Delinea Labs August 2026 Threat Outlook
In this monthly series, Delinea Labs breaks down the identity-related incidents that had the greatest operational impact over the previous month: how attacks unfolded, what failed in real environments and what those failures signal for the month ahead.
July's defining incident wasn't a phishing campaign or a stolen password. On July 14, SonicWall disclosed two actively exploited zero-days in its SMA1000 remote-access appliances: a maximum-severity server-side request forgery (SSRF) and a post-authentication code-injection flaw enabling root-level command execution, which attackers reached through the SSRF. According to Rapid7 and Volexity, attackers had been chaining the two since June 22 to hijack VPN sessions and extract MFA seed material.
Once inside, they pulled credentials, active session databases and time-based one-time password (TOTP) multi-factor authentication seed configurations off the appliance. They then authenticated directly against domain controllers using non-corporate hostnames under the appliance's own service account, without ever establishing a VPN session.
Attackers didn’t bypass the second factor. They extracted and reused it
Here's Delinea Labs' outlook for August.
The big theme: MFA seeds have become inventory to steal, not just a control to bypass an SSL VPN appliance. An OAuth client ID field. A TOTP seed file. These were designed to make attacks harder, but in July, attackers turned all three into targets, going after the systems that authenticate and log identity, rather than the identities themselves.
SonicWall's SMA1000 appliances warehoused the exact material MFA is supposed to keep out of reach. Around the same time, separate campaigns exposed gaps in how Microsoft Entra ID records authentication attempts. Attackers used those gaps to validate stolen credentials without a single sign-in event. The activity avoids the successful sign-in events and application-scoped detections defenders typically monitor, while blank or missing application fields remain identifiable.
What Delinea Labs is watching
MFA seeds are now appliance-resident inventory worth stealing.
The SonicWall SMA1000 attackers didn't need to defeat MFA. They took the seed configurations straight off the appliance, along with session databases that let them resume authenticated sessions outright.
Spoofed OAuth client IDs let attackers validate credentials without leaving a trace.
Research published by Proofpoint in July revealed two large campaigns spoofing the client ID field in Entra ID authentication requests. One sprayed more than 700,000 fake client IDs across nearly 4,000 tenants. The other targeted over two million users. Both let attackers confirm working username and password pairs while the application field stayed blank in the sign-in log, a gap most detection rules don't account for.
The Klue breach is still claiming new victims.
Companies including NoPass and GMS confirmed exposure from June's OAuth token theft as late as July. The Financial Industry Regulatory Authority (FINRA) issued a member alert referencing Klue's original June 12 detection date. Trust extended in June is still producing victims in August.
Ransomware operators still get in the same way they always have.
July logged 922 confirmed attacks. Initial access still runs through stolen credentials, exposed VPN access and Active Directory compromise more often than through a fresh exploit.
The vulnerability picture
Common vulnerabilities and exposures (CVEs). Of those, 863 were identity-related and 86 directly affected identity products. The Forum of Incident Response and Security Teams (FIRST) now projects roughly 66,000 disclosed CVEs for 2026, up by more than 35% from 2025, and identifies AI-assisted vulnerability discovery as one of the main drivers
Two disclosures stand out:
- CVE-2026-15409 — SonicWall SMA1000. A maximum-severity, unauthenticated SSRF that let attackers force the appliance to proxy requests into internal infrastructure. The vulnerability formed the first stage of the attack chain that ultimately enabled credential, session and MFA seed theft.
- CVE-2026-56155 — Active Directory Federation Services.An actively exploited local elevation-of-privilege flaw that allows an authorized attacker to elevate privileges on the affected system. The flaw involves ACLs on the Distributed Key Manager container, where AD FS stores symmetric keys protecting token-signing and token-encryption certificate private keys, making exposure of that key material the downstream identity risk.
Ransomware activity
TheGentlemen and Qilin led July's ransomware activity, together accounting for nearly a third of all activity tracked that month.
What to prioritize in August
- Treat MFA seed material as a credential, not a configuration file. If an attacker can extract and replay it, it needs the same rotation and access controls as any other secret, not appliance-default protection.
- Audit your internet-facing SonicWall SMA1000 deployments against the published indicators of compromise. Assume compromise back to June 22, not the July 14 disclosure date.
- Watch for blank application-ID fields in Entra sign-in logs. A missing value in that field is no longer a data quality issue. It may be the only sign a credential-validation attempt happened at all.
- Keep reviewing third-party OAuth grants tied to the Klue breach. New victims are still surfacing , and the same integration review applies to any vendor relationship carrying delegated access.
The Delinea Platform, powered by Iris AI, continuously discovers identities, analyzes privilege risk and enforces access control at the moment of execution across human, machine and AI identities. Runtime authorization extends that enforcement to the action itself, evaluating individual commands and queries inside a session rather than only the session that carries them.