Most Significant ShinyHunters 2026: New Untrusted OAuth Application Registration Mimicking a Trusted SaaS Integration
Detects the creation of new Entra ID applications or service principals that use display names similar to well-known SaaS vendors but lack a verified publisher status, followed within 24 hours by a consent grant for high-privilege permissions. This pattern is characteristic of OAuth-impersonation campaigns aimed at gaining persistent access to cloud resources.
Microsoft Sentinel (KQL)
