identity - AlphaHunt Converge

gametheory

[GAME THEORY] The Recruiter Was Also the Quartermaster

A new joint advisory links recruiter malware and some DPRK IT workers. Here is where to join hiring, access, and payment decisions.

deep

[DEEP RESEARCH] The Token Was Not a Session. It Was a Signing Dependency.

New NIST guidance exposes a containment gap: the revocation command can succeed while an attacker’s access survives.

weekly

[SIGNALS WEEKLY] Control Planes Under Pressure: KEV, AI, and Identity

Patch the control plane, then hunt leaked authority: new admins, fresh tokens, API use from new origins. Copied keys can outlive a green patch dashboard.

gametheory

[GAME THEORY] The help desk is becoming the new intrusion broker.

Vishing works because urgency can become SaaS authority. Break the trust transaction without breaking support.

weekly

[SIGNALS WEEKLY] Quiet Fault Lines in Identity, Perimeter, and CI/CD

The quiet failure mode in this week’s signals is trust doing exactly what it was configured to do—for the wrong operator. A TeamCity foothold can expose secrets and poison downstream artifacts..

forecasts

[FORECAST] The SaaS connector is where trust becomes blast radius.

A 30% forecast—and a practical way to reduce the cross-tenant blast radius before the next connector compromise.

weekly

[SIGNALS WEEKLY] Converging Pressures: Identity, Edge Exploits, and Decentralized C2

Edge exploits, helpdesk vishing, stolen CI tokens, and decentralized C2 share one objective: scale access while shrinking defender visibility. Hunt the transitions, not just the opening IOC.

gametheory

[GAME THEORY] The First Access Broker May Be the Recruiter

State-linked actors are competing for workforce trust. Map the handoffs that create access before the SOC sees an employee.

weekly

[SIGNALS WEEKLY] Shifting Access Paths: OT, Identity, and Adversarial AI

Some of this week’s most useful threat signals point to access paths that sit just outside the normal inventory: a cellular modem added by an OT integrator, a hotel captive portal steering a traveler toward token theft, or a passkey implementation that trusts the wrong lifecycle step.

gametheory

[GAME THEORY] The Phish Did Not Steal the Password. It Rented the Protocol.

Device-code phishing turns a legitimate login flow into rented access. The durable defense is to shrink who can use it.

deep

[DEEP RESEARCH] The account stealing your data may not be human

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

gametheory

[GAME THEORY] AI gateways are becoming the new IAM chokepoint

AI gateways are starting to concentrate credentials, logs, routing, quotas, and policy. That makes them worth watching now.