When the Credential Is the Target: Stolen Sessions and Identities

Week of 26 October 2026 | Compiled by Team Paringa

Attackers are not breaking MFA this week, they are walking around it by stealing the secrets, tokens and sessions that MFA produces. Identity programmes built on issuing and protecting credentials are being tested on that exact assumption.

What Happened This Week

🔴 ConnectWise application identities become the way in to 2,250+ Microsoft 365 tenants

Microsoft reported on 21 October that Storm-0940, a China-linked group, targeted more than 2,250 Microsoft 365 tenants after compromising ConnectWise application identities. The group first tried password spraying, with more than 151,000 failed sign-ins against 327 accounts at eight organisations between 10 and 14 October, and none succeeded. It then switched to the application identities, which carry permissions customers had already granted ConnectWise services and require no interactive user login at all.

That pivot is the point. A user-facing MFA prompt, including a strong one, never entered the picture, because the attacker authenticated as a trusted application. At times the attackers made about 2,900 authentication attempts per minute and, using the open-source AI pentest tool ARTEX, moved from target selection to privileged cloud access in under three hours in some cases. Microsoft also observed changes to application credentials and attempts to alter privileges, which could preserve access even after the original credentials are revoked.

ConnectWise took Cloud Backup, SaaS Security and Cloud Management offline and its CEO, Manny Rivelo, noted that shutting the connections does not necessarily remove attackers who already hold a foothold in customer environments. Microsoft has not said how many customers were compromised.

Sources: The Register

The lesson is that every issued secret, whether a password, an app credential or a token, is something an attacker can steal, spray or inherit. Hardening user login with stronger MFA does nothing for a standing app permission. Inventory every third-party application identity in your tenants and ask the harder strategic question: how much of your identity risk exists only because credentials exist at all? Credential-free authentication removes the artefact attackers are optimising for.

🔴 LiteLLM supply chain attack harvests cookies, cloud tokens and API keys

On 21 October attackers compromised the LiteLLM release process and published malicious version 1.107.0 to PyPI and Docker registries. LiteLLM is an open-source AI gateway with about 23 million weekly downloads. The package carried an infostealer and a remote access trojan. The stealer uses 16 modules to take credentials and cookies from Chrome, Firefox, Edge and Safari, AWS credentials and instance metadata, Google Cloud service account keys, Azure CLI tokens, LLM provider API keys, SSH and GPG keys, and shell history. Data is encrypted and sent to an attacker-controlled domain.

Browser cookies and cloud CLI tokens are exactly the material needed to replay an authenticated session without ever seeing a password or an MFA prompt. Researchers advise anyone who ran the package to assume their secrets were stolen. CloudSEK noted an earlier LiteLLM compromise in March potentially exposed more than 2,500 organisations.

Sources: The Register

Session theft is now an industrial process, and it works against FIDO2 and passkey users just as well, because the token is stolen after the strong login has already happened. Microsoft's own research on September passkey-themed phishing made the same point: attackers were not cracking passkeys, they captured the session. If your assurance story ends at the moment of login, it ends too early. Ask vendors what happens to identity when the session token leaves the device.

🟡 SafePay and PAN-OS: stolen credentials and MFA bypass at the edge

CISA, the FBI and partners warned on 22 October that SafePay ransomware has compromised about 600 organisations. Initial access includes stolen, exposed or guessed credentials, brute force and VPN abuse. Once inside, actors create new accounts, change passwords to lock out administrators and disable security software. Separately, Unit 42 and Rapid7 data reported by The Register show Qilin and Inc exploiting CVE-2026-0257, a Palo Alto GlobalProtect authentication bypass, to establish VPN sessions past MFA, then dump domain controller credentials.

The advisory's access-control advice is to require MFA wherever possible and follow NIST password guidance, sound baseline advice that also shows how much of the ecosystem still relies on credentials at the perimeter.

Sources: Industrial Cyber, The Register

Even where MFA is mandated, a bypass bug or a stolen session reduces it to a speed bump. Pressure-test your VPN and admin access paths specifically: what proves identity once the first factor or the gateway is defeated? Programmes that remove issued credentials from the access path leave far less to steal and replay.

What Identity and Security Leaders Are Dealing With

For years the guidance was to add a second factor, then move to phishing-resistant FIDO2 and passkeys. That remains sound, and the market leaders in workforce identity, including Microsoft Entra and Okta, have shipped real improvements. But this week's evidence shows attackers adapting around it: spraying, application identities, infostealer-harvested cookies and tokens, and adversary-in-the-middle kits that capture the session after a legitimate sign-in.

The shift underneath is from attacking authentication to attacking what authentication leaves behind. Every credential, key and session token is a stored value with a lifetime, and AI-assisted tooling now finds and uses them faster than most teams can revoke them. Identity leaders are starting to ask a different question: not how to protect credentials better, but how to need fewer of them.

Three Things Worth Watching Next Week

1. ConnectWise customer impact - Microsoft has not said how many tenants were actually compromised; expect clarification and wider scrutiny of third-party application consents.

2. LiteLLM downstream exposure - Watch for reports of stolen cloud tokens and API keys being used, and for lists of affected organisations.

3. Session-token and device-code phishing - Microsoft has tracked passkey-themed AiTM and device-code campaigns since May; expect further vendor guidance on token binding and session containment.

Questions? hello@paringa.ai

Paringa helps organisations look past the next MFA upgrade to credential-free authentication, where there is no issued credential to phish, spray or steal. We turn weekly identity threat news into a practical roadmap. | 26 October 2026 | © Paringa Ltd