IAM & Security Weekly Briefing

Week of: 2026-07-19 to 2026-07-25 Reporting window: Most recently completed Sunday–Saturday (excludes the in-progress week).

1. Executive Summary (TL;DR)

• Russian state-sponsored group exploited a Zimbra zero-click zero-day to steal email, browser passwords, and 2FA recovery codes from Western mailboxes.
• Police dismantled the Kratos phishing-as-a-service kit that specialized in stealing Microsoft 365 sessions and bypassing MFA.
• A default-enabled Azure Automation setting allowed cross-tenant identity takeover via flawed code chains; Microsoft addressed it.
• Researchers revealed exploitable flaws in Microsoft’s passkey implementation that could let attackers impersonate privileged users.
• A new AD certificate abuse technique (Certighost) lets low-privileged users impersonate a Domain Controller and extract krbtgt via DCSync.
• Hotel Wi-Fi DNS hijacking campaigns are actively redirecting guests to fake Microsoft 365 login pages to steal credentials.
• AI agents are being weapon