ingested to achieve this. Usually, a domain has to be used in a malicious campaign before it can be catalogued – meaning there's typically a window of opportunity before the infrastructure is burned. That said, security researchers at Lab539 (yes, another shout out) have developed a way of identifying sites running AitM tooling – even before they are used for the first time. ",{"data":35996,"content":35998,"nodeType":1102},{"uri":35997},"https://www.lab539.com/aitm",[35999],{"data":36000,"marks":36001,"value":36003,"nodeType":865},{},[36002],{"type":4537},"You can sign up to get access to their feed here.",{"data":36005,"marks":36006,"value":21,"nodeType":865},{},[],{"data":36008,"content":36009,"nodeType":880},{},[36010],{"data":36011,"content":36012,"nodeType":866},{},[36013,36018,36022,36031],{"data":36014,"marks":36015,"value":36017,"nodeType":865},{},[36016],{"type":946},"Introduce controls to detect phishing toolkits and cloned websites",{"data":36019,"marks":36020,"value":36021,"nodeType":865},{},[],". You can never rely on blocking malicious sites via TI feeds alone, so additional layers of defence are required. Push customers benefit from detection of AitM toolkits like Evilginx and EvilNoVNC in the browser (more to come on this soon!), while Thinkst Canary has developed ",{"data":36023,"content":36025,"nodeType":1102},{"uri":36024},"https://blog.thinkst.com/2024/01/defending-against-the-attack-of-the-cloned-websites.html",[36026],{"data":36027,"marks":36028,"value":36030,"nodeType":865},{},[36029],{"type":4537},"methods of detecting whenever your website or login portal is cloned",{"data":36032,"marks":36033,"value":36034,"nodeType":865},{},[]," – very cool.  ",{"data":36036,"content":36037,"nodeType":880},{},[36038],{"data":36039,"content":36040,"nodeType":866},{},[36041,36046],{"data":36042,"marks":36043,"value":36045,"nodeType":865},{},[36044],{"type":946},"Update IR playbooks to to deal with SSO account compromise,",{"data":36047,"marks":36048,"value":36049,"nodeType":865},{},[]," factoring in lateral movement and persistence across cloud apps. This really necessitates that you understand what business apps your organization is using, how they are accessed (e.g. SSO or username and password) and what functionality exists that could be abused by an attacker. ",{"data":36051,"content":36052,"nodeType":866},{},[36053,36057,36064],{"data":36054,"marks":36055,"value":36056,"nodeType":865},{},[],"If you want to know more about how Push detects and blocks phishing tools in the browser, you can ",{"data":36058,"content":36059,"nodeType":1102},{"uri":7395},[36060],{"data":36061,"marks":36062,"value":36063,"nodeType":865},{},[],"check out our article here",{"data":36065,"marks":36066,"value":1677,"nodeType":865},{},[],{"data":36068,"content":36069,"nodeType":948},{},[36070],{"data":36071,"marks":36072,"value":6758,"nodeType":865},{},[],{"data":36074,"content":36075,"nodeType":866},{},[36076],{"data":36077,"marks":36078,"value":36079,"nodeType":865},{},[],"We’ve seen in this article how there are multiple ways to perform AitM phishing attacks and how they can be extremely effective at targeting users even when their accounts are protected by MFA.  ",{"data":36081,"content":36082,"nodeType":866},{},[36083],{"data":36084,"marks":36085,"value":36086,"nodeType":865},{},[],"Very few organizations are universally using phishing-resistant MFA, such as FIDO-based methods, and even those that do often have fallback options to handle situations where they cannot be used and/or tokens malfunction or are lost. Therefore, the vast majority of organizations are at risk of AitM phishing attacks.",{"data":36088,"content":36089,"nodeType":866},{},[36090],{"data":36091,"marks":36092,"value":36093,"nodeType":865},{},[],"To make things worse, there are lateral movement and persistence techniques that can be exploited to greatly extend the depth of compromise even for a single low-privilege user account. This makes response and containment a significant challenge.",{"data":36095,"content":36096,"nodeType":866},{},[36097,36101,36108,36111,36119,36123,36131,36135,36144],{"data":36098,"marks":36099,"value":36100,"nodeType":865},{},[],"Phishing attacks are clearly evolving. Phishing attacks are no longer limited to email-based delivery mechanisms or being hosted on custom domains. There are many options now for delivering phishing attacks using ",{"data":36102,"content":36103,"nodeType":1102},{"uri":29047},[36104],{"data":36105,"marks":36106,"value":29053,"nodeType":865},{},[36107],{"type":4537},{"data":36109,"marks":36110,"value":1773,"nodeType":865},{},[],{"data":36112,"content":36113,"nodeType":1102},{"uri":29059},[36114],{"data":36115,"marks":36116,"value":36118,"nodeType":865},{},[36117],{"type":4537},"Microsoft Teams",{"data":36120,"marks":36121,"value":36122,"nodeType":865},{},[],", using ",{"data":36124,"content":36125,"nodeType":1102},{"uri":14098},[36126],{"data":36127,"marks":36128,"value":36130,"nodeType":865},{},[36129],{"type":4537},"SAMLjacking attacks",{"data":36132,"marks":36133,"value":36134,"nodeType":865},{},[]," to host the initial landing page on legitimate SaaS web domains or even using ",{"data":36136,"content":36138,"nodeType":1102},{"uri":36137},"https://pushsecurity.com/blog/oktajacking/",[36139],{"data":36140,"marks":36141,"value":36143,"nodeType":865},{},[36142],{"type":4537},"Okta to keylog credentials",{"data":36145,"marks":36146,"value":36147,"nodeType":865},{},[]," on behalf of the attacker. ",{"data":36149,"content":36150,"nodeType":866},{},[36151],{"data":36152,"marks":36153,"value":36154,"nodeType":865},{},[],"Increasingly, we should expect to see AitM toolkits being used as a standard part of phishing campaigns, and featured in Initial Access Broker tooling – AitM will effectively supersede legacy phishing methods in line with MFA adoption. Rather, it already is. ",{"data":36156,"content":36157,"nodeType":938},{},[],{"data":36159,"content":36160,"nodeType":866},{},[36161],{"data":36162,"marks":36163,"value":36164,"nodeType":865},{},[],"If you're interested in seeing some more AitM tools in action, you can watch our recent webinar on-demand via the link below. ",{"data":36166,"content":36169,"nodeType":907},{"target":36167},{"sys":36168},{"id":35429,"type":904,"linkType":905},[],{"data":36171,"content":36172,"nodeType":866},{},[36173],{"data":36174,"marks":36175,"value":21,"nodeType":865},{},[],"Phishing 2.0 – how phishing toolkits are evolving with AitM","Attackers are using Adversary in the Middle (AitM) phishing toolkits to bypass MFA. We look at what AitM is, how it works, and what you can do about it.","2024-05-23T00:00:00.000Z","phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm",{"items":36181},[36182,36184],{"sys":36183,"name":2524},{"id":2523},{"sys":36185,"name":342},{"id":2527},{"items":36187},[36188],{"fullName":11808,"firstName":11809,"jobTitle":11810,"profilePicture":36189},{"url":11812},{"__typename":2239,"sys":36191,"content":36193,"title":36665,"synopsis":36666,"hashTags":59,"publishedDate":36667,"slug":36668,"tagsCollection":36669,"authorsCollection":36675},{"id":36192},"7yCGcUryKQGOHYHRtipn6W",{"json":36194},{"data":36195,"content":36196,"nodeType":2232},{},[36197,36204,36211,36218,36225,36232,36239,36246,36253,36260,36278,36296,36303,36310,36329,36336,36348,36391,36398,36417,36425,36432,36439,36446,36453,36460,36525,36532,36537,36544,36551,36558,36565,36584,36591,36598,36605,36612,36619,36626,36633,36640,36647,36652,36658],{"data":36198,"content":36199,"nodeType":866},{},[36200],{"data":36201,"marks":36202,"value":36203,"nodeType":865},{},[],"User web activity can be a rich source of attack detection data. To this end, most organizations today ingest some form of network traffic data for security monitoring purposes. ",{"data":36205,"content":36206,"nodeType":866},{},[36207],{"data":36208,"marks":36209,"value":36210,"nodeType":865},{},[],"Typically, network traffic data is gathered by analyzing web proxy and/or DNS logs. But, we regularly speak to organizations that are frustrated with the challenge of piecing together web traffic data, without understanding the opportunity presented by the alternatives.",{"data":36212,"content":36213,"nodeType":866},{},[36214],{"data":36215,"marks":36216,"value":36217,"nodeType":865},{},[],"Even with proxies that can terminate TLS-encrypted datastreams, it’s difficult for even expert security teams to collect and analyze any meaningful data from web proxy logs. While the kind of data needed might be technically possible to extract, the process of reconstructing proxy data to analyze the specific data points that you really need, at scale, is prohibitively complicated.",{"data":36219,"content":36220,"nodeType":866},{},[36221],{"data":36222,"marks":36223,"value":36224,"nodeType":865},{},[],"The old “needle in a haystack” adage is very apt here! Rather than trying to piece together half-broken data – overlaying noisy proxy logs with other sources such as app and IdP telemetry – we think that the browser presents a much simpler way of analyzing relevant data points, particularly when it comes to identity attacks. ",{"data":36226,"content":36227,"nodeType":866},{},[36228],{"data":36229,"marks":36230,"value":36231,"nodeType":865},{},[],"Before we get on to detection opportunities in the browser, let’s take a deeper look at the web proxy situation.",{"data":36233,"content":36234,"nodeType":948},{},[36235],{"data":36236,"marks":36237,"value":36238,"nodeType":865},{},[],"Detection based on web proxy – how does it work and what are the limitations?",{"data":36240,"content":36241,"nodeType":866},{},[36242],{"data":36243,"marks":36244,"value":36245,"nodeType":865},{},[],"Web proxies generate common data points that can be used for threat detection, particularly when looking for indicators of an endpoint compromise. They work by inspecting network traffic to and from the endpoint, which includes web activity in the browser. ",{"data":36247,"content":36248,"nodeType":866},{},[36249],{"data":36250,"marks":36251,"value":36252,"nodeType":865},{},[],"The classic use case would be inspecting traffic from an endpoint to networked servers and devices, either on the local network or over the internet (e.g. via VPN), to detect signs of suspicious/malicious behavior from the device (indicating a potential compromise). Data is then shipped to a central proxy server where it can be analyzed for indicators of malicious activity. ",{"data":36254,"content":36255,"nodeType":866},{},[36256],{"data":36257,"marks":36258,"value":36259,"nodeType":865},{},[],"The traditional proxy setup has a number of limitations: ",{"data":36261,"content":36262,"nodeType":891},{},[36263],{"data":36264,"content":36265,"nodeType":880},{},[36266],{"data":36267,"content":36268,"nodeType":866},{},[36269,36274],{"data":36270,"marks":36271,"value":36273,"nodeType":865},{},[36272],{"type":946},"The proxy needs to be in a position to intercept traffic.",{"data":36275,"marks":36276,"value":36277,"nodeType":865},{},[]," It may only be active when a user is in the office, on a VPN and/or for external web traffic only. It might not work if a user is on their home or other other Wi-Fi – e.g. when working from Starbucks, or visiting a customer site, which isn’t an ideal setup in the era of remote working.  ",{"data":36279,"content":36280,"nodeType":891},{},[36281],{"data":36282,"content":36283,"nodeType":880},{},[36284],{"data":36285,"content":36286,"nodeType":866},{},[36287,36292],{"data":36288,"marks":36289,"value":36291,"nodeType":865},{},[36290],{"type":946},"Most web traffic is protected by TLS – so a proxy has to decrypt this to inspect what’s inside.",{"data":36293,"marks":36294,"value":36295,"nodeType":865},{},[]," At the very least you’re going to need to deploy a CA cert to every endpoint. But, some websites use things like certificate pinning or other SSL-enforcement controls to straight up prevent this. Unless you’re doing TLS-termination at scale with a COTS solution, then the ability to do proxy-based monitoring is seriously limited. ",{"data":36297,"content":36298,"nodeType":1218},{},[36299],{"data":36300,"marks":36301,"value":36302,"nodeType":865},{},[],"Proxies under the hood",{"data":36304,"content":36305,"nodeType":866},{},[36306],{"data":36307,"marks":36308,"value":36309,"nodeType":865},{},[],"Let’s pop the hood and take a look at the data you can collect using a web proxy that is useful for threat detection. ",{"data":36311,"content":36312,"nodeType":866},{},[36313,36317,36325],{"data":36314,"marks":36315,"value":36316,"nodeType":865},{},[],"Typically, you’re looking at data points such as domain names or IP addresses. If the proxy is terminating TLS, you might also have web URLs, the type of web content accessed, and other HTTP-level metadata. Higher level data like file uploads/downloads can sometimes be reconstructed when using very vanilla methods. More advanced proxies might run or open downloaded files in a sandbox for dynamic analysis to identify potentially malicious properties, which has ",{"data":36318,"content":36319,"nodeType":1102},{"uri":29102},[36320],{"data":36321,"marks":36322,"value":36324,"nodeType":865},{},[36323],{"type":4537},"given rise to techniques like HTML smuggling",{"data":36326,"marks":36327,"value":36328,"nodeType":865},{},[]," to hide these file downloads from advanced proxies. ",{"data":36330,"content":36331,"nodeType":866},{},[36332],{"data":36333,"marks":36334,"value":36335,"nodeType":865},{},[],"In practice this means that you might see that an endpoint at IP address X accessed google.com. If it’s an authenticated proxy, you might see the user of the endpoint as well. Using this data, it’s possible to see which endpoint’s owner accessed the web domain, but not the identity/account they used, or whether they actually logged in at all. So for the majority of in-house proxy setups not doing TLS-termination… that’s it. Even then, without decrypting TLS you can’t be sure you’re seeing the actual/final domain because of technologies like domain fronting that are commonly implemented in modern CDNs. ",{"data":36337,"content":36338,"nodeType":866},{},[36339,36343],{"data":36340,"marks":36341,"value":36342,"nodeType":865},{},[],"With TLS termination, it’s possible to see a lot more by inspecting/unpacking the HTTP data. At this point there are two possible approaches: Manual analysis after the fact, or automated analysis on the fly. ",{"data":36344,"marks":36345,"value":36347,"nodeType":865},{},[36346],{"type":946},"Unfortunately, there are problems with both options. ",{"data":36349,"content":36350,"nodeType":891},{},[36351,36371],{"data":36352,"content":36353,"nodeType":880},{},[36354],{"data":36355,"content":36356,"nodeType":866},{},[36357,36362,36366],{"data":36358,"marks":36359,"value":36361,"nodeType":865},{},[36360],{"type":946},"There is too much HTTP data to store and manually analyze everything:",{"data":36363,"marks":36364,"value":36365,"nodeType":865},{},[]," Usually, organizations limit the data being stored to specific metadata as opposed to trying to store everything (terabytes of data per day), which would be impossibly expensive to store (and also to build the server infrastructure required to index and search it – effectively a mini-datacenter). ",{"data":36367,"marks":36368,"value":36370,"nodeType":865},{},[36369],{"type":979},"Not to mention that storing detailed HTTP body data presents a significant security risk, as it includes valid session tokens/cookies for all your identities…  ",{"data":36372,"content":36373,"nodeType":880},{},[36374],{"data":36375,"content":36376,"nodeType":866},{},[36377,36382,36386],{"data":36378,"marks":36379,"value":36381,"nodeType":865},{},[36380],{"type":946},"Each web app is custom, making automated analysis (virtually) impossible:",{"data":36383,"marks":36384,"value":36385,"nodeType":865},{},[]," Proxy-based solutions have to reconstruct the data after TLS encryption. HTTP data is usually stored in large application JSON/XML objects or even in totally custom encoding – per each app. This means that complex, custom code is required per each app to be able to perform automated analysis. When businesses today are using hundreds of apps on average, ",{"data":36387,"marks":36388,"value":36390,"nodeType":865},{},[36389],{"type":946},"automating this process is not feasible as it requires constant reverse engineering of every web app. ",{"data":36392,"content":36393,"nodeType":866},{},[36394],{"data":36395,"marks":36396,"value":36397,"nodeType":865},{},[],"So what does this mean? Well, even organizations with a TLS-terminating proxy are limited to manual analysis of select metadata after-the-fact, which massively reduces its utility. You could sink a day or more’s analysis into gathering a small amount of useful data, for example whether a URL was accessed, but not necessarily which device/user, or what account/creds were used to log in). This means you’re probably going to use proxy data to aid in the investigation of a known incident rather than anything proactive. ",{"data":36399,"content":36400,"nodeType":866},{},[36401,36406,36412],{"data":36402,"marks":36403,"value":36405,"nodeType":865},{},[36404],{"type":946},"It might be ",{"data":36407,"marks":36408,"value":36411,"nodeType":865},{},[36409,36410],{"type":979},{"type":946},"theoretically",{"data":36413,"marks":36414,"value":36416,"nodeType":865},{},[36415],{"type":946}," possible to sift through decrypted HTTP data to identify and correlate identities and actions, effectively reconstructing web pages from the network traffic automatically and on the fly (in the same way that it’s theoretically possible to remove my head and transplant it onto your body), but is it practical or reasonable for most organizations to do this? No. ",{"data":36418,"content":36419,"nodeType":948},{},[36420],{"data":36421,"marks":36422,"value":36424,"nodeType":865},{},[36423],{"type":946},"Browser data: a better alternative?",{"data":36426,"content":36427,"nodeType":866},{},[36428],{"data":36429,"marks":36430,"value":36431,"nodeType":865},{},[],"One way of overcoming some of the limitations of the classic web proxy setup is to use a browser-based solution. It’s much easier to collect data at the browser level before it’s encrypted. ",{"data":36433,"content":36434,"nodeType":866},{},[36435],{"data":36436,"marks":36437,"value":36438,"nodeType":865},{},[],"A browser agent isn’t just a proxy for pre-TLS HTML data, though. In the browser, you’re able to dynamically interact with the DOM or the rendered web application, including its JS code. This makes it easy to find, for example, input fields for usernames and passwords. You can see what information the user is inputting and where, without needing to figure out how the data is encoded and sent back to the app. These are fairly generic fields that can be identified across your suite of apps without needing complex custom code. To put it in perspective, approximately 10 login cases cover the entirety of the SaaS apps we support (~1000). Using a proxy-based solution, each of these would require custom development.   ",{"data":36440,"content":36441,"nodeType":866},{},[36442],{"data":36443,"marks":36444,"value":36445,"nodeType":865},{},[],"While it's technically possible to keep track of multiple sessions for thousands of users across hundreds of apps via proxy, it’s no mean feat – made much easier when each extension is tracking one user, in one browser, and even knows the browser tab it’s running in. You also get additional context at the identity layer such as the email address, authentication protocol, and credentials used, neatly mapped to that specific user and browser profile – no more trying to link the owner of an IP address to log events!",{"data":36447,"content":36448,"nodeType":866},{},[36449],{"data":36450,"marks":36451,"value":36452,"nodeType":865},{},[],"The browser also has the added benefit of being a natural enforcement point. You can collect and analyze data dynamically, and produce an immediate response – rather than taking info away, analyzing it, and coming back with a detection minutes or hours later (and potentially prompting a manual response). ",{"data":36454,"content":36455,"nodeType":866},{},[36456],{"data":36457,"marks":36458,"value":36459,"nodeType":865},{},[],"Let’s look at a couple of examples based on how we’re using our browser agent to detect and block identity attacks. ",{"data":36461,"content":36462,"nodeType":891},{},[36463,36484,36504],{"data":36464,"content":36465,"nodeType":880},{},[36466],{"data":36467,"content":36468,"nodeType":866},{},[36469,36472,36480],{"data":36470,"marks":36471,"value":21,"nodeType":865},{},[],{"data":36473,"content":36474,"nodeType":1102},{"uri":7255},[36475],{"data":36476,"marks":36477,"value":36479,"nodeType":865},{},[36478],{"type":4537},"Pinning passwords to the legitimate site they are linked with",{"data":36481,"marks":36482,"value":36483,"nodeType":865},{},[],". This is made possible by interacting with the DOM to observe passwords being entered – enabling the Push agent to intercept and block before an HTTP network request can even be made. ",{"data":36485,"content":36486,"nodeType":880},{},[36487],{"data":36488,"content":36489,"nodeType":866},{},[36490,36493,36500],{"data":36491,"marks":36492,"value":21,"nodeType":865},{},[],{"data":36494,"content":36495,"nodeType":1102},{"uri":7395},[36496],{"data":36497,"marks":36498,"value":36499,"nodeType":865},{},[],"Detecting and blocking malicious phishing tools",{"data":36501,"marks":36502,"value":36503,"nodeType":865},{},[]," running on websites by observing behavioral attributes in the browser, such as Javascript calls being made or data structures saved to local storage.",{"data":36505,"content":36506,"nodeType":880},{},[36507],{"data":36508,"content":36509,"nodeType":866},{},[36510,36513,36521],{"data":36511,"marks":36512,"value":21,"nodeType":865},{},[],{"data":36514,"content":36516,"nodeType":1102},{"uri":36515},"https://pushsecurity.com/blog/manage-third-party-data-access/",[36517],{"data":36518,"marks":36519,"value":36520,"nodeType":865},{},[],"Observing users signing up to and using risky apps",{"data":36522,"marks":36523,"value":36524,"nodeType":865},{},[],", or changing or removing authentication methods, MFA methods, and configuration methods, which could indicate account takeover. ",{"data":36526,"content":36527,"nodeType":866},{},[36528],{"data":36529,"marks":36530,"value":36531,"nodeType":865},{},[],"It’s always useful to refer back to the concept of the Pyramid of Pain in these situations. The opportunities to detect and block in the browser tend to align with indicators at the apex of the pyramid, meaning they are a significant obstruction for attackers – and difficult to circumvent. This contrasts the indicators aligned with proxy-based solutions, which are much easier to bypass through, for example, IP masking using residential proxy networks, or changing the domains and URLs used for phishing campaigns.  ",{"data":36533,"content":36536,"nodeType":907},{"target":36534},{"sys":36535},{"id":7467,"type":904,"linkType":905},[],{"data":36538,"content":36539,"nodeType":866},{},[36540],{"data":36541,"marks":36542,"value":36543,"nodeType":865},{},[],"In summary: Browser data provides high-fidelity indicators of malicious activity, without the complications of proxy-based approaches. The scope for response in the browser is significant and immediate, meaning it’s a great enforcement point for security controls to be able to disrupt attacks. ",{"data":36545,"content":36546,"nodeType":948},{},[36547],{"data":36548,"marks":36549,"value":36550,"nodeType":865},{},[],"Won’t my app and IdP logs cover this?",{"data":36552,"content":36553,"nodeType":866},{},[36554],{"data":36555,"marks":36556,"value":36557,"nodeType":865},{},[],"App and IdP logs are useful (when you can get them), but neither give you the full picture. ",{"data":36559,"content":36560,"nodeType":1218},{},[36561],{"data":36562,"marks":36563,"value":36564,"nodeType":865},{},[],"App logs are limited in availability, scope, and ease of ingestion ",{"data":36566,"content":36567,"nodeType":866},{},[36568,36572,36580],{"data":36569,"marks":36570,"value":36571,"nodeType":865},{},[],"When relying on app logs, you’re naturally constrained by the app provider. Many smaller apps provide no security logging, while others ",{"data":36573,"content":36574,"nodeType":1102},{"uri":14356},[36575],{"data":36576,"marks":36577,"value":36579,"nodeType":865},{},[36578],{"type":4537},"lock security logging behind the premium tier subscription",{"data":36581,"marks":36582,"value":36583,"nodeType":865},{},[],". When logs are available, you’re limited to the events that the third-party deems suitable to log. ",{"data":36585,"content":36586,"nodeType":866},{},[36587],{"data":36588,"marks":36589,"value":36590,"nodeType":865},{},[],"Out of the 100 most popular apps we see across our customers, and perhaps the few dozen or so that are security critical, only a small handful provide any useful logging. This means, naturally, that the majority of apps do not. ",{"data":36592,"content":36593,"nodeType":866},{},[36594],{"data":36595,"marks":36596,"value":36597,"nodeType":865},{},[],"To top it all off, the process of extracting these logs and feeding them into your SIEM (or equivalent) is also not straightforward. The lack of out-of-the-box connectors for many apps means that complex custom architectures are required for collecting data. Some vendors place constraints on the format and mechanism for extracting logs which can make ingestion difficult to feed reliable detections – even before any meaningful analysis of the data can take place. ",{"data":36599,"content":36600,"nodeType":866},{},[36601],{"data":36602,"marks":36603,"value":36604,"nodeType":865},{},[],"Until application security logs are made widely available (and at no additional cost) it’s unlikely you’re going to be able to get the visibility you need from app logs, for every app your employees use (though of course there are exceptions – and we hope to see more vendors in future treating security as a minimum requirement, not a chargeable addon). ",{"data":36606,"content":36607,"nodeType":1218},{},[36608],{"data":36609,"marks":36610,"value":36611,"nodeType":865},{},[],"IdP logs cover only SSO integrated apps and are limited in scope",{"data":36613,"content":36614,"nodeType":866},{},[36615],{"data":36616,"marks":36617,"value":36618,"nodeType":865},{},[],"You might think, “but all of our business apps are behind SSO, right?” In reality, only about 1 in 3 apps support SSO (and even fewer at the ‘free’ tier). And in practice, our data shows us that only 1 in 5 apps on average are actually behind SSO per organization. The theoretical security benefit of IdP logs is that they provide context, a foundation for the user’s activity across (and between) a suite of apps. But because of the lack of coverage, this isn’t the case. ",{"data":36620,"content":36621,"nodeType":866},{},[36622],{"data":36623,"marks":36624,"value":36625,"nodeType":865},{},[],"IdP logs are naturally focused on authentication, and so don’t compensate for any gaps in app logging. Naturally, they are only able to observe what happens on the IdP side – and so are blind to client side attacks like phishing (which we’ve already shown the browser provides superior visibility of compared to typical alternatives like proxy logs).   ",{"data":36627,"content":36628,"nodeType":1218},{},[36629],{"data":36630,"marks":36631,"value":36632,"nodeType":865},{},[],"Browser is best for stopping identity attacks",{"data":36634,"content":36635,"nodeType":866},{},[36636],{"data":36637,"marks":36638,"value":36639,"nodeType":865},{},[],"This is where the browser comes in. Think of your browser as your source of truth, a broad data baseline for user activity where the browser provides complete context of the browser profile, employee, accounts, credentials, auth methods, and MFA types – as well as employee interaction with web sites.",{"data":36641,"content":36642,"nodeType":866},{},[36643],{"data":36644,"marks":36645,"value":36646,"nodeType":865},{},[],"The TL;DR is that your visibility in the browser is theoretically limitless. Every page loaded (and its source, javascript state, local storage), every user interaction can be observed. And best of all, this analysis is done securely in the browser and only the results of detections are reported back, rather than decrypting the entire raw traffic stream including all session data in an additional centralized system. ",{"data":36648,"content":36651,"nodeType":907},{"target":36649},{"sys":36650},{"id":29297,"type":904,"linkType":905},[],{"data":36653,"content":36654,"nodeType":948},{},[36655],{"data":36656,"marks":36657,"value":6758,"nodeType":865},{},[],{"data":36659,"content":36660,"nodeType":866},{},[36661],{"data":36662,"marks":36663,"value":36664,"nodeType":865},{},[],"As an industry, we need to start looking at browser-based detection and response as the next logical evolution to stop identity attacks. There are clear parallels with the emergence of EDR – which came about because existing endpoint log sources were not sufficient. Today, we wouldn’t dream of trying to detect and respond to endpoint-based attacks without EDR – it’s time we started thinking about cloud identity attacks and the browser in the same way.  ","The web proxy is dead… long live the browser extension!","Right now the majority of detections for identity attacks rely on web proxy telemetry. Here’s why the browser can be a better alternative.","2024-06-11T00:00:00.000Z","the-web-proxy-is-dead-long-live-the-browser-extension",{"items":36670},[36671,36673],{"sys":36672,"name":342},{"id":2527},{"sys":36674,"name":2524},{"id":2523},{"items":36676},[36677],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":36678},{"url":6031},"blog/introducing-set-and-forget-controls-that-stop-real-world-identity-attacks",{"json":36681},{"data":36682,"content":36683,"nodeType":2232},{},[36684],{"data":36685,"content":36686,"nodeType":866},{},[36687],{"data":36688,"marks":36689,"value":36690,"nodeType":865},{},[],"Enable plug-and-play detections and interventions in the browser using Push’s new security controls, or create your own automations from unique browser telemetry provided via API and webhooks.",{"id":26984,"publishedAt":36692},"2026-08-12T11:55:14.786Z",{"items":36694},[36695,36697],{"sys":36696,"name":3915},{"id":3914},{"sys":36698,"name":342},{"id":2527},{"items":36700},[36701,36703,36705,36707,36709,36711,36713,36715,36717,36719,36721,36723],{"sys":36702,"name":342,"slug":343,"tier":31},{"id":339},{"sys":36704,"name":297,"slug":298,"tier":31},{"id":294},{"sys":36706,"name":519,"slug":520,"tier":31},{"id":516},{"sys":36708,"name":413,"slug":414,"tier":31},{"id":410},{"sys":36710,"name":279,"slug":280,"tier":31},{"id":276},{"sys":36712,"name":261,"slug":262,"tier":45},{"id":258},{"sys":36714,"name":571,"slug":572,"tier":45},{"id":568},{"sys":36716,"name":324,"slug":325,"tier":45},{"id":321},{"sys":36718,"name":404,"slug":405,"tier":45},{"id":401},{"sys":36720,"name":589,"slug":590,"tier":45},{"id":586},{"sys":36722,"name":598,"slug":599,"tier":45},{"id":595},{"sys":36724,"name":351,"slug":352,"tier":45},{"id":348},"sWazNK-OBgQFJfoNwiyoRe6RQoN8uSbnv0t9uSXVEvE",{"id":36727,"title":13733,"authorsCollection":36728,"content":36732,"extension":228,"faqItemsCollection":37100,"faqTitle":59,"featured":6,"hashTags":59,"meta":37102,"metaTitle":37103,"ogImage":59,"postType":13332,"publishedDate":13735,"relatedBlogPostsCollection":37104,"slug":13736,"stem":37965,"subtitle":59,"summary":37966,"synopsis":13734,"sys":37977,"tagsCollection":37979,"topicsCollection":37985,"__hash__":38005},"blog/blog/combining-the-powers-of-push-and-panther-to-stop-identity-attacks.json",{"items":36729},[36730],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":36731},{"url":853},{"json":36733,"links":37066},{"data":36734,"content":36735,"nodeType":2232},{},[36736,36742,36748,36790,36796,36802,36808,36813,36828,36834,36852,36858,36864,36882,36887,36917,36923,36929,36934,36940,36946,36952,36958,36964,37030,37036,37051],{"data":36737,"content":36738,"nodeType":866},{},[36739],{"data":36740,"marks":36741,"value":13349,"nodeType":865},{},[],{"data":36743,"content":36744,"nodeType":866},{},[36745],{"data":36746,"marks":36747,"value":13356,"nodeType":865},{},[],{"data":36749,"content":36750,"nodeType":891},{},[36751,36764,36777],{"data":36752,"content":36753,"nodeType":880},{},[36754],{"data":36755,"content":36756,"nodeType":866},{},[36757,36761],{"data":36758,"marks":36759,"value":13370,"nodeType":865},{},[36760],{"type":946},{"data":36762,"marks":36763,"value":13374,"nodeType":865},{},[],{"data":36765,"content":36766,"nodeType":880},{},[36767],{"data":36768,"content":36769,"nodeType":866},{},[36770,36774],{"data":36771,"marks":36772,"value":13385,"nodeType":865},{},[36773],{"type":946},{"data":36775,"marks":36776,"value":13389,"nodeType":865},{},[],{"data":36778,"content":36779,"nodeType":880},{},[36780],{"data":36781,"content":36782,"nodeType":866},{},[36783,36787],{"data":36784,"marks":36785,"value":13400,"nodeType":865},{},[36786],{"type":946},{"data":36788,"marks":36789,"value":13404,"nodeType":865},{},[],{"data":36791,"content":36792,"nodeType":866},{},[36793],{"data":36794,"marks":36795,"value":13411,"nodeType":865},{},[],{"data":36797,"content":36798,"nodeType":866},{},[36799],{"data":36800,"marks":36801,"value":13418,"nodeType":865},{},[],{"data":36803,"content":36804,"nodeType":866},{},[36805],{"data":36806,"marks":36807,"value":13425,"nodeType":865},{},[],{"data":36809,"content":36812,"nodeType":907},{"target":36810},{"sys":36811},{"id":13430,"type":904,"linkType":905},[],{"data":36814,"content":36815,"nodeType":866},{},[36816,36819,36825],{"data":36817,"marks":36818,"value":13438,"nodeType":865},{},[],{"data":36820,"content":36821,"nodeType":1102},{"uri":13441},[36822],{"data":36823,"marks":36824,"value":13446,"nodeType":865},{},[],{"data":36826,"marks":36827,"value":13450,"nodeType":865},{},[],{"data":36829,"content":36830,"nodeType":948},{},[36831],{"data":36832,"marks":36833,"value":13457,"nodeType":865},{},[],{"data":36835,"content":36836,"nodeType":866},{},[36837,36840,36849],{"data":36838,"marks":36839,"value":13464,"nodeType":865},{},[],{"data":36841,"content":36844,"nodeType":1038},{"target":36842},{"sys":36843},{"id":13469,"type":904,"linkType":905},[36845],{"data":36846,"marks":36847,"value":13475,"nodeType":865},{},[36848],{"type":946},{"data":36850,"marks":36851,"value":13479,"nodeType":865},{},[],{"data":36853,"content":36854,"nodeType":866},{},[36855],{"data":36856,"marks":36857,"value":13486,"nodeType":865},{},[],{"data":36859,"content":36860,"nodeType":866},{},[36861],{"data":36862,"marks":36863,"value":13493,"nodeType":865},{},[],{"data":36865,"content":36866,"nodeType":866},{},[36867,36870,36879],{"data":36868,"marks":36869,"value":13500,"nodeType":865},{},[],{"data":36871,"content":36874,"nodeType":1038},{"target":36872},{"sys":36873},{"id":13505,"type":904,"linkType":905},[36875],{"data":36876,"marks":36877,"value":13511,"nodeType":865},{},[36878],{"type":946},{"data":36880,"marks":36881,"value":13515,"nodeType":865},{},[],{"data":36883,"content":36886,"nodeType":907},{"target":36884},{"sys":36885},{"id":13520,"type":904,"linkType":905},[],{"data":36888,"content":36889,"nodeType":866},{},[36890,36893,36900,36903,36907,36910,36914],{"data":36891,"marks":36892,"value":13528,"nodeType":865},{},[],{"data":36894,"content":36895,"nodeType":1102},{"uri":13531},[36896],{"data":36897,"marks":36898,"value":13537,"nodeType":865},{},[36899],{"type":946},{"data":36901,"marks":36902,"value":13541,"nodeType":865},{},[],{"data":36904,"marks":36905,"value":13546,"nodeType":865},{},[36906],{"type":979},{"data":36908,"marks":36909,"value":13550,"nodeType":865},{},[],{"data":36911,"marks":36912,"value":13555,"nodeType":865},{},[36913],{"type":979},{"data":36915,"marks":36916,"value":13559,"nodeType":865},{},[],{"data":36918,"content":36919,"nodeType":866},{},[36920],{"data":36921,"marks":36922,"value":13566,"nodeType":865},{},[],{"data":36924,"content":36925,"nodeType":866},{},[36926],{"data":36927,"marks":36928,"value":13573,"nodeType":865},{},[],{"data":36930,"content":36933,"nodeType":907},{"target":36931},{"sys":36932},{"id":13578,"type":904,"linkType":905},[],{"data":36935,"content":36936,"nodeType":866},{},[36937],{"data":36938,"marks":36939,"value":13586,"nodeType":865},{},[],{"data":36941,"content":36942,"nodeType":866},{},[36943],{"data":36944,"marks":36945,"value":13593,"nodeType":865},{},[],{"data":36947,"content":36948,"nodeType":948},{},[36949],{"data":36950,"marks":36951,"value":13600,"nodeType":865},{},[],{"data":36953,"content":36954,"nodeType":866},{},[36955],{"data":36956,"marks":36957,"value":13607,"nodeType":865},{},[],{"data":36959,"content":36960,"nodeType":866},{},[36961],{"data":36962,"marks":36963,"value":13614,"nodeType":865},{},[],{"data":36965,"content":36966,"nodeType":891},{},[36967,36991,37004,37017],{"data":36968,"content":36969,"nodeType":880},{},[36970],{"data":36971,"content":36972,"nodeType":866},{},[36973,36977,36980,36988],{"data":36974,"marks":36975,"value":13628,"nodeType":865},{},[36976],{"type":946},{"data":36978,"marks":36979,"value":13632,"nodeType":865},{},[],{"data":36981,"content":36984,"nodeType":1038},{"target":36982},{"sys":36983},{"id":13637,"type":904,"linkType":905},[36985],{"data":36986,"marks":36987,"value":13642,"nodeType":865},{},[],{"data":36989,"marks":36990,"value":13646,"nodeType":865},{},[],{"data":36992,"content":36993,"nodeType":880},{},[36994],{"data":36995,"content":36996,"nodeType":866},{},[36997,37001],{"data":36998,"marks":36999,"value":13657,"nodeType":865},{},[37000],{"type":946},{"data":37002,"marks":37003,"value":13661,"nodeType":865},{},[],{"data":37005,"content":37006,"nodeType":880},{},[37007],{"data":37008,"content":37009,"nodeType":866},{},[37010,37014],{"data":37011,"marks":37012,"value":13672,"nodeType":865},{},[37013],{"type":946},{"data":37015,"marks":37016,"value":13676,"nodeType":865},{},[],{"data":37018,"content":37019,"nodeType":880},{},[37020],{"data":37021,"content":37022,"nodeType":866},{},[37023,37027],{"data":37024,"marks":37025,"value":13687,"nodeType":865},{},[37026],{"type":946},{"data":37028,"marks":37029,"value":13691,"nodeType":865},{},[],{"data":37031,"content":37032,"nodeType":948},{},[37033],{"data":37034,"marks":37035,"value":6796,"nodeType":865},{},[],{"data":37037,"content":37038,"nodeType":866},{},[37039,37042,37048],{"data":37040,"marks":37041,"value":13704,"nodeType":865},{},[],{"data":37043,"content":37044,"nodeType":1102},{"uri":13707},[37045],{"data":37046,"marks":37047,"value":11104,"nodeType":865},{},[],{"data":37049,"marks":37050,"value":13715,"nodeType":865},{},[],{"data":37052,"content":37053,"nodeType":866},{},[37054,37057,37063],{"data":37055,"marks":37056,"value":13722,"nodeType":865},{},[],{"data":37058,"content":37059,"nodeType":1102},{"uri":13441},[37060],{"data":37061,"marks":37062,"value":13729,"nodeType":865},{},[],{"data":37064,"marks":37065,"value":1151,"nodeType":865},{},[],{"entries":37067},{"inline":37068,"hyperlink":37069,"block":37076},[],[37070,37072,37074],{"sys":37071,"__typename":2239,"title":35342,"slug":35344},{"id":13469},{"sys":37073,"__typename":2256,"title":34812,"slug":34813,"articleId":34814},{"id":13505},{"sys":37075,"__typename":2239,"title":27349,"slug":27350},{"id":13637},[37077,37085,37092],{"sys":37078,"__typename":2366,"title":37079,"caption":37080,"layoutMode":59,"file":37081},{"id":13430},"Panther configuration screen for Push custom log types","Panther configuration for Push custom log types",{"url":37082,"width":37083,"height":37084},"https://images.ctfassets.net/y1cdw1ablpvd/2s4cvkCHZI0019FNQbHARA/125a9e84b1b3e062b705d34347688098/panther_push_integration_slideout.png",2558,1327,{"sys":37086,"__typename":2366,"title":37087,"caption":37088,"layoutMode":59,"file":37089},{"id":13520},"Illustration of detected session activity showing the missing Push marker","Illustration of detected session activity showing the missing Push marker.",{"url":37090,"width":12338,"height":37091},"https://images.ctfassets.net/y1cdw1ablpvd/7CDurJgGW12KszlFzOr68K/482d37d80bc5f76ba70e6b8d3161e9bd/image1.png",398,{"sys":37093,"__typename":34820,"title":37094,"youTubeUrl":37095,"imagePlaceholder":37096},{"id":13578},"Push-Panther session theft detection demo","https://www.youtube.com/watch?v=8JNoQ4EhDXA",{"url":37097,"width":37098,"height":37099},"https://images.ctfassets.net/y1cdw1ablpvd/1eUEWHLBJD3ZVTyfbLUJLm/48965fb21cdaabfdb738217ee5b548b7/push-panther-title-card.png",1116,573,{"items":37101},[],{},"Integrate Push Security and Panther",{"items":37105},[37106,37543],{"__typename":2239,"sys":37107,"content":37108,"title":35342,"synopsis":35343,"hashTags":59,"publishedDate":13735,"slug":35344,"tagsCollection":37533,"authorsCollection":37539},{"id":13469},{"json":37109},{"data":37110,"content":37111,"nodeType":2232},{},[37112,37117,37123,37153,37159,37175,37181,37217,37223,37229,37235,37240,37246,37324,37330,37336,37357,37363,37369,37375,37381,37387,37393,37437,37443,37448,37464,37469,37475,37481,37487,37493,37499,37505,37511,37517],{"data":37113,"content":37116,"nodeType":907},{"target":37114},{"sys":37115},{"id":34868,"type":904,"linkType":905},[],{"data":37118,"content":37119,"nodeType":866},{},[37120],{"data":37121,"marks":37122,"value":34876,"nodeType":865},{},[],{"data":37124,"content":37125,"nodeType":891},{},[37126,37135,37144],{"data":37127,"content":37128,"nodeType":880},{},[37129],{"data":37130,"content":37131,"nodeType":866},{},[37132],{"data":37133,"marks":37134,"value":34889,"nodeType":865},{},[],{"data":37136,"content":37137,"nodeType":880},{},[37138],{"data":37139,"content":37140,"nodeType":866},{},[37141],{"data":37142,"marks":37143,"value":34899,"nodeType":865},{},[],{"data":37145,"content":37146,"nodeType":880},{},[37147],{"data":37148,"content":37149,"nodeType":866},{},[37150],{"data":37151,"marks":37152,"value":34909,"nodeType":865},{},[],{"data":37154,"content":37155,"nodeType":866},{},[37156],{"data":37157,"marks":37158,"value":34916,"nodeType":865},{},[],{"data":37160,"content":37161,"nodeType":866},{},[37162,37165,37172],{"data":37163,"marks":37164,"value":34923,"nodeType":865},{},[],{"data":37166,"content":37167,"nodeType":1102},{"uri":34926},[37168],{"data":37169,"marks":37170,"value":15596,"nodeType":865},{},[37171],{"type":4537},{"data":37173,"marks":37174,"value":34935,"nodeType":865},{},[],{"data":37176,"content":37177,"nodeType":948},{},[37178],{"data":37179,"marks":37180,"value":34942,"nodeType":865},{},[],{"data":37182,"content":37183,"nodeType":866},{},[37184,37187,37194,37197,37204,37207,37214],{"data":37185,"marks":37186,"value":34949,"nodeType":865},{},[],{"data":37188,"content":37189,"nodeType":1102},{"uri":34952},[37190],{"data":37191,"marks":37192,"value":34958,"nodeType":865},{},[37193],{"type":4537},{"data":37195,"marks":37196,"value":34962,"nodeType":865},{},[],{"data":37198,"content":37199,"nodeType":1102},{"uri":34965},[37200],{"data":37201,"marks":37202,"value":34971,"nodeType":865},{},[37203],{"type":4537},{"data":37205,"marks":37206,"value":34975,"nodeType":865},{},[],{"data":37208,"content":37209,"nodeType":1102},{"uri":29172},[37210],{"data":37211,"marks":37212,"value":34983,"nodeType":865},{},[37213],{"type":4537},{"data":37215,"marks":37216,"value":34987,"nodeType":865},{},[],{"data":37218,"content":37219,"nodeType":866},{},[37220],{"data":37221,"marks":37222,"value":34994,"nodeType":865},{},[],{"data":37224,"content":37225,"nodeType":866},{},[37226],{"data":37227,"marks":37228,"value":35001,"nodeType":865},{},[],{"data":37230,"content":37231,"nodeType":866},{},[37232],{"data":37233,"marks":37234,"value":35008,"nodeType":865},{},[],{"data":37236,"content":37239,"nodeType":907},{"target":37237},{"sys":37238},{"id":25087,"type":904,"linkType":905},[],{"data":37241,"content":37242,"nodeType":866},{},[37243],{"data":37244,"marks":37245,"value":35020,"nodeType":865},{},[],{"data":37247,"content":37248,"nodeType":891},{},[37249,37268,37287,37306],{"data":37250,"content":37251,"nodeType":880},{},[37252],{"data":37253,"content":37254,"nodeType":866},{},[37255,37258,37265],{"data":37256,"marks":37257,"value":35033,"nodeType":865},{},[],{"data":37259,"content":37260,"nodeType":1102},{"uri":16484},[37261],{"data":37262,"marks":37263,"value":35041,"nodeType":865},{},[37264],{"type":4537},{"data":37266,"marks":37267,"value":21,"nodeType":865},{},[],{"data":37269,"content":37270,"nodeType":880},{},[37271],{"data":37272,"content":37273,"nodeType":866},{},[37274,37277,37284],{"data":37275,"marks":37276,"value":35054,"nodeType":865},{},[],{"data":37278,"content":37279,"nodeType":1102},{"uri":35057},[37280],{"data":37281,"marks":37282,"value":35063,"nodeType":865},{},[37283],{"type":4537},{"data":37285,"marks":37286,"value":21,"nodeType":865},{},[],{"data":37288,"content":37289,"nodeType":880},{},[37290],{"data":37291,"content":37292,"nodeType":866},{},[37293,37296,37303],{"data":37294,"marks":37295,"value":35076,"nodeType":865},{},[],{"data":37297,"content":37298,"nodeType":1102},{"uri":2328},[37299],{"data":37300,"marks":37301,"value":35084,"nodeType":865},{},[37302],{"type":4537},{"data":37304,"marks":37305,"value":21,"nodeType":865},{},[],{"data":37307,"content":37308,"nodeType":880},{},[37309],{"data":37310,"content":37311,"nodeType":866},{},[37312,37315,37321],{"data":37313,"marks":37314,"value":35097,"nodeType":865},{},[],{"data":37316,"content":37317,"nodeType":1102},{"uri":28212},[37318],{"data":37319,"marks":37320,"value":35104,"nodeType":865},{},[],{"data":37322,"marks":37323,"value":21,"nodeType":865},{},[],{"data":37325,"content":37326,"nodeType":948},{},[37327],{"data":37328,"marks":37329,"value":35114,"nodeType":865},{},[],{"data":37331,"content":37332,"nodeType":866},{},[37333],{"data":37334,"marks":37335,"value":35121,"nodeType":865},{},[],{"data":37337,"content":37338,"nodeType":891},{},[37339,37348],{"data":37340,"content":37341,"nodeType":880},{},[37342],{"data":37343,"content":37344,"nodeType":866},{},[37345],{"data":37346,"marks":37347,"value":35134,"nodeType":865},{},[],{"data":37349,"content":37350,"nodeType":880},{},[37351],{"data":37352,"content":37353,"nodeType":866},{},[37354],{"data":37355,"marks":37356,"value":35144,"nodeType":865},{},[],{"data":37358,"content":37359,"nodeType":866},{},[37360],{"data":37361,"marks":37362,"value":35151,"nodeType":865},{},[],{"data":37364,"content":37365,"nodeType":866},{},[37366],{"data":37367,"marks":37368,"value":35158,"nodeType":865},{},[],{"data":37370,"content":37371,"nodeType":948},{},[37372],{"data":37373,"marks":37374,"value":35165,"nodeType":865},{},[],{"data":37376,"content":37377,"nodeType":866},{},[37378],{"data":37379,"marks":37380,"value":35172,"nodeType":865},{},[],{"data":37382,"content":37383,"nodeType":866},{},[37384],{"data":37385,"marks":37386,"value":35179,"nodeType":865},{},[],{"data":37388,"content":37389,"nodeType":866},{},[37390],{"data":37391,"marks":37392,"value":18316,"nodeType":865},{},[],{"data":37394,"content":37395,"nodeType":891},{},[37396,37405,37414],{"data":37397,"content":37398,"nodeType":880},{},[37399],{"data":37400,"content":37401,"nodeType":866},{},[37402],{"data":37403,"marks":37404,"value":35198,"nodeType":865},{},[],{"data":37406,"content":37407,"nodeType":880},{},[37408],{"data":37409,"content":37410,"nodeType":866},{},[37411],{"data":37412,"marks":37413,"value":35208,"nodeType":865},{},[],{"data":37415,"content":37416,"nodeType":880},{},[37417],{"data":37418,"content":37419,"nodeType":866},{},[37420,37423,37427,37430,37434],{"data":37421,"marks":37422,"value":35218,"nodeType":865},{},[],{"data":37424,"marks":37425,"value":13546,"nodeType":865},{},[37426],{"type":979},{"data":37428,"marks":37429,"value":35226,"nodeType":865},{},[],{"data":37431,"marks":37432,"value":13555,"nodeType":865},{},[37433],{"type":979},{"data":37435,"marks":37436,"value":35234,"nodeType":865},{},[],{"data":37438,"content":37439,"nodeType":866},{},[37440],{"data":37441,"marks":37442,"value":35241,"nodeType":865},{},[],{"data":37444,"content":37447,"nodeType":907},{"target":37445},{"sys":37446},{"id":13520,"type":904,"linkType":905},[],{"data":37449,"content":37450,"nodeType":866},{},[37451,37454,37461],{"data":37452,"marks":37453,"value":35253,"nodeType":865},{},[],{"data":37455,"content":37456,"nodeType":1102},{"uri":34926},[37457],{"data":37458,"marks":37459,"value":27024,"nodeType":865},{},[37460],{"type":4537},{"data":37462,"marks":37463,"value":1151,"nodeType":865},{},[],{"data":37465,"content":37468,"nodeType":907},{"target":37466},{"sys":37467},{"id":35268,"type":904,"linkType":905},[],{"data":37470,"content":37471,"nodeType":948},{},[37472],{"data":37473,"marks":37474,"value":35276,"nodeType":865},{},[],{"data":37476,"content":37477,"nodeType":866},{},[37478],{"data":37479,"marks":37480,"value":35283,"nodeType":865},{},[],{"data":37482,"content":37483,"nodeType":866},{},[37484],{"data":37485,"marks":37486,"value":35290,"nodeType":865},{},[],{"data":37488,"content":37489,"nodeType":866},{},[37490],{"data":37491,"marks":37492,"value":35297,"nodeType":865},{},[],{"data":37494,"content":37495,"nodeType":866},{},[37496],{"data":37497,"marks":37498,"value":35304,"nodeType":865},{},[],{"data":37500,"content":37501,"nodeType":866},{},[37502],{"data":37503,"marks":37504,"value":35311,"nodeType":865},{},[],{"data":37506,"content":37507,"nodeType":866},{},[37508],{"data":37509,"marks":37510,"value":35318,"nodeType":865},{},[],{"data":37512,"content":37513,"nodeType":948},{},[37514],{"data":37515,"marks":37516,"value":6796,"nodeType":865},{},[],{"data":37518,"content":37519,"nodeType":866},{},[37520,37523,37530],{"data":37521,"marks":37522,"value":13704,"nodeType":865},{},[],{"data":37524,"content":37525,"nodeType":1102},{"uri":10028},[37526],{"data":37527,"marks":37528,"value":11104,"nodeType":865},{},[37529],{"type":4537},{"data":37531,"marks":37532,"value":35341,"nodeType":865},{},[],{"items":37534},[37535,37537],{"sys":37536,"name":342},{"id":2527},{"sys":37538,"name":3915},{"id":3914},{"items":37540},[37541],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":37542},{"url":853},{"__typename":2239,"sys":37544,"content":37545,"title":36665,"synopsis":36666,"hashTags":59,"publishedDate":36667,"slug":36668,"tagsCollection":37955,"authorsCollection":37961},{"id":36192},{"json":37546},{"data":37547,"content":37548,"nodeType":2232},{},[37549,37555,37561,37567,37573,37579,37585,37591,37597,37603,37619,37635,37641,37647,37663,37669,37679,37716,37722,37738,37745,37751,37757,37763,37769,37775,37833,37839,37844,37850,37856,37862,37868,37884,37890,37896,37902,37908,37914,37920,37926,37932,37938,37943,37949],{"data":37550,"content":37551,"nodeType":866},{},[37552],{"data":37553,"marks":37554,"value":36203,"nodeType":865},{},[],{"data":37556,"content":37557,"nodeType":866},{},[37558],{"data":37559,"marks":37560,"value":36210,"nodeType":865},{},[],{"data":37562,"content":37563,"nodeType":866},{},[37564],{"data":37565,"marks":37566,"value":36217,"nodeType":865},{},[],{"data":37568,"content":37569,"nodeType":866},{},[37570],{"data":37571,"marks":37572,"value":36224,"nodeType":865},{},[],{"data":37574,"content":37575,"nodeType":866},{},[37576],{"data":37577,"marks":37578,"value":36231,"nodeType":865},{},[],{"data":37580,"content":37581,"nodeType":948},{},[37582],{"data":37583,"marks":37584,"value":36238,"nodeType":865},{},[],{"data":37586,"content":37587,"nodeType":866},{},[37588],{"data":37589,"marks":37590,"value":36245,"nodeType":865},{},[],{"data":37592,"content":37593,"nodeType":866},{},[37594],{"data":37595,"marks":37596,"value":36252,"nodeType":865},{},[],{"data":37598,"content":37599,"nodeType":866},{},[37600],{"data":37601,"marks":37602,"value":36259,"nodeType":865},{},[],{"data":37604,"content":37605,"nodeType":891},{},[37606],{"data":37607,"content":37608,"nodeType":880},{},[37609],{"data":37610,"content":37611,"nodeType":866},{},[37612,37616],{"data":37613,"marks":37614,"value":36273,"nodeType":865},{},[37615],{"type":946},{"data":37617,"marks":37618,"value":36277,"nodeType":865},{},[],{"data":37620,"content":37621,"nodeType":891},{},[37622],{"data":37623,"content":37624,"nodeType":880},{},[37625],{"data":37626,"content":37627,"nodeType":866},{},[37628,37632],{"data":37629,"marks":37630,"value":36291,"nodeType":865},{},[37631],{"type":946},{"data":37633,"marks":37634,"value":36295,"nodeType":865},{},[],{"data":37636,"content":37637,"nodeType":1218},{},[37638],{"data":37639,"marks":37640,"value":36302,"nodeType":865},{},[],{"data":37642,"content":37643,"nodeType":866},{},[37644],{"data":37645,"marks":37646,"value":36309,"nodeType":865},{},[],{"data":37648,"content":37649,"nodeType":866},{},[37650,37653,37660],{"data":37651,"marks":37652,"value":36316,"nodeType":865},{},[],{"data":37654,"content":37655,"nodeType":1102},{"uri":29102},[37656],{"data":37657,"marks":37658,"value":36324,"nodeType":865},{},[37659],{"type":4537},{"data":37661,"marks":37662,"value":36328,"nodeType":865},{},[],{"data":37664,"content":37665,"nodeType":866},{},[37666],{"data":37667,"marks":37668,"value":36335,"nodeType":865},{},[],{"data":37670,"content":37671,"nodeType":866},{},[37672,37675],{"data":37673,"marks":37674,"value":36342,"nodeType":865},{},[],{"data":37676,"marks":37677,"value":36347,"nodeType":865},{},[37678],{"type":946},{"data":37680,"content":37681,"nodeType":891},{},[37682,37699],{"data":37683,"content":37684,"nodeType":880},{},[37685],{"data":37686,"content":37687,"nodeType":866},{},[37688,37692,37695],{"data":37689,"marks":37690,"value":36361,"nodeType":865},{},[37691],{"type":946},{"data":37693,"marks":37694,"value":36365,"nodeType":865},{},[],{"data":37696,"marks":37697,"value":36370,"nodeType":865},{},[37698],{"type":979},{"data":37700,"content":37701,"nodeType":880},{},[37702],{"data":37703,"content":37704,"nodeType":866},{},[37705,37709,37712],{"data":37706,"marks":37707,"value":36381,"nodeType":865},{},[37708],{"type":946},{"data":37710,"marks":37711,"value":36385,"nodeType":865},{},[],{"data":37713,"marks":37714,"value":36390,"nodeType":865},{},[37715],{"type":946},{"data":37717,"content":37718,"nodeType":866},{},[37719],{"data":37720,"marks":37721,"value":36397,"nodeType":865},{},[],{"data":37723,"content":37724,"nodeType":866},{},[37725,37729,37734],{"data":37726,"marks":37727,"value":36405,"nodeType":865},{},[37728],{"type":946},{"data":37730,"marks":37731,"value":36411,"nodeType":865},{},[37732,37733],{"type":979},{"type":946},{"data":37735,"marks":37736,"value":36416,"nodeType":865},{},[37737],{"type":946},{"data":37739,"content":37740,"nodeType":948},{},[37741],{"data":37742,"marks":37743,"value":36424,"nodeType":865},{},[37744],{"type":946},{"data":37746,"content":37747,"nodeType":866},{},[37748],{"data":37749,"marks":37750,"value":36431,"nodeType":865},{},[],{"data":37752,"content":37753,"nodeType":866},{},[37754],{"data":37755,"marks":37756,"value":36438,"nodeType":865},{},[],{"data":37758,"content":37759,"nodeType":866},{},[37760],{"data":37761,"marks":37762,"value":36445,"nodeType":865},{},[],{"data":37764,"content":37765,"nodeType":866},{},[37766],{"data":37767,"marks":37768,"value":36452,"nodeType":865},{},[],{"data":37770,"content":37771,"nodeType":866},{},[37772],{"data":37773,"marks":37774,"value":36459,"nodeType":865},{},[],{"data":37776,"content":37777,"nodeType":891},{},[37778,37797,37815],{"data":37779,"content":37780,"nodeType":880},{},[37781],{"data":37782,"content":37783,"nodeType":866},{},[37784,37787,37794],{"data":37785,"marks":37786,"value":21,"nodeType":865},{},[],{"data":37788,"content":37789,"nodeType":1102},{"uri":7255},[37790],{"data":37791,"marks":37792,"value":36479,"nodeType":865},{},[37793],{"type":4537},{"data":37795,"marks":37796,"value":36483,"nodeType":865},{},[],{"data":37798,"content":37799,"nodeType":880},{},[37800],{"data":37801,"content":37802,"nodeType":866},{},[37803,37806,37812],{"data":37804,"marks":37805,"value":21,"nodeType":865},{},[],{"data":37807,"content":37808,"nodeType":1102},{"uri":7395},[37809],{"data":37810,"marks":37811,"value":36499,"nodeType":865},{},[],{"data":37813,"marks":37814,"value":36503,"nodeType":865},{},[],{"data":37816,"content":37817,"nodeType":880},{},[37818],{"data":37819,"content":37820,"nodeType":866},{},[37821,37824,37830],{"data":37822,"marks":37823,"value":21,"nodeType":865},{},[],{"data":37825,"content":37826,"nodeType":1102},{"uri":36515},[37827],{"data":37828,"marks":37829,"value":36520,"nodeType":865},{},[],{"data":37831,"marks":37832,"value":36524,"nodeType":865},{},[],{"data":37834,"content":37835,"nodeType":866},{},[37836],{"data":37837,"marks":37838,"value":36531,"nodeType":865},{},[],{"data":37840,"content":37843,"nodeType":907},{"target":37841},{"sys":37842},{"id":7467,"type":904,"linkType":905},[],{"data":37845,"content":37846,"nodeType":866},{},[37847],{"data":37848,"marks":37849,"value":36543,"nodeType":865},{},[],{"data":37851,"content":37852,"nodeType":948},{},[37853],{"data":37854,"marks":37855,"value":36550,"nodeType":865},{},[],{"data":37857,"content":37858,"nodeType":866},{},[37859],{"data":37860,"marks":37861,"value":36557,"nodeType":865},{},[],{"data":37863,"content":37864,"nodeType":1218},{},[37865],{"data":37866,"marks":37867,"value":36564,"nodeType":865},{},[],{"data":37869,"content":37870,"nodeType":866},{},[37871,37874,37881],{"data":37872,"marks":37873,"value":36571,"nodeType":865},{},[],{"data":37875,"content":37876,"nodeType":1102},{"uri":14356},[37877],{"data":37878,"marks":37879,"value":36579,"nodeType":865},{},[37880],{"type":4537},{"data":37882,"marks":37883,"value":36583,"nodeType":865},{},[],{"data":37885,"content":37886,"nodeType":866},{},[37887],{"data":37888,"marks":37889,"value":36590,"nodeType":865},{},[],{"data":37891,"content":37892,"nodeType":866},{},[37893],{"data":37894,"marks":37895,"value":36597,"nodeType":865},{},[],{"data":37897,"content":37898,"nodeType":866},{},[37899],{"data":37900,"marks":37901,"value":36604,"nodeType":865},{},[],{"data":37903,"content":37904,"nodeType":1218},{},[37905],{"data":37906,"marks":37907,"value":36611,"nodeType":865},{},[],{"data":37909,"content":37910,"nodeType":866},{},[37911],{"data":37912,"marks":37913,"value":36618,"nodeType":865},{},[],{"data":37915,"content":37916,"nodeType":866},{},[37917],{"data":37918,"marks":37919,"value":36625,"nodeType":865},{},[],{"data":37921,"content":37922,"nodeType":1218},{},[37923],{"data":37924,"marks":37925,"value":36632,"nodeType":865},{},[],{"data":37927,"content":37928,"nodeType":866},{},[37929],{"data":37930,"marks":37931,"value":36639,"nodeType":865},{},[],{"data":37933,"content":37934,"nodeType":866},{},[37935],{"data":37936,"marks":37937,"value":36646,"nodeType":865},{},[],{"data":37939,"content":37942,"nodeType":907},{"target":37940},{"sys":37941},{"id":29297,"type":904,"linkType":905},[],{"data":37944,"content":37945,"nodeType":948},{},[37946],{"data":37947,"marks":37948,"value":6758,"nodeType":865},{},[],{"data":37950,"content":37951,"nodeType":866},{},[37952],{"data":37953,"marks":37954,"value":36664,"nodeType":865},{},[],{"items":37956},[37957,37959],{"sys":37958,"name":342},{"id":2527},{"sys":37960,"name":2524},{"id":2523},{"items":37962},[37963],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":37964},{"url":6031},"blog/combining-the-powers-of-push-and-panther-to-stop-identity-attacks",{"json":37967},{"data":37968,"content":37969,"nodeType":2232},{},[37970],{"data":37971,"content":37972,"nodeType":866},{},[37973],{"data":37974,"marks":37975,"value":37976,"nodeType":865},{},[],"Push is excited to partner with Panther to help security teams correlate Push’s unique browser telemetry with existing log sources to detect and stop identity attacks, including session token theft and adversary-in-the-middle phishing toolkits.",{"id":13338,"publishedAt":37978},"2026-08-12T11:55:16.149Z",{"items":37980},[37981,37983],{"sys":37982,"name":342},{"id":2527},{"sys":37984,"name":3915},{"id":3914},{"items":37986},[37987,37989,37991,37993,37995,37997,37999,38001,38003],{"sys":37988,"name":342,"slug":343,"tier":31},{"id":339},{"sys":37990,"name":297,"slug":298,"tier":31},{"id":294},{"sys":37992,"name":413,"slug":414,"tier":31},{"id":410},{"sys":37994,"name":571,"slug":572,"tier":45},{"id":568},{"sys":37996,"name":261,"slug":262,"tier":45},{"id":258},{"sys":37998,"name":598,"slug":599,"tier":45},{"id":595},{"sys":38000,"name":351,"slug":352,"tier":45},{"id":348},{"sys":38002,"name":404,"slug":405,"tier":45},{"id":401},{"sys":38004,"name":422,"slug":423,"tier":45},{"id":419},"SWuvU32kbgyJCvPj9PWgRwYze-n9Gq__WLqggK6QCag",{"id":38007,"title":35342,"authorsCollection":38008,"content":38012,"extension":228,"faqItemsCollection":38466,"faqTitle":59,"featured":6,"hashTags":59,"meta":38468,"metaTitle":38469,"ogImage":59,"postType":10139,"publishedDate":13735,"relatedBlogPostsCollection":38470,"slug":35344,"stem":39706,"subtitle":59,"summary":39707,"synopsis":35343,"sys":39718,"tagsCollection":39720,"topicsCollection":39726,"__hash__":39750},"blog/blog/introducing-session-token-theft-detection-why-browser-is-best.json",{"items":38009},[38010],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":38011},{"url":853},{"json":38013,"links":38437},{"data":38014,"content":38015,"nodeType":2232},{},[38016,38021,38027,38057,38063,38079,38085,38121,38127,38133,38139,38144,38150,38228,38234,38240,38261,38267,38273,38279,38285,38291,38297,38341,38347,38352,38368,38373,38379,38385,38391,38397,38403,38409,38415,38421],{"data":38017,"content":38020,"nodeType":907},{"target":38018},{"sys":38019},{"id":34868,"type":904,"linkType":905},[],{"data":38022,"content":38023,"nodeType":866},{},[38024],{"data":38025,"marks":38026,"value":34876,"nodeType":865},{},[],{"data":38028,"content":38029,"nodeType":891},{},[38030,38039,38048],{"data":38031,"content":38032,"nodeType":880},{},[38033],{"data":38034,"content":38035,"nodeType":866},{},[38036],{"data":38037,"marks":38038,"value":34889,"nodeType":865},{},[],{"data":38040,"content":38041,"nodeType":880},{},[38042],{"data":38043,"content":38044,"nodeType":866},{},[38045],{"data":38046,"marks":38047,"value":34899,"nodeType":865},{},[],{"data":38049,"content":38050,"nodeType":880},{},[38051],{"data":38052,"content":38053,"nodeType":866},{},[38054],{"data":38055,"marks":38056,"value":34909,"nodeType":865},{},[],{"data":38058,"content":38059,"nodeType":866},{},[38060],{"data":38061,"marks":38062,"value":34916,"nodeType":865},{},[],{"data":38064,"content":38065,"nodeType":866},{},[38066,38069,38076],{"data":38067,"marks":38068,"value":34923,"nodeType":865},{},[],{"data":38070,"content":38071,"nodeType":1102},{"uri":34926},[38072],{"data":38073,"marks":38074,"value":15596,"nodeType":865},{},[38075],{"type":4537},{"data":38077,"marks":38078,"value":34935,"nodeType":865},{},[],{"data":38080,"content":38081,"nodeType":948},{},[38082],{"data":38083,"marks":38084,"value":34942,"nodeType":865},{},[],{"data":38086,"content":38087,"nodeType":866},{},[38088,38091,38098,38101,38108,38111,38118],{"data":38089,"marks":38090,"value":34949,"nodeType":865},{},[],{"data":38092,"content":38093,"nodeType":1102},{"uri":34952},[38094],{"data":38095,"marks":38096,"value":34958,"nodeType":865},{},[38097],{"type":4537},{"data":38099,"marks":38100,"value":34962,"nodeType":865},{},[],{"data":38102,"content":38103,"nodeType":1102},{"uri":34965},[38104],{"data":38105,"marks":38106,"value":34971,"nodeType":865},{},[38107],{"type":4537},{"data":38109,"marks":38110,"value":34975,"nodeType":865},{},[],{"data":38112,"content":38113,"nodeType":1102},{"uri":29172},[38114],{"data":38115,"marks":38116,"value":34983,"nodeType":865},{},[38117],{"type":4537},{"data":38119,"marks":38120,"value":34987,"nodeType":865},{},[],{"data":38122,"content":38123,"nodeType":866},{},[38124],{"data":38125,"marks":38126,"value":34994,"nodeType":865},{},[],{"data":38128,"content":38129,"nodeType":866},{},[38130],{"data":38131,"marks":38132,"value":35001,"nodeType":865},{},[],{"data":38134,"content":38135,"nodeType":866},{},[38136],{"data":38137,"marks":38138,"value":35008,"nodeType":865},{},[],{"data":38140,"content":38143,"nodeType":907},{"target":38141},{"sys":38142},{"id":25087,"type":904,"linkType":905},[],{"data":38145,"content":38146,"nodeType":866},{},[38147],{"data":38148,"marks":38149,"value":35020,"nodeType":865},{},[],{"data":38151,"content":38152,"nodeType":891},{},[38153,38172,38191,38210],{"data":38154,"content":38155,"nodeType":880},{},[38156],{"data":38157,"content":38158,"nodeType":866},{},[38159,38162,38169],{"data":38160,"marks":38161,"value":35033,"nodeType":865},{},[],{"data":38163,"content":38164,"nodeType":1102},{"uri":16484},[38165],{"data":38166,"marks":38167,"value":35041,"nodeType":865},{},[38168],{"type":4537},{"data":38170,"marks":38171,"value":21,"nodeType":865},{},[],{"data":38173,"content":38174,"nodeType":880},{},[38175],{"data":38176,"content":38177,"nodeType":866},{},[38178,38181,38188],{"data":38179,"marks":38180,"value":35054,"nodeType":865},{},[],{"data":38182,"content":38183,"nodeType":1102},{"uri":35057},[38184],{"data":38185,"marks":38186,"value":35063,"nodeType":865},{},[38187],{"type":4537},{"data":38189,"marks":38190,"value":21,"nodeType":865},{},[],{"data":38192,"content":38193,"nodeType":880},{},[38194],{"data":38195,"content":38196,"nodeType":866},{},[38197,38200,38207],{"data":38198,"marks":38199,"value":35076,"nodeType":865},{},[],{"data":38201,"content":38202,"nodeType":1102},{"uri":2328},[38203],{"data":38204,"marks":38205,"value":35084,"nodeType":865},{},[38206],{"type":4537},{"data":38208,"marks":38209,"value":21,"nodeType":865},{},[],{"data":38211,"content":38212,"nodeType":880},{},[38213],{"data":38214,"content":38215,"nodeType":866},{},[38216,38219,38225],{"data":38217,"marks":38218,"value":35097,"nodeType":865},{},[],{"data":38220,"content":38221,"nodeType":1102},{"uri":28212},[38222],{"data":38223,"marks":38224,"value":35104,"nodeType":865},{},[],{"data":38226,"marks":38227,"value":21,"nodeType":865},{},[],{"data":38229,"content":38230,"nodeType":948},{},[38231],{"data":38232,"marks":38233,"value":35114,"nodeType":865},{},[],{"data":38235,"content":38236,"nodeType":866},{},[38237],{"data":38238,"marks":38239,"value":35121,"nodeType":865},{},[],{"data":38241,"content":38242,"nodeType":891},{},[38243,38252],{"data":38244,"content":38245,"nodeType":880},{},[38246],{"data":38247,"content":38248,"nodeType":866},{},[38249],{"data":38250,"marks":38251,"value":35134,"nodeType":865},{},[],{"data":38253,"content":38254,"nodeType":880},{},[38255],{"data":38256,"content":38257,"nodeType":866},{},[38258],{"data":38259,"marks":38260,"value":35144,"nodeType":865},{},[],{"data":38262,"content":38263,"nodeType":866},{},[38264],{"data":38265,"marks":38266,"value":35151,"nodeType":865},{},[],{"data":38268,"content":38269,"nodeType":866},{},[38270],{"data":38271,"marks":38272,"value":35158,"nodeType":865},{},[],{"data":38274,"content":38275,"nodeType":948},{},[38276],{"data":38277,"marks":38278,"value":35165,"nodeType":865},{},[],{"data":38280,"content":38281,"nodeType":866},{},[38282],{"data":38283,"marks":38284,"value":35172,"nodeType":865},{},[],{"data":38286,"content":38287,"nodeType":866},{},[38288],{"data":38289,"marks":38290,"value":35179,"nodeType":865},{},[],{"data":38292,"content":38293,"nodeType":866},{},[38294],{"data":38295,"marks":38296,"value":18316,"nodeType":865},{},[],{"data":38298,"content":38299,"nodeType":891},{},[38300,38309,38318],{"data":38301,"content":38302,"nodeType":880},{},[38303],{"data":38304,"content":38305,"nodeType":866},{},[38306],{"data":38307,"marks":38308,"value":35198,"nodeType":865},{},[],{"data":38310,"content":38311,"nodeType":880},{},[38312],{"data":38313,"content":38314,"nodeType":866},{},[38315],{"data":38316,"marks":38317,"value":35208,"nodeType":865},{},[],{"data":38319,"content":38320,"nodeType":880},{},[38321],{"data":38322,"content":38323,"nodeType":866},{},[38324,38327,38331,38334,38338],{"data":38325,"marks":38326,"value":35218,"nodeType":865},{},[],{"data":38328,"marks":38329,"value":13546,"nodeType":865},{},[38330],{"type":979},{"data":38332,"marks":38333,"value":35226,"nodeType":865},{},[],{"data":38335,"marks":38336,"value":13555,"nodeType":865},{},[38337],{"type":979},{"data":38339,"marks":38340,"value":35234,"nodeType":865},{},[],{"data":38342,"content":38343,"nodeType":866},{},[38344],{"data":38345,"marks":38346,"value":35241,"nodeType":865},{},[],{"data":38348,"content":38351,"nodeType":907},{"target":38349},{"sys":38350},{"id":13520,"type":904,"linkType":905},[],{"data":38353,"content":38354,"nodeType":866},{},[38355,38358,38365],{"data":38356,"marks":38357,"value":35253,"nodeType":865},{},[],{"data":38359,"content":38360,"nodeType":1102},{"uri":34926},[38361],{"data":38362,"marks":38363,"value":27024,"nodeType":865},{},[38364],{"type":4537},{"data":38366,"marks":38367,"value":1151,"nodeType":865},{},[],{"data":38369,"content":38372,"nodeType":907},{"target":38370},{"sys":38371},{"id":35268,"type":904,"linkType":905},[],{"data":38374,"content":38375,"nodeType":948},{},[38376],{"data":38377,"marks":38378,"value":35276,"nodeType":865},{},[],{"data":38380,"content":38381,"nodeType":866},{},[38382],{"data":38383,"marks":38384,"value":35283,"nodeType":865},{},[],{"data":38386,"content":38387,"nodeType":866},{},[38388],{"data":38389,"marks":38390,"value":35290,"nodeType":865},{},[],{"data":38392,"content":38393,"nodeType":866},{},[38394],{"data":38395,"marks":38396,"value":35297,"nodeType":865},{},[],{"data":38398,"content":38399,"nodeType":866},{},[38400],{"data":38401,"marks":38402,"value":35304,"nodeType":865},{},[],{"data":38404,"content":38405,"nodeType":866},{},[38406],{"data":38407,"marks":38408,"value":35311,"nodeType":865},{},[],{"data":38410,"content":38411,"nodeType":866},{},[38412],{"data":38413,"marks":38414,"value":35318,"nodeType":865},{},[],{"data":38416,"content":38417,"nodeType":948},{},[38418],{"data":38419,"marks":38420,"value":6796,"nodeType":865},{},[],{"data":38422,"content":38423,"nodeType":866},{},[38424,38427,38434],{"data":38425,"marks":38426,"value":13704,"nodeType":865},{},[],{"data":38428,"content":38429,"nodeType":1102},{"uri":10028},[38430],{"data":38431,"marks":38432,"value":11104,"nodeType":865},{},[38433],{"type":4537},{"data":38435,"marks":38436,"value":35341,"nodeType":865},{},[],{"entries":38438},{"hyperlink":38439,"inline":38440,"block":38441},[],[],[38442,38450,38456,38459],{"sys":38443,"__typename":34820,"title":38444,"youTubeUrl":38445,"imagePlaceholder":38446},{"id":34868},"Introducing session token theft detection with Push","https://www.youtube.com/watch?v=p4UCfeTs_po",{"url":38447,"width":38448,"height":38449},"https://images.ctfassets.net/y1cdw1ablpvd/3HHLFnvZ0hkovL7MJMGQN2/d82ab3a6757201d2cf9869ade89c9091/Screenshot_2024-08-15_at_07.15.04.png",3358,1888,{"sys":38451,"__typename":2366,"title":38452,"caption":38452,"layoutMode":59,"file":38453},{"id":25087},"The 2024 Sophos Threat Report shows the prevalence of info stealer malware.",{"url":38454,"width":16,"height":38455},"https://images.ctfassets.net/y1cdw1ablpvd/ntLmjUBbgKFILEraHAiLC/dbefc5df68c0260dd6301237af4ba49a/image3.png",432,{"sys":38457,"__typename":2366,"title":37087,"caption":37088,"layoutMode":59,"file":38458},{"id":13520},{"url":37090,"width":12338,"height":37091},{"sys":38460,"__typename":2366,"title":38461,"caption":38461,"layoutMode":59,"file":38462},{"id":35268},"Sample syntax for querying session theft in a SIEM.",{"url":38463,"width":38464,"height":38465},"https://images.ctfassets.net/y1cdw1ablpvd/1eutG6NRlAHZB3w335MJzR/7708168c4ae2a28e4f2470e5f49e8138/image2.png",735,115,{"items":38467},[],{},"Detecting session token theft using Push browser telemetry",{"items":38471},[38472,38869,39291],{"__typename":2239,"sys":38473,"content":38475,"title":38855,"synopsis":38856,"hashTags":59,"publishedDate":38857,"slug":38858,"tagsCollection":38859,"authorsCollection":38865},{"id":38474},"4pXsh0RffPhT783P6CNlOA",{"json":38476},{"data":38477,"content":38478,"nodeType":2232},{},[38479,38486,38493,38499,38506,38513,38520,38527,38534,38541,38604,38610,38617,38624,38640,38647,38654,38661,38668,38675,38682,38692,38699,38705,38712,38719,38726,38733,38740,38746,38753,38773,38780,38787,38794,38837],{"data":38480,"content":38481,"nodeType":866},{},[38482],{"data":38483,"marks":38484,"value":38485,"nodeType":865},{},[],"When the media reports that a popular third-party service provider has suffered a breach and stolen credentials are being sold online, it’s inevitable for your security team to get asked, “Are we affected by this?”",{"data":38487,"content":38488,"nodeType":866},{},[38489],{"data":38490,"marks":38491,"value":38492,"nodeType":865},{},[],"Push helps its customers to answer this question in seconds and with absolute certainty. Here’s how.",{"data":38494,"content":38498,"nodeType":907},{"target":38495},{"sys":38496},{"id":38497,"type":904,"linkType":905},"56lMG3VskDDU1dUHzgQxFK",[],{"data":38500,"content":38501,"nodeType":948},{},[38502],{"data":38503,"marks":38504,"value":38505,"nodeType":865},{},[],"Step 1: Are we using the breached service?",{"data":38507,"content":38508,"nodeType":866},{},[38509],{"data":38510,"marks":38511,"value":38512,"nodeType":865},{},[],"If this service is IT-managed in your organization, then you can probably answer this relatively quickly – at least for the tenant that is IT-managed. If it’s not, then you're going to need to check. ",{"data":38514,"content":38515,"nodeType":866},{},[38516],{"data":38517,"marks":38518,"value":38519,"nodeType":865},{},[],"That’s because end-users increasingly create SaaS accounts and tenants themselves without going through IT. When a third-party data breach hits the headlines, security teams are often surprised to find out that they have people in their organizations using that service.",{"data":38521,"content":38522,"nodeType":866},{},[38523],{"data":38524,"marks":38525,"value":38526,"nodeType":865},{},[],"Push uses a browser agent to track every login to every application made by your employees. It offers ground truth for answering questions like: Are we using the service? Who in the business is using it, and how are they accessing it?",{"data":38528,"content":38529,"nodeType":866},{},[38530],{"data":38531,"marks":38532,"value":38533,"nodeType":865},{},[],"Push can also highlight issues like missing MFA and if an employee is re-using the same password across multiple services — vital information if user credentials for the breached service have been leaked.",{"data":38535,"content":38536,"nodeType":866},{},[38537],{"data":38538,"marks":38539,"value":38540,"nodeType":865},{},[],"There are other data sources that can be used, but they all have their drawbacks:    ",{"data":38542,"content":38543,"nodeType":891},{},[38544,38559,38574,38589],{"data":38545,"content":38546,"nodeType":880},{},[38547],{"data":38548,"content":38549,"nodeType":866},{},[38550,38555],{"data":38551,"marks":38552,"value":38554,"nodeType":865},{},[38553],{"type":946},"Network or SWG",{"data":38556,"marks":38557,"value":38558,"nodeType":865},{},[]," can show you whose endpoints accessed an app website, but not if they've ever logged into the app.",{"data":38560,"content":38561,"nodeType":880},{},[38562],{"data":38563,"content":38564,"nodeType":866},{},[38565,38570],{"data":38566,"marks":38567,"value":38569,"nodeType":865},{},[38568],{"type":946},"IdP",{"data":38571,"marks":38572,"value":38573,"nodeType":865},{},[]," can show you that you're using an app if it’s accessed using SSO, but if that’s the case then you already know about it. It won’t show you non-SSO apps, tenants, or accounts that are more likely to be compromised using stolen credentials.",{"data":38575,"content":38576,"nodeType":880},{},[38577],{"data":38578,"content":38579,"nodeType":866},{},[38580,38585],{"data":38581,"marks":38582,"value":38584,"nodeType":865},{},[38583],{"type":946},"Email",{"data":38586,"marks":38587,"value":38588,"nodeType":865},{},[]," can be used to quickly tell you if employees have received email from an app – indicating an account might exist – but won’t tell you if they signed up using personal email, when they last logged in or if they are using the same password for everything.",{"data":38590,"content":38591,"nodeType":880},{},[38592],{"data":38593,"content":38594,"nodeType":866},{},[38595,38600],{"data":38596,"marks":38597,"value":38599,"nodeType":865},{},[38598],{"type":946},"Finance / contract records",{"data":38601,"marks":38602,"value":38603,"nodeType":865},{},[]," take time to search through and will only cover the services you pay for (many SaaS products offer a free tier). Obviously these records won’t tell you anything about vulnerable accounts.  \n",{"data":38605,"content":38609,"nodeType":907},{"target":38606},{"sys":38607},{"id":38608,"type":904,"linkType":905},"3pLEarsM0oltdxGlkHATbB",[],{"data":38611,"content":38612,"nodeType":948},{},[38613],{"data":38614,"marks":38615,"value":38616,"nodeType":865},{},[],"Step 2: Are any of our accounts currently vulnerable to account takeover through stolen creds?",{"data":38618,"content":38619,"nodeType":866},{},[38620],{"data":38621,"marks":38622,"value":38623,"nodeType":865},{},[],"If credentials are being sold on the dark web for a service your employees use, then you need to quickly determine whether any workforce accounts can be accessed using just the stolen credentials. In other words, are any of these accounts using a leaked password and/or missing MFA?",{"data":38625,"content":38626,"nodeType":866},{},[38627,38631,38636],{"data":38628,"marks":38629,"value":38630,"nodeType":865},{},[],"At this point, you might reach for your IdP and make sure that MFA is enforced for all logins to the affected app. But that’s only going to cover apps and tenants already using SSO. To make things more complicated, most apps still allow username and password logins in addition to SSO logins. You need to see accounts with SSO logins ",{"data":38632,"marks":38633,"value":38635,"nodeType":865},{},[38634],{"type":979},"and",{"data":38637,"marks":38638,"value":38639,"nodeType":865},{},[]," local logins. ",{"data":38641,"content":38642,"nodeType":866},{},[38643],{"data":38644,"marks":38645,"value":38646,"nodeType":865},{},[],"The data that Push collects in the browser provides rich web app context. That means Push shows you how your employees are authenticating on every app, whether it’s password, OIDC, or SAML. ",{"data":38648,"content":38649,"nodeType":866},{},[38650],{"data":38651,"marks":38652,"value":38653,"nodeType":865},{},[],"When you search for a breached third-party service in Push, you’ll see which employees are using usernames and passwords but missing MFA on their accounts. You can then prioritize these accounts for password resets and enabling MFA to stop any stolen credentials from being used to access those accounts. ",{"data":38655,"content":38656,"nodeType":866},{},[38657],{"data":38658,"marks":38659,"value":38660,"nodeType":865},{},[],"As well as highlighting accounts missing MFA, Push fingerprints every password using a shortened salted hash and checks in the browser whether it has been leaked and/or is easily guessable. Armed with this information, you can quickly get these vulnerabilities fixed to reduce the likelihood of an account takeover.",{"data":38662,"content":38663,"nodeType":948},{},[38664],{"data":38665,"marks":38666,"value":38667,"nodeType":865},{},[],"Step 3: Are the stolen credentials being used anywhere else? ",{"data":38669,"content":38670,"nodeType":866},{},[38671],{"data":38672,"marks":38673,"value":38674,"nodeType":865},{},[],"The next consideration is whether the stolen credentials can be used by an attacker in a credential-stuffing attack to compromise accounts on other applications. ",{"data":38676,"content":38677,"nodeType":866},{},[38678],{"data":38679,"marks":38680,"value":38681,"nodeType":865},{},[],"This is an important, and often overlooked, ring of the third-party data breach blast radius. ",{"data":38683,"content":38684,"nodeType":15681},{},[38685],{"data":38686,"content":38687,"nodeType":866},{},[38688],{"data":38689,"marks":38690,"value":38691,"nodeType":865},{},[],"Here at Push, we see that on average 1 in 3 users in every business reuse passwords across multiple accounts.",{"data":38693,"content":38694,"nodeType":866},{},[38695],{"data":38696,"marks":38697,"value":38698,"nodeType":865},{},[],"The password checks performed by Push also identify password reuse between applications. So if there’s a chance that a password has been stolen as part of the third-party data breach, you can make sure it’s changed across all applications. ",{"data":38700,"content":38704,"nodeType":907},{"target":38701},{"sys":38702},{"id":38703,"type":904,"linkType":905},"X9axqTO6dWEe1Jy49hAyG",[],{"data":38706,"content":38707,"nodeType":948},{},[38708],{"data":38709,"marks":38710,"value":38711,"nodeType":865},{},[],"Take action before breaches hit the headlines",{"data":38713,"content":38714,"nodeType":866},{},[38715],{"data":38716,"marks":38717,"value":38718,"nodeType":865},{},[],"The workflow described above takes seconds to perform in Push. It enables you to quickly investigate a third-party data breach to determine if you could have been impacted, and if so, to take targeted action to mitigate the risks. ",{"data":38720,"content":38721,"nodeType":866},{},[38722],{"data":38723,"marks":38724,"value":38725,"nodeType":865},{},[],"That said, no one enjoys scrambling to respond to these kinds of incidents. If you use Push, you can actually get out ahead of these issues so you’re not stuck having to react.",{"data":38727,"content":38728,"nodeType":866},{},[38729],{"data":38730,"marks":38731,"value":38732,"nodeType":865},{},[],"Push integrates stolen account threat intelligence and alerts you when employees are currently using the same password that’s being sold on the dark web. This allows you to take action at the earliest possible opportunity and harden vulnerable accounts before any data breach is reported in the media. ",{"data":38734,"content":38735,"nodeType":866},{},[38736],{"data":38737,"marks":38738,"value":38739,"nodeType":865},{},[],"What this means for you is that next time you’re asked, “Does this affect us?” you can say you dealt with any issues way before it landed in the headlines. ",{"data":38741,"content":38745,"nodeType":907},{"target":38742},{"sys":38743},{"id":38744,"type":904,"linkType":905},"2vFMyWtMlxzTqqtvCPmlGW",[],{"data":38747,"content":38748,"nodeType":1218},{},[38749],{"data":38750,"marks":38751,"value":38752,"nodeType":865},{},[],"Do we need to log in to another security tool to do this?",{"data":38754,"content":38755,"nodeType":866},{},[38756,38760,38769],{"data":38757,"marks":38758,"value":38759,"nodeType":865},{},[],"No. Using the ",{"data":38761,"content":38763,"nodeType":1102},{"uri":38762},"https://pushsecurity.com/help/audience/administrators/docs/getting-started/#api-and-webhooks",[38764],{"data":38765,"marks":38766,"value":38768,"nodeType":865},{},[38767],{"type":4537},"Push API",{"data":38770,"marks":38771,"value":38772,"nodeType":865},{},[],", you can quickly gather relevant data to support the response to a third-party data breach in your SIEM or XDR solution.",{"data":38774,"content":38775,"nodeType":1218},{},[38776],{"data":38777,"marks":38778,"value":38779,"nodeType":865},{},[],"Why not eliminate the risk of password-based attacks altogether? ",{"data":38781,"content":38782,"nodeType":866},{},[38783],{"data":38784,"marks":38785,"value":38786,"nodeType":865},{},[],"Push gives you the ability to react quickly and decisively to a third-party data breach. But it also enables you to take proactive steps to eliminate the risk of password-based attacks altogether so stolen credentials from third-party data breaches no longer pose a threat to your business. ",{"data":38788,"content":38789,"nodeType":866},{},[38790],{"data":38791,"marks":38792,"value":38793,"nodeType":865},{},[],"Push does this by:",{"data":38795,"content":38796,"nodeType":891},{},[38797,38807,38817,38827],{"data":38798,"content":38799,"nodeType":880},{},[38800],{"data":38801,"content":38802,"nodeType":866},{},[38803],{"data":38804,"marks":38805,"value":38806,"nodeType":865},{},[],"Stopping your employees from creating accounts with leaked, weak and reused passwords.",{"data":38808,"content":38809,"nodeType":880},{},[38810],{"data":38811,"content":38812,"nodeType":866},{},[38813],{"data":38814,"marks":38815,"value":38816,"nodeType":865},{},[],"Pinning passwords to individual apps. ",{"data":38818,"content":38819,"nodeType":880},{},[38820],{"data":38821,"content":38822,"nodeType":866},{},[38823],{"data":38824,"marks":38825,"value":38826,"nodeType":865},{},[],"Helping you to get all apps and accounts behind SSO.",{"data":38828,"content":38829,"nodeType":880},{},[38830],{"data":38831,"content":38832,"nodeType":866},{},[38833],{"data":38834,"marks":38835,"value":38836,"nodeType":865},{},[],"Blocking phishing attacks against your employees so their credentials aren’t stolen.",{"data":38838,"content":38839,"nodeType":866},{},[38840,38844,38851],{"data":38841,"marks":38842,"value":38843,"nodeType":865},{},[],"If you want to find out more about how Push can help you mitigate the risks of employee credentials being stolen in the third-party data breach, then ",{"data":38845,"content":38846,"nodeType":1102},{"uri":10028},[38847],{"data":38848,"marks":38849,"value":11104,"nodeType":865},{},[38850],{"type":4537},{"data":38852,"marks":38853,"value":38854,"nodeType":865},{},[]," and we’ll be happy to show you. ","Investigating and responding to a third-party data breach using Push","How to use Push to investigate and respond to a third-party data breach, which results in credentials being stolen and sold on criminal marketplaces.  ","2024-06-13T00:00:00.000Z","investigating-and-responding-to-a-third-party-data-breach-using-push",{"items":38860},[38861,38863],{"sys":38862,"name":342},{"id":2527},{"sys":38864,"name":297},{"id":11129},{"items":38866},[38867],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":38868},{"url":11136},{"__typename":2239,"sys":38870,"content":38871,"title":36665,"synopsis":36666,"hashTags":59,"publishedDate":36667,"slug":36668,"tagsCollection":39281,"authorsCollection":39287},{"id":36192},{"json":38872},{"data":38873,"content":38874,"nodeType":2232},{},[38875,38881,38887,38893,38899,38905,38911,38917,38923,38929,38945,38961,38967,38973,38989,38995,39005,39042,39048,39064,39071,39077,39083,39089,39095,39101,39159,39165,39170,39176,39182,39188,39194,39210,39216,39222,39228,39234,39240,39246,39252,39258,39264,39269,39275],{"data":38876,"content":38877,"nodeType":866},{},[38878],{"data":38879,"marks":38880,"value":36203,"nodeType":865},{},[],{"data":38882,"content":38883,"nodeType":866},{},[38884],{"data":38885,"marks":38886,"value":36210,"nodeType":865},{},[],{"data":38888,"content":38889,"nodeType":866},{},[38890],{"data":38891,"marks":38892,"value":36217,"nodeType":865},{},[],{"data":38894,"content":38895,"nodeType":866},{},[38896],{"data":38897,"marks":38898,"value":36224,"nodeType":865},{},[],{"data":38900,"content":38901,"nodeType":866},{},[38902],{"data":38903,"marks":38904,"value":36231,"nodeType":865},{},[],{"data":38906,"content":38907,"nodeType":948},{},[38908],{"data":38909,"marks":38910,"value":36238,"nodeType":865},{},[],{"data":38912,"content":38913,"nodeType":866},{},[38914],{"data":38915,"marks":38916,"value":36245,"nodeType":865},{},[],{"data":38918,"content":38919,"nodeType":866},{},[38920],{"data":38921,"marks":38922,"value":36252,"nodeType":865},{},[],{"data":38924,"content":38925,"nodeType":866},{},[38926],{"data":38927,"marks":38928,"value":36259,"nodeType":865},{},[],{"data":38930,"content":38931,"nodeType":891},{},[38932],{"data":38933,"content":38934,"nodeType":880},{},[38935],{"data":38936,"content":38937,"nodeType":866},{},[38938,38942],{"data":38939,"marks":38940,"value":36273,"nodeType":865},{},[38941],{"type":946},{"data":38943,"marks":38944,"value":36277,"nodeType":865},{},[],{"data":38946,"content":38947,"nodeType":891},{},[38948],{"data":38949,"content":38950,"nodeType":880},{},[38951],{"data":38952,"content":38953,"nodeType":866},{},[38954,38958],{"data":38955,"marks":38956,"value":36291,"nodeType":865},{},[38957],{"type":946},{"data":38959,"marks":38960,"value":36295,"nodeType":865},{},[],{"data":38962,"content":38963,"nodeType":1218},{},[38964],{"data":38965,"marks":38966,"value":36302,"nodeType":865},{},[],{"data":38968,"content":38969,"nodeType":866},{},[38970],{"data":38971,"marks":38972,"value":36309,"nodeType":865},{},[],{"data":38974,"content":38975,"nodeType":866},{},[38976,38979,38986],{"data":38977,"marks":38978,"value":36316,"nodeType":865},{},[],{"data":38980,"content":38981,"nodeType":1102},{"uri":29102},[38982],{"data":38983,"marks":38984,"value":36324,"nodeType":865},{},[38985],{"type":4537},{"data":38987,"marks":38988,"value":36328,"nodeType":865},{},[],{"data":38990,"content":38991,"nodeType":866},{},[38992],{"data":38993,"marks":38994,"value":36335,"nodeType":865},{},[],{"data":38996,"content":38997,"nodeType":866},{},[38998,39001],{"data":38999,"marks":39000,"value":36342,"nodeType":865},{},[],{"data":39002,"marks":39003,"value":36347,"nodeType":865},{},[39004],{"type":946},{"data":39006,"content":39007,"nodeType":891},{},[39008,39025],{"data":39009,"content":39010,"nodeType":880},{},[39011],{"data":39012,"content":39013,"nodeType":866},{},[39014,39018,39021],{"data":39015,"marks":39016,"value":36361,"nodeType":865},{},[39017],{"type":946},{"data":39019,"marks":39020,"value":36365,"nodeType":865},{},[],{"data":39022,"marks":39023,"value":36370,"nodeType":865},{},[39024],{"type":979},{"data":39026,"content":39027,"nodeType":880},{},[39028],{"data":39029,"content":39030,"nodeType":866},{},[39031,39035,39038],{"data":39032,"marks":39033,"value":36381,"nodeType":865},{},[39034],{"type":946},{"data":39036,"marks":39037,"value":36385,"nodeType":865},{},[],{"data":39039,"marks":39040,"value":36390,"nodeType":865},{},[39041],{"type":946},{"data":39043,"content":39044,"nodeType":866},{},[39045],{"data":39046,"marks":39047,"value":36397,"nodeType":865},{},[],{"data":39049,"content":39050,"nodeType":866},{},[39051,39055,39060],{"data":39052,"marks":39053,"value":36405,"nodeType":865},{},[39054],{"type":946},{"data":39056,"marks":39057,"value":36411,"nodeType":865},{},[39058,39059],{"type":979},{"type":946},{"data":39061,"marks":39062,"value":36416,"nodeType":865},{},[39063],{"type":946},{"data":39065,"content":39066,"nodeType":948},{},[39067],{"data":39068,"marks":39069,"value":36424,"nodeType":865},{},[39070],{"type":946},{"data":39072,"content":39073,"nodeType":866},{},[39074],{"data":39075,"marks":39076,"value":36431,"nodeType":865},{},[],{"data":39078,"content":39079,"nodeType":866},{},[39080],{"data":39081,"marks":39082,"value":36438,"nodeType":865},{},[],{"data":39084,"content":39085,"nodeType":866},{},[39086],{"data":39087,"marks":39088,"value":36445,"nodeType":865},{},[],{"data":39090,"content":39091,"nodeType":866},{},[39092],{"data":39093,"marks":39094,"value":36452,"nodeType":865},{},[],{"data":39096,"content":39097,"nodeType":866},{},[39098],{"data":39099,"marks":39100,"value":36459,"nodeType":865},{},[],{"data":39102,"content":39103,"nodeType":891},{},[39104,39123,39141],{"data":39105,"content":39106,"nodeType":880},{},[39107],{"data":39108,"content":39109,"nodeType":866},{},[39110,39113,39120],{"data":39111,"marks":39112,"value":21,"nodeType":865},{},[],{"data":39114,"content":39115,"nodeType":1102},{"uri":7255},[39116],{"data":39117,"marks":39118,"value":36479,"nodeType":865},{},[39119],{"type":4537},{"data":39121,"marks":39122,"value":36483,"nodeType":865},{},[],{"data":39124,"content":39125,"nodeType":880},{},[39126],{"data":39127,"content":39128,"nodeType":866},{},[39129,39132,39138],{"data":39130,"marks":39131,"value":21,"nodeType":865},{},[],{"data":39133,"content":39134,"nodeType":1102},{"uri":7395},[39135],{"data":39136,"marks":39137,"value":36499,"nodeType":865},{},[],{"data":39139,"marks":39140,"value":36503,"nodeType":865},{},[],{"data":39142,"content":39143,"nodeType":880},{},[39144],{"data":39145,"content":39146,"nodeType":866},{},[39147,39150,39156],{"data":39148,"marks":39149,"value":21,"nodeType":865},{},[],{"data":39151,"content":39152,"nodeType":1102},{"uri":36515},[39153],{"data":39154,"marks":39155,"value":36520,"nodeType":865},{},[],{"data":39157,"marks":39158,"value":36524,"nodeType":865},{},[],{"data":39160,"content":39161,"nodeType":866},{},[39162],{"data":39163,"marks":39164,"value":36531,"nodeType":865},{},[],{"data":39166,"content":39169,"nodeType":907},{"target":39167},{"sys":39168},{"id":7467,"type":904,"linkType":905},[],{"data":39171,"content":39172,"nodeType":866},{},[39173],{"data":39174,"marks":39175,"value":36543,"nodeType":865},{},[],{"data":39177,"content":39178,"nodeType":948},{},[39179],{"data":39180,"marks":39181,"value":36550,"nodeType":865},{},[],{"data":39183,"content":39184,"nodeType":866},{},[39185],{"data":39186,"marks":39187,"value":36557,"nodeType":865},{},[],{"data":39189,"content":39190,"nodeType":1218},{},[39191],{"data":39192,"marks":39193,"value":36564,"nodeType":865},{},[],{"data":39195,"content":39196,"nodeType":866},{},[39197,39200,39207],{"data":39198,"marks":39199,"value":36571,"nodeType":865},{},[],{"data":39201,"content":39202,"nodeType":1102},{"uri":14356},[39203],{"data":39204,"marks":39205,"value":36579,"nodeType":865},{},[39206],{"type":4537},{"data":39208,"marks":39209,"value":36583,"nodeType":865},{},[],{"data":39211,"content":39212,"nodeType":866},{},[39213],{"data":39214,"marks":39215,"value":36590,"nodeType":865},{},[],{"data":39217,"content":39218,"nodeType":866},{},[39219],{"data":39220,"marks":39221,"value":36597,"nodeType":865},{},[],{"data":39223,"content":39224,"nodeType":866},{},[39225],{"data":39226,"marks":39227,"value":36604,"nodeType":865},{},[],{"data":39229,"content":39230,"nodeType":1218},{},[39231],{"data":39232,"marks":39233,"value":36611,"nodeType":865},{},[],{"data":39235,"content":39236,"nodeType":866},{},[39237],{"data":39238,"marks":39239,"value":36618,"nodeType":865},{},[],{"data":39241,"content":39242,"nodeType":866},{},[39243],{"data":39244,"marks":39245,"value":36625,"nodeType":865},{},[],{"data":39247,"content":39248,"nodeType":1218},{},[39249],{"data":39250,"marks":39251,"value":36632,"nodeType":865},{},[],{"data":39253,"content":39254,"nodeType":866},{},[39255],{"data":39256,"marks":39257,"value":36639,"nodeType":865},{},[],{"data":39259,"content":39260,"nodeType":866},{},[39261],{"data":39262,"marks":39263,"value":36646,"nodeType":865},{},[],{"data":39265,"content":39268,"nodeType":907},{"target":39266},{"sys":39267},{"id":29297,"type":904,"linkType":905},[],{"data":39270,"content":39271,"nodeType":948},{},[39272],{"data":39273,"marks":39274,"value":6758,"nodeType":865},{},[],{"data":39276,"content":39277,"nodeType":866},{},[39278],{"data":39279,"marks":39280,"value":36664,"nodeType":865},{},[],{"items":39282},[39283,39285],{"sys":39284,"name":342},{"id":2527},{"sys":39286,"name":2524},{"id":2523},{"items":39288},[39289],{"fullName":6027,"firstName":6028,"jobTitle":6029,"profilePicture":39290},{"url":6031},{"__typename":2239,"sys":39292,"content":39293,"title":27349,"synopsis":39694,"hashTags":59,"publishedDate":39695,"slug":27350,"tagsCollection":39696,"authorsCollection":39702},{"id":13637},{"json":39294},{"data":39295,"content":39296,"nodeType":2232},{},[39297,39303,39323,39343,39361,39381,39404,39411,39431,39451,39458,39464,39471,39478,39485,39492,39499,39506,39513,39519,39526,39545,39552,39557,39580,39587,39602,39608,39627,39634,39641,39648,39655,39673,39679],{"data":39298,"content":39302,"nodeType":907},{"target":39299},{"sys":39300},{"id":39301,"type":904,"linkType":905},"B8i0EK90Dn7FLrJXR4ANh",[],{"data":39304,"content":39305,"nodeType":866},{},[39306,39310,39319],{"data":39307,"marks":39308,"value":39309,"nodeType":865},{},[],"Is the golden era of MFA protection over? Watch a demo of an ",{"data":39311,"content":39314,"nodeType":1038},{"target":39312},{"sys":39313},{"id":35357,"type":904,"linkType":905},[39315],{"data":39316,"marks":39317,"value":39318,"nodeType":865},{},[],"EvilNoVNC phishing attack",{"data":39320,"marks":39321,"value":39322,"nodeType":865},{},[]," and you may be left sweating a little and whispering “FIDO2” like a protection spell.",{"data":39324,"content":39325,"nodeType":866},{},[39326,39330,39339],{"data":39327,"marks":39328,"value":39329,"nodeType":865},{},[],"With the widespread adoption of MFA, attackers are ",{"data":39331,"content":39334,"nodeType":1038},{"target":39332},{"sys":39333},{"id":29472,"type":904,"linkType":905},[39335],{"data":39336,"marks":39337,"value":39338,"nodeType":865},{},[],"increasingly turning",{"data":39340,"marks":39341,"value":39342,"nodeType":865},{},[]," to more sophisticated methods of credential theft as their initial point of entry. ",{"data":39344,"content":39345,"nodeType":866},{},[39346,39350,39357],{"data":39347,"marks":39348,"value":39349,"nodeType":865},{},[],"Newer phishing approaches include reverse proxies as well as tools that mimic legitimate login pages by rendering the webpages and then displaying those renders to the unsuspecting end-user. While these tools are not always common knowledge among blue teams, their use is ",{"data":39351,"content":39352,"nodeType":1102},{"uri":32488},[39353],{"data":39354,"marks":39355,"value":39356,"nodeType":865},{},[],"on the rise",{"data":39358,"marks":39359,"value":39360,"nodeType":865},{},[],", an unsurprising response to the broad use of multi-factor authentication in many organizations.",{"data":39362,"content":39363,"nodeType":866},{},[39364,39368,39377],{"data":39365,"marks":39366,"value":39367,"nodeType":865},{},[],"What sets this generation of ",{"data":39369,"content":39372,"nodeType":1038},{"target":39370},{"sys":39371},{"id":35357,"type":904,"linkType":905},[39373],{"data":39374,"marks":39375,"value":39376,"nodeType":865},{},[],"Adversary-in-the-Middle (AitM) phishing tools",{"data":39378,"marks":39379,"value":39380,"nodeType":865},{},[]," apart? ",{"data":39382,"content":39383,"nodeType":891},{},[39384,39394],{"data":39385,"content":39386,"nodeType":880},{},[39387],{"data":39388,"content":39389,"nodeType":866},{},[39390],{"data":39391,"marks":39392,"value":39393,"nodeType":865},{},[],"They act as a proxy between the user and a legitimate web login page, allowing the attacker to bypass MFA and harvest credentials and session tokens.",{"data":39395,"content":39396,"nodeType":880},{},[39397],{"data":39398,"content":39399,"nodeType":866},{},[39400],{"data":39401,"marks":39402,"value":39403,"nodeType":865},{},[],"They give off little scent to end-users, because the end-user is logging into the legitimate site, just by taking a detour via the attacker’s device.",{"data":39405,"content":39406,"nodeType":866},{},[39407],{"data":39408,"marks":39409,"value":39410,"nodeType":865},{},[],"These AitM tools are also difficult to detect — unless you have eyes in the browser.",{"data":39412,"content":39413,"nodeType":866},{},[39414,39418,39427],{"data":39415,"marks":39416,"value":39417,"nodeType":865},{},[],"Powered by the Push browser agent, Push now offers a ",{"data":39419,"content":39422,"nodeType":1038},{"target":39420},{"sys":39421},{"id":1483,"type":904,"linkType":905},[39423],{"data":39424,"marks":39425,"value":39426,"nodeType":865},{},[],"preconfigured set of detections",{"data":39428,"marks":39429,"value":39430,"nodeType":865},{},[]," for phishing tools like Evilginx and others, informed by our threat detection team’s research into their behavior. This phishing tool detection feature will automatically prevent users from accessing a site that’s running one of these malicious tools, and display a custom warning message to your end-users.",{"data":39432,"content":39433,"nodeType":866},{},[39434,39438,39447],{"data":39435,"marks":39436,"value":39437,"nodeType":865},{},[],"While Push already provides strong phishing protection by ",{"data":39439,"content":39442,"nodeType":1038},{"target":39440},{"sys":39441},{"id":27526,"type":904,"linkType":905},[39443],{"data":39444,"marks":39445,"value":39446,"nodeType":865},{},[],"preventing SSO password use",{"data":39448,"marks":39449,"value":39450,"nodeType":865},{},[]," on non-IdP webpages (in other words, it stops you from using your Okta password on any page that isn’t an Okta login page), this new feature allows us to sharpen our anti-phishing capabilities by detecting malware on a site before a user even interacts with the page. ",{"data":39452,"content":39453,"nodeType":866},{},[39454],{"data":39455,"marks":39456,"value":39457,"nodeType":865},{},[],"In this article, we’ll describe our approach to detecting these newer phishing tools, including how we’re borrowing techniques from the world of EDR, and how you can combine phishing tool detection with other Push controls for a defense-in-depth strategy that covers both the user and the application sides of the equation.",{"data":39459,"content":39463,"nodeType":907},{"target":39460},{"sys":39461},{"id":39462,"type":904,"linkType":905},"59q6klX2j7ClgUvmix93sG",[],{"data":39465,"content":39466,"nodeType":948},{},[39467],{"data":39468,"marks":39469,"value":39470,"nodeType":865},{},[],"Taking a page from EDR",{"data":39472,"content":39473,"nodeType":866},{},[39474],{"data":39475,"marks":39476,"value":39477,"nodeType":865},{},[],"Most phishing prevention solutions rely on lists of known-bad sites as the source of intelligence. These are always going to be a step behind reality because they rely on ever-shifting secondary attributes such as domain names (though we won’t be disabling Chrome Safe Browsing anytime soon, and we’re not trying to replace it).",{"data":39479,"content":39480,"nodeType":866},{},[39481],{"data":39482,"marks":39483,"value":39484,"nodeType":865},{},[],"As veterans of the EDR world, we’re drawn to think in analogous terms. With detecting AitM phishing tools, that means expanding on the concept of dynamic analysis on the endpoint. EDR allows you to dynamically analyze the behavior of malware live and at scale, rather than focusing on easy-to-change indicators like file hashes or domain names.",{"data":39486,"content":39487,"nodeType":866},{},[39488],{"data":39489,"marks":39490,"value":39491,"nodeType":865},{},[],"Applying this idea to malware that runs in the browser requires a solution that is in the browser, like the Push browser agent.",{"data":39493,"content":39494,"nodeType":866},{},[39495],{"data":39496,"marks":39497,"value":39498,"nodeType":865},{},[],"So we’re expanding the attributes that are traditionally analyzed to spot indicators of compromise (IoCs) beyond domains, file names, file hashes, IP addresses, etc., to also include behavioral attributes of malware that are much harder to change, such as Javascript calls being made or data structures saved to local storage.",{"data":39500,"content":39501,"nodeType":866},{},[39502],{"data":39503,"marks":39504,"value":39505,"nodeType":865},{},[],"By performing behavioral analysis on AitM automated proxy tools, we can directly analyze the application for a precise and immediate identification. ",{"data":39507,"content":39508,"nodeType":866},{},[39509],{"data":39510,"marks":39511,"value":39512,"nodeType":865},{},[],"Push researchers are regularly identifying and adding detections for new toolkits — think of this like Push’s database of threat research in action.",{"data":39514,"content":39515,"nodeType":948},{},[39516],{"data":39517,"marks":39518,"value":27127,"nodeType":865},{},[],{"data":39520,"content":39521,"nodeType":866},{},[39522],{"data":39523,"marks":39524,"value":39525,"nodeType":865},{},[],"If you’re new to Push, a bit of context may be useful. Push uses a browser agent deployed to employee browsers (we support all major browsers) to prevent, detect, and block identity attacks. ",{"data":39527,"content":39528,"nodeType":866},{},[39529,39533,39541],{"data":39530,"marks":39531,"value":39532,"nodeType":865},{},[],"By directly observing user behavior at the login event, Push provides broad and actionable context across all the apps your employees are using, how they are accessing them, their MFA methods, and where they’re using insecure and reused passwords. With this context as the foundation, Push enforces your desired ",{"data":39534,"content":39537,"nodeType":1038},{"target":39535},{"sys":39536},{"id":32563,"type":904,"linkType":905},[39538],{"data":39539,"marks":39540,"value":18234,"nodeType":865},{},[],{"data":39542,"marks":39543,"value":39544,"nodeType":865},{},[],", including preventing SSO password reuse, blocking malicious websites, or steering employees to approved apps only.",{"data":39546,"content":39547,"nodeType":866},{},[39548],{"data":39549,"marks":39550,"value":39551,"nodeType":865},{},[],"Once configured by an administrator, phishing tool detection will immediately check for the fingerprints of these toolkits as end-users visit websites and then display your custom warn or block message. ",{"data":39553,"content":39556,"nodeType":907},{"target":39554},{"sys":39555},{"id":27111,"type":904,"linkType":905},[],{"data":39558,"content":39559,"nodeType":866},{},[39560,39564,39568,39572,39576],{"data":39561,"marks":39562,"value":39563,"nodeType":865},{},[],"In ",{"data":39565,"marks":39566,"value":2088,"nodeType":865},{},[39567],{"type":946},{"data":39569,"marks":39570,"value":39571,"nodeType":865},{},[]," mode, users cannot proceed to the site where malicious software has been detected. In ",{"data":39573,"marks":39574,"value":2080,"nodeType":865},{},[39575],{"type":946},{"data":39577,"marks":39578,"value":39579,"nodeType":865},{},[]," mode, users can choose to proceed if they are sure it’s not a phishing site.",{"data":39581,"content":39582,"nodeType":866},{},[39583],{"data":39584,"marks":39585,"value":39586,"nodeType":865},{},[],"In both cases, users do not need to interact with a page (by typing, clicking, etc.) for Push to trigger the custom message. ",{"data":39588,"content":39589,"nodeType":866},{},[39590,39593,39599],{"data":39591,"marks":39592,"value":25021,"nodeType":865},{},[],{"data":39594,"content":39595,"nodeType":1102},{"uri":24833},[39596],{"data":39597,"marks":39598,"value":17844,"nodeType":865},{},[],{"data":39600,"marks":39601,"value":25031,"nodeType":865},{},[],{"data":39603,"content":39607,"nodeType":907},{"target":39604},{"sys":39605},{"id":39606,"type":904,"linkType":905},"6oAhxLBPVxN3Rcw2kFeVtG",[],{"data":39609,"content":39610,"nodeType":866},{},[39611,39615,39623],{"data":39612,"marks":39613,"value":39614,"nodeType":865},{},[],"Pairing this phishing detection capability with Push’s ",{"data":39616,"content":39619,"nodeType":1038},{"target":39617},{"sys":39618},{"id":1740,"type":904,"linkType":905},[39620],{"data":39621,"marks":39622,"value":15108,"nodeType":865},{},[],{"data":39624,"marks":39625,"value":39626,"nodeType":865},{},[]," feature provides a strong defense-in-depth strategy for stopping credential theft.",{"data":39628,"content":39629,"nodeType":866},{},[39630],{"data":39631,"marks":39632,"value":39633,"nodeType":865},{},[],"SSO password protection works by analyzing user behavior — namely, is a user entering their SSO password onto a page that does not belong to the legitimate identity provider.",{"data":39635,"content":39636,"nodeType":866},{},[39637],{"data":39638,"marks":39639,"value":39640,"nodeType":865},{},[],"Phishing tool detection adds in the application-level behavioral analysis. In addition, when Push identifies a new, previously unknown phishing tool in the wild via blocked SSO credential theft, we add its fingerprints to the browser agent’s detective capabilities.  ",{"data":39642,"content":39643,"nodeType":948},{},[39644],{"data":39645,"marks":39646,"value":39647,"nodeType":865},{},[],"Looking ahead",{"data":39649,"content":39650,"nodeType":866},{},[39651],{"data":39652,"marks":39653,"value":39654,"nodeType":865},{},[],"We’re just scratching the surface on this approach and are exploring how Push can identify and block other web-delivered malware and Javascript-based attack types beyond AitM tools. Think HTML smuggling, tabnabbing, and the like.",{"data":39656,"content":39657,"nodeType":866},{},[39658,39662,39670],{"data":39659,"marks":39660,"value":39661,"nodeType":865},{},[],"Got feedback? We’d ",{"data":39663,"content":39665,"nodeType":1102},{"uri":39664},"/contact/",[39666],{"data":39667,"marks":39668,"value":39669,"nodeType":865},{},[],"love to talk",{"data":39671,"marks":39672,"value":1151,"nodeType":865},{},[],{"data":39674,"content":39675,"nodeType":948},{},[39676],{"data":39677,"marks":39678,"value":6796,"nodeType":865},{},[],{"data":39680,"content":39681,"nodeType":866},{},[39682,39685,39691],{"data":39683,"marks":39684,"value":13704,"nodeType":865},{},[],{"data":39686,"content":39687,"nodeType":1102},{"uri":10028},[39688],{"data":39689,"marks":39690,"value":11104,"nodeType":865},{},[],{"data":39692,"marks":39693,"value":35341,"nodeType":865},{},[],"Push analyzes behavioral attributes of malware to identify phishing tools like Evilginx and NakedPages and immediately block end-users from visiting them.","2024-06-06T00:00:00.000Z",{"items":39697},[39698,39700],{"sys":39699,"name":3915},{"id":3914},{"sys":39701,"name":342},{"id":2527},{"items":39703},[39704],{"fullName":849,"firstName":850,"jobTitle":851,"profilePicture":39705},{"url":853},"blog/introducing-session-token-theft-detection-why-browser-is-best",{"json":39708},{"data":39709,"content":39710,"nodeType":2232},{},[39711],{"data":39712,"content":39713,"nodeType":866},{},[39714],{"data":39715,"marks":39716,"value":39717,"nodeType":865},{},[],"Push identifies session token theft by adding telemetry to the user agent string – using the power of our browser agent to create a new high-fidelity signal for your security team.",{"id":13469,"publishedAt":39719},"2026-08-12T11:55:17.569Z",{"items":39721},[39722,39724],{"sys":39723,"name":342},{"id":2527},{"sys":39725,"name":3915},{"id":3914},{"items":39727},[39728,39730,39732,39734,39736,39738,39740,39742,39744,39746,39748],{"sys":39729,"name":279,"slug":280,"tier":31},{"id":276},{"sys":39731,"name":342,"slug":343,"tier":31},{"id":339},{"sys":39733,"name":413,"slug":414,"tier":31},{"id":410},{"sys":39735,"name":297,"slug":298,"tier":31},{"id":294},{"sys":39737,"name":571,"slug":572,"tier":45},{"id":568},{"sys":39739,"name":422,"slug":423,"tier":45},{"id":419},{"sys":39741,"name":404,"slug":405,"tier":45},{"id":401},{"sys":39743,"name":351,"slug":352,"tier":45},{"id":348},{"sys":39745,"name":466,"slug":467,"tier":45},{"id":463},{"sys":39747,"name":598,"slug":599,"tier":45},{"id":595},{"sys":39749,"name":377,"slug":378,"tier":45},{"id":374},"6NALxwByZU7T83nPujij4fs17n2Hsv8JXM23iqDL5Zs",{"id":39752,"title":27349,"authorsCollection":39753,"content":39757,"extension":228,"faqItemsCollection":40149,"faqTitle":59,"featured":6,"hashTags":59,"meta":40151,"metaTitle":40152,"ogImage":59,"postType":10139,"publishedDate":39695,"relatedBlogPostsCollection":40153,"slug":27350,"stem":41809,"subtitle":59,"summary":41810,"synopsis":39694,"sys":41821,"tagsCollection":41823,"topicsCollection":41829,"__hash__":41857},"blog/blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser.json",{"items":39754},[39755],{"fullName":849,"firstName":850,"jobTitle":851,"socialLinks":59,"profilePicture":39756},{"url":853},{"json":39758,"links":40109},{"data":39759,"content":39760,"nodeType":2232},{},[39761,39766,39783,39800,39815,39832,39853,39859,39876,39893,39899,39904,39910,39916,39922,39928,39934,39940,39946,39952,39958,39975,39981,39986,40006,40012,40027,40032,40049,40055,40061,40067,40073,40088,40094],{"data":39762,"content":39765,"nodeType":907},{"target":39763},{"sys":39764},{"id":39301,"type":904,"linkType":905},[],{"data":39767,"content":39768,"nodeType":866},{},[39769,39772,39780],{"data":39770,"marks":39771,"value":39309,"nodeType":865},{},[],{"data":39773,"content":39776,"nodeType":1038},{"target":39774},{"sys":39775},{"id":35357,"type":904,"linkType":905},[39777],{"data":39778,"marks":39779,"value":39318,"nodeType":865},{},[],{"data":39781,"marks":39782,"value":39322,"nodeType":865},{},[],{"data":39784,"content":39785,"nodeType":866},{},[39786,39789,39797],{"data":39787,"marks":39788,"value":39329,"nodeType":865},{},[],{"data":39790,"content":39793,"nodeType":1038},{"target":39791},{"sys":39792},{"id":29472,"type":904,"linkType":905},[39794],{"data":39795,"marks":39796,"value":39338,"nodeType":865},{},[],{"data":39798,"marks":39799,"value":39342,"nodeType":865},{},[],{"data":39801,"content":39802,"nodeType":866},{},[39803,39806,39812],{"data":39804,"marks":39805,"value":39349,"nodeType":865},{},[],{"data":39807,"content":39808,"nodeType":1102},{"uri":32488},[39809],{"data":39810,"marks":39811,"value":39356,"nodeType":865},{},[],{"data":39813,"marks":39814,"value":39360,"nodeType":865},{},[],{"data":39816,"content":39817,"nodeType":866},{},[39818,39821,39829],{"data":39819,"marks":39820,"value":39367,"nodeType":865},{},[],{"data":39822,"content":39825,"nodeType":1038},{"target":39823},{"sys":39824},{"id":35357,"type":904,"linkType":905},[39826],{"data":39827,"marks":39828,"value":39376,"nodeType":865},{},[],{"data":39830,"marks":39831,"value":39380,"nodeType":865},{},[],{"data":39833,"content":39834,"nodeType":891},{},[39835,39844],{"data":39836,"content":39837,"nodeType":880},{},[39838],{"data":39839,"content":39840,"nodeType":866},{},[39841],{"data":39842,"marks":39843,"value":39393,"nodeType":865},{},[],{"data":39845,"content":39846,"nodeType":880},{},[39847],{"data":39848,"content":39849,"nodeType":866},{},[39850],{"data":39851,"marks":39852,"value":39403,"nodeType":865},{},[],{"data":39854,"content":39855,"nodeType":866},{},[39856],{"data":39857,"marks":39858,"value":39410,"nodeType":865},{},[],{"data":39860,"content":39861,"nodeType":866},{},[39862,39865,39873],{"data":39863,"marks":39864,"value":39417,"nodeType":865},{},[],{"data":39866,"content":39869,"nodeType":1038},{"target":39867},{"sys":39868},{"id":1483,"type":904,"linkType":905},[39870],{"data":39871,"marks":39872,"value":39426,"nodeType":865},{},[],{"data":39874,"marks":39875,"value":39430,"nodeType":865},{},[],{"data":39877,"content":39878,"nodeType":866},{},[39879,39882,39890],{"data":39880,"marks":39881,"value":39437,"nodeType":865},{},[],{"data":39883,"content":39886,"nodeType":1038},{"target":39884},{"sys":39885},{"id":27526,"type":904,"linkType":905},[39887],{"data":39888,"marks":39889,"value":39446,"nodeType":865},{},[],{"data":39891,"marks":39892,"value":39450,"nodeType":865},{},[],{"data":39894,"content":39895,"nodeType":866},{},[39896],{"data":39897,"marks":39898,"value":39457,"nodeType":865},{},[],{"data":39900,"content":39903,"nodeType":907},{"target":39901},{"sys":39902},{"id":39462,"type":904,"linkType":905},[],{"data":39905,"content":39906,"nodeType":948},{},[39907],{"data":39908,"marks":39909,"value":39470,"nodeType":865},{},[],{"data":39911,"content":39912,"nodeType":866},{},[39913],{"data":39914,"marks":39915,"value":39477,"nodeType":865},{},[],{"data":39917,"content":39918,"nodeType":866},{},[39919],{"data":39920,"marks":39921,"value":39484,"nodeType":865},{},[],{"data":39923,"content":39924,"nodeType":866},{},[39925],{"data":39926,"marks":39927,"value":39491,"nodeType":865},{},[],{"data":39929,"content":39930,"nodeType":866},{},[39931],{"data":39932,"marks":39933,"value":39498,"nodeType":865},{},[],{"data":39935,"content":39936,"nodeType":866},{},[39937],{"data":39938,"marks":39939,"value":39505,"nodeType":865},{},[],{"data":39941,"content":39942,"nodeType":866},{},[39943],{"data":39944,"marks":39945,"value":39512,"nodeType":865},{},[],{"data":39947,"content":39948,"nodeType":948},{},[39949],{"data":39950,"marks":39951,"value":27127,"nodeType":865},{},[],{"data":39953,"content":39954,"nodeType":866},{},[39955],{"data":39956,"marks":39957,"value":39525,"nodeType":865},{},[],{"data":39959,"content":39960,"nodeType":866},{},[39961,39964,39972],{"data":39962,"marks":39963,"value":39532,"nodeType":865},{},[],{"data":39965,"content":39968,"nodeType":1038},{"target":39966},{"sys":39967},{"id":32563,"type":904,"linkType":905},[39969],{"data":39970,"marks":39971,"value":18234,"nodeType":865},{},[],{"data":39973,"marks":39974,"value":39544,"nodeType":865},{},[],{"data":39976,"content":39977,"nodeType":866},{},[39978],{"data":39979,"marks":39980,"value":39551,"nodeType":865},{},[],{"data":39982,"content":39985,"nodeType":907},{"target":39983},{"sys":39984},{"id":27111,"type":904,"linkType":905},[],{"data":39987,"content":39988,"nodeType":866},{},[39989,39992,39996,39999,40003],{"data":39990,"marks":39991,"value":39563,"nodeType":865},{},[],{"data":39993,"marks":39994,"value":2088,"nodeType":865},{},[39995],{"type":946},{"data":39997,"marks":39998,"value":39571,"nodeType":865},{},[],{"data":40000,"marks":40001,"value":2080,"nodeType":865},{},[40002],{"type":946},{"data":40004,"marks":40005,"value":39579,"nodeType":865},{},[],{"data":40007,"content":40008,"nodeType":866},{},[40009],{"data":40010,"marks":40011,"value":39586,"nodeType":865},{},[],{"data":40013,"content":40014,"nodeType":866},{},[40015,40018,40024],{"data":40016,"marks":40017,"value":25021,"nodeType":865},{},[],{"data":40019,"content":40020,"nodeType":1102},{"uri":24833},[40021],{"data":40022,"marks":40023,"value":17844,"nodeType":865},{},[],{"data":40025,"marks":40026,"value":25031,"nodeType":865},{},[],{"data":40028,"content":40031,"nodeType":907},{"target":40029},{"sys":40030},{"id":39606,"type":904,"linkType":905},[],{"data":40033,"content":40034,"nodeType":866},{},[40035,40038,40046],{"data":40036,"marks":40037,"value":39614,"nodeType":865},{},[],{"data":40039,"content":40042,"nodeType":1038},{"target":40040},{"sys":40041},{"id":1740,"type":904,"linkType":905},[40043],{"data":40044,"marks":40045,"value":15108,"nodeType":865},{},[],{"data":40047,"marks":40048,"value":39626,"nodeType":865},{},[],{"data":40050,"content":40051,"nodeType":866},{},[40052],{"data":40053,"marks":40054,"value":39633,"nodeType":865},{},[],{"data":40056,"content":40057,"nodeType":866},{},[40058],{"data":40059,"marks":40060,"value":39640,"nodeType":865},{},[],{"data":40062,"content":40063,"nodeType":948},{},[40064],{"data":40065,"marks":40066,"value":39647,"nodeType":865},{},[],{"data":40068,"content":40069,"nodeType":866},{},[40070],{"data":40071,"marks":40072,"value":39654,"nodeType":865},{},[],{"data":40074,"content":40075,"nodeType":866},{},[40076,40079,40085],{"data":40077,"marks":40078,"value":39661,"nodeType":865},{},[],{"data":40080,"content":40081,"nodeType":1102},{"uri":39664},[40082],{"data":40083,"marks":40084,"value":39669,"nodeType":865},{},[],{"data":40086,"marks":40087,"value":1151,"nodeType":865},{},[],{"data":40089,"content":40090,"nodeType":948},{},[40091],{"data":40092,"marks":40093,"value":6796,"nodeType":865},{},[],{"data":40095,"content":40096,"nodeType":866},{},[40097,40100,40106],{"data":40098,"marks":40099,"value":13704,"nodeType":865},{},[],{"data":40101,"content":40102,"nodeType":1102},{"uri":10028},[40103],{"data":40104,"marks":40105,"value":11104,"nodeType":865},{},[],{"data":40107,"marks":40108,"value":35341,"nodeType":865},{},[],{"entries":40110},{"inline":40111,"hyperlink":40112,"block":40127},[],[40113,40115,40117,40119,40123,40125],{"sys":40114,"__typename":2239,"title":36176,"slug":36179},{"id":35357},{"sys":40116,"__typename":2239,"title":32414,"slug":32417},{"id":29472},{"sys":40118,"__typename":2256,"title":2257,"slug":2258,"articleId":2259},{"id":1483},{"sys":40120,"__typename":2239,"title":40121,"slug":40122},{"id":27526},"Introducing SSO Password Protection: Stop employees’ IdP credentials being exposed or phished","introducing-sso-password-protection",{"sys":40124,"__typename":3313,"linkedFromParent":59,"title":34799,"slug":34800,"audience":3316},{"id":32563},{"sys":40126,"__typename":2256,"title":2277,"slug":2278,"articleId":2279},{"id":1740},[40128,40136,40140,40143],{"sys":40129,"__typename":34820,"title":40130,"youTubeUrl":40131,"imagePlaceholder":40132},{"id":39301},"Introducing phishing toolkit detection with Push: Detect AitM and BitM toolkits","https://www.youtube.com/watch?v=em8H0VOezqM",{"url":40133,"width":40134,"height":40135},"https://images.ctfassets.net/y1cdw1ablpvd/44uW8syU7RcxSx5kI2y0yO/469cb925808f74196b57b6ae209888de/Screenshot_2024-08-15_at_07.11.23.png",3372,1898,{"sys":40137,"__typename":4959,"type":4960,"ctaText":40138,"buttonLabel":40139,"buttonColour":14691,"buttonUrl":24992},{"id":39462},"Learn more about AitM phishing toolkits in our on-demand webinar","Watch Now",{"sys":40141,"__typename":2366,"title":27366,"caption":27367,"layoutMode":59,"file":40142},{"id":27111},{"url":27369,"width":12338,"height":27370},{"sys":40144,"__typename":2366,"title":40145,"caption":59,"layoutMode":59,"file":40146},{"id":39606},"Evilginx and EvilnoVNC",{"url":40147,"width":40148,"height":3349},"https://images.ctfassets.net/y1cdw1ablpvd/5x785N81GKYzByJoSNIYE0/12da45107348238316b9c5d6350b9d05/Image1__4_-min.png",1336,{"items":40150},[],{},"Detect and block phishing tools with the Push browser agent",{"items":40154},[40155,40881,41268],{"__typename":2239,"sys":40156,"content":40157,"title":36176,"synopsis":36177,"hashTags":59,"publishedDate":36178,"slug":36179,"tagsCollection":40871,"authorsCollection":40877},{"id":35357},{"json":40158},{"data":40159,"content":40160,"nodeType":2232},{},[40161,40167,40173,40179,40185,40191,40197,40203,40209,40215,40220,40226,40232,40238,40284,40290,40296,40312,40318,40324,40330,40356,40369,40375,40381,40387,40393,40399,40405,40421,40437,40535,40541,40557,40563,40569,40575,40580,40586,40592,40598,40624,40630,40636,40666,40672,40678,40760,40775,40781,40787,40793,40799,40845,40851,40854,40860,40865],{"data":40162,"content":40163,"nodeType":866},{},[40164],{"data":40165,"marks":40166,"value":35368,"nodeType":865},{},[],{"data":40168,"content":40169,"nodeType":866},{},[40170],{"data":40171,"marks":40172,"value":35375,"nodeType":865},{},[],{"data":40174,"content":40175,"nodeType":866},{},[40176],{"data":40177,"marks":40178,"value":35382,"nodeType":865},{},[],{"data":40180,"content":40181,"nodeType":948},{},[40182],{"data":40183,"marks":40184,"value":35389,"nodeType":865},{},[],{"data":40186,"content":40187,"nodeType":866},{},[40188],{"data":40189,"marks":40190,"value":35396,"nodeType":865},{},[],{"data":40192,"content":40193,"nodeType":866},{},[40194],{"data":40195,"marks":40196,"value":35403,"nodeType":865},{},[],{"data":40198,"content":40199,"nodeType":866},{},[40200],{"data":40201,"marks":40202,"value":35410,"nodeType":865},{},[],{"data":40204,"content":40205,"nodeType":866},{},[40206],{"data":40207,"marks":40208,"value":35417,"nodeType":865},{},[],{"data":40210,"content":40211,"nodeType":866},{},[40212],{"data":40213,"marks":40214,"value":35424,"nodeType":865},{},[],{"data":40216,"content":40219,"nodeType":907},{"target":40217},{"sys":40218},{"id":35429,"type":904,"linkType":905},[],{"data":40221,"content":40222,"nodeType":1218},{},[40223],{"data":40224,"marks":40225,"value":35437,"nodeType":865},{},[],{"data":40227,"content":40228,"nodeType":866},{},[40229],{"data":40230,"marks":40231,"value":35444,"nodeType":865},{},[],{"data":40233,"content":40234,"nodeType":866},{},[40235],{"data":40236,"marks":40237,"value":35451,"nodeType":865},{},[],{"data":40239,"content":40240,"nodeType":866},{},[40241,40244,40251,40254,40261,40264,40271,40274,40281],{"data":40242,"marks":40243,"value":35458,"nodeType":865},{},[],{"data":40245,"content":40246,"nodeType":1102},{"uri":24934},[40247],{"data":40248,"marks":40249,"value":24939,"nodeType":865},{},[40250],{"type":4537},{"data":40252,"marks":40253,"value":3531,"nodeType":865},{},[],{"data":40255,"content":40256,"nodeType":1102},{"uri":24945},[40257],{"data":40258,"marks":40259,"value":24950,"nodeType":865},{},[40260],{"type":4537},{"data":40262,"marks":40263,"value":35479,"nodeType":865},{},[],{"data":40265,"content":40266,"nodeType":1102},{"uri":24956},[40267],{"data":40268,"marks":40269,"value":24961,"nodeType":865},{},[40270],{"type":4537},{"data":40272,"marks":40273,"value":35490,"nodeType":865},{},[],{"data":40275,"content":40276,"nodeType":1102},{"uri":24967},[40277],{"data":40278,"marks":40279,"value":24972,"nodeType":865},{},[40280],{"type":4537},{"data":40282,"marks":40283,"value":1151,"nodeType":865},{},[],{"data":40285,"content":40286,"nodeType":866},{},[40287],{"data":40288,"marks":40289,"value":35507,"nodeType":865},{},[],{"data":40291,"content":40292,"nodeType":866},{},[40293],{"data":40294,"marks":40295,"value":35514,"nodeType":865},{},[],{"data":40297,"content":40298,"nodeType":866},{},[40299,40302,40309],{"data":40300,"marks":40301,"value":35521,"nodeType":865},{},[],{"data":40303,"content":40304,"nodeType":1102},{"uri":35524},[40305],{"data":40306,"marks":40307,"value":35530,"nodeType":865},{},[40308],{"type":4537},{"data":40310,"marks":40311,"value":6360,"nodeType":865},{},[],{"data":40313,"content":40314,"nodeType":1218},{},[40315],{"data":40316,"marks":40317,"value":35540,"nodeType":865},{},[],{"data":40319,"content":40320,"nodeType":866},{},[40321],{"data":40322,"marks":40323,"value":35547,"nodeType":865},{},[],{"data":40325,"content":40326,"nodeType":866},{},[40327],{"data":40328,"marks":40329,"value":35554,"nodeType":865},{},[],{"data":40331,"content":40332,"nodeType":866},{},[40333,40336,40343,40346,40353],{"data":40334,"marks":40335,"value":35561,"nodeType":865},{},[],{"data":40337,"content":40338,"nodeType":1102},{"uri":35564},[40339],{"data":40340,"marks":40341,"value":35570,"nodeType":865},{},[40342],{"type":4537},{"data":40344,"marks":40345,"value":35574,"nodeType":865},{},[],{"data":40347,"content":40348,"nodeType":1102},{"uri":35577},[40349],{"data":40350,"marks":40351,"value":35583,"nodeType":865},{},[40352],{"type":4537},{"data":40354,"marks":40355,"value":35587,"nodeType":865},{},[],{"data":40357,"content":40358,"nodeType":866},{},[40359,40362,40366],{"data":40360,"marks":40361,"value":35594,"nodeType":865},{},[],{"data":40363,"marks":40364,"value":35599,"nodeType":865},{},[40365],{"type":946},{"data":40367,"marks":40368,"value":35603,"nodeType":865},{},[],{"data":40370,"content":40371,"nodeType":866},{},[40372],{"data":40373,"marks":40374,"value":35610,"nodeType":865},{},[],{"data":40376,"content":40377,"nodeType":866},{},[40378],{"data":40379,"marks":40380,"value":35617,"nodeType":865},{},[],{"data":40382,"content":40383,"nodeType":948},{},[40384],{"data":40385,"marks":40386,"value":35624,"nodeType":865},{},[],{"data":40388,"content":40389,"nodeType":866},{},[40390],{"data":40391,"marks":40392,"value":35631,"nodeType":865},{},[],{"data":40394,"content":40395,"nodeType":866},{},[40396],{"data":40397,"marks":40398,"value":35638,"nodeType":865},{},[],{"data":40400,"content":40401,"nodeType":866},{},[40402],{"data":40403,"marks":40404,"value":35645,"nodeType":865},{},[],{"data":40406,"content":40407,"nodeType":866},{},[40408,40411,40418],{"data":40409,"marks":40410,"value":35652,"nodeType":865},{},[],{"data":40412,"content":40413,"nodeType":1102},{"uri":35655},[40414],{"data":40415,"marks":40416,"value":35661,"nodeType":865},{},[40417],{"type":4537},{"data":40419,"marks":40420,"value":35665,"nodeType":865},{},[],{"data":40422,"content":40423,"nodeType":866},{},[40424,40427,40434],{"data":40425,"marks":40426,"value":35672,"nodeType":865},{},[],{"data":40428,"content":40429,"nodeType":1102},{"uri":22038},[40430],{"data":40431,"marks":40432,"value":35680,"nodeType":865},{},[40433],{"type":4537},{"data":40435,"marks":40436,"value":35684,"nodeType":865},{},[],{"data":40438,"content":40439,"nodeType":891},{},[40440,40459,40478,40497,40516],{"data":40441,"content":40442,"nodeType":880},{},[40443],{"data":40444,"content":40445,"nodeType":866},{},[40446,40449,40456],{"data":40447,"marks":40448,"value":21,"nodeType":865},{},[],{"data":40450,"content":40451,"nodeType":1102},{"uri":6472},[40452],{"data":40453,"marks":40454,"value":35704,"nodeType":865},{},[40455],{"type":4537},{"data":40457,"marks":40458,"value":21,"nodeType":865},{},[],{"data":40460,"content":40461,"nodeType":880},{},[40462],{"data":40463,"content":40464,"nodeType":866},{},[40465,40468,40475],{"data":40466,"marks":40467,"value":21,"nodeType":865},{},[],{"data":40469,"content":40470,"nodeType":1102},{"uri":35719},[40471],{"data":40472,"marks":40473,"value":35725,"nodeType":865},{},[40474],{"type":4537},{"data":40476,"marks":40477,"value":21,"nodeType":865},{},[],{"data":40479,"content":40480,"nodeType":880},{},[40481],{"data":40482,"content":40483,"nodeType":866},{},[40484,40487,40494],{"data":40485,"marks":40486,"value":21,"nodeType":865},{},[],{"data":40488,"content":40489,"nodeType":1102},{"uri":5377},[40490],{"data":40491,"marks":40492,"value":35745,"nodeType":865},{},[40493],{"type":4537},{"data":40495,"marks":40496,"value":21,"nodeType":865},{},[],{"data":40498,"content":40499,"nodeType":880},{},[40500],{"data":40501,"content":40502,"nodeType":866},{},[40503,40506,40513],{"data":40504,"marks":40505,"value":21,"nodeType":865},{},[],{"data":40507,"content":40508,"nodeType":1102},{"uri":26442},[40509],{"data":40510,"marks":40511,"value":35765,"nodeType":865},{},[40512],{"type":4537},{"data":40514,"marks":40515,"value":21,"nodeType":865},{},[],{"data":40517,"content":40518,"nodeType":880},{},[40519],{"data":40520,"content":40521,"nodeType":866},{},[40522,40525,40532],{"data":40523,"marks":40524,"value":21,"nodeType":865},{},[],{"data":40526,"content":40527,"nodeType":1102},{"uri":17081},[40528],{"data":40529,"marks":40530,"value":35785,"nodeType":865},{},[40531],{"type":4537},{"data":40533,"marks":40534,"value":21,"nodeType":865},{},[],{"data":40536,"content":40537,"nodeType":866},{},[40538],{"data":40539,"marks":40540,"value":35795,"nodeType":865},{},[],{"data":40542,"content":40543,"nodeType":866},{},[40544,40547,40554],{"data":40545,"marks":40546,"value":35802,"nodeType":865},{},[],{"data":40548,"content":40549,"nodeType":1102},{"uri":26686},[40550],{"data":40551,"marks":40552,"value":14104,"nodeType":865},{},[40553],{"type":4537},{"data":40555,"marks":40556,"value":35813,"nodeType":865},{},[],{"data":40558,"content":40559,"nodeType":948},{},[40560],{"data":40561,"marks":40562,"value":35820,"nodeType":865},{},[],{"data":40564,"content":40565,"nodeType":866},{},[40566],{"data":40567,"marks":40568,"value":35827,"nodeType":865},{},[],{"data":40570,"content":40571,"nodeType":866},{},[40572],{"data":40573,"marks":40574,"value":35834,"nodeType":865},{},[],{"data":40576,"content":40579,"nodeType":907},{"target":40577},{"sys":40578},{"id":35839,"type":904,"linkType":905},[],{"data":40581,"content":40582,"nodeType":866},{},[40583],{"data":40584,"marks":40585,"value":35847,"nodeType":865},{},[],{"data":40587,"content":40588,"nodeType":948},{},[40589],{"data":40590,"marks":40591,"value":35854,"nodeType":865},{},[],{"data":40593,"content":40594,"nodeType":866},{},[40595],{"data":40596,"marks":40597,"value":35861,"nodeType":865},{},[],{"data":40599,"content":40600,"nodeType":866},{},[40601,40604,40614,40617,40621],{"data":40602,"marks":40603,"value":35868,"nodeType":865},{},[],{"data":40605,"content":40606,"nodeType":1102},{"uri":32488},[40607,40611],{"data":40608,"marks":40609,"value":35876,"nodeType":865},{},[40610],{"type":4537},{"data":40612,"marks":40613,"value":5804,"nodeType":865},{},[],{"data":40615,"marks":40616,"value":35883,"nodeType":865},{},[],{"data":40618,"marks":40619,"value":35888,"nodeType":865},{},[40620],{"type":946},{"data":40622,"marks":40623,"value":35892,"nodeType":865},{},[],{"data":40625,"content":40626,"nodeType":948},{},[40627],{"data":40628,"marks":40629,"value":35899,"nodeType":865},{},[],{"data":40631,"content":40632,"nodeType":866},{},[40633],{"data":40634,"marks":40635,"value":35906,"nodeType":865},{},[],{"data":40637,"content":40638,"nodeType":891},{},[40639,40648,40657],{"data":40640,"content":40641,"nodeType":880},{},[40642],{"data":40643,"content":40644,"nodeType":866},{},[40645],{"data":40646,"marks":40647,"value":35919,"nodeType":865},{},[],{"data":40649,"content":40650,"nodeType":880},{},[40651],{"data":40652,"content":40653,"nodeType":866},{},[40654],{"data":40655,"marks":40656,"value":35929,"nodeType":865},{},[],{"data":40658,"content":40659,"nodeType":880},{},[40660],{"data":40661,"content":40662,"nodeType":866},{},[40663],{"data":40664,"marks":40665,"value":35939,"nodeType":865},{},[],{"data":40667,"content":40668,"nodeType":948},{},[40669],{"data":40670,"marks":40671,"value":35946,"nodeType":865},{},[],{"data":40673,"content":40674,"nodeType":866},{},[40675],{"data":40676,"marks":40677,"value":35953,"nodeType":865},{},[],{"data":40679,"content":40680,"nodeType":891},{},[40681,40694,40724,40747],{"data":40682,"content":40683,"nodeType":880},{},[40684],{"data":40685,"content":40686,"nodeType":866},{},[40687,40691],{"data":40688,"marks":40689,"value":35967,"nodeType":865},{},[40690],{"type":946},{"data":40692,"marks":40693,"value":35971,"nodeType":865},{},[],{"data":40695,"content":40696,"nodeType":880},{},[40697],{"data":40698,"content":40699,"nodeType":866},{},[40700,40704,40707,40711,40714,40721],{"data":40701,"marks":40702,"value":35982,"nodeType":865},{},[40703],{"type":946},{"data":40705,"marks":40706,"value":6192,"nodeType":865},{},[],{"data":40708,"marks":40709,"value":35990,"nodeType":865},{},[40710],{"type":946},{"data":40712,"marks":40713,"value":35994,"nodeType":865},{},[],{"data":40715,"content":40716,"nodeType":1102},{"uri":35997},[40717],{"data":40718,"marks":40719,"value":36003,"nodeType":865},{},[40720],{"type":4537},{"data":40722,"marks":40723,"value":21,"nodeType":865},{},[],{"data":40725,"content":40726,"nodeType":880},{},[40727],{"data":40728,"content":40729,"nodeType":866},{},[40730,40734,40737,40744],{"data":40731,"marks":40732,"value":36017,"nodeType":865},{},[40733],{"type":946},{"data":40735,"marks":40736,"value":36021,"nodeType":865},{},[],{"data":40738,"content":40739,"nodeType":1102},{"uri":36024},[40740],{"data":40741,"marks":40742,"value":36030,"nodeType":865},{},[40743],{"type":4537},{"data":40745,"marks":40746,"value":36034,"nodeType":865},{},[],{"data":40748,"content":40749,"nodeType":880},{},[40750],{"data":40751,"content":40752,"nodeType":866},{},[40753,40757],{"data":40754,"marks":40755,"value":36045,"nodeType":865},{},[40756],{"type":946},{"data":40758,"marks":40759,"value":36049,"nodeType":865},{},[],{"data":40761,"content":40762,"nodeType":866},{},[40763,40766,40772],{"data":40764,"marks":40765,"value":36056,"nodeType":865},{},[],{"data":40767,"content":40768,"nodeType":1102},{"uri":7395},[40769],{"data":40770,"marks":40771,"value":36063,"nodeType":865},{},[],{"data":40773,"marks":40774,"value":1677,"nodeType":865},{},[],{"data":40776,"content":40777,"nodeType":948},{},[40778],{"data":40779,"marks":40780,"value":6758,"nodeType":865},{},[],{"data":40782,"content":40783,"nodeType":866},{},[40784],{"data":40785,"marks":40786,"value":36079,"nodeType":865},{},[],{"data":40788,"content":40789,"nodeType":866},{},[40790],{"data":40791,"marks":40792,"value":36086,"nodeType":865},{},[],{"data":40794,"content":40795,"nodeType":866},{},[40796],{"data":40797,"marks":40798,"value":36093,"nodeType":865},{},[],{"data":40800,"content":40801,"nodeType":866},{},[40802,40805,40812,40815,40822,40825,40832,40835,40842],{"data":40803,"marks":40804,"value":36100,"nodeType":865},{},[],{"data":40806,"content":40807,"nodeType":1102},{"uri":29047},[40808],{"data":40809,"marks":40810,"value":29053,"nodeType":865},{},[40811],{"type":4537},{"data":40813,"marks":40814,"value":1773,"nodeType":865},{},[],{"data":40816,"content":40817,"nodeType":1102},{"uri":29059},[40818],{"data":40819,"marks":40820,"value":36118,"nodeType":865},{},[40821],{"type":4537},{"data":40823,"marks":40824,"value":36122,"nodeType":865},{},[],{"data":40826,"content":40827,"nodeType":1102},{"uri":14098},[40828],{"data":40829,"marks":40830,"value":36130,"nodeType":865},{},[40831],{"type":4537},{"data":40833,"marks":40834,"value":36134,"nodeType":865},{},[],{"data":40836,"content":40837,"nodeType":1102},{"uri":36137},[40838],{"data":40839,"marks":40840,"value":36143,"nodeType":865},{},[40841],{"type":4537},{"data":40843,"marks":40844,"value":36147,"nodeType":865},{},[],{"data":40846,"content":40847,"nodeType":866},{},[40848],{"data":40849,"marks":40850,"value":36154,"nodeType":865},{},[],{"data":40852,"content":40853,"nodeType":938},{},[],{"data":40855,"content":40856,"nodeType":866},{},[40857],{"data":40858,"marks":40859,"value":36164,"nodeType":865},{},[],{"data":40861,"content":40864,"nodeType":907},{"target":40862},{"sys":40863},{"id":35429,"type":904,"linkType":905},[],{"data":40866,"content":40867,"nodeType":866},{},[40868],{"data":40869,"marks":40870,"value":21,"nodeType":865},{},[],{"items":40872},[40873,40875],{"sys":40874,"name":2524},{"id":2523},{"sys":40876,"name":342},{"id":2527},{"items":40878},[40879],{"fullName":11808,"firstName":11809,"jobTitle":11810,"profilePicture":40880},{"url":11812},{"__typename":2239,"sys":40882,"content":40883,"title":27821,"synopsis":27822,"hashTags":59,"publishedDate":27823,"slug":27824,"tagsCollection":41260,"authorsCollection":41264},{"id":27395},{"json":40884},{"data":40885,"content":40886,"nodeType":2232},{},[40887,40893,40950,40956,40969,40982,40988,40993,41010,41016,41029,41035,41040,41057,41063,41083,41096,41113,41119,41132,41145,41150,41167,41173,41193,41198,41215,41221,41245],{"data":40888,"content":40889,"nodeType":1218},{},[40890],{"data":40891,"marks":40892,"value":3372,"nodeType":865},{},[],{"data":40894,"content":40895,"nodeType":891},{},[40896,40905,40914,40923,40932,40941],{"data":40897,"content":40898,"nodeType":880},{},[40899],{"data":40900,"content":40901,"nodeType":866},{},[40902],{"data":40903,"marks":40904,"value":15108,"nodeType":865},{},[],{"data":40906,"content":40907,"nodeType":880},{},[40908],{"data":40909,"content":40910,"nodeType":866},{},[40911],{"data":40912,"marks":40913,"value":19926,"nodeType":865},{},[],{"data":40915,"content":40916,"nodeType":880},{},[40917],{"data":40918,"content":40919,"nodeType":866},{},[40920],{"data":40921,"marks":40922,"value":27436,"nodeType":865},{},[],{"data":40924,"content":40925,"nodeType":880},{},[40926],{"data":40927,"content":40928,"nodeType":866},{},[40929],{"data":40930,"marks":40931,"value":20770,"nodeType":865},{},[],{"data":40933,"content":40934,"nodeType":880},{},[40935],{"data":40936,"content":40937,"nodeType":866},{},[40938],{"data":40939,"marks":40940,"value":27455,"nodeType":865},{},[],{"data":40942,"content":40943,"nodeType":880},{},[40944],{"data":40945,"content":40946,"nodeType":866},{},[40947],{"data":40948,"marks":40949,"value":27465,"nodeType":865},{},[],{"data":40951,"content":40952,"nodeType":1218},{},[40953],{"data":40954,"marks":40955,"value":27472,"nodeType":865},{},[],{"data":40957,"content":40958,"nodeType":866},{},[40959,40962,40966],{"data":40960,"marks":40961,"value":27479,"nodeType":865},{},[],{"data":40963,"marks":40964,"value":27484,"nodeType":865},{},[40965],{"type":946},{"data":40967,"marks":40968,"value":27488,"nodeType":865},{},[],{"data":40970,"content":40971,"nodeType":866},{},[40972,40975,40979],{"data":40973,"marks":40974,"value":4693,"nodeType":865},{},[],{"data":40976,"marks":40977,"value":15108,"nodeType":865},{},[40978],{"type":946},{"data":40980,"marks":40981,"value":27502,"nodeType":865},{},[],{"data":40983,"content":40984,"nodeType":866},{},[40985],{"data":40986,"marks":40987,"value":27509,"nodeType":865},{},[],{"data":40989,"content":40992,"nodeType":907},{"target":40990},{"sys":40991},{"id":27514,"type":904,"linkType":905},[],{"data":40994,"content":40995,"nodeType":866},{},[40996,40999,41007],{"data":40997,"marks":40998,"value":21,"nodeType":865},{},[],{"data":41000,"content":41003,"nodeType":1038},{"target":41001},{"sys":41002},{"id":27526,"type":904,"linkType":905},[41004],{"data":41005,"marks":41006,"value":27531,"nodeType":865},{},[],{"data":41008,"marks":41009,"value":21,"nodeType":865},{},[],{"data":41011,"content":41012,"nodeType":1218},{},[41013],{"data":41014,"marks":41015,"value":27541,"nodeType":865},{},[],{"data":41017,"content":41018,"nodeType":866},{},[41019,41022,41026],{"data":41020,"marks":41021,"value":27548,"nodeType":865},{},[],{"data":41023,"marks":41024,"value":27553,"nodeType":865},{},[41025],{"type":946},{"data":41027,"marks":41028,"value":27557,"nodeType":865},{},[],{"data":41030,"content":41031,"nodeType":866},{},[41032],{"data":41033,"marks":41034,"value":27564,"nodeType":865},{},[],{"data":41036,"content":41039,"nodeType":907},{"target":41037},{"sys":41038},{"id":27569,"type":904,"linkType":905},[],{"data":41041,"content":41042,"nodeType":866},{},[41043,41046,41054],{"data":41044,"marks":41045,"value":21,"nodeType":865},{},[],{"data":41047,"content":41050,"nodeType":1038},{"target":41048},{"sys":41049},{"id":1483,"type":904,"linkType":905},[41051],{"data":41052,"marks":41053,"value":2777,"nodeType":865},{},[],{"data":41055,"marks":41056,"value":21,"nodeType":865},{},[],{"data":41058,"content":41059,"nodeType":1218},{},[41060],{"data":41061,"marks":41062,"value":27594,"nodeType":865},{},[],{"data":41064,"content":41065,"nodeType":866},{},[41066,41069,41073,41076,41080],{"data":41067,"marks":41068,"value":27601,"nodeType":865},{},[],{"data":41070,"marks":41071,"value":27606,"nodeType":865},{},[41072],{"type":946},{"data":41074,"marks":41075,"value":27610,"nodeType":865},{},[],{"data":41077,"marks":41078,"value":27615,"nodeType":865},{},[41079],{"type":946},{"data":41081,"marks":41082,"value":27619,"nodeType":865},{},[],{"data":41084,"content":41085,"nodeType":866},{},[41086,41089,41093],{"data":41087,"marks":41088,"value":27626,"nodeType":865},{},[],{"data":41090,"marks":41091,"value":27631,"nodeType":865},{},[41092],{"type":946},{"data":41094,"marks":41095,"value":1151,"nodeType":865},{},[],{"data":41097,"content":41098,"nodeType":866},{},[41099,41102,41110],{"data":41100,"marks":41101,"value":21,"nodeType":865},{},[],{"data":41103,"content":41106,"nodeType":1038},{"target":41104},{"sys":41105},{"id":13505,"type":904,"linkType":905},[41107],{"data":41108,"marks":41109,"value":27531,"nodeType":865},{},[],{"data":41111,"marks":41112,"value":21,"nodeType":865},{},[],{"data":41114,"content":41115,"nodeType":1218},{},[41116],{"data":41117,"marks":41118,"value":27658,"nodeType":865},{},[],{"data":41120,"content":41121,"nodeType":866},{},[41122,41125,41129],{"data":41123,"marks":41124,"value":27665,"nodeType":865},{},[],{"data":41126,"marks":41127,"value":20770,"nodeType":865},{},[41128],{"type":946},{"data":41130,"marks":41131,"value":27673,"nodeType":865},{},[],{"data":41133,"content":41134,"nodeType":866},{},[41135,41138,41142],{"data":41136,"marks":41137,"value":27680,"nodeType":865},{},[],{"data":41139,"marks":41140,"value":27685,"nodeType":865},{},[41141],{"type":946},{"data":41143,"marks":41144,"value":27689,"nodeType":865},{},[],{"data":41146,"content":41149,"nodeType":907},{"target":41147},{"sys":41148},{"id":27694,"type":904,"linkType":905},[],{"data":41151,"content":41152,"nodeType":866},{},[41153,41156,41164],{"data":41154,"marks":41155,"value":21,"nodeType":865},{},[],{"data":41157,"content":41160,"nodeType":1038},{"target":41158},{"sys":41159},{"id":27706,"type":904,"linkType":905},[41161],{"data":41162,"marks":41163,"value":2777,"nodeType":865},{},[],{"data":41165,"marks":41166,"value":21,"nodeType":865},{},[],{"data":41168,"content":41169,"nodeType":1218},{},[41170],{"data":41171,"marks":41172,"value":27720,"nodeType":865},{},[],{"data":41174,"content":41175,"nodeType":866},{},[41176,41179,41183,41186,41190],{"data":41177,"marks":41178,"value":27727,"nodeType":865},{},[],{"data":41180,"marks":41181,"value":20817,"nodeType":865},{},[41182],{"type":946},{"data":41184,"marks":41185,"value":27735,"nodeType":865},{},[],{"data":41187,"marks":41188,"value":27740,"nodeType":865},{},[41189],{"type":946},{"data":41191,"marks":41192,"value":27744,"nodeType":865},{},[],{"data":41194,"content":41197,"nodeType":907},{"target":41195},{"sys":41196},{"id":27749,"type":904,"linkType":905},[],{"data":41199,"content":41200,"nodeType":866},{},[41201,41204,41212],{"data":41202,"marks":41203,"value":21,"nodeType":865},{},[],{"data":41205,"content":41208,"nodeType":1038},{"target":41206},{"sys":41207},{"id":1802,"type":904,"linkType":905},[41209],{"data":41210,"marks":41211,"value":2777,"nodeType":865},{},[],{"data":41213,"marks":41214,"value":21,"nodeType":865},{},[],{"data":41216,"content":41217,"nodeType":1218},{},[41218],{"data":41219,"marks":41220,"value":27774,"nodeType":865},{},[],{"data":41222,"content":41223,"nodeType":866},{},[41224,41227,41231,41234,41242],{"data":41225,"marks":41226,"value":27781,"nodeType":865},{},[],{"data":41228,"marks":41229,"value":27786,"nodeType":865},{},[41230],{"type":946},{"data":41232,"marks":41233,"value":27790,"nodeType":865},{},[],{"data":41235,"content":41238,"nodeType":1038},{"target":41236},{"sys":41237},{"id":27795,"type":904,"linkType":905},[41239],{"data":41240,"marks":41241,"value":27800,"nodeType":865},{},[],{"data":41243,"marks":41244,"value":27804,"nodeType":865},{},[],{"data":41246,"content":41247,"nodeType":866},{},[41248,41251,41257],{"data":41249,"marks":41250,"value":21,"nodeType":865},{},[],{"data":41252,"content":41253,"nodeType":1102},{"uri":24833},[41254],{"data":41255,"marks":41256,"value":2777,"nodeType":865},{},[],{"data":41258,"marks":41259,"value":27820,"nodeType":865},{},[],{"items":41261},[41262],{"sys":41263,"name":3915},{"id":3914},{"items":41265},[41266],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":41267},{"url":2577},{"__typename":2239,"sys":41269,"content":41270,"title":40121,"synopsis":41797,"hashTags":59,"publishedDate":41798,"slug":40122,"tagsCollection":41799,"authorsCollection":41805},{"id":27526},{"json":41271},{"data":41272,"content":41273,"nodeType":2232},{},[41274,41280,41286,41293,41300,41315,41348,41355,41363,41368,41383,41391,41397,41404,41411,41418,41425,41433,41440,41455,41471,41476,41483,41501,41520,41527,41550,41557,41580,41596,41603,41622,41629,41702,41709,41725,41732,41739,41746,41753,41769,41775,41781],{"data":41275,"content":41276,"nodeType":866},{},[41277],{"data":41278,"marks":41279,"value":21,"nodeType":865},{},[],{"data":41281,"content":41285,"nodeType":907},{"target":41282},{"sys":41283},{"id":41284,"type":904,"linkType":905},"5cseu1Cre2FrSQrIhSFxQw",[],{"data":41287,"content":41288,"nodeType":866},{},[41289],{"data":41290,"marks":41291,"value":41292,"nodeType":865},{},[],"Reliably detecting phishing sites is like trying to hit a moving target, as malicious websites and domains emerge, get taken down, and re-emerge continuously across the sprawl of the web.",{"data":41294,"content":41295,"nodeType":866},{},[41296],{"data":41297,"marks":41298,"value":41299,"nodeType":865},{},[],"Existing phishing prevention solutions have tried to solve the problem by protecting the inbox, a common (but not the only) attack vector, or by chasing lists of known-bad domains.",{"data":41301,"content":41302,"nodeType":866},{},[41303,41307,41312],{"data":41304,"marks":41305,"value":41306,"nodeType":865},{},[],"But these approaches have ",{"data":41308,"marks":41309,"value":41311,"nodeType":865},{},[41310],{"type":946},"two major shortcomings",{"data":41313,"marks":41314,"value":3467,"nodeType":865},{},[],{"data":41316,"content":41317,"nodeType":891},{},[41318,41333],{"data":41319,"content":41320,"nodeType":880},{},[41321],{"data":41322,"content":41323,"nodeType":866},{},[41324,41329],{"data":41325,"marks":41326,"value":41328,"nodeType":865},{},[41327],{"type":946},"Lack of coverage:",{"data":41330,"marks":41331,"value":41332,"nodeType":865},{},[]," Email-based phishing prevention tools can catch general spray-and-pray email phishing campaigns, but it only takes a small amount of tailoring to fly under their radar. The use of LLM tools to tailor phishing emails for their intended victims already makes this possible at scale. Email-based tools also fail to cover phishing attacks beyond the inbox, such as Slack and Teams phishing.",{"data":41334,"content":41335,"nodeType":880},{},[41336],{"data":41337,"content":41338,"nodeType":866},{},[41339,41344],{"data":41340,"marks":41341,"value":41343,"nodeType":865},{},[41342],{"type":946},"Expired intel:",{"data":41345,"marks":41346,"value":41347,"nodeType":865},{},[]," Tools that rely on known-bad domains always have an incomplete picture because a domain must be reported as malicious in order to get added to a blocklist. Meanwhile, attackers can spin up new sites or host phishing pages on existing sites by exploiting vulnerabilities in them, bypassing rules around preventing visits to newly registered domains. ",{"data":41349,"content":41350,"nodeType":866},{},[41351],{"data":41352,"marks":41353,"value":41354,"nodeType":865},{},[],"Using Push’s unique vantage point in the browser, we set out to attack this problem from a new angle. ",{"data":41356,"content":41357,"nodeType":866},{},[41358],{"data":41359,"marks":41360,"value":41362,"nodeType":865},{},[41361],{"type":946},"Instead of trying to detect phishing websites and domains that constantly change, we can now detect (and block!) phishing attempts based on directly observing user behavior in the browser.",{"data":41364,"content":41367,"nodeType":907},{"target":41365},{"sys":41366},{"id":38744,"type":904,"linkType":905},[],{"data":41369,"content":41370,"nodeType":866},{},[41371,41375,41379],{"data":41372,"marks":41373,"value":41374,"nodeType":865},{},[],"Our latest feature, ",{"data":41376,"marks":41377,"value":15108,"nodeType":865},{},[41378],{"type":946},{"data":41380,"marks":41381,"value":41382,"nodeType":865},{},[],", detects and blocks when a user enters their identity provider password on a webpage that does not belong to the IdP (e.g Okta, Google Workspace, Microsoft 365, etc.).",{"data":41384,"content":41385,"nodeType":866},{},[41386],{"data":41387,"marks":41388,"value":41390,"nodeType":865},{},[41389],{"type":946},"This means that even if that employee was the first person to get phished using a new attacker site, Push still detects it and blocks it.",{"data":41392,"content":41396,"nodeType":907},{"target":41393},{"sys":41394},{"id":41395,"type":904,"linkType":905},"4eCSQGec7mozFLDucNMO7m",[],{"data":41398,"content":41399,"nodeType":1218},{},[41400],{"data":41401,"marks":41402,"value":41403,"nodeType":865},{},[],"How does it work?",{"data":41405,"content":41406,"nodeType":866},{},[41407],{"data":41408,"marks":41409,"value":41410,"nodeType":865},{},[],"Instead of detecting a phishing page based on a known-bad signature, the Push browser agent dynamically inspects user behavior and the attributes of the page itself.",{"data":41412,"content":41413,"nodeType":866},{},[41414],{"data":41415,"marks":41416,"value":41417,"nodeType":865},{},[],"The browser agent works by observing all logins and generating a salted partial hash of the user’s password, known as a fingerprint. This fingerprint is then stored locally to allow Push to perform comparisons. ",{"data":41419,"content":41420,"nodeType":866},{},[41421],{"data":41422,"marks":41423,"value":41424,"nodeType":865},{},[],"To detect potential phishing attacks, the browser agent compares the observed password fingerprint to known fingerprints for identity provider passwords that already exist in local storage. ",{"data":41426,"content":41427,"nodeType":866},{},[41428],{"data":41429,"marks":41430,"value":41432,"nodeType":865},{},[41431],{"type":946},"If an employee enters a known IdP password on a webpage that Push doesn’t recognize, Push blocks it. ",{"data":41434,"content":41435,"nodeType":866},{},[41436],{"data":41437,"marks":41438,"value":41439,"nodeType":865},{},[],"Once you’ve discovered a malicious site, use Push’s companion feature, URL blocking, to add the domain to a blocklist and prevent your other end-users from visiting the site. ",{"data":41441,"content":41442,"nodeType":866},{},[41443,41446,41452],{"data":41444,"marks":41445,"value":24830,"nodeType":865},{},[],{"data":41447,"content":41448,"nodeType":1102},{"uri":24833},[41449],{"data":41450,"marks":41451,"value":17844,"nodeType":865},{},[],{"data":41453,"marks":41454,"value":24841,"nodeType":865},{},[],{"data":41456,"content":41457,"nodeType":866},{},[41458,41462,41467],{"data":41459,"marks":41460,"value":41461,"nodeType":865},{},[],"Push administrators can configure SSO password protection in Monitor, Warn, or Block modes to first observe how often employees are re-using IdP credentials on other sites, eliminating any false positives by adding them to an ignore list, and then turning on Warn or Block to ",{"data":41463,"marks":41464,"value":41466,"nodeType":865},{},[41465],{"type":946},"show a custom message",{"data":41468,"marks":41469,"value":41470,"nodeType":865},{},[]," that either provides a speedbump for users (“Are you sure this isn’t a phishing site?”) or prevents them from logging in altogether.",{"data":41472,"content":41475,"nodeType":907},{"target":41473},{"sys":41474},{"id":27514,"type":904,"linkType":905},[],{"data":41477,"content":41478,"nodeType":866},{},[41479],{"data":41480,"marks":41481,"value":41482,"nodeType":865},{},[],"Supported identity providers include Okta, Microsoft 365, Google Workspace, JumpCloud, Duo and Ping Identity. ",{"data":41484,"content":41485,"nodeType":866},{},[41486,41490,41497],{"data":41487,"marks":41488,"value":41489,"nodeType":865},{},[],"You can also ",{"data":41491,"content":41492,"nodeType":1102},{"uri":13248},[41493],{"data":41494,"marks":41495,"value":41496,"nodeType":865},{},[],"get alerted",{"data":41498,"marks":41499,"value":41500,"nodeType":865},{},[]," via webhook when Push detects a suspected phishing event.",{"data":41502,"content":41503,"nodeType":866},{},[41504,41508,41517],{"data":41505,"marks":41506,"value":41507,"nodeType":865},{},[],"Learn more about how it works and the end-user experience in our ",{"data":41509,"content":41512,"nodeType":1038},{"target":41510},{"sys":41511},{"id":1740,"type":904,"linkType":905},[41513],{"data":41514,"marks":41515,"value":41516,"nodeType":865},{},[],"help article",{"data":41518,"marks":41519,"value":1151,"nodeType":865},{},[],{"data":41521,"content":41522,"nodeType":1218},{},[41523],{"data":41524,"marks":41525,"value":41526,"nodeType":865},{},[],"But what about … ",{"data":41528,"content":41529,"nodeType":866},{},[41530,41534,41538,41541,41546],{"data":41531,"marks":41532,"value":41533,"nodeType":865},{},[],"Yes, we believe ",{"data":41535,"marks":41536,"value":457,"nodeType":865},{},[41537],{"type":946},{"data":41539,"marks":41540,"value":1913,"nodeType":865},{},[],{"data":41542,"marks":41543,"value":41545,"nodeType":865},{},[41544],{"type":946},"conditional access policies",{"data":41547,"marks":41548,"value":41549,"nodeType":865},{},[]," are important parts of a defense-in-depth strategy against phishing — in addition to protecting IdP credentials directly in the browser.",{"data":41551,"content":41552,"nodeType":866},{},[41553],{"data":41554,"marks":41555,"value":41556,"nodeType":865},{},[],"Here’s why MFA and conditional access policies aren’t enough:",{"data":41558,"content":41559,"nodeType":891},{},[41560,41570],{"data":41561,"content":41562,"nodeType":880},{},[41563],{"data":41564,"content":41565,"nodeType":866},{},[41566],{"data":41567,"marks":41568,"value":41569,"nodeType":865},{},[],"MFA is not infallible and not all MFA methods are created equal. Methods such as SMS, TOTP, or even push notifications are phishable. Even if your employees are also using more phishing-resistant forms of MFA, such as WebAuthn, it’s common for accounts to use multiple MFA methods and an attacker need only target the weakest one. An attacker in possession of an SSO password also has leverage to socially engineer an authentication reset, including an MFA reset.",{"data":41571,"content":41572,"nodeType":880},{},[41573],{"data":41574,"content":41575,"nodeType":866},{},[41576],{"data":41577,"marks":41578,"value":41579,"nodeType":865},{},[],"It’s worryingly common for us to deploy Push and find that a customer’s conditional access policies aren’t implemented as they are designed to be. The most common reason is that admins have to create so many exceptions to allow for real-world situations that policies become complex and full of gaps.",{"data":41581,"content":41582,"nodeType":866},{},[41583,41587,41592],{"data":41584,"marks":41585,"value":41586,"nodeType":865},{},[],"And of course, protecting ",{"data":41588,"marks":41589,"value":41591,"nodeType":865},{},[41590],{"type":979},"all",{"data":41593,"marks":41594,"value":41595,"nodeType":865},{},[]," your organization’s passwords is important. In fact, we’re currently developing this feature further so it will do just that! We focus here on IdP passwords because they’re a higher-value target for attackers — and the frequent target of recent real-world attacks.",{"data":41597,"content":41598,"nodeType":1218},{},[41599],{"data":41600,"marks":41601,"value":41602,"nodeType":865},{},[],"Why IdP accounts?",{"data":41604,"content":41605,"nodeType":866},{},[41606,41610,41618],{"data":41607,"marks":41608,"value":41609,"nodeType":865},{},[],"IdP accounts have been targeted in several high-profile recent attacks, like those carried out by Scattered Spider against MGM resorts and in the Retool breach. You can read more about them in our ",{"data":41611,"content":41614,"nodeType":1038},{"target":41612},{"sys":41613},{"id":29472,"type":904,"linkType":905},[41615],{"data":41616,"marks":41617,"value":24566,"nodeType":865},{},[],{"data":41619,"marks":41620,"value":41621,"nodeType":865},{},[]," blog article.",{"data":41623,"content":41624,"nodeType":866},{},[41625],{"data":41626,"marks":41627,"value":41628,"nodeType":865},{},[],"In the cloud-first world, a compromised IdP account is like a compromised user workstation. It gives an attacker a solid initial foothold from which they can operate:",{"data":41630,"content":41631,"nodeType":891},{},[41632,41654],{"data":41633,"content":41634,"nodeType":880},{},[41635],{"data":41636,"content":41637,"nodeType":866},{},[41638,41642,41651],{"data":41639,"marks":41640,"value":41641,"nodeType":865},{},[],"They instantly get access to all the apps the compromised user was accessing with SSO. It’s easy to move laterally to sensitive apps or to apps where the user has admin privileges. This obviously enables an attacker to directly exfiltrate data from these apps or to use them maliciously, as in the ",{"data":41643,"content":41646,"nodeType":1038},{"target":41644},{"sys":41645},{"id":29472,"type":904,"linkType":905},[41647],{"data":41648,"marks":41649,"value":41650,"nodeType":865},{},[],"Mandiant and SEC Twitter/X breaches",{"data":41652,"marks":41653,"value":1151,"nodeType":865},{},[],{"data":41655,"content":41656,"nodeType":880},{},[41657],{"data":41658,"content":41659,"nodeType":866},{},[41660,41664,41673,41677,41686,41689,41698],{"data":41661,"marks":41662,"value":41663,"nodeType":865},{},[],"Assuming an attacker hasn’t initially gotten access to a privileged IdP account, they can escalate their privileges by performing ",{"data":41665,"content":41669,"nodeType":1038},{"target":41666},{"sys":41667},{"id":41668,"type":904,"linkType":905},"3F96pyn4qqkbVctSOH69vm",[41670],{"data":41671,"marks":41672,"value":14104,"nodeType":865},{},[],{"data":41674,"marks":41675,"value":41676,"nodeType":865},{},[]," on any low-risk app where the user is an admin or by using apps like ",{"data":41678,"content":41682,"nodeType":1038},{"target":41679},{"sys":41680},{"id":41681,"type":904,"linkType":905},"2rjLrCo6KWwLicfpV2qTOZ",[41683],{"data":41684,"marks":41685,"value":29053,"nodeType":865},{},[],{"data":41687,"marks":41688,"value":1913,"nodeType":865},{},[],{"data":41690,"content":41694,"nodeType":1038},{"target":41691},{"sys":41692},{"id":41693,"type":904,"linkType":905},"2cv7Yq1DQpm1Mho7fKDs44",[41695],{"data":41696,"marks":41697,"value":29065,"nodeType":865},{},[],{"data":41699,"marks":41700,"value":41701,"nodeType":865},{},[]," to phish higher-privilege users.",{"data":41703,"content":41704,"nodeType":1218},{},[41705],{"data":41706,"marks":41707,"value":41708,"nodeType":865},{},[],"It also protects against credential stuffing attacks",{"data":41710,"content":41711,"nodeType":866},{},[41712,41716,41721],{"data":41713,"marks":41714,"value":41715,"nodeType":865},{},[],"As well as protecting your users against phishing, the SSO password protection feature can prevent credential stuffing attacks succeeding against your IdP instance. How? By stopping your employees from reusing their SSO password on other apps.  \nPush monitors the identities of thousands of employees. Around ",{"data":41717,"marks":41718,"value":41720,"nodeType":865},{},[41719],{"type":946},"1 in 3 of them reuse passwords",{"data":41722,"marks":41723,"value":41724,"nodeType":865},{},[]," across multiple accounts. ",{"data":41726,"content":41727,"nodeType":866},{},[41728],{"data":41729,"marks":41730,"value":41731,"nodeType":865},{},[],"Employees know that their SSO password is one they’ll need to use a lot, and so they tend to choose one they know they will remember, because they are already using it successfully. That’s why we see higher levels of password reuse on IdP apps in particular.",{"data":41733,"content":41734,"nodeType":866},{},[41735],{"data":41736,"marks":41737,"value":41738,"nodeType":865},{},[],"Every time an SSO password is reused on another app, its exposure increases, along with the likelihood of it falling into the wrong hands. This can happen when another app experiences a breach and credentials are stolen. Or alternatively, when an attacker steals credentials in a phishing attack aimed at users of other apps where the password is being reused.",{"data":41740,"content":41741,"nodeType":866},{},[41742],{"data":41743,"marks":41744,"value":41745,"nodeType":865},{},[],"Armed with stolen credentials, an attacker can spray them across common cloud apps and see what additional accounts they can gain access to. IdP apps will be high on the list of cloud apps attackers will try because they provide much more in the way of access than a general SaaS user account.",{"data":41747,"content":41748,"nodeType":866},{},[41749],{"data":41750,"marks":41751,"value":41752,"nodeType":865},{},[],"You might be wondering if this feature can also be used to stop other password attacks such as password spraying and brute-forcing attacks. While this specific feature does not, Push’s other features do. ",{"data":41754,"content":41755,"nodeType":866},{},[41756,41760,41765],{"data":41757,"marks":41758,"value":41759,"nodeType":865},{},[],"These include ",{"data":41761,"marks":41762,"value":41764,"nodeType":865},{},[41763],{"type":946},"in-browser guidance",{"data":41766,"marks":41767,"value":41768,"nodeType":865},{},[]," that stops users from creating and using easily guessable passwords as well as Push’s ability to detect when employees are not registered for MFA (and whether the methods they are using are phishing-resistant or not).",{"data":41770,"content":41774,"nodeType":907},{"target":41771},{"sys":41772},{"id":41773,"type":904,"linkType":905},"uy6utpRA35spZFM7Da4Nt",[],{"data":41776,"content":41777,"nodeType":1218},{},[41778],{"data":41779,"marks":41780,"value":6796,"nodeType":865},{},[],{"data":41782,"content":41783,"nodeType":866},{},[41784,41787,41793],{"data":41785,"marks":41786,"value":13704,"nodeType":865},{},[],{"data":41788,"content":41789,"nodeType":1102},{"uri":10028},[41790],{"data":41791,"marks":41792,"value":11104,"nodeType":865},{},[],{"data":41794,"marks":41795,"value":41796,"nodeType":865},{},[],". We’ll be happy to show you this feature, along with how we discover all the apps your employees are using and how we detect vulnerable identities.","Use the Push browser agent’s unique vantage point to protect SSO credentials by blocking employees from entering their password into any other site. ","2024-04-29T00:00:00.000Z",{"items":41800},[41801,41803],{"sys":41802,"name":342},{"id":2527},{"sys":41804,"name":3915},{"id":3914},{"items":41806},[41807],{"fullName":11133,"firstName":11134,"jobTitle":851,"profilePicture":41808},{"url":11136},"blog/introducing-aitm-phishing-toolkit-detection-powered-by-the-push-browser",{"json":41811},{"data":41812,"content":41813,"nodeType":2232},{},[41814],{"data":41815,"content":41816,"nodeType":866},{},[41817],{"data":41818,"marks":41819,"value":41820,"nodeType":865},{},[],"Push analyzes behavioral attributes of malware to identify advanced phishing tools like Evilginx and NakedPages in use on websites and immediately block end-users from visiting them.",{"id":13637,"publishedAt":41822},"2026-08-12T11:57:14.270Z",{"items":41824},[41825,41827],{"sys":41826,"name":3915},{"id":3914},{"sys":41828,"name":342},{"id":2527},{"items":41830},[41831,41833,41835,41837,41839,41841,41843,41845,41847,41849,41851,41853,41855],{"sys":41832,"name":519,"slug":520,"tier":31},{"id":516},{"sys":41834,"name":279,"slug":280,"tier":31},{"id":276},{"sys":41836,"name":342,"slug":343,"tier":31},{"id":339},{"sys":41838,"name":297,"slug":298,"tier":31},{"id":294},{"sys":41840,"name":413,"slug":414,"tier":31},{"id":410},{"sys":41842,"name":261,"slug":262,"tier":45},{"id":258},{"sys":41844,"name":511,"slug":512,"tier":45},{"id":508},{"sys":41846,"name":466,"slug":467,"tier":45},{"id":463},{"sys":41848,"name":324,"slug":325,"tier":45},{"id":321},{"sys":41850,"name":351,"slug":352,"tier":45},{"id":348},{"sys":41852,"name":377,"slug":378,"tier":45},{"id":374},{"sys":41854,"name":598,"slug":599,"tier":45},{"id":595},{"sys":41856,"name":404,"slug":405,"tier":45},{"id":401},"qlmXy5FkADS7F25sxNmLMjPboPGE79KlfxoABFCLuFI",{"id":41859,"title":41860,"authorsCollection":41861,"content":41865,"extension":228,"faqItemsCollection":42182,"faqTitle":59,"featured":6,"hashTags":59,"meta":42184,"metaTitle":42185,"ogImage":59,"postType":3355,"publishedDate":42186,"relatedBlogPostsCollection":42187,"slug":42418,"stem":42419,"subtitle":59,"summary":42420,"synopsis":42431,"sys":42432,"tagsCollection":42435,"topicsCollection":42439,"__hash__":42451},"blog/blog/product-release-january-2024.json","Product release: January 2024",{"items":41862},[41863],{"fullName":2573,"firstName":2574,"jobTitle":2575,"socialLinks":59,"profilePicture":41864},{"url":2577},{"json":41866,"links":42124},{"data":41867,"content":41868,"nodeType":2232},{},[41869,41875,41918,41924,41931,41938,41953,41959,41976,41983,41998,42004,42021,42027,42048,42054,42075,42081,42088,42112,42118],{"data":41870,"content":41871,"nodeType":1218},{},[41872],{"data":41873,"marks":41874,"value":27846,"nodeType":865},{},[],{"data":41876,"content":41877,"nodeType":891},{},[41878,41888,41898,41908],{"data":41879,"content":41880,"nodeType":880},{},[41881],{"data":41882,"content":41883,"nodeType":866},{},[41884],{"data":41885,"marks":41886,"value":41887,"nodeType":865},{},[],"Push REST API and webhooks available in beta",{"data":41889,"content":41890,"nodeType":880},{},[41891],{"data":41892,"content":41893,"nodeType":866},{},[41894],{"data":41895,"marks":41896,"value":41897,"nodeType":865},{},[],"View activity for all apps in your environment",{"data":41899,"content":41900,"nodeType":880},{},[41901],{"data":41902,"content":41903,"nodeType":866},{},[41904],{"data":41905,"marks":41906,"value":41907,"nodeType":865},{},[],"Easier cleanup of old or shared accounts",{"data":41909,"content":41910,"nodeType":880},{},[41911],{"data":41912,"content":41913,"nodeType":866},{},[41914],{"data":41915,"marks":41916,"value":41917,"nodeType":865},{},[],"SAML login detection",{"data":41919,"content":41923,"nodeType":907},{"target":41920},{"sys":41921},{"id":41922,"type":904,"linkType":905},"2y0INxqAi594O7rCAVKhTI",[],{"data":41925,"content":41926,"nodeType":1218},{},[41927],{"data":41928,"marks":41929,"value":41930,"nodeType":865},{},[],"Explore Push’s new REST API and webhooks",{"data":41932,"content":41933,"nodeType":866},{},[41934],{"data":41935,"marks":41936,"value":41937,"nodeType":865},{},[],"Now you can send Push data to a SIEM, or create real-time updates for events that occur on the platform, such as triggering a support ticket (or whatever else you’d like to do with Push data!), using our new REST API and webhooks, available in public beta.",{"data":41939,"content":41940,"nodeType":866},{},[41941,41945,41949],{"data":41942,"marks":41943,"value":41944,"nodeType":865},{},[],"You can configure the API and set up webhooks on the ",{"data":41946,"marks":41947,"value":2129,"nodeType":865},{},[41948],{"type":946},{"data":41950,"marks":41951,"value":41952,"nodeType":865},{},[]," page of the Push admin console.",{"data":41954,"content":41958,"nodeType":907},{"target":41955},{"sys":41956},{"id":41957,"type":904,"linkType":905},"6aKaM2QlTFX6Tdap3Luwpi",[],{"data":41960,"content":41961,"nodeType":866},{},[41962,41965,41973],{"data":41963,"marks":41964,"value":21,"nodeType":865},{},[],{"data":41966,"content":41967,"nodeType":1102},{"uri":24833},[41968],{"data":41969,"marks":41970,"value":41972,"nodeType":865},{},[41971],{"type":4537},"Developer documentation",{"data":41974,"marks":41975,"value":21,"nodeType":865},{},[],{"data":41977,"content":41978,"nodeType":1218},{},[41979],{"data":41980,"marks":41981,"value":41982,"nodeType":865},{},[],"See activity for all apps in your environment",{"data":41984,"content":41985,"nodeType":866},{},[41986,41990,41994],{"data":41987,"marks":41988,"value":41989,"nodeType":865},{},[],"See other apps that Push has discovered in your environment that it doesn’t recognize as commonly used work apps. You’ll find these “other apps” accessible from the ",{"data":41991,"marks":41992,"value":8928,"nodeType":865},{},[41993],{"type":946},{"data":41995,"marks":41996,"value":41997,"nodeType":865},{},[]," page in the admin console. Over time, we’ll be working to make it easy to request support for these apps, so you can monitor those you care about.",{"data":41999,"content":42003,"nodeType":907},{"target":42000},{"sys":42001},{"id":42002,"type":904,"linkType":905},"5tuTL1XuuDytbskxUewP2Q",[],{"data":42005,"content":42006,"nodeType":866},{},[42007,42010,42018],{"data":42008,"marks":42009,"value":21,"nodeType":865},{},[],{"data":42011,"content":42014,"nodeType":1038},{"target":42012},{"sys":42013},{"id":27795,"type":904,"linkType":905},[42015],{"data":42016,"marks":42017,"value":27531,"nodeType":865},{},[],{"data":42019,"marks":42020,"value":21,"nodeType":865},{},[],{"data":42022,"content":42023,"nodeType":1218},{},[42024],{"data":42025,"marks":42026,"value":41907,"nodeType":865},{},[],{"data":42028,"content":42029,"nodeType":866},{},[42030,42034,42044],{"data":42031,"marks":42032,"value":42033,"nodeType":865},{},[],"If you need to do any cleanup of your inventory (or to help with employee offboarding), you can now select accounts in Push you wish to forget. ",{"data":42035,"content":42039,"nodeType":1038},{"target":42036},{"sys":42037},{"id":42038,"type":904,"linkType":905},"7lTCPjP5xRnvBlJI7aesWd",[42040],{"data":42041,"marks":42042,"value":42043,"nodeType":865},{},[],"Forgetting an account",{"data":42045,"marks":42046,"value":42047,"nodeType":865},{},[]," will remove that data from Push, but not impact the employee record itself. ",{"data":42049,"content":42053,"nodeType":907},{"target":42050},{"sys":42051},{"id":42052,"type":904,"linkType":905},"2Z9cdE7lttKORRVQDfDcOu",[],{"data":42055,"content":42056,"nodeType":866},{},[42057,42061,42071],{"data":42058,"marks":42059,"value":42060,"nodeType":865},{},[],"You can also now ",{"data":42062,"content":42066,"nodeType":1038},{"target":42063},{"sys":42064},{"id":42065,"type":904,"linkType":905},"HbTn8sH2kV9CHHHeXpt9s",[42067],{"data":42068,"marks":42069,"value":42070,"nodeType":865},{},[],"resolve findings for shared accounts",{"data":42072,"marks":42073,"value":42074,"nodeType":865},{},[]," that have been remediated. If Push sees the account get shared again, a new finding will appear.",{"data":42076,"content":42080,"nodeType":907},{"target":42077},{"sys":42078},{"id":42079,"type":904,"linkType":905},"14bJ6ze4qC45uA9hHdVIme",[],{"data":42082,"content":42083,"nodeType":1218},{},[42084],{"data":42085,"marks":42086,"value":42087,"nodeType":865},{},[],"See login methods, including SAML",{"data":42089,"content":42090,"nodeType":866},{},[42091,42095,42100,42104,42108],{"data":42092,"marks":42093,"value":42094,"nodeType":865},{},[],"The Push browser extension can now detect when logins occur via SAML, in addition to OIDC and password logins, giving you more context as you monitor how employees access work apps. You’ll see SAML appear in the Push admin console wherever ",{"data":42096,"marks":42097,"value":42099,"nodeType":865},{},[42098],{"type":946},"Login methods",{"data":42101,"marks":42102,"value":42103,"nodeType":865},{},[]," are shown, such as the ",{"data":42105,"marks":42106,"value":8936,"nodeType":865},{},[42107],{"type":946},{"data":42109,"marks":42110,"value":42111,"nodeType":865},{},[]," page and the account details slideout. ",{"data":42113,"content":42117,"nodeType":907},{"target":42114},{"sys":42115},{"id":42116,"type":904,"linkType":905},"59K4tBnQtiZkgppOulwKzD",[],{"data":42119,"content":42120,"nodeType":866},{},[42121],{"data":42122,"marks":42123,"value":21,"nodeType":865},{},[],{"entries":42125},{"inline":42126,"hyperlink":42127,"block":42143},[],[42128,42133,42138],{"sys":42129,"__typename":2256,"title":42130,"slug":42131,"articleId":42132},{"id":27795},"What apps appear in the ‘Other apps’ list in Push?","what-apps-appear-in-the-other-apps-list-in-push",10100,{"sys":42134,"__typename":2256,"title":42135,"slug":42136,"articleId":42137},{"id":42038},"How do I remove account data that is old or unneeded?","how-do-i-remove-account-data-that-is-old-or-unneeded",10103,{"sys":42139,"__typename":2256,"title":42140,"slug":42141,"articleId":42142},{"id":42065},"How do I resolve a shared account finding?","how-do-i-resolve-a-shared-account-finding",10104,[42144,42149,42155,42161,42168,42175],{"sys":42145,"__typename":4959,"type":42146,"ctaText":42147,"buttonLabel":42148,"buttonColour":14853,"buttonUrl":59},{"id":41922},"LinkedIn","See more original research and technical content from Push","Follow us on LinkedIn",{"sys":42150,"__typename":2366,"title":42151,"caption":59,"layoutMode":59,"file":42152},{"id":41957},"API settings demo gif - release notes - January 2024",{"url":42153,"width":17,"height":42154},"https://images.ctfassets.net/y1cdw1ablpvd/1Vbjpi7EuwAC0t9dTr65ab/e4db83c045e4f6aadfc2a6b19915c237/configure_api_settings.gif",390,{"sys":42156,"__typename":2366,"title":42157,"caption":59,"layoutMode":59,"file":42158},{"id":42002},"Other apps demo - release notes - January 2024",{"url":42159,"width":17,"height":42160},"https://images.ctfassets.net/y1cdw1ablpvd/3DAouOsQkUMq68Ypoy16VN/24a44239fcf73cf87f12e71b2b22cfe8/view_other_apps.gif",330,{"sys":42162,"__typename":2366,"title":42163,"caption":59,"layoutMode":59,"file":42164},{"id":42052},"Forget accounts bulk action - docs - View SaaS activity",{"url":42165,"width":42166,"height":42167},"https://images.ctfassets.net/y1cdw1ablpvd/3sKaRd4vt3JNp68HbwWjK4/17f22f4199804375c23617cb91e113b9/forget_accounts_20260804.png",1407,295,{"sys":42169,"__typename":2366,"title":42170,"caption":59,"layoutMode":59,"file":42171},{"id":42079},"Resolve shared account - docs - View SaaS activity",{"url":42172,"width":42173,"height":42174},"https://images.ctfassets.net/y1cdw1ablpvd/MELCh8C03rkAQkqcCJVy9/fe6c8c2e9b7260609b69d8e192eea35a/shared_account_resolve_20231218.png",1199,836,{"sys":42176,"__typename":2366,"title":42177,"caption":59,"layoutMode":59,"file":42178},{"id":42116},"SAML login detection - release notes - January 2024",{"url":42179,"width":42180,"height":42181},"https://images.ctfassets.net/y1cdw1ablpvd/3N9VlT6uokJ5rD67lTBxny/c16cb791dd676fe70c346b8b036bb4b2/saml_detection_screenshot.png",1366,324,{"items":42183},[],{},"Push Security new product features for January 2024","2024-01-09T00:00:00.000Z",{"items":42188},[42189],{"__typename":2239,"sys":42190,"content":42192,"title":42406,"synopsis":42407,"hashTags":59,"publishedDate":42408,"slug":42409,"tagsCollection":42410,"authorsCollection":42414},{"id":42191},"419eJCECzN9ECKLsJD9vgs",{"json":42193},{"data":42194,"content":42195,"nodeType":2232},{},[42196,42202,42235,42242,42258,42264,42282,42289,42305,42311,42329,42335,42349,42382,42389,42395,42400],{"data":42197,"content":42198,"nodeType":1218},{},[42199],{"data":42200,"marks":42201,"value":27846,"nodeType":865},{},[],{"data":42203,"content":42204,"nodeType":891},{},[42205,42215,42225],{"data":42206,"content":42207,"nodeType":880},{},[42208],{"data":42209,"content":42210,"nodeType":866},{},[42211],{"data":42212,"marks":42213,"value":42214,"nodeType":865},{},[],"New finding type for leaked passwords",{"data":42216,"content":42217,"nodeType":880},{},[42218],{"data":42219,"content":42220,"nodeType":866},{},[42221],{"data":42222,"marks":42223,"value":42224,"nodeType":865},{},[],"Automatic licensing option for new employees",{"data":42226,"content":42227,"nodeType":880},{},[42228],{"data":42229,"content":42230,"nodeType":866},{},[42231],{"data":42232,"marks":42233,"value":42234,"nodeType":865},{},[],"Improved filtering options",{"data":42236,"content":42237,"nodeType":1218},{},[42238],{"data":42239,"marks":42240,"value":42241,"nodeType":865},{},[],"Easily identify leaked passwords",{"data":42243,"content":42244,"nodeType":866},{},[42245,42249,42254],{"data":42246,"marks":42247,"value":42248,"nodeType":865},{},[],"We’ve added a filter to quickly identify any ",{"data":42250,"marks":42251,"value":42253,"nodeType":865},{},[42252],{"type":946},"leaked password findings",{"data":42255,"marks":42256,"value":42257,"nodeType":865},{},[]," among your employee accounts. You’ll also see leaked passwords listed as a separate security finding type on an account or employee record in the Push admin console, so it’s easier to distinguish those from other password vulnerabilities.",{"data":42259,"content":42263,"nodeType":907},{"target":42260},{"sys":42261},{"id":42262,"type":904,"linkType":905},"1bIPUfhQMnIIoyMDOebqqz",[],{"data":42265,"content":42266,"nodeType":866},{},[42267,42270,42279],{"data":42268,"marks":42269,"value":21,"nodeType":865},{},[],{"data":42271,"content":42275,"nodeType":1038},{"target":42272},{"sys":42273},{"id":42274,"type":904,"linkType":905},"5d9a04bd-bde1-4012-9b91-175e6c90d75c",[42276],{"data":42277,"marks":42278,"value":2777,"nodeType":865},{},[],{"data":42280,"marks":42281,"value":21,"nodeType":865},{},[],{"data":42283,"content":42284,"nodeType":1218},{},[42285],{"data":42286,"marks":42287,"value":42288,"nodeType":865},{},[],"Save time by automatically licensing new employees",{"data":42290,"content":42291,"nodeType":866},{},[42292,42296,42301],{"data":42293,"marks":42294,"value":42295,"nodeType":865},{},[],"Efficiently protect new employees with our new ",{"data":42297,"marks":42298,"value":42300,"nodeType":865},{},[42299],{"type":946},"automatic licensing",{"data":42302,"marks":42303,"value":42304,"nodeType":865},{},[]," feature. Once you’ve deployed the Push browser extension to employee browsers, Push will identify the user of a browser and then license them on the platform automatically.",{"data":42306,"content":42310,"nodeType":907},{"target":42307},{"sys":42308},{"id":42309,"type":904,"linkType":905},"6DWCHqJdupN7smSfrL5dW7",[],{"data":42312,"content":42313,"nodeType":866},{},[42314,42317,42326],{"data":42315,"marks":42316,"value":21,"nodeType":865},{},[],{"data":42318,"content":42322,"nodeType":1038},{"target":42319},{"sys":42320},{"id":42321,"type":904,"linkType":905},"6S9daVUJa84AWkPNDgXpBU",[42323],{"data":42324,"marks":42325,"value":27531,"nodeType":865},{},[],{"data":42327,"marks":42328,"value":21,"nodeType":865},{},[],{"data":42330,"content":42331,"nodeType":1218},{},[42332],{"data":42333,"marks":42334,"value":42234,"nodeType":865},{},[],{"data":42336,"content":42337,"nodeType":866},{},[42338,42341,42345],{"data":42339,"marks":42340,"value":20329,"nodeType":865},{},[],{"data":42342,"marks":42343,"value":8936,"nodeType":865},{},[42344],{"type":946},{"data":42346,"marks":42347,"value":42348,"nodeType":865},{},[]," page, you can now filter by:",{"data":42350,"content":42351,"nodeType":891},{},[42352,42367],{"data":42353,"content":42354,"nodeType":880},{},[42355],{"data":42356,"content":42357,"nodeType":866},{},[42358,42363],{"data":42359,"marks":42360,"value":42362,"nodeType":865},{},[42361],{"type":946},"Identity provider and login method: ",{"data":42364,"marks":42365,"value":42366,"nodeType":865},{},[],"This makes it easier to identify accounts using specific IdPs and login methods (SAML, OIDC, or passwords), or any combination of those. We’ve also added timestamps for login methods, which you’ll see on the account details slideout.",{"data":42368,"content":42369,"nodeType":880},{},[42370],{"data":42371,"content":42372,"nodeType":866},{},[42373,42378],{"data":42374,"marks":42375,"value":42377,"nodeType":865},{},[42376],{"type":946},"App approval status or sensitivity: ",{"data":42379,"marks":42380,"value":42381,"nodeType":865},{},[],"This makes it easier to find accounts on high-value apps that have vulnerabilities, or see who’s still using unapproved apps. ",{"data":42383,"content":42384,"nodeType":866},{},[42385],{"data":42386,"marks":42387,"value":42388,"nodeType":865},{},[],"We’ve also made your selected filters easier to see by displaying them on the page when active.",{"data":42390,"content":42394,"nodeType":907},{"target":42391},{"sys":42392},{"id":42393,"type":904,"linkType":905},"6qydMrw4uidUGqi63tVlYU",[],{"data":42396,"content":42399,"nodeType":907},{"target":42397},{"sys":42398},{"id":41922,"type":904,"linkType":905},[],{"data":42401,"content":42402,"nodeType":866},{},[42403],{"data":42404,"marks":42405,"value":21,"nodeType":865},{},[],"Product release: November 2023","Here’s what’s new on the Push platform for November 2023.","2023-11-28T00:00:00.000Z","product-release-november-2023",{"items":42411},[42412],{"sys":42413,"name":3915},{"id":3914},{"items":42415},[42416],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":42417},{"url":2577},"product-release-january-2024","blog/product-release-january-2024",{"json":42421},{"data":42422,"content":42423,"nodeType":2232},{},[42424],{"data":42425,"content":42426,"nodeType":866},{},[42427],{"data":42428,"marks":42429,"value":42430,"nodeType":865},{},[],"Push REST API and webhooks available in beta, view activity for all apps in your environment, easier cleanup of old or shared accounts, and SAML login detection","Here’s what’s new on the Push platform for January 2024.",{"id":42433,"publishedAt":42434},"58EOJUfsjNpdEYtKyQVYHM","2026-08-13T09:34:51.193Z",{"items":42436},[42437],{"sys":42438,"name":3915},{"id":3914},{"items":42440},[42441,42443,42445,42447,42449],{"sys":42442,"name":297,"slug":298,"tier":31},{"id":294},{"sys":42444,"name":413,"slug":414,"tier":31},{"id":410},{"sys":42446,"name":545,"slug":546,"tier":31},{"id":542},{"sys":42448,"name":589,"slug":590,"tier":45},{"id":586},{"sys":42450,"name":598,"slug":599,"tier":45},{"id":595},"pFDk1_5-BAMHQSt_yj8LheenPaUjalZiOQGFi-Pv09A",{"id":42453,"title":42454,"authorsCollection":42455,"content":42461,"extension":228,"faqItemsCollection":43735,"faqTitle":59,"featured":6,"hashTags":59,"meta":43737,"metaTitle":43738,"ogImage":59,"postType":43739,"publishedDate":43740,"relatedBlogPostsCollection":43741,"slug":46016,"stem":46017,"subtitle":59,"summary":46018,"synopsis":46029,"sys":46030,"tagsCollection":46033,"topicsCollection":46039,"__hash__":46063},"blog/blog/okta-swa.json","Abusing Okta's SWA authentication",{"items":42456},[42457],{"fullName":11808,"firstName":11809,"jobTitle":11810,"socialLinks":42458,"profilePicture":42460},[42459],"https://www.linkedin.com/in/luke-jennings-042b5619b/",{"url":11812},{"json":42462,"links":43636},{"data":42463,"content":42464,"nodeType":2232},{},[42465,42472,42479,42486,42493,42500,42507,42513,42520,42527,42534,42624,42629,42636,42643,42650,42683,42690,42697,42704,42711,42717,42724,42731,42754,42761,42767,42773,42780,42787,42794,42801,42808,42815,42822,42828,42834,42842,42849,42856,42863,42870,42877,42884,42891,42898,42905,42912,42919,42926,42931,42938,42945,42952,42959,42965,42971,42978,42985,42992,43015,43022,43028,43034,43041,43047,43054,43061,43072,43079,43086,43093,43100,43107,43124,43222,43229,43236,43284,43290,43297,43304,43311,43318,43325,43332,43338,43345,43364,43371,43378,43385,43392,43399,43406,43449,43456,43511,43518,43525,43588,43594,43601,43608,43615,43622,43629],{"data":42466,"content":42467,"nodeType":866},{},[42468],{"data":42469,"marks":42470,"value":42471,"nodeType":865},{},[],"This blog post covers the implications of using SWA as an authentication method in Okta, with a particular focus on what security teams need to consider in an account breach and subsequent incident response scenario. ",{"data":42473,"content":42474,"nodeType":866},{},[42475],{"data":42476,"marks":42477,"value":42478,"nodeType":865},{},[],"Spoiler alert: we’ll make the case that the true value of an SSO solution like Okta is in the use of SAML and OIDC authentication methods, not convenience features like SWA.",{"data":42480,"content":42481,"nodeType":948},{},[42482],{"data":42483,"marks":42484,"value":42485,"nodeType":865},{},[],"Introduction",{"data":42487,"content":42488,"nodeType":866},{},[42489],{"data":42490,"marks":42491,"value":42492,"nodeType":865},{},[],"To facilitate SSO logins to web applications, Okta allows the industry standard SAML and OIDC protocols for federated logins to be used with applications that support it. These represent the most secure and recommended options. However, Okta also offers a proprietary system called SWA to support apps that don’t support these protocols, or where they are otherwise unavailable due to licensing restrictions.     ",{"data":42494,"content":42495,"nodeType":866},{},[42496],{"data":42497,"marks":42498,"value":42499,"nodeType":865},{},[],"While SWA is referred to as an SSO login mechanism, functionally it’s a password manager. SWA stores username and password combinations for individual applications on a per-user basis and makes use of a browser extension to automate the login process on behalf of the user. ",{"data":42501,"content":42502,"nodeType":866},{},[42503],{"data":42504,"marks":42505,"value":42506,"nodeType":865},{},[],"The screenshot below shows an example of an application being configured to use SWA as opposed to SAML, in this case Salesforce:",{"data":42508,"content":42512,"nodeType":907},{"target":42509},{"sys":42510},{"id":42511,"type":904,"linkType":905},"4wrRez2VpTG1vjsvNFlklK",[],{"data":42514,"content":42515,"nodeType":866},{},[42516],{"data":42517,"marks":42518,"value":42519,"nodeType":865},{},[],"From this configuration screen it’s not obvious that there is a fundamental difference between some login methods like SWA and true federated identity methods like SAML 2.0. To better understand the difference and the risks of SWA, let’s look at it from an attacker’s perspective.",{"data":42521,"content":42522,"nodeType":948},{},[42523],{"data":42524,"marks":42525,"value":42526,"nodeType":865},{},[],"How are Okta accounts compromised?",{"data":42528,"content":42529,"nodeType":866},{},[42530],{"data":42531,"marks":42532,"value":42533,"nodeType":865},{},[],"While it’s common for Okta accounts to be protected using MFA, and sometimes device trust, there are still viable attack vectors. The two most prevalent attacks would be: ",{"data":42535,"content":42536,"nodeType":891},{},[42537,42552],{"data":42538,"content":42539,"nodeType":880},{},[42540],{"data":42541,"content":42542,"nodeType":866},{},[42543,42548],{"data":42544,"marks":42545,"value":42547,"nodeType":865},{},[42546],{"type":946},"Endpoint compromise",{"data":42549,"marks":42550,"value":42551,"nodeType":865},{},[]," - In a traditional endpoint compromise scenario, an attacker will generally have full access to the user’s browser. This means they can hijack existing Okta sessions by stealing authentication tokens, which bypass all device trust and MFA protections. For persistent access, they can keylog credentials when the user next logs in and add MFA methods or enrol a new endpoint with device trust.",{"data":42553,"content":42554,"nodeType":880},{},[42555],{"data":42556,"content":42557,"nodeType":866},{},[42558,42563,42567,42575,42578,42587,42591,42595,42604,42608,42612,42621],{"data":42559,"marks":42560,"value":42562,"nodeType":865},{},[42561],{"type":946},"Phishing attacks/MFA proxying",{"data":42564,"marks":42565,"value":42566,"nodeType":865},{},[]," - Traditional phishing attacks can be launched against Okta users to obtain credentials and/or authenticated sessions. Attacker-in-the-middle (AITM) attacks can be used to bypass common MFA mechanisms, and attacks against Okta users are typically carried out using tools such as ",{"data":42568,"content":42569,"nodeType":1102},{"uri":24956},[42570],{"data":42571,"marks":42572,"value":42574,"nodeType":865},{},[42573],{"type":4537},"evilginx",{"data":42576,"marks":42577,"value":3531,"nodeType":865},{},[],{"data":42579,"content":42581,"nodeType":1102},{"uri":42580},"https://mrd0x.com/bypass-2fa-using-novnc/",[42582],{"data":42583,"marks":42584,"value":42586,"nodeType":865},{},[42585],{"type":4537},"noVNC",{"data":42588,"marks":42589,"value":6192,"nodeType":865},{},[42590],{"type":946},{"data":42592,"marks":42593,"value":42594,"nodeType":865},{},[],"or ",{"data":42596,"content":42598,"nodeType":1102},{"uri":42597},"https://github.com/fkasler/cuddlephish",[42599],{"data":42600,"marks":42601,"value":42603,"nodeType":865},{},[42602],{"type":4537},"cuddlephish",{"data":42605,"marks":42606,"value":1151,"nodeType":865},{},[42607],{"type":946},{"data":42609,"marks":42610,"value":42611,"nodeType":865},{},[]," We’ve even seen groups using tooling specifically crafted to target Okta such as the notorious ",{"data":42613,"content":42615,"nodeType":1102},{"uri":42614},"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/",[42616],{"data":42617,"marks":42618,"value":42620,"nodeType":865},{},[42619],{"type":4537},"0ktapus group/campaign.",{"data":42622,"marks":42623,"value":21,"nodeType":865},{},[],{"data":42625,"content":42628,"nodeType":907},{"target":42626},{"sys":42627},{"id":18832,"type":904,"linkType":905},[],{"data":42630,"content":42631,"nodeType":948},{},[42632],{"data":42633,"marks":42634,"value":42635,"nodeType":865},{},[],"What is Okta SWA?",{"data":42637,"content":42638,"nodeType":866},{},[42639],{"data":42640,"marks":42641,"value":42642,"nodeType":865},{},[],"Okta Secure Web Authentication (SWA) provides SSO-like functionality to web applications that don’t support federated protocols and is intended to be used only when SAML or OIDC federated logins cannot be used. ",{"data":42644,"content":42645,"nodeType":866},{},[42646],{"data":42647,"marks":42648,"value":42649,"nodeType":865},{},[],"It is SSO-like in the sense that:",{"data":42651,"content":42652,"nodeType":891},{},[42653,42663,42673],{"data":42654,"content":42655,"nodeType":880},{},[42656],{"data":42657,"content":42658,"nodeType":866},{},[42659],{"data":42660,"marks":42661,"value":42662,"nodeType":865},{},[],"A user enters their single Okta password to login to Okta, ",{"data":42664,"content":42665,"nodeType":880},{},[42666],{"data":42667,"content":42668,"nodeType":866},{},[42669],{"data":42670,"marks":42671,"value":42672,"nodeType":865},{},[],"SWA then stores username/password combinations ",{"data":42674,"content":42675,"nodeType":880},{},[42676],{"data":42677,"content":42678,"nodeType":866},{},[42679],{"data":42680,"marks":42681,"value":42682,"nodeType":865},{},[],"SWA then makes use of a browser extension to automatically login to applications using the credentials. ",{"data":42684,"content":42685,"nodeType":866},{},[42686],{"data":42687,"marks":42688,"value":42689,"nodeType":865},{},[],"In that sense, it’s essentially a password manager. Like any password manager, it can be a big security improvement over a user manually managing their accounts or reusing the same password everywhere.",{"data":42691,"content":42692,"nodeType":866},{},[42693],{"data":42694,"marks":42695,"value":42696,"nodeType":865},{},[],"There’s a good reason that true SSO is considered more secure than password managers, and this comes down to the identity. An SSO uses a single identity that is federated to other apps, where a password manager just better manages many discrete identities. So, when an employee leaves an organization and they’re using an SSO, a single identity needs to be disabled, but disabling access to a password manager does nothing to disable the identities inside it.",{"data":42698,"content":42699,"nodeType":866},{},[42700],{"data":42701,"marks":42702,"value":42703,"nodeType":865},{},[],"In the case of SWA, the use of a browser extension and a long list of supported applications with custom login scripts already written is a key value add. This means users don’t need to copy/paste credentials like they might with some password managers. ",{"data":42705,"content":42706,"nodeType":866},{},[42707],{"data":42708,"marks":42709,"value":42710,"nodeType":865},{},[],"However, unlike typical password managers, there isn’t just one type of SWA, administrators can actually pick between one of five configuration options. This is shown in the screenshot below:",{"data":42712,"content":42716,"nodeType":907},{"target":42713},{"sys":42714},{"id":42715,"type":904,"linkType":905},"42kt5hDFjjVYLf85HnjlU8",[],{"data":42718,"content":42719,"nodeType":866},{},[42720],{"data":42721,"marks":42722,"value":42723,"nodeType":865},{},[],"So, it’s possible to configure SWA like a traditional password manager scenario where the user sets their own username and password. However, as you can see above, you can set it up so that administrators can fully control the credentials, including the use of shared credentials used by multiple users.",{"data":42725,"content":42726,"nodeType":866},{},[42727],{"data":42728,"marks":42729,"value":42730,"nodeType":865},{},[],"SWA can also control the default configuration of the password reveal capability:",{"data":42732,"content":42733,"nodeType":891},{},[42734,42744],{"data":42735,"content":42736,"nodeType":880},{},[42737],{"data":42738,"content":42739,"nodeType":866},{},[42740],{"data":42741,"marks":42742,"value":42743,"nodeType":865},{},[],"When configured to allow users to set their own credentials, password reveal is enabled by default. ",{"data":42745,"content":42746,"nodeType":880},{},[42747],{"data":42748,"content":42749,"nodeType":866},{},[42750],{"data":42751,"marks":42752,"value":42753,"nodeType":865},{},[],"When administrators control the credentials, password reveal is disabled by default. ",{"data":42755,"content":42756,"nodeType":866},{},[42757],{"data":42758,"marks":42759,"value":42760,"nodeType":865},{},[],"Since Okta SWA performs logins automatically on behalf of the user, the user doesn’t technically need to be able to view or copy/paste the credentials. This makes it possible for Okta to support disabling password reveal. ",{"data":42762,"content":42766,"nodeType":907},{"target":42763},{"sys":42764},{"id":42765,"type":904,"linkType":905},"3IE8neYJbh0H8Vc7Hd9p5W",[],{"data":42768,"content":42772,"nodeType":907},{"target":42769},{"sys":42770},{"id":42771,"type":904,"linkType":905},"5C1lhoJtBEgdndiL9gSUbd",[],{"data":42774,"content":42775,"nodeType":948},{},[42776],{"data":42777,"marks":42778,"value":42779,"nodeType":865},{},[],"What are the security risks of using SWA?",{"data":42781,"content":42782,"nodeType":866},{},[42783],{"data":42784,"marks":42785,"value":42786,"nodeType":865},{},[],"While SWA may be a step up from users performing manual logins to a range of apps, it carries the same risk that any password manager solution has. If your account is compromised then all your usernames and passwords can be stolen in one go.",{"data":42788,"content":42789,"nodeType":866},{},[42790],{"data":42791,"marks":42792,"value":42793,"nodeType":865},{},[],"But how can that be if password reveal has been disabled",{"data":42795,"content":42796,"nodeType":1218},{},[42797],{"data":42798,"marks":42799,"value":42800,"nodeType":865},{},[],"1. Bypassing password reveal restrictions",{"data":42802,"content":42803,"nodeType":866},{},[42804],{"data":42805,"marks":42806,"value":42807,"nodeType":865},{},[],"Even if users don’t directly interact with their passwords themselves (e.g. via copy/paste), their browser needs access otherwise it wouldn’t be possible to login to apps. ",{"data":42809,"content":42810,"nodeType":866},{},[42811],{"data":42812,"marks":42813,"value":42814,"nodeType":865},{},[],"The Okta browser extension uses the user’s active Okta login session to request credentials in the background, then automatically logs in to apps without the user ever directly seeing those credentials. So, while disabling password reveal may defeat a low-skill attacker or normal user scenarios, it’s essentially a client-side control, and isn’t going to stop a more determined attacker or technical user from getting at the credentials. This isn’t a bug, it’s a technical limitation of how a password manager works.",{"data":42816,"content":42817,"nodeType":866},{},[42818],{"data":42819,"marks":42820,"value":42821,"nodeType":865},{},[],"For example, let’s say a user has Salesforce configured as an app with SWA and clicks the app tile in the extension to login. The browser extension will use the active user session to make a request like the following (headers and irrelevant data removed for clarity):",{"data":42823,"content":42827,"nodeType":907},{"target":42824},{"sys":42825},{"id":42826,"type":904,"linkType":905},"2tiqg9EUoa9KxkTCduZoVe",[],{"data":42829,"content":42833,"nodeType":907},{"target":42830},{"sys":42831},{"id":42832,"type":904,"linkType":905},"4ApkgD7IwPRC3jC09Jf2SJ",[],{"data":42835,"content":42836,"nodeType":866},{},[42837],{"data":42838,"marks":42839,"value":42841,"nodeType":865},{},[42840],{"type":979},"This response to the browser extension’s web request contains the username and password for Salesforce",{"data":42843,"content":42844,"nodeType":866},{},[42845],{"data":42846,"marks":42847,"value":42848,"nodeType":865},{},[],"This is the Salesforce-specific login script that allows the extension to automatically log the user in to Salesforce and includes their credentials. This request will include the credentials even if password reveal is disabled - the request above was captured using an intercepting proxy like Burp Suite.",{"data":42850,"content":42851,"nodeType":1218},{},[42852],{"data":42853,"marks":42854,"value":42855,"nodeType":865},{},[],"2. Cross-account shared passwords",{"data":42857,"content":42858,"nodeType":866},{},[42859],{"data":42860,"marks":42861,"value":42862,"nodeType":865},{},[],"An additional risk with SWA is an operational one. Administrators can set passwords for users and also disable password reveal, which can encourage the use of shared passwords, since they don’t expect the users to see them. ",{"data":42864,"content":42865,"nodeType":866},{},[42866],{"data":42867,"marks":42868,"value":42869,"nodeType":865},{},[],"If administrators are auto-generating complex passwords for every single user account they create as a strong operational process, then there may be no issue. However, breach history would tell us that rarely do organizations have operational security practices as stringent as that.",{"data":42871,"content":42872,"nodeType":866},{},[42873],{"data":42874,"marks":42875,"value":42876,"nodeType":865},{},[],"An attacker compromising an Okta user account can not only extract valid credentials for all configured SWA apps for that user, but may uncover passwords that are valid for other user accounts configured by administrators, making this a likely vector for lateral movement.",{"data":42878,"content":42879,"nodeType":1218},{},[42880],{"data":42881,"marks":42882,"value":42883,"nodeType":865},{},[],"3. Shared Okta passwords",{"data":42885,"content":42886,"nodeType":866},{},[42887],{"data":42888,"marks":42889,"value":42890,"nodeType":865},{},[],"One SWA option administrators can configure is to require the user to use their Okta password for the application (see earlier screenshot of configuration options). In this case, Okta lets the user set the password for the application, but it will confirm it matches the user’s Okta password and reject it otherwise.",{"data":42892,"content":42893,"nodeType":866},{},[42894],{"data":42895,"marks":42896,"value":42897,"nodeType":865},{},[],"This is a dangerous option, since it means the user’s Okta password is shared with other applications. So, if one of those applications is compromised, then their Okta password could be breached as well, which could allow both other applications and the user’s core Okta account to be compromised. It’s essentially enforcing password re-use, the exact opposite of what you want from an identity security perspective.",{"data":42899,"content":42900,"nodeType":1218},{},[42901],{"data":42902,"marks":42903,"value":42904,"nodeType":865},{},[],"4. Persistent access to connected apps",{"data":42906,"content":42907,"nodeType":866},{},[42908],{"data":42909,"marks":42910,"value":42911,"nodeType":865},{},[],"Okta acts as an authentication gateway for access to other applications. Ideally, strong authentication policies will be in place such as strong password policies, MFA, account lockout and detection and response controls.",{"data":42913,"content":42914,"nodeType":866},{},[42915],{"data":42916,"marks":42917,"value":42918,"nodeType":865},{},[],"However, if even a temporary compromise of an Okta account is achieved (for example through an Okta session theft), an attacker extracting all credentials for SWA apps does not need to maintain access to Okta any further. Instead, they can maintain persistent access to all the downstream SWA apps by logging in manually, using the credentials they have extracted without using Okta. ",{"data":42920,"content":42921,"nodeType":866},{},[42922],{"data":42923,"marks":42924,"value":42925,"nodeType":865},{},[],"This greatly complicates incident response playbooks. Where an otherwise simple recovery action like disabling an Okta account, resetting the password and MFA methods, et cetera, would kick an attacker out of the Okta account - for a user using SWA the attacker will still have all the access to downstream SWA applications unless every single SWA app user account is recovered as well. This is where the value of a federated identity becomes clear.",{"data":42927,"content":42930,"nodeType":907},{"target":42928},{"sys":42929},{"id":41922,"type":904,"linkType":905},[],{"data":42932,"content":42933,"nodeType":948},{},[42934],{"data":42935,"marks":42936,"value":42937,"nodeType":865},{},[],"Dumping SWA credentials",{"data":42939,"content":42940,"nodeType":866},{},[42941],{"data":42942,"marks":42943,"value":42944,"nodeType":865},{},[],"Since Okta SWA functions as a password manager, and it’s also possible to bypass password reveal restrictions, an attacker who has gained temporary access to an Okta session can automate the extraction of all credentials stored via SWA for that account.",{"data":42946,"content":42947,"nodeType":1218},{},[42948],{"data":42949,"marks":42950,"value":42951,"nodeType":865},{},[],"Using the password reveal API",{"data":42953,"content":42954,"nodeType":866},{},[42955],{"data":42956,"marks":42957,"value":42958,"nodeType":865},{},[],"One method would be to automate the password reveal API call in the dashboard for every app configured. This is the simplest, direct way to get credentials but has the disadvantage that it will not return credentials that have had password reveal disabled. The following screenshots show an example of the API call that is made:",{"data":42960,"content":42964,"nodeType":907},{"target":42961},{"sys":42962},{"id":42963,"type":904,"linkType":905},"27xCaphfwy6zSNU7QDQZ1g",[],{"data":42966,"content":42970,"nodeType":907},{"target":42967},{"sys":42968},{"id":42969,"type":904,"linkType":905},"begENC8Oxq4rwprZ0fGpG",[],{"data":42972,"content":42973,"nodeType":1218},{},[42974],{"data":42975,"marks":42976,"value":42977,"nodeType":865},{},[],"Using the browser extension API",{"data":42979,"content":42980,"nodeType":866},{},[42981],{"data":42982,"marks":42983,"value":42984,"nodeType":865},{},[],"The more effective way for an attacker to dump credentials, and bypass password reveal restrictions, is to emulate the API calls made by the browser extension to retrieve the login scripts for each SWA application. ",{"data":42986,"content":42987,"nodeType":866},{},[42988],{"data":42989,"marks":42990,"value":42991,"nodeType":865},{},[],"For an attacker to make these calls, a valid Okta session is needed. Specifically, the tokens that need to be extracted from the browser for these calls are:",{"data":42993,"content":42994,"nodeType":891},{},[42995,43005],{"data":42996,"content":42997,"nodeType":880},{},[42998],{"data":42999,"content":43000,"nodeType":866},{},[43001],{"data":43002,"marks":43003,"value":43004,"nodeType":865},{},[],"The access token in “okta-token-storage” in browser local storage",{"data":43006,"content":43007,"nodeType":880},{},[43008],{"data":43009,"content":43010,"nodeType":866},{},[43011],{"data":43012,"marks":43013,"value":43014,"nodeType":865},{},[],"The “idx” token in cookies",{"data":43016,"content":43017,"nodeType":866},{},[43018],{"data":43019,"marks":43020,"value":43021,"nodeType":865},{},[],"These can be seen below:",{"data":43023,"content":43027,"nodeType":907},{"target":43024},{"sys":43025},{"id":43026,"type":904,"linkType":905},"4ooNI3TmnxqCAtw9MZuuVI",[],{"data":43029,"content":43033,"nodeType":907},{"target":43030},{"sys":43031},{"id":43032,"type":904,"linkType":905},"6rbgLXHewT34SPH3qA24Fu",[],{"data":43035,"content":43036,"nodeType":866},{},[43037],{"data":43038,"marks":43039,"value":43040,"nodeType":865},{},[],"The following screenshot shows the use of a simple internal PoC we created to investigate logging detection opportunities. It gives a sense of the type of information that can be retrieved for a test Okta user account: ",{"data":43042,"content":43046,"nodeType":907},{"target":43043},{"sys":43044},{"id":43045,"type":904,"linkType":905},"5lYhdtWKVqIch6CpksR7Dd",[],{"data":43048,"content":43049,"nodeType":948},{},[43050],{"data":43051,"marks":43052,"value":43053,"nodeType":865},{},[],"So if SWA can be risky, is SAML and OIDC safe?",{"data":43055,"content":43056,"nodeType":866},{},[43057],{"data":43058,"marks":43059,"value":43060,"nodeType":865},{},[],"In general, much more so, but as is unfortunately so often the case in security, the answer is “it depends.” The threat profile for federated SSO like SAML and OIDC is very different, and they don’t suffer from the risks highlighted with SWA use given above. ",{"data":43062,"content":43063,"nodeType":866},{},[43064,43069],{"data":43065,"marks":43066,"value":43068,"nodeType":865},{},[43067],{"type":946},"Any organization using Okta should strive to use SAML/OIDC for as many applications as possible - this is the true power of a federated identity solution",{"data":43070,"marks":43071,"value":1151,"nodeType":865},{},[],{"data":43073,"content":43074,"nodeType":866},{},[43075],{"data":43076,"marks":43077,"value":43078,"nodeType":865},{},[],"However, it’s important to remember that not even SAML/OIDC isn't a silver bullet.",{"data":43080,"content":43081,"nodeType":866},{},[43082],{"data":43083,"marks":43084,"value":43085,"nodeType":865},{},[],"For example, it’s still possible for an attacker achieving a temporary compromise of an Okta account to click every single SAML/OIDC application to establish authenticated sessions with all of them. While some sessions may be short-lived, depending on the application, these sessions may stay alive for longer periods such as 30 days or for some apps even indefinitely. ",{"data":43087,"content":43088,"nodeType":866},{},[43089],{"data":43090,"marks":43091,"value":43092,"nodeType":865},{},[],"While it may be simple for incident responders to disable an Okta account temporarily, it’s certainly much more difficult to disable all connected SaaS accounts and/or kill active sessions for all of them. ",{"data":43094,"content":43095,"nodeType":866},{},[43096],{"data":43097,"marks":43098,"value":43099,"nodeType":865},{},[],"Additionally, while active sessions won’t generally allow an attacker long-term access to an application like stolen SWA credentials often will, many different SaaS applications support methods that can be used to effectively backdoor access to them - though this is a risk to both SWA and federated identities.",{"data":43101,"content":43102,"nodeType":866},{},[43103],{"data":43104,"marks":43105,"value":43106,"nodeType":865},{},[],"This is another big challenge for incident responders to deal with, as it can allow attacks to maintain persistence without requiring valid credentials or active sessions. In other words, there are many ways to turn that short term access into persistent access outside Okta. ",{"data":43108,"content":43109,"nodeType":866},{},[43110,43113,43120],{"data":43111,"marks":43112,"value":35672,"nodeType":865},{},[],{"data":43114,"content":43115,"nodeType":1102},{"uri":22038},[43116],{"data":43117,"marks":43118,"value":35680,"nodeType":865},{},[43119],{"type":4537},{"data":43121,"marks":43122,"value":43123,"nodeType":865},{},[],". Some of the most common techniques that apply here are:",{"data":43125,"content":43126,"nodeType":891},{},[43127,43146,43165,43184,43203],{"data":43128,"content":43129,"nodeType":880},{},[43130],{"data":43131,"content":43132,"nodeType":866},{},[43133,43136,43143],{"data":43134,"marks":43135,"value":21,"nodeType":865},{},[],{"data":43137,"content":43138,"nodeType":1102},{"uri":6472},[43139],{"data":43140,"marks":43141,"value":35704,"nodeType":865},{},[43142],{"type":4537},{"data":43144,"marks":43145,"value":21,"nodeType":865},{},[],{"data":43147,"content":43148,"nodeType":880},{},[43149],{"data":43150,"content":43151,"nodeType":866},{},[43152,43155,43162],{"data":43153,"marks":43154,"value":21,"nodeType":865},{},[],{"data":43156,"content":43157,"nodeType":1102},{"uri":35719},[43158],{"data":43159,"marks":43160,"value":35725,"nodeType":865},{},[43161],{"type":4537},{"data":43163,"marks":43164,"value":21,"nodeType":865},{},[],{"data":43166,"content":43167,"nodeType":880},{},[43168],{"data":43169,"content":43170,"nodeType":866},{},[43171,43174,43181],{"data":43172,"marks":43173,"value":21,"nodeType":865},{},[],{"data":43175,"content":43176,"nodeType":1102},{"uri":5377},[43177],{"data":43178,"marks":43179,"value":35745,"nodeType":865},{},[43180],{"type":4537},{"data":43182,"marks":43183,"value":21,"nodeType":865},{},[],{"data":43185,"content":43186,"nodeType":880},{},[43187],{"data":43188,"content":43189,"nodeType":866},{},[43190,43193,43200],{"data":43191,"marks":43192,"value":21,"nodeType":865},{},[],{"data":43194,"content":43195,"nodeType":1102},{"uri":26442},[43196],{"data":43197,"marks":43198,"value":35765,"nodeType":865},{},[43199],{"type":4537},{"data":43201,"marks":43202,"value":21,"nodeType":865},{},[],{"data":43204,"content":43205,"nodeType":880},{},[43206],{"data":43207,"content":43208,"nodeType":866},{},[43209,43212,43219],{"data":43210,"marks":43211,"value":21,"nodeType":865},{},[],{"data":43213,"content":43214,"nodeType":1102},{"uri":17081},[43215],{"data":43216,"marks":43217,"value":35785,"nodeType":865},{},[43218],{"type":4537},{"data":43220,"marks":43221,"value":21,"nodeType":865},{},[],{"data":43223,"content":43224,"nodeType":948},{},[43225],{"data":43226,"marks":43227,"value":43228,"nodeType":865},{},[],"Investigating and detecting an Okta account compromise",{"data":43230,"content":43231,"nodeType":866},{},[43232],{"data":43233,"marks":43234,"value":43235,"nodeType":865},{},[],"The good news is there are multiple Okta log events that can be used for either investigating a breach or providing some detection mechanisms via a SIEM. Three key log events are as follows:",{"data":43237,"content":43238,"nodeType":891},{},[43239,43254,43269],{"data":43240,"content":43241,"nodeType":880},{},[43242],{"data":43243,"content":43244,"nodeType":866},{},[43245,43250],{"data":43246,"marks":43247,"value":43249,"nodeType":865},{},[43248],{"type":946},"Show password event",{"data":43251,"marks":43252,"value":43253,"nodeType":865},{},[]," - indicates when a user has clicked the reveal password button",{"data":43255,"content":43256,"nodeType":880},{},[43257],{"data":43258,"content":43259,"nodeType":866},{},[43260,43265],{"data":43261,"marks":43262,"value":43264,"nodeType":865},{},[43263],{"type":946},"Evaluation of sign-on policy",{"data":43266,"marks":43267,"value":43268,"nodeType":865},{},[]," - occurs when the browser extension requests credentials",{"data":43270,"content":43271,"nodeType":880},{},[43272],{"data":43273,"content":43274,"nodeType":866},{},[43275,43280],{"data":43276,"marks":43277,"value":43279,"nodeType":865},{},[43278],{"type":946},"User single sign on to app",{"data":43281,"marks":43282,"value":43283,"nodeType":865},{},[]," - occurs when a full app login is performed",{"data":43285,"content":43289,"nodeType":907},{"target":43286},{"sys":43287},{"id":43288,"type":904,"linkType":905},"23G5QvwzgyTEJBJ33Ut7NJ",[],{"data":43291,"content":43292,"nodeType":866},{},[43293],{"data":43294,"marks":43295,"value":43296,"nodeType":865},{},[],"Using these events in a post-compromise situation could potentially significantly reduce the response actions required. If there is clear evidence that the attacker only accessed a limited number of applications, focus can be placed on disabling those accounts and removing potential backdoors, as opposed to having to perform containment procedures for every single application the user has access to.",{"data":43298,"content":43299,"nodeType":1218},{},[43300],{"data":43301,"marks":43302,"value":43303,"nodeType":865},{},[],"Short time-window detection",{"data":43305,"content":43306,"nodeType":866},{},[43307],{"data":43308,"marks":43309,"value":43310,"nodeType":865},{},[],"While the events above are great for investigation, they are all expected events during normal use of Okta by a user. Perhaps the “show password” event may be rarer, but it would still not be completely unusual to see. ",{"data":43312,"content":43313,"nodeType":866},{},[43314],{"data":43315,"marks":43316,"value":43317,"nodeType":865},{},[],"This makes detection more difficult as defenders need to separate malicious logins from legitimate logins, a notoriously difficult task.",{"data":43319,"content":43320,"nodeType":866},{},[43321],{"data":43322,"marks":43323,"value":43324,"nodeType":865},{},[],"For proactive detection, one option would be to detect unusually large numbers of these events in a short time window for the same user account. This would be especially effective against automated tools. It would be much more unusual to see a legitimate user login to every app or reveal every password all in one go, or even all in one day. On the other hand, an attacker may seek to compromise all applications in a short time window.",{"data":43326,"content":43327,"nodeType":866},{},[43328],{"data":43329,"marks":43330,"value":43331,"nodeType":865},{},[],"Given below is an example of the flurry of logs generated by running our internal SWA password dumping tool shown earlier. You can see they are all generated in a very short time window:",{"data":43333,"content":43337,"nodeType":907},{"target":43334},{"sys":43335},{"id":43336,"type":904,"linkType":905},"2PaCRx02gpTyYOiuJ85x9Y",[],{"data":43339,"content":43340,"nodeType":866},{},[43341],{"data":43342,"marks":43343,"value":43344,"nodeType":865},{},[],"The only difficulty here is picking sensible numbers for the minimum number of apps and maximum time window required in order to generate a detection event. This would likely need customizing to individual environments based on what number of applications are typical for a user to have access to.",{"data":43346,"content":43347,"nodeType":866},{},[43348,43352,43361],{"data":43349,"marks":43350,"value":43351,"nodeType":865},{},[],"For more general Okta detection rule options, consider checking out the Okta rules contained in the open-source ",{"data":43353,"content":43355,"nodeType":1102},{"uri":43354},"https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta",[43356],{"data":43357,"marks":43358,"value":43360,"nodeType":865},{},[43359],{"type":4537},"Sigma rule repository on GitHub",{"data":43362,"marks":43363,"value":1151,"nodeType":865},{},[],{"data":43365,"content":43366,"nodeType":948},{},[43367],{"data":43368,"marks":43369,"value":43370,"nodeType":865},{},[],"Guidance for incident response",{"data":43372,"content":43373,"nodeType":866},{},[43374],{"data":43375,"marks":43376,"value":43377,"nodeType":865},{},[],"If there is one key takeaway from this article, it’s that responding to an Okta account compromise isn’t as simple as disabling the user’s Okta account and/or resetting passwords and MFA factors.",{"data":43379,"content":43380,"nodeType":866},{},[43381],{"data":43382,"marks":43383,"value":43384,"nodeType":865},{},[],"Once an attacker has compromised an Okta account, it should be initially assumed that all connected application accounts are also compromised, whether they use SAML, OIDC or SWA. ",{"data":43386,"content":43387,"nodeType":866},{},[43388],{"data":43389,"marks":43390,"value":43391,"nodeType":865},{},[],"If SWA is used, incident responders should also explore whether those passwords are compromised and whether any other accounts that potentially share those passwords are compromised. ",{"data":43393,"content":43394,"nodeType":866},{},[43395],{"data":43396,"marks":43397,"value":43398,"nodeType":865},{},[],"We’re going to assume all applications/credentials were accessed for the following containment advice, as it’s likely that even moderately-skilled attackers would have tools to automate this. ",{"data":43400,"content":43401,"nodeType":866},{},[43402],{"data":43403,"marks":43404,"value":43405,"nodeType":865},{},[],"A full belt and braces containment exercise would involve the following activities:",{"data":43407,"content":43408,"nodeType":891},{},[43409,43419,43429,43439],{"data":43410,"content":43411,"nodeType":880},{},[43412],{"data":43413,"content":43414,"nodeType":866},{},[43415],{"data":43416,"marks":43417,"value":43418,"nodeType":865},{},[],"Disabling/resetting the Okta account",{"data":43420,"content":43421,"nodeType":880},{},[43422],{"data":43423,"content":43424,"nodeType":866},{},[43425],{"data":43426,"marks":43427,"value":43428,"nodeType":865},{},[],"Disabling/resetting every single connected application account",{"data":43430,"content":43431,"nodeType":880},{},[43432],{"data":43433,"content":43434,"nodeType":866},{},[43435],{"data":43436,"marks":43437,"value":43438,"nodeType":865},{},[],"Identifying any other accounts that may share compromised SWA passwords for investigation and disabling/resetting",{"data":43440,"content":43441,"nodeType":880},{},[43442],{"data":43443,"content":43444,"nodeType":866},{},[43445],{"data":43446,"marks":43447,"value":43448,"nodeType":865},{},[],"Investigating every connected application account for signs of backdooring through multiple persistence techniques",{"data":43450,"content":43451,"nodeType":866},{},[43452],{"data":43453,"marks":43454,"value":43455,"nodeType":865},{},[],"The last point on investigating potential backdoors is particularly important because of the following reasons:",{"data":43457,"content":43458,"nodeType":891},{},[43459,43489],{"data":43460,"content":43461,"nodeType":880},{},[43462],{"data":43463,"content":43464,"nodeType":866},{},[43465,43469,43476,43479,43486],{"data":43466,"marks":43467,"value":43468,"nodeType":865},{},[],"Even if every application user account is temporarily disabled while passwords are reset etc, re-enabling the account could re-activate the attacker’s access if they have made use of persistence techniques like ",{"data":43470,"content":43471,"nodeType":1102},{"uri":6472},[43472],{"data":43473,"marks":43474,"value":26459,"nodeType":865},{},[43475],{"type":4537},{"data":43477,"marks":43478,"value":1913,"nodeType":865},{},[],{"data":43480,"content":43481,"nodeType":1102},{"uri":5377},[43482],{"data":43483,"marks":43484,"value":5383,"nodeType":865},{},[43485],{"type":4537},{"data":43487,"marks":43488,"value":21,"nodeType":865},{},[],{"data":43490,"content":43491,"nodeType":880},{},[43492],{"data":43493,"content":43494,"nodeType":866},{},[43495,43499,43507],{"data":43496,"marks":43497,"value":43498,"nodeType":865},{},[],"Even if all application user accounts are disabled, even permanently, techniques like ",{"data":43500,"content":43501,"nodeType":1102},{"uri":35719},[43502],{"data":43503,"marks":43504,"value":43506,"nodeType":865},{},[43505],{"type":4537},"link sharing",{"data":43508,"marks":43509,"value":43510,"nodeType":865},{},[]," can enable attackers to maintain access to data because link sharing decouples the access from being reliant on control of a user account.",{"data":43512,"content":43513,"nodeType":948},{},[43514],{"data":43515,"marks":43516,"value":43517,"nodeType":865},{},[],"Impact",{"data":43519,"content":43520,"nodeType":866},{},[43521],{"data":43522,"marks":43523,"value":43524,"nodeType":865},{},[],"We’ve covered a lot of ground here, so let’s take a quick step back to understand the key points of impact:",{"data":43526,"content":43527,"nodeType":891},{},[43528,43538,43548,43558,43568,43578],{"data":43529,"content":43530,"nodeType":880},{},[43531],{"data":43532,"content":43533,"nodeType":866},{},[43534],{"data":43535,"marks":43536,"value":43537,"nodeType":865},{},[],"Attackers can extract passwords for SWA apps, even if password reveal has been disabled - to be clear, this is not a bug, it’s just a technical limitation on how this style of password manager login has to work",{"data":43539,"content":43540,"nodeType":880},{},[43541],{"data":43542,"content":43543,"nodeType":866},{},[43544],{"data":43545,"marks":43546,"value":43547,"nodeType":865},{},[],"SWA passwords set by administrators should not be considered secret from the users as they can be accessed via the extension API",{"data":43549,"content":43550,"nodeType":880},{},[43551],{"data":43552,"content":43553,"nodeType":866},{},[43554],{"data":43555,"marks":43556,"value":43557,"nodeType":865},{},[],"Attackers gaining temporary control of an Okta user account can establish authenticated sessions with SAML/OIDC applications. ",{"data":43559,"content":43560,"nodeType":880},{},[43561],{"data":43562,"content":43563,"nodeType":866},{},[43564],{"data":43565,"marks":43566,"value":43567,"nodeType":865},{},[],"These sessions won’t automatically be revoked if the Okta user account is disabled/reset in response to compromise",{"data":43569,"content":43570,"nodeType":880},{},[43571],{"data":43572,"content":43573,"nodeType":866},{},[43574],{"data":43575,"marks":43576,"value":43577,"nodeType":865},{},[],"There are multiple common attack techniques to gain persistent access to SaaS applications.  ",{"data":43579,"content":43580,"nodeType":880},{},[43581],{"data":43582,"content":43583,"nodeType":866},{},[43584],{"data":43585,"marks":43586,"value":43587,"nodeType":865},{},[],"An attacker can potentially gain permanent access to many connected Okta applications even if efforts are made to reset individual application accounts",{"data":43589,"content":43590,"nodeType":948},{},[43591],{"data":43592,"marks":43593,"value":6758,"nodeType":865},{},[],{"data":43595,"content":43596,"nodeType":866},{},[43597],{"data":43598,"marks":43599,"value":43600,"nodeType":865},{},[],"While many of these attacks are not unique to Okta, it is one of the most widely used products because it supports many apps, but it supports these apps using methods that have very different risk profiles. ",{"data":43602,"content":43603,"nodeType":866},{},[43604],{"data":43605,"marks":43606,"value":43607,"nodeType":865},{},[],"From a security perspective (and whatever your chosen identity platform), our recommendation would be to use SAML (the strongest auth method) where possible. If that isn’t available, use OIDC. If neither is an option, use password managers (like SWA), which in practise leads to far less reused passwords. ",{"data":43609,"content":43610,"nodeType":866},{},[43611],{"data":43612,"marks":43613,"value":43614,"nodeType":865},{},[],"Unfortunately the state of modern cloud app landscape means that you will be paying a lot more to get many apps using federated SSO, and even then many will still not support this at any license tier, so the use of passwords is still going to be part of the solution.",{"data":43616,"content":43617,"nodeType":866},{},[43618],{"data":43619,"marks":43620,"value":43621,"nodeType":865},{},[],"As we have seen in this article, an attacker can use a compromised SSO session to perform a number of follow-up attacks. Whether using SWA or SAML/OIDC it’s possible to gain authenticated sessions on connected apps and also potentially backdoor access to them.",{"data":43623,"content":43624,"nodeType":866},{},[43625],{"data":43626,"marks":43627,"value":43628,"nodeType":865},{},[],"When using SWA, it’s additionally possible to extract SWA passwords even when password reveal is disabled and potentially gain access to passwords shared with other accounts. This requires additional actions as part of your breach recovery processes/play-books.",{"data":43630,"content":43631,"nodeType":866},{},[43632],{"data":43633,"marks":43634,"value":43635,"nodeType":865},{},[],"There are multiple log events that can be used by security teams to investigate and respond to Okta account compromises and potentially detect them too. Additionally, strong incident response procedures need to be in place for dealing with compromised Okta or any other SSO accounts that factor in the ability for an attacker to laterally move to all the connected applications. Therefore, plans need to include revoking their access to those as well and investigating them for signs of backdoor persistence techniques.",{"entries":43637},{"hyperlink":43638,"inline":43639,"block":43640},[],[],[43641,43648,43650,43657,43665,43673,43681,43685,43687,43694,43701,43708,43715,43721,43728],{"sys":43642,"__typename":2366,"title":43643,"caption":59,"layoutMode":59,"file":43644},{"id":42511},"SWA for Salesforce ",{"url":43645,"width":43646,"height":43647},"https://images.ctfassets.net/y1cdw1ablpvd/3aoL5dRRGM3VL3k6GDXmHg/db100cfc57bf0fa34bd822d5f475984f/image10.png",1053,1007,{"sys":43649,"__typename":4959,"type":17743,"ctaText":34829,"buttonLabel":34830,"buttonColour":4963,"buttonUrl":59},{"id":18832},{"sys":43651,"__typename":2366,"title":43652,"caption":59,"layoutMode":59,"file":43653},{"id":42715},"SWA configuration",{"url":43654,"width":43655,"height":43656},"https://images.ctfassets.net/y1cdw1ablpvd/78s95OShHAzkXFlc7e14Hd/b6ac238115249a5fe71080bf0142a9dc/image13.png",682,293,{"sys":43658,"__typename":2366,"title":43659,"caption":43660,"layoutMode":59,"file":43661},{"id":42765},"SWA credential details","Administrators can disable password reveal on a per-app basis, as can be seen by unchecking the box here",{"url":43662,"width":43663,"height":43664},"https://images.ctfassets.net/y1cdw1ablpvd/3FrFNvcjFdBXGtf0ynfLZ/b4d0f5d15787e8a084faeca8512e2725/image8.png",684,243,{"sys":43666,"__typename":2366,"title":43667,"caption":43668,"layoutMode":59,"file":43669},{"id":42771},"Salesforce login","When password reveal is disabled, users see this message and cannot request the credentials",{"url":43670,"width":43671,"height":43672},"https://images.ctfassets.net/y1cdw1ablpvd/6q0nLXJSCURTJWZblqT9vq/a69e68276777f1a9f3ad7ebe89ebc139/image6.png",326,532,{"sys":43674,"__typename":2366,"title":43675,"caption":43676,"layoutMode":59,"file":43677},{"id":42826},"Okta extension","Clicking the Salesforce login button triggers a web request which returns the data shown below (and which is visible to the user through for example the browser’s built-in devtools)",{"url":43678,"width":43679,"height":43680},"https://images.ctfassets.net/y1cdw1ablpvd/LyjRr43VyfcQWpzlV3EQ5/56081e155d8a3fcb8d3aa80def11ff26/image7.png",453,504,{"sys":43682,"__typename":17737,"name":43683,"type":228,"syntax":43684},{"id":42832},"Salesforce web request data","GET /api/plugin/2/app/salesforce/0oa5ybnree2VPL6EA0x7/flow?plugin_version=6.20.0-73.101.0 HTTP/2\n\n\n{\n  \"scripts\": {\n    \"script\": [\n      {\n        \"action\": [\n          {\n            \"id\": \"username\",\n            \"value\": \"lukejennings@bugcrowdninja.com\",\n            ...\n          },\n          {\n                        \"id\": \"password\",\n                       \"value\": \"MySalesforcePassword1\",\n            ...\n          },\n          {\n            \"type\": \"click\",\n\n\n\n            \"element\": \"css=input[id=\\\"Login\\\"]\",\n            ...\n          }\n        ],\n        \"name\": \"Login\"\n      }\n    ]\n  },\n  \"urls\": {\n    \"match\": [\n      {\n        \"exact\": false,\n        \"isRegex\": false,\n        \"matchFrames\": false,\n        \"url\": \"https://login.salesforce.com\",\n        \"scriptName\": \"Login\"\n      }\n    ]\n  },\n  \"annotated\": false,\n  \"hasEncryptedValues\": false,\n  \"appName\": \"salesforce\",\n  \"signOnModeType\": \"BROWSER_PLUGIN\"\n}\n",{"sys":43686,"__typename":4959,"type":42146,"ctaText":42147,"buttonLabel":42148,"buttonColour":14853,"buttonUrl":59},{"id":41922},{"sys":43688,"__typename":2366,"title":43689,"caption":59,"layoutMode":59,"file":43690},{"id":42963},"Password reveal API",{"url":43691,"width":43692,"height":43693},"https://images.ctfassets.net/y1cdw1ablpvd/4mqIfbFwKPhLepm4he2skV/194964f3261c5a9e564899068049e54d/image3.png",676,130,{"sys":43695,"__typename":2366,"title":43696,"caption":59,"layoutMode":59,"file":43697},{"id":42969},"Password reveal API 2",{"url":43698,"width":43699,"height":43700},"https://images.ctfassets.net/y1cdw1ablpvd/66tquT2FlW6ZEkzwu3eGH1/292c902f9a364e2dc3b25506ac4ecb13/image11.png",1069,463,{"sys":43702,"__typename":2366,"title":43703,"caption":59,"layoutMode":59,"file":43704},{"id":43026},"Okta token storage",{"url":43705,"width":43706,"height":43707},"https://images.ctfassets.net/y1cdw1ablpvd/3JyyiqyemQR7HeztvdB98u/a35a82a49e4ef168579a52de66ea6892/image14.png",906,404,{"sys":43709,"__typename":2366,"title":43710,"caption":59,"layoutMode":59,"file":43711},{"id":43032},"Okta token storage 2",{"url":43712,"width":43713,"height":43714},"https://images.ctfassets.net/y1cdw1ablpvd/1gUig6FNPvlAqGaqSoBrbM/36afab96a0c4d2a1ec4ac64a7c34f066/image4.png",898,361,{"sys":43716,"__typename":2366,"title":43717,"caption":59,"layoutMode":59,"file":43718},{"id":43045},"Okta internal POC",{"url":43719,"width":2444,"height":43720},"https://images.ctfassets.net/y1cdw1ablpvd/naYWcydapvxMisBc4I0d2/41e0b5e816b38927354e39d39414d97f/image5.png",350,{"sys":43722,"__typename":2366,"title":43723,"caption":59,"layoutMode":59,"file":43724},{"id":43288},"Okta log events",{"url":43725,"width":43726,"height":43727},"https://images.ctfassets.net/y1cdw1ablpvd/7g9KCqO9mqC9mxaJH4O8u5/8062fc4441cd42371c0a97642a6d8de5/image2.png",999,283,{"sys":43729,"__typename":2366,"title":43730,"caption":59,"layoutMode":59,"file":43731},{"id":43336},"Logs generated by our internal SWA password dumping tool",{"url":43732,"width":43733,"height":43734},"https://images.ctfassets.net/y1cdw1ablpvd/3Ok01IBCObf6bsLmOeWLA1/727605fae8500d4e9c2284299ea82617/image1.png",1016,724,{"items":43736},[],{},"Abusing Okta's SWA authentication method","threat-research","2023-11-30T00:00:00.000Z",{"items":43742},[43743,45067,45817],{"__typename":2239,"sys":43744,"content":43746,"title":45054,"synopsis":43763,"hashTags":59,"publishedDate":45055,"slug":45056,"tagsCollection":45057,"authorsCollection":45063},{"id":43745},"3JXKiUMGU8JBpndhLRYOCJ",{"json":43747},{"data":43748,"content":43749,"nodeType":2232},{},[43750,43757,43764,43770,43777,43799,43806,43812,43819,43826,43833,43868,43874,43881,43999,44006,44013,44269,44276,44283,44289,44322,44329,44336,44342,44349,44355,44362,44369,44375,44382,44389,44395,44402,44409,44415,44422,44438,44444,44451,44484,44491,44511,44518,44525,44532,44538,44576,44596,44650,44657,44664,44684,44703,44710,44743,44749,44756,44763,44770,44777,44784,44791,44811,44817,44824,44843,44850,44857,44863,44870,44877,44883,44890,44936,44943,44949,44956,44962,44969,44976,45009,45015,45022,45029,45036,45043,45048],{"data":43751,"content":43752,"nodeType":866},{},[43753],{"data":43754,"marks":43755,"value":43756,"nodeType":865},{},[],"With the proliferation of SaaS apps and integrations comes an equal helping of uncertainty surrounding the associated security risks. If you’ve ever found yourself in a position where you’ve had to review a SaaS app integration, whether it’s during the remediation stage of an incident or simply during the process of tending to a user request, then keep on reading. ",{"data":43758,"content":43759,"nodeType":866},{},[43760],{"data":43761,"marks":43762,"value":43763,"nodeType":865},{},[],"This article covers common ways an app could lead to compromise in Microsoft Azure, and what to look out for when determining risk to your organization.",{"data":43765,"content":43766,"nodeType":948},{},[43767],{"data":43768,"marks":43769,"value":11689,"nodeType":865},{},[],{"data":43771,"content":43772,"nodeType":1218},{},[43773],{"data":43774,"marks":43775,"value":43776,"nodeType":865},{},[],"The issue:",{"data":43778,"content":43779,"nodeType":866},{},[43780,43784,43795],{"data":43781,"marks":43782,"value":43783,"nodeType":865},{},[],"This method of compromising user accounts has been covered a ",{"data":43785,"content":43789,"nodeType":1038},{"target":43786},{"sys":43787},{"id":43788,"type":904,"linkType":905},"1bV8YTSQHvveCTnRc4H8su",[43790],{"data":43791,"marks":43792,"value":43794,"nodeType":865},{},[43793],{"type":4537},"few times",{"data":43796,"marks":43797,"value":43798,"nodeType":865},{},[]," by Push. Without rehashing too much of the content, the main idea behind consent phishing is to get a user to perform an integration while the app masquerades as something official. ",{"data":43800,"content":43801,"nodeType":866},{},[43802],{"data":43803,"marks":43804,"value":43805,"nodeType":865},{},[],"As an example, a user is sent an email where the content is either surprisingly legitimate, or sparks sufficient curiosity to make them want to access the data behind the link. They are directed to a Microsoft or Google login page, where the app asks for certain permissions, such as mailbox access. The user, having performed these actions before, thinks nothing of it and clicks ‘allow’. The attacker successfully tricked the user to give them access to their mailbox (or whichever privileges the app was requesting).",{"data":43807,"content":43811,"nodeType":907},{"target":43808},{"sys":43809},{"id":43810,"type":904,"linkType":905},"2zeeE8NrgX4MnpHdIjszot",[],{"data":43813,"content":43814,"nodeType":1218},{},[43815],{"data":43816,"marks":43817,"value":43818,"nodeType":865},{},[],"The solution:",{"data":43820,"content":43821,"nodeType":866},{},[43822],{"data":43823,"marks":43824,"value":43825,"nodeType":865},{},[],"There are two ways to help prevent this type of compromise:",{"data":43827,"content":43828,"nodeType":866},{},[43829],{"data":43830,"marks":43831,"value":43832,"nodeType":865},{},[],"The first is to go the “block everything” route by preventing any integrations from being added to your tenants at all. This is quite heavy-handed and a bit like throwing the baby out with the bathwater, as this approach leads to IT/security departments becoming known as the departments of ‘NO’, potentially resulting in users circumventing controls, and the emergence of shadow IT.",{"data":43834,"content":43835,"nodeType":866},{},[43836,43840,43849,43853,43864],{"data":43837,"marks":43838,"value":43839,"nodeType":865},{},[],"The second is to be sensible about what to allow and what to prevent during SaaS integrations. For instance, in Microsoft 365 administrators are able to ",{"data":43841,"content":43843,"nodeType":1102},{"uri":43842},"https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/configure-permission-classifications",[43844],{"data":43845,"marks":43846,"value":43848,"nodeType":865},{},[43847],{"type":4537},"specify low-risk scopes",{"data":43850,"marks":43851,"value":43852,"nodeType":865},{},[],", such as ones specifically used for performing social logins (which are okay to do ",{"data":43854,"content":43858,"nodeType":1038},{"target":43855},{"sys":43856},{"id":43857,"type":904,"linkType":905},"68syxk4cmD6QOdVRcDqgEZ",[43859],{"data":43860,"marks":43861,"value":43863,"nodeType":865},{},[43862],{"type":4537},"by the way",{"data":43865,"marks":43866,"value":43867,"nodeType":865},{},[],"). Admins can then allow employees to perform social logins, and integrate apps making use of other low-risk scopes from  verified apps only. Employees can also request access to anything requiring other scopes. This is a great way to enable users to perform their jobs, while preventing them from accidentally exposing themselves or the wider organization to unnecessary risk.",{"data":43869,"content":43873,"nodeType":907},{"target":43870},{"sys":43871},{"id":43872,"type":904,"linkType":905},"44NsMwlLpX4qnZP94GyTSO",[],{"data":43875,"content":43876,"nodeType":866},{},[43877],{"data":43878,"marks":43879,"value":43880,"nodeType":865},{},[],"When configuring the above for the first time, Microsoft provides a list of 5 scopes:",{"data":43882,"content":43883,"nodeType":1197},{},[43884,43907,43930,43953,43976],{"data":43885,"content":43886,"nodeType":1014},{},[43887,43897],{"data":43888,"content":43889,"nodeType":1043},{},[43890],{"data":43891,"content":43892,"nodeType":866},{},[43893],{"data":43894,"marks":43895,"value":43896,"nodeType":865},{},[],"profile",{"data":43898,"content":43899,"nodeType":1043},{},[43900],{"data":43901,"content":43902,"nodeType":866},{},[43903],{"data":43904,"marks":43905,"value":43906,"nodeType":865},{},[],"View user's basic profile",{"data":43908,"content":43909,"nodeType":1014},{},[43910,43920],{"data":43911,"content":43912,"nodeType":1043},{},[43913],{"data":43914,"content":43915,"nodeType":866},{},[43916],{"data":43917,"marks":43918,"value":43919,"nodeType":865},{},[],"openid",{"data":43921,"content":43922,"nodeType":1043},{},[43923],{"data":43924,"content":43925,"nodeType":866},{},[43926],{"data":43927,"marks":43928,"value":43929,"nodeType":865},{},[],"Sign users in",{"data":43931,"content":43932,"nodeType":1014},{},[43933,43943],{"data":43934,"content":43935,"nodeType":1043},{},[43936],{"data":43937,"content":43938,"nodeType":866},{},[43939],{"data":43940,"marks":43941,"value":43942,"nodeType":865},{},[],"email",{"data":43944,"content":43945,"nodeType":1043},{},[43946],{"data":43947,"content":43948,"nodeType":866},{},[43949],{"data":43950,"marks":43951,"value":43952,"nodeType":865},{},[],"View user's email address",{"data":43954,"content":43955,"nodeType":1014},{},[43956,43966],{"data":43957,"content":43958,"nodeType":1043},{},[43959],{"data":43960,"content":43961,"nodeType":866},{},[43962],{"data":43963,"marks":43964,"value":43965,"nodeType":865},{},[],"User.Read",{"data":43967,"content":43968,"nodeType":1043},{},[43969],{"data":43970,"content":43971,"nodeType":866},{},[43972],{"data":43973,"marks":43974,"value":43975,"nodeType":865},{},[],"Sign in and read user profile",{"data":43977,"content":43978,"nodeType":1014},{},[43979,43989],{"data":43980,"content":43981,"nodeType":1043},{},[43982],{"data":43983,"content":43984,"nodeType":866},{},[43985],{"data":43986,"marks":43987,"value":43988,"nodeType":865},{},[],"Offline_access",{"data":43990,"content":43991,"nodeType":1043},{},[43992],{"data":43993,"content":43994,"nodeType":866},{},[43995],{"data":43996,"marks":43997,"value":43998,"nodeType":865},{},[],"Maintain access to data you. have given it access to (refresh tokens)",{"data":44000,"content":44001,"nodeType":866},{},[44002],{"data":44003,"marks":44004,"value":44005,"nodeType":865},{},[],"The above scopes are the minimum required to enable social logins to take place, and would cover a good amount of apps that only require basic information for account creation purposes. ",{"data":44007,"content":44008,"nodeType":866},{},[44009],{"data":44010,"marks":44011,"value":44012,"nodeType":865},{},[],"If you’d like to go a step further, you should also consider approving the following to allow users to integrate these relatively common scopes from verified apps:",{"data":44014,"content":44015,"nodeType":1197},{},[44016,44039,44062,44085,44108,44131,44154,44177,44200,44223,44246],{"data":44017,"content":44018,"nodeType":1014},{},[44019,44029],{"data":44020,"content":44021,"nodeType":1043},{},[44022],{"data":44023,"content":44024,"nodeType":866},{},[44025],{"data":44026,"marks":44027,"value":44028,"nodeType":865},{},[],"Calendars.Read",{"data":44030,"content":44031,"nodeType":1043},{},[44032],{"data":44033,"content":44034,"nodeType":866},{},[44035],{"data":44036,"marks":44037,"value":44038,"nodeType":865},{},[],"Read user calendars",{"data":44040,"content":44041,"nodeType":1014},{},[44042,44052],{"data":44043,"content":44044,"nodeType":1043},{},[44045],{"data":44046,"content":44047,"nodeType":866},{},[44048],{"data":44049,"marks":44050,"value":44051,"nodeType":865},{},[],"Calendars.ReadWrite",{"data":44053,"content":44054,"nodeType":1043},{},[44055],{"data":44056,"content":44057,"nodeType":866},{},[44058],{"data":44059,"marks":44060,"value":44061,"nodeType":865},{},[],"Have full access to user calendars",{"data":44063,"content":44064,"nodeType":1014},{},[44065,44075],{"data":44066,"content":44067,"nodeType":1043},{},[44068],{"data":44069,"content":44070,"nodeType":866},{},[44071],{"data":44072,"marks":44073,"value":44074,"nodeType":865},{},[],"Calendars.ReadWrite.Shared",{"data":44076,"content":44077,"nodeType":1043},{},[44078],{"data":44079,"content":44080,"nodeType":866},{},[44081],{"data":44082,"marks":44083,"value":44084,"nodeType":865},{},[],"Read and write user and shared calendars",{"data":44086,"content":44087,"nodeType":1014},{},[44088,44098],{"data":44089,"content":44090,"nodeType":1043},{},[44091],{"data":44092,"content":44093,"nodeType":866},{},[44094],{"data":44095,"marks":44096,"value":44097,"nodeType":865},{},[],"Contacts.Read",{"data":44099,"content":44100,"nodeType":1043},{},[44101],{"data":44102,"content":44103,"nodeType":866},{},[44104],{"data":44105,"marks":44106,"value":44107,"nodeType":865},{},[],"Read user contacts",{"data":44109,"content":44110,"nodeType":1014},{},[44111,44121],{"data":44112,"content":44113,"nodeType":1043},{},[44114],{"data":44115,"content":44116,"nodeType":866},{},[44117],{"data":44118,"marks":44119,"value":44120,"nodeType":865},{},[],"Contacts.Read.Shared",{"data":44122,"content":44123,"nodeType":1043},{},[44124],{"data":44125,"content":44126,"nodeType":866},{},[44127],{"data":44128,"marks":44129,"value":44130,"nodeType":865},{},[],"Read user and shared contacts",{"data":44132,"content":44133,"nodeType":1014},{},[44134,44144],{"data":44135,"content":44136,"nodeType":1043},{},[44137],{"data":44138,"content":44139,"nodeType":866},{},[44140],{"data":44141,"marks":44142,"value":44143,"nodeType":865},{},[],"Contacts.ReadWrite",{"data":44145,"content":44146,"nodeType":1043},{},[44147],{"data":44148,"content":44149,"nodeType":866},{},[44150],{"data":44151,"marks":44152,"value":44153,"nodeType":865},{},[],"Have full access to user contacts",{"data":44155,"content":44156,"nodeType":1014},{},[44157,44167],{"data":44158,"content":44159,"nodeType":1043},{},[44160],{"data":44161,"content":44162,"nodeType":866},{},[44163],{"data":44164,"marks":44165,"value":44166,"nodeType":865},{},[],"Contacts.ReadWrite.Shared",{"data":44168,"content":44169,"nodeType":1043},{},[44170],{"data":44171,"content":44172,"nodeType":866},{},[44173],{"data":44174,"marks":44175,"value":44176,"nodeType":865},{},[],"Read and write user and shared contacts",{"data":44178,"content":44179,"nodeType":1014},{},[44180,44190],{"data":44181,"content":44182,"nodeType":1043},{},[44183],{"data":44184,"content":44185,"nodeType":866},{},[44186],{"data":44187,"marks":44188,"value":44189,"nodeType":865},{},[],"People.Read",{"data":44191,"content":44192,"nodeType":1043},{},[44193],{"data":44194,"content":44195,"nodeType":866},{},[44196],{"data":44197,"marks":44198,"value":44199,"nodeType":865},{},[],"Read users' relevant people lists",{"data":44201,"content":44202,"nodeType":1014},{},[44203,44213],{"data":44204,"content":44205,"nodeType":1043},{},[44206],{"data":44207,"content":44208,"nodeType":866},{},[44209],{"data":44210,"marks":44211,"value":44212,"nodeType":865},{},[],"Files.Read.Selected",{"data":44214,"content":44215,"nodeType":1043},{},[44216],{"data":44217,"content":44218,"nodeType":866},{},[44219],{"data":44220,"marks":44221,"value":44222,"nodeType":865},{},[],"Read files that the user selects",{"data":44224,"content":44225,"nodeType":1014},{},[44226,44236],{"data":44227,"content":44228,"nodeType":1043},{},[44229],{"data":44230,"content":44231,"nodeType":866},{},[44232],{"data":44233,"marks":44234,"value":44235,"nodeType":865},{},[],"Files.ReadWrite.Selected",{"data":44237,"content":44238,"nodeType":1043},{},[44239],{"data":44240,"content":44241,"nodeType":866},{},[44242],{"data":44243,"marks":44244,"value":44245,"nodeType":865},{},[],"Read and write files that the user selects",{"data":44247,"content":44248,"nodeType":1014},{},[44249,44259],{"data":44250,"content":44251,"nodeType":1043},{},[44252],{"data":44253,"content":44254,"nodeType":866},{},[44255],{"data":44256,"marks":44257,"value":44258,"nodeType":865},{},[],"User.ReadWrite",{"data":44260,"content":44261,"nodeType":1043},{},[44262],{"data":44263,"content":44264,"nodeType":866},{},[44265],{"data":44266,"marks":44267,"value":44268,"nodeType":865},{},[],"Read and write access to user profile",{"data":44270,"content":44271,"nodeType":866},{},[44272],{"data":44273,"marks":44274,"value":44275,"nodeType":865},{},[],"We’ve determined these scopes to be relatively low-risk, but this would depend on the risk appetite of your organization. Pre-approving the scopes will go a long way towards enabling your users to make use of SaaS apps without raising unnecessary approval requests from your IT or security team.",{"data":44277,"content":44278,"nodeType":948},{},[44279],{"data":44280,"marks":44281,"value":44282,"nodeType":865},{},[],"Unverified apps",{"data":44284,"content":44285,"nodeType":1218},{},[44286],{"data":44287,"marks":44288,"value":43776,"nodeType":865},{},[],{"data":44290,"content":44291,"nodeType":866},{},[44292,44296,44305,44309,44318],{"data":44293,"marks":44294,"value":44295,"nodeType":865},{},[],"First, let’s define what causes an app to be classified as unverified. When you see an app in your tenant that’s marked as unverified, it means that the tenant that publishes the app has not gone through the ",{"data":44297,"content":44299,"nodeType":1102},{"uri":44298},"https://learn.microsoft.com/en-gb/azure/active-directory/develop/publisher-verification-overview",[44300],{"data":44301,"marks":44302,"value":44304,"nodeType":865},{},[44303],{"type":4537},"Publisher Verification",{"data":44306,"marks":44307,"value":44308,"nodeType":865},{},[]," process. Going through the verification process requires the publisher to have a Microsoft Partner Network (MPN) account, which typically involves ",{"data":44310,"content":44312,"nodeType":1102},{"uri":44311},"https://learn.microsoft.com/en-us/partner-center/verification-responses",[44313],{"data":44314,"marks":44315,"value":44317,"nodeType":865},{},[44316],{"type":4537},"verifying",{"data":44319,"marks":44320,"value":44321,"nodeType":865},{},[]," their business address, email address, and a few additional due diligence tasks. ",{"data":44323,"content":44324,"nodeType":866},{},[44325],{"data":44326,"marks":44327,"value":44328,"nodeType":865},{},[],"While I’m sure this is not a 100% infallible process, at the very least it provides you with the confidence that someone at Microsoft had reached out to the company and spoken to someone who claims they are who they say they are. This is opposed to a random person creating a Microsoft Azure tenant and marking their app as being published by Adobe, as an example.",{"data":44330,"content":44331,"nodeType":866},{},[44332],{"data":44333,"marks":44334,"value":44335,"nodeType":865},{},[],"At Push, we’ve noticed plenty of unverified apps published by legitimate vendors. This could be related to vendors having multiple tenants, and not having completed the verification process across all yet. As an example, we have a few of Adobe’s apps for Microsoft 365:",{"data":44337,"content":44341,"nodeType":907},{"target":44338},{"sys":44339},{"id":44340,"type":904,"linkType":905},"4eDWZKrMau1AfU4pXgOW42",[],{"data":44343,"content":44344,"nodeType":866},{},[44345],{"data":44346,"marks":44347,"value":44348,"nodeType":865},{},[],"In the above image, we have a verified app from Adobe, Inc. We know this due to the ‘Verified Publisher’ attribute that is included when parsing the information provided by Microsoft. We can also see that the only reply url is one associated directly with Adobe – adobe.com. Next, we have an unverified app:",{"data":44350,"content":44354,"nodeType":907},{"target":44351},{"sys":44352},{"id":44353,"type":904,"linkType":905},"5e5RhdYiMh0Q3CZzmNoRDI",[],{"data":44356,"content":44357,"nodeType":866},{},[44358],{"data":44359,"marks":44360,"value":44361,"nodeType":865},{},[],"This app does not include the ‘verified publisher’ attribute when reading the information provided by Microsoft. However, the app only has one reply url, and this is again a subdomain of adobe.com.",{"data":44363,"content":44364,"nodeType":866},{},[44365],{"data":44366,"marks":44367,"value":44368,"nodeType":865},{},[],"The takeaway here is that not all unverified apps are malicious. More often than not it’s related to the vendor not having gone through the verification process, but this means it unfortunately becomes the security team’s burden to figure out.",{"data":44370,"content":44371,"nodeType":1218},{},[44372],{"data":44373,"marks":44374,"value":43818,"nodeType":865},{},[],{"data":44376,"content":44377,"nodeType":866},{},[44378],{"data":44379,"marks":44380,"value":44381,"nodeType":865},{},[],"At Push, we attempt to review every application we come across to determine if it's legit and whether it belongs to the vendor it claims to originate from. There are multiple ways to do this, but as a general rule of thumb if all the app’s reply urls are associated with the vendor, you are good. You can perform an integration from the app’s website to verify that the particular app ID (seen in the metadata tag above) is the one you are looking at in your environment.",{"data":44383,"content":44384,"nodeType":948},{},[44385],{"data":44386,"marks":44387,"value":44388,"nodeType":865},{},[],"Apps with excessive privileges",{"data":44390,"content":44391,"nodeType":1218},{},[44392],{"data":44393,"marks":44394,"value":43776,"nodeType":865},{},[],{"data":44396,"content":44397,"nodeType":866},{},[44398],{"data":44399,"marks":44400,"value":44401,"nodeType":865},{},[],"When you first start doing deep dives on permissions associated with apps in your environment, you find yourself looking at some apps and wonder out loud “we’re granting this vendor access to what?!",{"data":44403,"content":44404,"nodeType":866},{},[44405],{"data":44406,"marks":44407,"value":44408,"nodeType":865},{},[],"It’s a totally normal response, but don't worry, we’re here to help. Let’s take diagrams.net as an example:",{"data":44410,"content":44414,"nodeType":907},{"target":44411},{"sys":44412},{"id":44413,"type":904,"linkType":905},"7DcPUSZ0nDYKmIy4E9xEHs",[],{"data":44416,"content":44417,"nodeType":866},{},[44418],{"data":44419,"marks":44420,"value":44421,"nodeType":865},{},[],"At first glance this doesn’t seem too bad. For the purposes of this example, let’s say the app was approved by 49 users. That means if diagrams.net got compromised, an attacker would potentially have access to 49 of your user’s OneDrive files. “That’s OK!” you say. “This will only affect a handful of files they’ve been working on locally. Our policy specifies that any company data, specifically data containing PII, be stored in SharePoint.”",{"data":44423,"content":44424,"nodeType":866},{},[44425,44429,44434],{"data":44426,"marks":44427,"value":44428,"nodeType":865},{},[],"And then comes the part where you notice the following permission: ",{"data":44430,"marks":44431,"value":44433,"nodeType":865},{},[44432],{"type":979},"Sites.Read.All",{"data":44435,"marks":44436,"value":44437,"nodeType":865},{},[],". This permission gives the application the ability to read every file across all SharePoint sites in your organization (that the users have permission to access.) Suddenly the scope of data access is much larger than you hoped.",{"data":44439,"content":44440,"nodeType":1218},{},[44441],{"data":44442,"marks":44443,"value":43818,"nodeType":865},{},[],{"data":44445,"content":44446,"nodeType":866},{},[44447],{"data":44448,"marks":44449,"value":44450,"nodeType":865},{},[],"When faced with the dilemma of granting apps access to resources within your organization, the best course of action is to do a risk assessment.",{"data":44452,"content":44453,"nodeType":866},{},[44454,44458,44467,44471,44480],{"data":44455,"marks":44456,"value":44457,"nodeType":865},{},[],"This requires some good ol’ googling and reviewing the security policies of the app’s creator. You ideally also want to know who they use to process your data. Through this process, I found a ",{"data":44459,"content":44461,"nodeType":1102},{"uri":44460},"https://www.diagrams.net/blog/data-protection",[44462],{"data":44463,"marks":44464,"value":44466,"nodeType":865},{},[44465],{"type":4537},"blog post",{"data":44468,"marks":44469,"value":44470,"nodeType":865},{},[]," on diagrams.net detailing their approach to security and user privacy. They do make note that they don’t ",{"data":44472,"content":44474,"nodeType":1102},{"uri":44473},"https://www.diagrams.net/blog/data-protection#:~:text=Because%20your%20sensitive%20diagram%20data%20doesn%E2%80%99t%20leave%20your%20infrastructure%20and%20is%20never%20stored%20on%20the%20diagrams.net%20servers%2C%20diagrams.net%20is%20a%20tool%20which%20lets%20you%20comply%20with%20data%20protection%20certifications%20(ISO%2027000%2C%2027001%20and%2027002)%20and%20the%20GDPR.",[44475],{"data":44476,"marks":44477,"value":44479,"nodeType":865},{},[44478],{"type":4537},"store any sensitive customer data data on their servers",{"data":44481,"marks":44482,"value":44483,"nodeType":865},{},[],", and thus let you comply with GDPR, ISO 2700* etc. certifications if you use their services.",{"data":44485,"content":44486,"nodeType":866},{},[44487],{"data":44488,"marks":44489,"value":44490,"nodeType":865},{},[],"While this is great from a tick box exercise perspective, this doesn’t address the original concern – how much risk are you taking on by letting their app integrate with your environment? What could an attacker who compromises diagrams.net have access to and how do you lessen the risk while still allowing employees to use the app?",{"data":44492,"content":44493,"nodeType":866},{},[44494,44498,44507],{"data":44495,"marks":44496,"value":44497,"nodeType":865},{},[],"Further in the same blog post, they link to a GitHub ",{"data":44499,"content":44501,"nodeType":1102},{"uri":44500},"https://github.com/jgraph/security-privacy-legal",[44502],{"data":44503,"marks":44504,"value":44506,"nodeType":865},{},[44505],{"type":4537},"repository",{"data":44508,"marks":44509,"value":44510,"nodeType":865},{},[]," that contains their security and privacy processes, policies, and even some pentest reports. They do a great job of including this information, by the way, so cheers to diagrams.net!",{"data":44512,"content":44513,"nodeType":866},{},[44514],{"data":44515,"marks":44516,"value":44517,"nodeType":865},{},[],"At this point you should have a better understanding of the security of the vendor you’re integrating into your organization, and whether it’s okay to accept the risk. Documenting and adding the information you found to your risk register is also a good idea. Likely, you’ll be taking this information to your Information Security Manager for risk acceptance. ",{"data":44519,"content":44520,"nodeType":866},{},[44521],{"data":44522,"marks":44523,"value":44524,"nodeType":865},{},[],"We’re working on ways to provide this information to our clients through the Push app dashboard in future, too. Sign up or subscribe to our blog to get product updates when features like this are introduced. ",{"data":44526,"content":44527,"nodeType":948},{},[44528],{"data":44529,"marks":44530,"value":44531,"nodeType":865},{},[],"Hijackable urls and implicit grant flow",{"data":44533,"content":44534,"nodeType":1218},{},[44535],{"data":44536,"marks":44537,"value":43776,"nodeType":865},{},[],{"data":44539,"content":44540,"nodeType":866},{},[44541,44546,44556,44561,44571],{"data":44542,"marks":44543,"value":44545,"nodeType":865},{},[44544],{"type":979},"Developer side note: The implicit grant flow is no longer recommended due to security-related concerns and that it won’t function where ",{"data":44547,"content":44549,"nodeType":1102},{"uri":44548},"https://learn.microsoft.com/en-us/azure/active-directory/develop/reference-third-party-cookies-spas#:~:text=Many%20browsers%20block%20third%2Dparty%20cookies%2C%20cookies%20on%20requests%20to%20domains%20other%20than%20the%20domain%20shown%20in%20the%20browser%27s%20address%20bar.%20This%20block%20breaks%20the%20implicit%20flow%20and%20requires%20new%20authentication%20patterns%20to%20successfully%20sign%20in%20users.",[44550],{"data":44551,"marks":44552,"value":44555,"nodeType":865},{},[44553,44554],{"type":4537},{"type":979},"3rd party cookies are blocked in browsers",{"data":44557,"marks":44558,"value":44560,"nodeType":865},{},[44559],{"type":979},". Instead, you should switch to using the ",{"data":44562,"content":44564,"nodeType":1102},{"uri":44563},"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow",[44565],{"data":44566,"marks":44567,"value":44570,"nodeType":865},{},[44568,44569],{"type":4537},{"type":979},"authorization code flow",{"data":44572,"marks":44573,"value":44575,"nodeType":865},{},[44574],{"type":979}," if applicable to your requirements.",{"data":44577,"content":44578,"nodeType":866},{},[44579,44583,44592],{"data":44580,"marks":44581,"value":44582,"nodeType":865},{},[],"Let’s quickly go over how OAuth2’s implicit grant flow works so you can better understand how to spot potentially risky apps and integrations, and why this can result in a security concern. Microsoft provides a great ",{"data":44584,"content":44586,"nodeType":1102},{"uri":44585},"https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-implicit-grant-flow",[44587],{"data":44588,"marks":44589,"value":44591,"nodeType":865},{},[44590],{"type":4537},"breakdown",{"data":44593,"marks":44594,"value":44595,"nodeType":865},{},[]," of the implicit grant flow, however for the purposes of brevity (and simplicity), it does the following:",{"data":44597,"content":44598,"nodeType":44649},{},[44599,44609,44619,44629,44639],{"data":44600,"content":44601,"nodeType":880},{},[44602],{"data":44603,"content":44604,"nodeType":866},{},[44605],{"data":44606,"marks":44607,"value":44608,"nodeType":865},{},[],"A user goes to a web app and clicks a login link",{"data":44610,"content":44611,"nodeType":880},{},[44612],{"data":44613,"content":44614,"nodeType":866},{},[44615],{"data":44616,"marks":44617,"value":44618,"nodeType":865},{},[],"The web app redirects the user to authenticate and authorize the app. This is performed against your identity provider (in this example, Microsoft)",{"data":44620,"content":44621,"nodeType":880},{},[44622],{"data":44623,"content":44624,"nodeType":866},{},[44625],{"data":44626,"marks":44627,"value":44628,"nodeType":865},{},[],"If this is the first time authorizing the app, the user is presented with a list of scopes (permissions) the app will need access to, and the user clicks “approve”",{"data":44630,"content":44631,"nodeType":880},{},[44632],{"data":44633,"content":44634,"nodeType":866},{},[44635],{"data":44636,"marks":44637,"value":44638,"nodeType":865},{},[],"This responds with a token to one of the hard-coded reply urls associated with the app integration (e.g. https://apps.diagrams.net/microsoft as with the ‘Apps with excessive privileges’ example)",{"data":44640,"content":44641,"nodeType":880},{},[44642],{"data":44643,"content":44644,"nodeType":866},{},[44645],{"data":44646,"marks":44647,"value":44648,"nodeType":865},{},[],"The app uses the token to access the user’s resources with the permissions approved in step 3","ordered-list",{"data":44651,"content":44652,"nodeType":866},{},[44653],{"data":44654,"marks":44655,"value":44656,"nodeType":865},{},[],"Based on the flow above, if an attacker gets their hands on the token from step 4, they can perform requests as the user, granting them access to your resources. To get the token, you need to control one of the hardcoded reply url endpoints, and convince a user to authenticate to the app – perhaps via a phishing attack.",{"data":44658,"content":44659,"nodeType":866},{},[44660],{"data":44661,"marks":44662,"value":44663,"nodeType":865},{},[],"As an example, some of the apps we’ve reviewed contained reply urls which were subdomains of azurewebsites.net and ngrok.io. These urls don’t appear problematic at first. However, the urls could have been used during the development process, and were forgotten about at the conclusion of the project. During the review process we follow at Push, we found multiple examples of such urls that were no longer in use.",{"data":44665,"content":44666,"nodeType":866},{},[44667,44671,44680],{"data":44668,"marks":44669,"value":44670,"nodeType":865},{},[],"This could allow an attacker to register the urls and perform phishing attacks against organizations that use these particular apps, granting the attacker access to previously- approved scopes and resources. The outcome of this attack would be similar to ",{"data":44672,"content":44674,"nodeType":1102},{"uri":44673},"https://www.oauth.com/oauth2-servers/authorization/security-considerations/#:~:text=Redirect%20URL%20Manipulation",[44675],{"data":44676,"marks":44677,"value":44679,"nodeType":865},{},[44678],{"type":4537},"redirect URL manipulation",{"data":44681,"marks":44682,"value":44683,"nodeType":865},{},[],", but instead of taking advantage of an open or misconfigured redirect, the attacker is in control of the endpoint where the token ends up.",{"data":44685,"content":44686,"nodeType":866},{},[44687,44691,44699],{"data":44688,"marks":44689,"value":44690,"nodeType":865},{},[],"How would you even go about detecting if an app makes use of the implicit grant flow? This requires getting your hands dirty with making authorization requests to your tenant for the specific app ID, and passing the “response_type=token” parameter in the url. This should return an error if the app is not configured with the implicit grant flow. If you’d like to test this yourself, you can follow the “Run in Postman” link at the top of ",{"data":44692,"content":44693,"nodeType":1102},{"uri":44585},[44694],{"data":44695,"marks":44696,"value":44698,"nodeType":865},{},[44697],{"type":4537},"this article",{"data":44700,"marks":44701,"value":44702,"nodeType":865},{},[]," to make this process a bit easier.",{"data":44704,"content":44705,"nodeType":866},{},[44706],{"data":44707,"marks":44708,"value":44709,"nodeType":865},{},[],"Another example of a hijackable url includes dangling DNS records. Let’s say your app includes a reply url pointing to a legacy server used for development (eg. apptesting-dev.ctrlaltsecure.com). This server was hosted on an EC2 instance in AWS, and has long since been decommissioned. However, the IP address associated with the instance is still pointing to the same address. A determined attacker could potentially gain access to the IP address by spinning up resources until it’s assigned to them.",{"data":44711,"content":44712,"nodeType":866},{},[44713,44717,44726,44730,44739],{"data":44714,"marks":44715,"value":44716,"nodeType":865},{},[],"OWASP has ",{"data":44718,"content":44720,"nodeType":1102},{"uri":44719},"https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/10-Test_for_Subdomain_Takeover",[44721],{"data":44722,"marks":44723,"value":44725,"nodeType":865},{},[44724],{"type":4537},"published an article",{"data":44727,"marks":44728,"value":44729,"nodeType":865},{},[]," and HackerOne ",{"data":44731,"content":44733,"nodeType":1102},{"uri":44732},"https://www.hackerone.com/application-security/guide-subdomain-takeovers",[44734],{"data":44735,"marks":44736,"value":44738,"nodeType":865},{},[44737],{"type":4537},"posted a guide",{"data":44740,"marks":44741,"value":44742,"nodeType":865},{},[]," highlighting ways to take over subdomains , and it’s very easy to overlook.",{"data":44744,"content":44745,"nodeType":1218},{},[44746],{"data":44747,"marks":44748,"value":43818,"nodeType":865},{},[],{"data":44750,"content":44751,"nodeType":866},{},[44752],{"data":44753,"marks":44754,"value":44755,"nodeType":865},{},[],"Unfortunately there is no elegant solution to this problem, and it’s not easy to spot as you would need to review each url to see if it’s still in use, in addition to figuring out if the app makes use of the implicit grant flow. Even then, is the active url being used by the developer, or has an attacker already claimed it.",{"data":44757,"content":44758,"nodeType":866},{},[44759],{"data":44760,"marks":44761,"value":44762,"nodeType":865},{},[],"The best course of action here is likely to make use of a proxy that prevents users from accessing unclassified urls, or urls with a low reputation. However, you will risk breaking applications and making your developers angry. This also does not solve the dangling DNS issue, as with the EC2 instance problem above.",{"data":44764,"content":44765,"nodeType":866},{},[44766],{"data":44767,"marks":44768,"value":44769,"nodeType":865},{},[],"Another option is to contact vendors of apps that you’ve noticed including such urls in their apps and ask them to remove the stale entries from their apps.",{"data":44771,"content":44772,"nodeType":948},{},[44773],{"data":44774,"marks":44775,"value":44776,"nodeType":865},{},[],"You think you’ve been compromised. Now what?",{"data":44778,"content":44779,"nodeType":866},{},[44780],{"data":44781,"marks":44782,"value":44783,"nodeType":865},{},[],"\nRegardless of the method of compromise, there’s a few steps you can take to review what happened and to prevent further access into your environment.",{"data":44785,"content":44786,"nodeType":1218},{},[44787],{"data":44788,"marks":44789,"value":44790,"nodeType":865},{},[],"Review app sign-in logs",{"data":44792,"content":44793,"nodeType":866},{},[44794,44798,44807],{"data":44795,"marks":44796,"value":44797,"nodeType":865},{},[],"In Azure Active Directory, head to ",{"data":44799,"content":44801,"nodeType":1102},{"uri":44800},"https://portal.azure.com/#view/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/~/AppAppsPreview/menuId~/null",[44802],{"data":44803,"marks":44804,"value":44806,"nodeType":865},{},[44805],{"type":4537},"Enterprise applications",{"data":44808,"marks":44809,"value":44810,"nodeType":865},{},[]," and click on the app you want to review. In the new window, click on sign-in logs. You will be presented with a list of user sign-ins (interactive and non-interactive), service principal sign-ins, and managed identity sign-ins.",{"data":44812,"content":44816,"nodeType":907},{"target":44813},{"sys":44814},{"id":44815,"type":904,"linkType":905},"2L7vf2zjZBelGMJSjP2inY",[],{"data":44818,"content":44819,"nodeType":866},{},[44820],{"data":44821,"marks":44822,"value":44823,"nodeType":865},{},[],"What you typically need to look for is non-interactive user sign-in logs. Non-interactive sign-ins are related to login events performed on behalf of a user where usernames and passwords were not used (read: tokens). You want to review the sign-ins to determine if there were authentication events from IP addresses unrelated to normal employee activity, which can include discrepancies in geographical locations, and out-of-hours activity. Service principal sign-ins would also be of interest, however it would be more difficult to determine odd behavior as you wouldn’t have user sign-ins to compare with.",{"data":44825,"content":44826,"nodeType":866},{},[44827,44831,44839],{"data":44828,"marks":44829,"value":44830,"nodeType":865},{},[],"You could also review Azure’s ",{"data":44832,"content":44834,"nodeType":1102},{"uri":44833},"https://portal.azure.com/#view/Microsoft_AAD_IAM/SecurityMenuBlade/~/RiskySignIns",[44835],{"data":44836,"marks":44837,"value":44838,"nodeType":865},{},[],"risky sign-ins ",{"data":44840,"marks":44841,"value":44842,"nodeType":865},{},[],"page, as these issues are likely to show up already classified. Just make sure your filters include non-interactive sign-in methods.",{"data":44844,"content":44845,"nodeType":1218},{},[44846],{"data":44847,"marks":44848,"value":44849,"nodeType":865},{},[],"Review app audit logs",{"data":44851,"content":44852,"nodeType":866},{},[44853],{"data":44854,"marks":44855,"value":44856,"nodeType":865},{},[],"In the same window underneath sign-in logs, you’ll find the audit logs section. Audit logs will provide you with crucial information relating to when an app was integrated, by who, and which permissions were delegated.",{"data":44858,"content":44862,"nodeType":907},{"target":44859},{"sys":44860},{"id":44861,"type":904,"linkType":905},"5HRLoa9zlIWZdZGLN84Yae",[],{"data":44864,"content":44865,"nodeType":1218},{},[44866],{"data":44867,"marks":44868,"value":44869,"nodeType":865},{},[],"Disable the app",{"data":44871,"content":44872,"nodeType":866},{},[44873],{"data":44874,"marks":44875,"value":44876,"nodeType":865},{},[],"If you’ve determined that an app was involved in an incident, the first step would be to disable the app to prevent malicious actors from performing any further authentication. Under the application’s properties, change the setting “Enable for users to sign-in?” from “Yes” to “No”, followed by clicking “Save.”",{"data":44878,"content":44882,"nodeType":907},{"target":44879},{"sys":44880},{"id":44881,"type":904,"linkType":905},"12NnJ8OhD3K27rFRJ48t6a",[],{"data":44884,"content":44885,"nodeType":1218},{},[44886],{"data":44887,"marks":44888,"value":44889,"nodeType":865},{},[],"Revoke all refresh tokens",{"data":44891,"content":44892,"nodeType":866},{},[44893,44897,44906,44910,44919,44923,44932],{"data":44894,"marks":44895,"value":44896,"nodeType":865},{},[],"Disabling the app is not enough to prevent attackers from maintaining access to your environment. ",{"data":44898,"content":44900,"nodeType":1102},{"uri":44899},"https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens",[44901],{"data":44902,"marks":44903,"value":44905,"nodeType":865},{},[44904],{"type":4537},"Refresh tokens",{"data":44907,"marks":44908,"value":44909,"nodeType":865},{},[]," provide a way for apps to retrieve new access tokens without bugging users with pesky sign-in screens. Tokens are typically valid for between ",{"data":44911,"content":44913,"nodeType":1102},{"uri":44912},"https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens#access-token-lifetime:~:text=The%20default%20lifetime%20of%20an%20access%20token%20is%20variable.%20When%20issued%2C%20the%20default%20lifetime%20of%20an%20access%20token%20is%20assigned%20a%20random%20value%20ranging%20between%2060%2D90%20minutes%20(75%20minutes%20on%20average).",[44914],{"data":44915,"marks":44916,"value":44918,"nodeType":865},{},[44917],{"type":4537},"60 to 90 minutes",{"data":44920,"marks":44921,"value":44922,"nodeType":865},{},[],", and if a refresh token has been issued, the token holder can request new tokens for ",{"data":44924,"content":44926,"nodeType":1102},{"uri":44925},"https://learn.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens#:~:text=The%20default%20lifetime%20for%20the%20refresh%20tokens%20is%2024%20hours%20for%20single%20page%20apps%20and%2090%20days%20for%20all%20other%20scenarios",[44927],{"data":44928,"marks":44929,"value":44931,"nodeType":865},{},[44930],{"type":4537},"up to 90 days",{"data":44933,"marks":44934,"value":44935,"nodeType":865},{},[],"! ",{"data":44937,"content":44938,"nodeType":866},{},[44939],{"data":44940,"marks":44941,"value":44942,"nodeType":865},{},[],"So, revoking refresh tokens is an important step as part of the mitigation and recovery steps. This step can be performed with some PowerShell – luckily Microsoft provides pre-generated scripts for you to copy and paste. Click on ‘Permissions’ for the app, followed by ‘Review permissions.’ ",{"data":44944,"content":44948,"nodeType":907},{"target":44945},{"sys":44946},{"id":44947,"type":904,"linkType":905},"7vuFmlmZbzfNhWHPj8ToHm",[],{"data":44950,"content":44951,"nodeType":866},{},[44952],{"data":44953,"marks":44954,"value":44955,"nodeType":865},{},[],"In the new window, click on ‘This application is malicious and I’m compromised.’ This will present you with the necessary PowerShell scripts to remove users from the app, revoke all permissions granted to the app, and finally to revoke refresh tokens associated with the app.",{"data":44957,"content":44961,"nodeType":907},{"target":44958},{"sys":44959},{"id":44960,"type":904,"linkType":905},"4NnD6WKRHlnzKE0F4GUDEm",[],{"data":44963,"content":44964,"nodeType":1218},{},[44965],{"data":44966,"marks":44967,"value":44968,"nodeType":865},{},[],"What to do if the initial access token was stolen",{"data":44970,"content":44971,"nodeType":866},{},[44972],{"data":44973,"marks":44974,"value":44975,"nodeType":865},{},[],"The initial access token cannot be revoked. In practice, if an attacker has managed to steal an access token it will be valid for the remainder of its lifespan, which is typically one hour. This is true even if the account is disabled, the compromised app deleted, and all refresh tokens revoked. If you’re responding to an incident, you will need to keep an eye on audit logs for an hour or more after performing the above steps to make sure the valid access token wasn’t still being used to perform actions in the environment.",{"data":44977,"content":44978,"nodeType":866},{},[44979,44983,44992,44996,45005],{"data":44980,"marks":44981,"value":44982,"nodeType":865},{},[],"Microsoft’s response to this was to develop something called ",{"data":44984,"content":44986,"nodeType":1102},{"uri":44985},"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation",[44987],{"data":44988,"marks":44989,"value":44991,"nodeType":865},{},[44990],{"type":4537},"continuous access evaluation",{"data":44993,"marks":44994,"value":44995,"nodeType":865},{},[],". However, they admit in the article that it does not address a scenario where an attacker exfiltrated the token outside of a ",{"data":44997,"content":44999,"nodeType":1102},{"uri":44998},"https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation#:~:text=Token%20export%20to%20a%20machine%20outside%20of%20a%20trusted%20network%20can%20be%20prevented%20with%20Conditional%20Access%20location%20policies",[45000],{"data":45001,"marks":45002,"value":45004,"nodeType":865},{},[45003],{"type":4537},"trusted network",{"data":45006,"marks":45007,"value":45008,"nodeType":865},{},[],", in which case conditional access policy enforcement would be required to address the issue. Continuous access evaluation is ideal for handling specific cases of user access into the environment such as employee contract termination, or scenarios where conditional access policies are violated.",{"data":45010,"content":45011,"nodeType":948},{},[45012],{"data":45013,"marks":45014,"value":6758,"nodeType":865},{},[],{"data":45016,"content":45017,"nodeType":866},{},[45018],{"data":45019,"marks":45020,"value":45021,"nodeType":865},{},[],"This article should have given you a better understanding of the most common issues presented when reviewing SaaS apps integrated into your environment. ",{"data":45023,"content":45024,"nodeType":866},{},[45025],{"data":45026,"marks":45027,"value":45028,"nodeType":865},{},[],"Determining whether using an app would result in compromise is not a simple task, especially if you haven’t observed malicious behavior. As such, the best course of action is to consider all angles, which include the business case of users requiring its use, the permission scopes, and whether the vendor’s security practices are in line with your requirements.",{"data":45030,"content":45031,"nodeType":866},{},[45032],{"data":45033,"marks":45034,"value":45035,"nodeType":865},{},[],"SaaS is a new(ish) frontier that can be really daunting to defend against attackers, but it's not impossible to reduce risk without simply blocking access to SaaS. And, remember: denying users access to tools will make them find ways around the limitations.",{"data":45037,"content":45038,"nodeType":866},{},[45039],{"data":45040,"marks":45041,"value":45042,"nodeType":865},{},[],"We hope this article helps you get a better handle on how to determine if you’ve been compromised, and respond to incidents involving SaaS apps and/or OAuth integrations to your core work platforms.",{"data":45044,"content":45047,"nodeType":907},{"target":45045},{"sys":45046},{"id":41922,"type":904,"linkType":905},[],{"data":45049,"content":45050,"nodeType":866},{},[45051],{"data":45052,"marks":45053,"value":21,"nodeType":865},{},[],"How attackers compromise Azure organizations through SaaS apps ","2023-01-03T00:00:00.000Z","how-attackers-compromise-azure-organizations-through-saas-apps",{"items":45058},[45059,45061],{"sys":45060,"name":2524},{"id":2523},{"sys":45062,"name":342},{"id":2527},{"items":45064},[45065],{"fullName":17385,"firstName":17386,"jobTitle":17387,"profilePicture":45066},{"url":17389},{"__typename":2239,"sys":45068,"content":45070,"title":45800,"synopsis":45801,"hashTags":45802,"publishedDate":45803,"slug":45804,"tagsCollection":45805,"authorsCollection":45813},{"id":45069},"73JjdrO5GKRzYum97MqJ9q",{"json":45071},{"data":45072,"content":45073,"nodeType":2232},{},[45074,45090,45097,45140,45147,45192,45199,45558,45564,45570,45577,45584,45591,45597,45604,45611,45618,45625,45632,45639,45646,45653,45672,45679,45686,45693,45700,45707,45737,45744,45751,45758,45765,45772,45779,45782,45789,45794],{"data":45075,"content":45076,"nodeType":866},{},[45077,45081,45086],{"data":45078,"marks":45079,"value":45080,"nodeType":865},{},[],"Before we start, ",{"data":45082,"marks":45083,"value":45085,"nodeType":865},{},[45084],{"type":946},"MFA with any method is better than no MFA at all",{"data":45087,"marks":45088,"value":45089,"nodeType":865},{},[],". Although some methods are better than others, they're all leagues ahead of passwords alone. If, for whatever reason, you can only implement MFA using a weaker second factor, you should still do it. You can always improve later and you'll have made a significant improvement even with the weaker second factor.",{"data":45091,"content":45092,"nodeType":866},{},[45093],{"data":45094,"marks":45095,"value":45096,"nodeType":865},{},[],"So, how can one factor be better than others? Here's how we think about it:",{"data":45098,"content":45099,"nodeType":891},{},[45100,45110,45120,45130],{"data":45101,"content":45102,"nodeType":880},{},[45103],{"data":45104,"content":45105,"nodeType":866},{},[45106],{"data":45107,"marks":45108,"value":45109,"nodeType":865},{},[],"User experience: how easy is it to use?",{"data":45111,"content":45112,"nodeType":880},{},[45113],{"data":45114,"content":45115,"nodeType":866},{},[45116],{"data":45117,"marks":45118,"value":45119,"nodeType":865},{},[],"Security: how easy is it for someone to compromise?",{"data":45121,"content":45122,"nodeType":880},{},[45123],{"data":45124,"content":45125,"nodeType":866},{},[45126],{"data":45127,"marks":45128,"value":45129,"nodeType":865},{},[],"Cost: do you need to upgrade your SaaS license, or buy physical bits?",{"data":45131,"content":45132,"nodeType":880},{},[45133],{"data":45134,"content":45135,"nodeType":866},{},[45136],{"data":45137,"marks":45138,"value":45139,"nodeType":865},{},[],"Support: how widely can it be used?",{"data":45141,"content":45142,"nodeType":1218},{},[45143],{"data":45144,"marks":45145,"value":45146,"nodeType":865},{},[],"Just want the answers? ",{"data":45148,"content":45149,"nodeType":891},{},[45150,45160,45182],{"data":45151,"content":45152,"nodeType":880},{},[45153],{"data":45154,"content":45155,"nodeType":866},{},[45156],{"data":45157,"marks":45158,"value":45159,"nodeType":865},{},[],"Using an app on your phone, like Microsoft or Google Authenticator, to receive notifications or use a one-time password are the top all-round options today - they're free, intuitive for users, relatively easy to set up, and widely supported. ",{"data":45161,"content":45162,"nodeType":880},{},[45163],{"data":45164,"content":45165,"nodeType":866},{},[45166,45170,45178],{"data":45167,"marks":45168,"value":45169,"nodeType":865},{},[],"The gold standard is a FIDO2-capable security key, like the ",{"data":45171,"content":45173,"nodeType":1102},{"uri":45172},"https://www.yubico.com/products/yubikey-5-overview/",[45174],{"data":45175,"marks":45176,"value":45177,"nodeType":865},{},[],"YubiKey 5 series",{"data":45179,"marks":45180,"value":45181,"nodeType":865},{},[],", or a security key built-in to your device, like Touch ID  - it's the most secure, provides the best user experience, but has an upfront cost as each user will need a key or a compatible device. The main drawback today is they aren't supported on all platforms yet so might not be an option everywhere.",{"data":45183,"content":45184,"nodeType":880},{},[45185],{"data":45186,"content":45187,"nodeType":866},{},[45188],{"data":45189,"marks":45190,"value":45191,"nodeType":865},{},[],"Factors that rely on your phone number, such as SMS and phone calls should be avoided if possible as they are the least secure and provide the worst user experience.",{"data":45193,"content":45194,"nodeType":866},{},[45195],{"data":45196,"marks":45197,"value":45198,"nodeType":865},{},[],"Here's a summary:",{"data":45200,"content":45201,"nodeType":1197},{},[45202,45255,45307,45357,45409,45458,45509],{"data":45203,"content":45204,"nodeType":1014},{},[45205,45215,45225,45235,45245],{"data":45206,"content":45207,"nodeType":1002},{},[45208],{"data":45209,"content":45210,"nodeType":866},{},[45211],{"data":45212,"marks":45213,"value":45214,"nodeType":865},{},[],"Method",{"data":45216,"content":45217,"nodeType":1002},{},[45218],{"data":45219,"content":45220,"nodeType":866},{},[45221],{"data":45222,"marks":45223,"value":45224,"nodeType":865},{},[],"User experience",{"data":45226,"content":45227,"nodeType":1002},{},[45228],{"data":45229,"content":45230,"nodeType":866},{},[45231],{"data":45232,"marks":45233,"value":45234,"nodeType":865},{},[],"Security",{"data":45236,"content":45237,"nodeType":1002},{},[45238],{"data":45239,"content":45240,"nodeType":866},{},[45241],{"data":45242,"marks":45243,"value":45244,"nodeType":865},{},[],"Cost",{"data":45246,"content":45247,"nodeType":1002},{},[45248],{"data":45249,"content":45250,"nodeType":866},{},[45251],{"data":45252,"marks":45253,"value":45254,"nodeType":865},{},[],"Support",{"data":45256,"content":45257,"nodeType":1014},{},[45258,45268,45278,45287,45297],{"data":45259,"content":45260,"nodeType":1043},{},[45261],{"data":45262,"content":45263,"nodeType":866},{},[45264],{"data":45265,"marks":45266,"value":45267,"nodeType":865},{},[],"App Notification",{"data":45269,"content":45270,"nodeType":1043},{},[45271],{"data":45272,"content":45273,"nodeType":866},{},[45274],{"data":45275,"marks":45276,"value":45277,"nodeType":865},{},[],"Good",{"data":45279,"content":45280,"nodeType":1043},{},[45281],{"data":45282,"content":45283,"nodeType":866},{},[45284],{"data":45285,"marks":45286,"value":45277,"nodeType":865},{},[],{"data":45288,"content":45289,"nodeType":1043},{},[45290],{"data":45291,"content":45292,"nodeType":866},{},[45293],{"data":45294,"marks":45295,"value":45296,"nodeType":865},{},[],"Free",{"data":45298,"content":45299,"nodeType":1043},{},[45300],{"data":45301,"content":45302,"nodeType":866},{},[45303],{"data":45304,"marks":45305,"value":45306,"nodeType":865},{},[],"Widely supported",{"data":45308,"content":45309,"nodeType":1014},{},[45310,45320,45330,45339,45348],{"data":45311,"content":45312,"nodeType":1043},{},[45313],{"data":45314,"content":45315,"nodeType":866},{},[45316],{"data":45317,"marks":45318,"value":45319,"nodeType":865},{},[],"App code",{"data":45321,"content":45322,"nodeType":1043},{},[45323],{"data":45324,"content":45325,"nodeType":866},{},[45326],{"data":45327,"marks":45328,"value":45329,"nodeType":865},{},[],"Moderate",{"data":45331,"content":45332,"nodeType":1043},{},[45333],{"data":45334,"content":45335,"nodeType":866},{},[45336],{"data":45337,"marks":45338,"value":45277,"nodeType":865},{},[],{"data":45340,"content":45341,"nodeType":1043},{},[45342],{"data":45343,"content":45344,"nodeType":866},{},[45345],{"data":45346,"marks":45347,"value":45296,"nodeType":865},{},[],{"data":45349,"content":45350,"nodeType":1043},{},[45351],{"data":45352,"content":45353,"nodeType":866},{},[45354],{"data":45355,"marks":45356,"value":45306,"nodeType":865},{},[],{"data":45358,"content":45359,"nodeType":1014},{},[45360,45370,45380,45389,45399],{"data":45361,"content":45362,"nodeType":1043},{},[45363],{"data":45364,"content":45365,"nodeType":866},{},[45366],{"data":45367,"marks":45368,"value":45369,"nodeType":865},{},[],"Security key (external)",{"data":45371,"content":45372,"nodeType":1043},{},[45373],{"data":45374,"content":45375,"nodeType":866},{},[45376],{"data":45377,"marks":45378,"value":45379,"nodeType":865},{},[],"Best",{"data":45381,"content":45382,"nodeType":1043},{},[45383],{"data":45384,"content":45385,"nodeType":866},{},[45386],{"data":45387,"marks":45388,"value":45379,"nodeType":865},{},[],{"data":45390,"content":45391,"nodeType":1043},{},[45392],{"data":45393,"content":45394,"nodeType":866},{},[45395],{"data":45396,"marks":45397,"value":45398,"nodeType":865},{},[],"Expensive",{"data":45400,"content":45401,"nodeType":1043},{},[45402],{"data":45403,"content":45404,"nodeType":866},{},[45405],{"data":45406,"marks":45407,"value":45408,"nodeType":865},{},[],"Some platforms",{"data":45410,"content":45411,"nodeType":1014},{},[45412,45422,45431,45440,45449],{"data":45413,"content":45414,"nodeType":1043},{},[45415],{"data":45416,"content":45417,"nodeType":866},{},[45418],{"data":45419,"marks":45420,"value":45421,"nodeType":865},{},[],"Security key (internal)",{"data":45423,"content":45424,"nodeType":1043},{},[45425],{"data":45426,"content":45427,"nodeType":866},{},[45428],{"data":45429,"marks":45430,"value":45379,"nodeType":865},{},[],{"data":45432,"content":45433,"nodeType":1043},{},[45434],{"data":45435,"content":45436,"nodeType":866},{},[45437],{"data":45438,"marks":45439,"value":45379,"nodeType":865},{},[],{"data":45441,"content":45442,"nodeType":1043},{},[45443],{"data":45444,"content":45445,"nodeType":866},{},[45446],{"data":45447,"marks":45448,"value":45296,"nodeType":865},{},[],{"data":45450,"content":45451,"nodeType":1043},{},[45452],{"data":45453,"content":45454,"nodeType":866},{},[45455],{"data":45456,"marks":45457,"value":45408,"nodeType":865},{},[],{"data":45459,"content":45460,"nodeType":1014},{},[45461,45471,45481,45490,45500],{"data":45462,"content":45463,"nodeType":1043},{},[45464],{"data":45465,"content":45466,"nodeType":866},{},[45467],{"data":45468,"marks":45469,"value":45470,"nodeType":865},{},[],"SMS",{"data":45472,"content":45473,"nodeType":1043},{},[45474],{"data":45475,"content":45476,"nodeType":866},{},[45477],{"data":45478,"marks":45479,"value":45480,"nodeType":865},{},[],"Poor",{"data":45482,"content":45483,"nodeType":1043},{},[45484],{"data":45485,"content":45486,"nodeType":866},{},[45487],{"data":45488,"marks":45489,"value":45480,"nodeType":865},{},[],{"data":45491,"content":45492,"nodeType":1043},{},[45493],{"data":45494,"content":45495,"nodeType":866},{},[45496],{"data":45497,"marks":45498,"value":45499,"nodeType":865},{},[],"Cheap",{"data":45501,"content":45502,"nodeType":1043},{},[45503],{"data":45504,"content":45505,"nodeType":866},{},[45506],{"data":45507,"marks":45508,"value":45306,"nodeType":865},{},[],{"data":45510,"content":45511,"nodeType":1014},{},[45512,45522,45531,45540,45549],{"data":45513,"content":45514,"nodeType":1043},{},[45515],{"data":45516,"content":45517,"nodeType":866},{},[45518],{"data":45519,"marks":45520,"value":45521,"nodeType":865},{},[],"Phone call",{"data":45523,"content":45524,"nodeType":1043},{},[45525],{"data":45526,"content":45527,"nodeType":866},{},[45528],{"data":45529,"marks":45530,"value":45480,"nodeType":865},{},[],{"data":45532,"content":45533,"nodeType":1043},{},[45534],{"data":45535,"content":45536,"nodeType":866},{},[45537],{"data":45538,"marks":45539,"value":45480,"nodeType":865},{},[],{"data":45541,"content":45542,"nodeType":1043},{},[45543],{"data":45544,"content":45545,"nodeType":866},{},[45546],{"data":45547,"marks":45548,"value":45499,"nodeType":865},{},[],{"data":45550,"content":45551,"nodeType":1043},{},[45552],{"data":45553,"content":45554,"nodeType":866},{},[45555],{"data":45556,"marks":45557,"value":45306,"nodeType":865},{},[],{"data":45559,"content":45563,"nodeType":907},{"target":45560},{"sys":45561},{"id":45562,"type":904,"linkType":905},"7rgrP5FFAKG63lscwhAsW1",[],{"data":45565,"content":45566,"nodeType":1218},{},[45567],{"data":45568,"marks":45569,"value":45267,"nodeType":865},{},[],{"data":45571,"content":45572,"nodeType":866},{},[45573],{"data":45574,"marks":45575,"value":45576,"nodeType":865},{},[],"One of the most common methods today is the app notification. Using an app on your phone, like Microsoft Authenticator, to receive a push notification when you login.",{"data":45578,"content":45579,"nodeType":866},{},[45580],{"data":45581,"marks":45582,"value":45583,"nodeType":865},{},[],"Free, easy to use, and secure - this is a good choice if your users all have devices to install the app on and will reliably have a network connection to receive the notification.",{"data":45585,"content":45586,"nodeType":866},{},[45587],{"data":45588,"marks":45589,"value":45590,"nodeType":865},{},[],"Your challenges with using this method will be getting the app setup on everyone's device, getting everyone enrolled, and making sure users understand to only hit approve when they actually performed a login (seriously).",{"data":45592,"content":45596,"nodeType":907},{"target":45593},{"sys":45594},{"id":45595,"type":904,"linkType":905},"4ybLnYAdHltdWCluLbr4di",[],{"data":45598,"content":45599,"nodeType":1218},{},[45600],{"data":45601,"marks":45602,"value":45603,"nodeType":865},{},[],"App Code",{"data":45605,"content":45606,"nodeType":866},{},[45607],{"data":45608,"marks":45609,"value":45610,"nodeType":865},{},[],"The early days of MFA looked like RSA tokens; those devices you used to have to carry on a key chain with a code that changed every minute. Those devices worked by having a \"seed\" value that both the device and the server knew which changed predictably. So long as that seed value stayed safe, this provided a convenient second factor for users that was difficult to compromise.",{"data":45612,"content":45613,"nodeType":866},{},[45614],{"data":45615,"marks":45616,"value":45617,"nodeType":865},{},[],"Today, this approach is more common via an app, where the app provides a code that changes every minute, but the concept is exactly the same.",{"data":45619,"content":45620,"nodeType":866},{},[45621],{"data":45622,"marks":45623,"value":45624,"nodeType":865},{},[],"This approach uses what is officially called One Time Passwords (OTP) but is often just referred to as an app code. It has some advantages, such as not needing signal after setup which can be handy if that's a concern. ",{"data":45626,"content":45627,"nodeType":866},{},[45628],{"data":45629,"marks":45630,"value":45631,"nodeType":865},{},[],"However, as was true of the RSA tokens of the past, if the seed value is compromised all future values can be predicted. The odds of this happening in practice are exceptionally low so this remains a good choice.",{"data":45633,"content":45634,"nodeType":866},{},[45635],{"data":45636,"marks":45637,"value":45638,"nodeType":865},{},[],"Your challenges with using this method will again be mostly in rolling it out to all users and getting everyone setup.",{"data":45640,"content":45641,"nodeType":1218},{},[45642],{"data":45643,"marks":45644,"value":45645,"nodeType":865},{},[],"Text message / phone call",{"data":45647,"content":45648,"nodeType":866},{},[45649],{"data":45650,"marks":45651,"value":45652,"nodeType":865},{},[],"As MFA gained popularity, receiving a code via text message (SMS), or sometimes a phone call, quickly became the de-facto method. Before everyone had smartphones and therefore the ability to install apps, using text messages or phone calls was the only way to implement MFA without having to provision RSA tokens for everyone in the team.",{"data":45654,"content":45655,"nodeType":866},{},[45656,45660,45668],{"data":45657,"marks":45658,"value":45659,"nodeType":865},{},[],"The major downside to using these methods is their reliance on the security of the phone number. If attackers really want to target an account, and they know the phone number used for MFA, they can try something called ",{"data":45661,"content":45663,"nodeType":1102},{"uri":45662},"https://en.wikipedia.org/wiki/SIM_swap_scam",[45664],{"data":45665,"marks":45666,"value":45667,"nodeType":865},{},[],"SIM-swapping",{"data":45669,"marks":45670,"value":45671,"nodeType":865},{},[]," to hijack the phone number, and hence nullify the MFA.",{"data":45673,"content":45674,"nodeType":866},{},[45675],{"data":45676,"marks":45677,"value":45678,"nodeType":865},{},[],"The most important thing to note in that scenario is how targeted it is. With no MFA, any attacker on the Internet can simply guess passwords on an account - the cost is extremely low. To bypass SMS or phone call MFA using SIM swapping has a significantly higher cost. The attack is definitely practical, but would only happen when you're specifically targeted.",{"data":45680,"content":45681,"nodeType":866},{},[45682],{"data":45683,"marks":45684,"value":45685,"nodeType":865},{},[],"Additionally, the user experience isn't as good. Firstly, the user must have mobile signal to receive the SMS or call. Secondly, there can often be a delay in delivery, due to the less-reliable mobile network. Finally, there is almost always a usage cost associated with these methods, since it costs money to send SMSs or make phone calls.",{"data":45687,"content":45688,"nodeType":866},{},[45689],{"data":45690,"marks":45691,"value":45692,"nodeType":865},{},[],"Because of this, SMS or phone calls are often considered least desirable MFA methods today.",{"data":45694,"content":45695,"nodeType":1218},{},[45696],{"data":45697,"marks":45698,"value":45699,"nodeType":865},{},[],"Security keys",{"data":45701,"content":45702,"nodeType":866},{},[45703],{"data":45704,"marks":45705,"value":45706,"nodeType":865},{},[],"FIDO2 is the name for a set of authentication protocols and standards developed by a consortium of tech companies to be the future of authentication. FIDO2 solves a lot of the problems we've dealt with in the past: it's secure, usable, impossible to spoof.",{"data":45708,"content":45709,"nodeType":866},{},[45710,45714,45722,45726,45733],{"data":45711,"marks":45712,"value":45713,"nodeType":865},{},[],"Without digging into the weeds of how that works (",{"data":45715,"content":45717,"nodeType":1102},{"uri":45716},"https://fidoalliance.org/fido2/",[45718],{"data":45719,"marks":45720,"value":45721,"nodeType":865},{},[],"the official page from the FIDO alliance is worth a read if you're interested",{"data":45723,"marks":45724,"value":45725,"nodeType":865},{},[],"), you will need what's commonly referred to as a \"security key\" to make use of it. This is a small physical device, often plugged into your USB port - modern devices that understand FIDO2, like the ",{"data":45727,"content":45728,"nodeType":1102},{"uri":45172},[45729],{"data":45730,"marks":45731,"value":45732,"nodeType":865},{},[],"YubiKey 5 Series",{"data":45734,"marks":45735,"value":45736,"nodeType":865},{},[],", are preferable. Once setup, you simply touch the key on login and the magic of cryptography ensures a high degree of security.",{"data":45738,"content":45739,"nodeType":866},{},[45740],{"data":45741,"marks":45742,"value":45743,"nodeType":865},{},[],"In fact, this approach is so secure, it is the basis of a \"passwordless\" revolution, where this strong factor of authentication can feasibly be used as a single-factor of authentication, and users don't even need to remember passwords anymore. Though in its infancy at the moment, expect to hear more about that in the coming years.",{"data":45745,"content":45746,"nodeType":866},{},[45747],{"data":45748,"marks":45749,"value":45750,"nodeType":865},{},[],"The primary drawback of this method is the cost, with devices typically costing around $50 each. Also, although you can expect them to be supported on major platforms, they aren't supported as widely as other methods just yet.",{"data":45752,"content":45753,"nodeType":866},{},[45754],{"data":45755,"marks":45756,"value":45757,"nodeType":865},{},[],"If you are unable to justify their cost for all users, a common implementation is to use security keys for high privilege accounts.",{"data":45759,"content":45760,"nodeType":1218},{},[45761],{"data":45762,"marks":45763,"value":45764,"nodeType":865},{},[],"Built-in security keys",{"data":45766,"content":45767,"nodeType":866},{},[45768],{"data":45769,"marks":45770,"value":45771,"nodeType":865},{},[],"Many modern mobile devices like laptops, tablets and phones have built-in security keys (e.g. Apple TouchId,  Android phones, and Windows Hello). These have many of the advantages of stand-alone security keys, but without the cost!",{"data":45773,"content":45774,"nodeType":866},{},[45775],{"data":45776,"marks":45777,"value":45778,"nodeType":865},{},[],"Support for these keys is a fairly recent development and is still ongoing but opens up an exciting future where users will increasingly be able to very easily add a second factor, or even go passwordless, in a secure way, without much effort or thought.",{"data":45780,"content":45781,"nodeType":938},{},[],{"data":45783,"content":45784,"nodeType":866},{},[45785],{"data":45786,"marks":45787,"value":45788,"nodeType":865},{},[],"In conclusion there are multiple options you can choose from to fit almost any scenario you have. While some options are better than others, even the worst option is still a massive improvement on passwords alone. In the end, the best MFA method is the one you can start rolling out today, you can always improve down the line.",{"data":45790,"content":45793,"nodeType":907},{"target":45791},{"sys":45792},{"id":41922,"type":904,"linkType":905},[],{"data":45795,"content":45796,"nodeType":866},{},[45797],{"data":45798,"marks":45799,"value":21,"nodeType":865},{},[],"Which MFA methods should you use?","SMS, Authenticator apps, Security Keys, and more! We compare them from a user experience, security, cost, and security aspect.",[457],"2021-03-15T00:00:00.000+01:00","which-mfa-methods-should-you-use",{"items":45806},[45807,45811],{"sys":45808,"name":45810},{"id":45809},"1gZi8NrRy2v9OqPV7C4dwD","Risk management",{"sys":45812,"name":297},{"id":11129},{"items":45814},[45815],{"fullName":2573,"firstName":2574,"jobTitle":2575,"profilePicture":45816},{"url":2577},{"__typename":2239,"sys":45818,"content":45819,"title":45999,"synopsis":46000,"hashTags":59,"publishedDate":46001,"slug":46002,"tagsCollection":46003,"authorsCollection":46009},{"id":43788},{"json":45820},{"data":45821,"content":45822,"nodeType":2232},{},[45823,45830,45837,45843,45859,45865,45872,45879,45908,45914,45933,45951,45970],{"data":45824,"content":45825,"nodeType":866},{},[45826],{"data":45827,"marks":45828,"value":45829,"nodeType":865},{},[],"With more platforms adding support for Multi-factor Authentication (MFA) and users increasingly adopting it to secure their accounts, attackers are adapting and moving to new methods of compromising user accounts. In this post we’ll take a look at consent phishing and how it is being used to bypass MFA and also skirt key attributes of phishing that are taught in traditional user awareness campaigns, such as links to untrusted domains.",{"data":45831,"content":45832,"nodeType":866},{},[45833],{"data":45834,"marks":45835,"value":45836,"nodeType":865},{},[],"Imagine yourself sitting down at your desk first thing on a Monday morning, cup of coffee steaming next to your keyboard as you click through your backlog of emails. You open the below email and you see that Karl has shared a financial report with you. ",{"data":45838,"content":45842,"nodeType":907},{"target":45839},{"sys":45840},{"id":45841,"type":904,"linkType":905},"7zysXleQdpE6isqi9OU56l",[],{"data":45844,"content":45845,"nodeType":866},{},[45846,45850,45855],{"data":45847,"marks":45848,"value":45849,"nodeType":865},{},[],"Maybe you’ve been waiting for the latest financials or you suspect this was sent erroneously but you’re curious and want to take a peek. When you click the link you are presented with a prompt that with your Monday brain looks just like the “Yes give me access” prompt you’ve clicked through a thousand times. I mean, it's a ",{"data":45851,"marks":45852,"value":45854,"nodeType":865},{},[45853],{"type":946},"microsoftonline.com",{"data":45856,"marks":45857,"value":45858,"nodeType":865},{},[]," domain, it's https and there’s a green tick in the corner so everything looks fine. ",{"data":45860,"content":45864,"nodeType":907},{"target":45861},{"sys":45862},{"id":45863,"type":904,"linkType":905},"6nPueTKEjLphqlytbQ0gcx",[],{"data":45866,"content":45867,"nodeType":866},{},[45868],{"data":45869,"marks":45870,"value":45871,"nodeType":865},{},[],"If you’d looked closely you may have noticed that this was in fact asking you to approve access rather than granting you access. But with your muscle memory in full control you click “Accept” before even glancing at the screen. You wait for the spreadsheet to open but are presented with a generic “File does not exist” error page. Oh well, apparently Karl realised his mistake and deleted the file or revoked your access. Onto the next email.",{"data":45873,"content":45874,"nodeType":866},{},[45875],{"data":45876,"marks":45877,"value":45878,"nodeType":865},{},[],"And just like that you’ve been consent phished. You’ve just granted the attackers permanent access to your account, which they retain even if you change your password or have MFA enabled. Chances are the attacker’s tools will immediately start downloading every piece of data you just granted them access to, which they can then explore at their leisure. ",{"data":45880,"content":45881,"nodeType":866},{},[45882,45886,45894,45897,45905],{"data":45883,"marks":45884,"value":45885,"nodeType":865},{},[],"To spot this you need to audit the apps you’ve approved, something you are doing regularly, right? Seriously though, this isn’t something many people check. These integrations are designed to be as seamless as possible and not to get in your way. But if this has piqued your interest you can check what access you have personally granted on ",{"data":45887,"content":45889,"nodeType":1102},{"uri":45888},"https://myaccount.google.com/permissions",[45890],{"data":45891,"marks":45892,"value":45893,"nodeType":865},{},[],"Google Workspace",{"data":45895,"marks":45896,"value":1913,"nodeType":865},{},[],{"data":45898,"content":45900,"nodeType":1102},{"uri":45899},"https://myapps.microsoft.com/",[45901],{"data":45902,"marks":45903,"value":45904,"nodeType":865},{},[],"Microsoft 365",{"data":45906,"marks":45907,"value":1151,"nodeType":865},{},[],{"data":45909,"content":45913,"nodeType":907},{"target":45910},{"sys":45911},{"id":45912,"type":904,"linkType":905},"BPIX02LWblUNnkQw1TFWD",[],{"data":45915,"content":45916,"nodeType":866},{},[45917,45921,45929],{"data":45918,"marks":45919,"value":45920,"nodeType":865},{},[],"If you’d been paying attention when you clicked “Accept” you might have noticed that you were granting some pretty serious permissions here. These permissions allow the attackers to read and write any files you have access to - they could download all these files and then delete them. The attackers also got permission to send emails as you. They could send emails to your colleagues from you and phish them too, this isn’t impersonation where the email just “looks” like it came from you, the email DID come from you. Lastly the attackers asked for permission to manipulate your Outlook settings, with this they could set up a ",{"data":45922,"content":45924,"nodeType":1102},{"uri":45923},"/features/detect-malicious-mail-rules/",[45925],{"data":45926,"marks":45927,"value":45928,"nodeType":865},{},[],"mail forwarding rule",{"data":45930,"marks":45931,"value":45932,"nodeType":865},{},[]," so that they get copies of all your emails forwarded to them directly without even having to log in. And all of this happens until you delete the underlying OAuth app.",{"data":45934,"content":45935,"nodeType":866},{},[45936,45940,45947],{"data":45937,"marks":45938,"value":45939,"nodeType":865},{},[],"In a ",{"data":45941,"content":45943,"nodeType":1102},{"uri":45942},"https://www.microsoft.com/security/blog/2020/07/08/protecting-remote-workforce-application-attacks-consent-phishing/",[45944],{"data":45945,"marks":45946,"value":44466,"nodeType":865},{},[],{"data":45948,"marks":45949,"value":45950,"nodeType":865},{},[]," Microsoft warns that these attacks are on the rise. One notable example of this comes from the SANS Institute. They reported in August of 2020 that they had fallen victim to one of these attacks. As part of the investigation they produced a report with details on how the attackers managed to convince an employee to install a malicious Microsoft 365 add-in to gain access. ",{"data":45952,"content":45953,"nodeType":866},{},[45954,45958,45966],{"data":45955,"marks":45956,"value":45957,"nodeType":865},{},[],"So what can you do about this threat today? The only fool proof method of preventing this kind of attack is to prevent users from granting access to third party apps. This is terrible for users though, and you’ll be missing out on all the productivity benefits these apps can bring. A more balanced approach is to let users find and request apps, but have administrators approve the apps. More and more platforms (including Microsoft 365 and Slack) are offering built-in “admin consent” workflows to make getting a second pair of eyes on new apps even easier. You can also make it even easier for users  by pre-approving widely used apps from trusted publishers and users won’t even notice there is new protection in place 99% of the time. We are also actively working on this problem and if you would like to join our ",{"data":45959,"content":45961,"nodeType":1102},{"uri":45960},"/features/secure-oauth-permissions-and-applications/",[45962],{"data":45963,"marks":45964,"value":45965,"nodeType":865},{},[],"early access program",{"data":45967,"marks":45968,"value":45969,"nodeType":865},{},[]," please get in touch.",{"data":45971,"content":45972,"nodeType":866},{},[45973,45977,45985,45988,45995],{"data":45974,"marks":45975,"value":45976,"nodeType":865},{},[],"Consent phishing is still an emerging technique and we believe that it has not reached peak usage by attackers yet. We are actively researching this attack technique as it continues to evolve. Follow us on Twitter ",{"data":45978,"content":45980,"nodeType":1102},{"uri":45979},"https://twitter.com/PushSecurity",[45981],{"data":45982,"marks":45983,"value":45984,"nodeType":865},{},[],"@pushsecurity",{"data":45986,"marks":45987,"value":3531,"nodeType":865},{},[],{"data":45989,"content":45991,"nodeType":1102},{"uri":45990},"https://www.linkedin.com/company/push-security",[45992],{"data":45993,"marks":45994,"value":42146,"nodeType":865},{},[],{"data":45996,"marks":45997,"value":45998,"nodeType":865},{},[]," or subscribe to our mailing list below to get the latest updates and tips for managing this for your users.","Consent phishing: the emerging phishing technique that can bypass 2FA","Consent phishing is an emerging technique attackers are using to compromise user accounts, even if they have Multi-factor Authentication (MFA or 2FA) enabled.","2021-07-06T00:00:00.000+01:00","consent-phishing-the-emerging-phishing-technique-that-can-bypass-2fa",{"items":46004},[46005,46007],{"sys":46006,"name":2524},{"id":2523},{"sys":46008,"name":342},{"id":2527},{"items":46010},[46011],{"fullName":46012,"firstName":11134,"jobTitle":46013,"profilePicture":46014},"Alex Triaca","Chief Architect",{"url":46015},"https://images.ctfassets.net/y1cdw1ablpvd/LmC3LyTH5V9NthbqKuqA2/8291887e41c15613bf98f6fd55773817/117-0-2.jpg","okta-swa","blog/okta-swa",{"json":46019},{"data":46020,"content":46021,"nodeType":2232},{},[46022],{"data":46023,"content":46024,"nodeType":866},{},[46025],{"data":46026,"marks":46027,"value":46028,"nodeType":865},{},[],"In this article, we’ll discuss and demonstrate why Okta's SWA isn't the same or as secure as using SAML and OIDC authentication methods for SSO.\n","We'll cover the implications of using Okta's SWA authentication method. Learn what security teams need to know in an account breach and IR scenario. ",{"id":46031,"publishedAt":46032},"1te7lpcknxuN73jdCdkXjd","2026-08-13T09:35:30.843Z",{"items":46034},[46035,46037],{"sys":46036,"name":297},{"id":11129},{"sys":46038,"name":342},{"id":2527},{"items":46040},[46041,46043,46045,46047,46049,46051,46053,46055,46057,46059,46061],{"sys":46042,"name":279,"slug":280,"tier":31},{"id":276},{"sys":46044,"name":413,"slug":414,"tier":31},{"id":410},{"sys":46046,"name":545,"slug":546,"tier":31},{"id":542},{"sys":46048,"name":297,"slug":298,"tier":31},{"id":294},{"sys":46050,"name":342,"slug":343,"tier":31},{"id":339},{"sys":46052,"name":404,"slug":405,"tier":45},{"id":401},{"sys":46054,"name":571,"slug":572,"tier":45},{"id":568},{"sys":46056,"name":502,"slug":503,"tier":45},{"id":499},{"sys":46058,"name":395,"slug":396,"tier":45},{"id":392},{"sys":46060,"name":484,"slug":485,"tier":45},{"id":481},{"sys":46062,"name":598,"slug":599,"tier":45},{"id":595},"h-WNFaGzdRTPJF9qOFIS_yyC7JgZMN6_vS4PUbbDCrE",1787040116643]