IAM Engineer: 2026-09-25

1. Unmasking EvilTokens: Getting to the root of device code phishing

   Microsoft Threat Intelligence, 2026-09-22. Read, 20 min.

   Microsoft Threat Intelligence reports that EvilTokens, a phishing-as-a-service platform that emerged in February 2026 and whose developer it tracks as Storm-2992, enabled threat actors to abuse the device code authentication flow to steal tokens and facilitated campaigns that compromised more than 12,000 inboxes in over 10,000 organizations. Microsoft's Digital Crimes Unit, working with partners, facilitated a coordinated disruption of the infrastructure used to operate the service.

   Why it matters for this role: Blocking device code flow in Conditional Access, with a narrow exception for Teams device resource accounts, is the control Microsoft puts first against this kind of token theft.

2. Critical Vulnerability in F5 BIG-IP APM

   CERT-EU, 2026-09-22. Read, 3 min.

   F5 disclosed CVE-2026-94127 on September 22, a heap-based buffer overflow in BIG-IP APM rated CVSS 9.8 that allows an unauthenticated attacker to achieve remote code execution, and confirmed active exploitation in the wild. CERT-EU lists versions 17.1.0 to 17.1.3, 17.5.0 to 17.5.1, and 21.1.0 as affected when configured with an access policy and an OAuth profile on a virtual server, and recommends preserving forensic evidence, applying the hotfix, and checking for signs of compromise.

   Why it matters for this role: If BIG-IP APM issues OAuth tokens in your environment as an Authorization Server, it needs the hotfix or F5's iRule now, because F5 has confirmed exploitation.

IAM Engineer