Microsoft moved to harden browser-based sign-ins: beginning in 2026, Entra ID logins will block unauthorized or injected scripts under a stricter Content Security Policy. Researchers also warned that cross‑tenant collaboration can strip protections from guests, underscoring how convenience defaults create security blind spots. The day rounded out with supply‑chain exposure at OpenAI through an analytics partner, an expanded Salesforce‑linked incident at Gainsight, a major ransomware disclosure from Asahi, and fresh espionage tradecraft focused on email stores and cloud tokens.
Sign‑in hardening meets cross‑tenant gaps
Microsoft plans to restrict script downloads to trusted CDNs and allow inline execution only from approved sources on login.microsoftonline.com, excluding Entra External ID. The CSP change is slated to roll out globally in mid‑to‑late October 2026 and is positioned as part of the company’s Secure Future Initiative. Microsoft urges administrators to test sign‑in flows, avoid extensions that inject code into the sign‑in experience, and use the browser console to detect CSP violations. The guidance ties back to broader SFI measures such as phishing‑resistant MFA, memory safety work, and hardened token validation—steps meant to reduce attack surface before the policy takes effect. Why it matters: enforcing CSP at the identity entry point curbs script‑based tampering where session cookies and tokens are most valuable.
Researchers at Ontinue highlighted that a recently enabled default letting users chat with "anyone" can expose a cross‑tenant blind spot in Teams, where guest sessions inherit the host tenant’s security posture rather than the user’s home protections. According to CSO Online, this means URL scanning, Safe Links, file sandboxing and zero‑hour auto purge in Defender for Office 365 may not apply when users interact as guests. Recommended mitigations include allow‑listing partner domains for B2B invitations, applying Entra ID cross‑tenant access policies, and disabling the default "chat with Anyone" capability if risk outweighs collaboration benefits.
Identity and authorization consolidate
ServiceNow is reportedly in advanced talks to acquire identity‑security startup Veza for over $1 billion, a move that would pair enterprise automation and AI assistants with deeper authorization intelligence. As reported by CSO Online, Veza maps effective permissions across cloud, SaaS and internal systems, including non‑human identities such as API keys and service accounts. The companies already share customers and investment ties; native integration could let agents query and enforce access policies more safely, though licensing and packaging changes may follow. The market signal: authorization context is becoming a first‑class control for safe automation.
SaaS supply chain: telemetry and integrations
OpenAI notified API users that an incident at analytics provider Mixpanel led to the export of a dataset containing limited account‑identifiable and analytics metadata, including names, email addresses, coarse location, OS/browser details, referrers, and organization or user IDs. OpenAI emphasized its own systems were not breached and no API keys, prompts, responses, usage logs, passwords, payment details or government IDs were included. The company removed Mixpanel from production, is supporting the vendor’s investigation, and is warning of targeted phishing risks. Details are outlined by Infosecurity, which notes elevated vendor requirements and ongoing user notifications.
Gainsight expanded the list of customers potentially affected by unauthorized activity against its Salesforce‑integrated applications after Salesforce revoked related access and refresh tokens and shared indicators of compromise. Per The Hacker News, multiple ecosystem providers paused integrations as a precaution; the ShinyHunters group claimed involvement. Gainsight advised customers to rotate keys and connector credentials, log into NXT directly while restorations proceed, reset passwords for non‑SSO users, and reauthorize integrations as needed. The episode illustrates how third‑party connectors and OAuth flows can serve as pivot points across SaaS estates.
Incidents and espionage pressure
Asahi Group confirmed that a September ransomware attack may have exposed personal data for about 1.914 million individuals, including 1.525 million customers. Fields potentially affected include names, gender, birth dates, postal addresses, email addresses and phone numbers; the company said payment card data was not exposed. The incident disrupted orders, shipments and call centers in Japan, and the Qilin group claimed responsibility with a 27 GB leak consistent with double‑extortion tactics. As reported by Infosecurity, Asahi spent two months on containment, integrity checks and restoration, and is reviewing potential fiscal impacts. Why it matters: the narrative points to the need for Zero Trust and strict OT/IT segmentation to contain lateral movement and service disruption.
The FCC warned broadcasters that attackers have hijacked radio‑transmission paths by reconfiguring unsecured Barix devices to air bogus Emergency Alert System tones and offensive content. The notice urges patching, replacing default credentials, isolating devices behind firewalls, limiting access via VPN, and monitoring logs for unauthorized changes. Infosecurity reports that affected stations in Texas and Virginia learned of compromises from listener reports, and the commission is asking victims to alert its Operations Center and the FBI’s IC3. The takeaway: operational broadcast gear remains an attractive target when misconfigured.
Kaspersky researchers documented that the APT group ToddyCat has shifted from browser credential theft to exfiltrating Outlook OST archives and Microsoft 365 access tokens. The toolkit uses a C++ utility to copy locked OST files for offline parsing and employs token theft via OAuth artifacts or process dumps when needed; earlier activity included PowerShell toolkits executed from domain controllers to collect cookies, saved credentials, and DPAPI material. According to CSO Online, the group also abused a vulnerability in an antivirus engine for execution under trusted processes, aligning with long‑term espionage priorities. Defenders are advised to monitor for memory‑dumping tools, unusual mailbox access, and suspicious scheduled tasks.
CISA cautioned that both cybercriminals and state‑backed actors increasingly use spyware to compromise smartphones of users on encrypted messengers, targeting endpoints rather than in‑transit encryption. Tactics include fake QR codes to link accounts to attacker devices, bogus updates, and zero‑click exploits. The advisory, summarized by Bitdefender, urges prompt OS and app patching, avoiding unofficial app sources, and treating unexpected files or links with caution—even when they appear to come from known contacts.