<p>Automated sign-ins used the vendor’s Entra application identity to request Microsoft Graph tokens across consenting tenants</p>
Categories: Threat Research
Tags: connectwise
Source: Sophos X-Ops Threat Research · 2026-10-19
Day: October 19, 2026
-
Graph reconnaissance and ServiceNow user enumeration in a modern identity intrusion
No novelty required to be effective
Categories: Threat Research, X-ops, Sophos SecOps
Tags: incident response
Source: Sophos X-Ops Threat Research · 2026-10-19