Skip to content
Threat Feed
Subscribe

Product

Microsoft Authentication Broker

2 briefs RSS
high advisory

Microsoft Security Updates — July 2026

Roundup of Microsoft security advisories published in July 2026.

PoC PowerShell +516 roundup
10c 227i updated
high advisory

Entra ID OAuth Phishing via Auth Broker to DRS

Detection of OAuth phishing in Microsoft Entra ID through Microsoft Authentication Broker (MAB) and Device Registration Service (DRS) indicated by the same user principal and session ID originating from multiple IP addresses within a short timeframe, indicative of unauthorized token acquisition.

Microsoft Entra ID +3 entra-id oauth-phishing initial-access
2r 1t 2i