Episode Details

In this session, we analyze the commodification of MFA-bypass techniques through the Greatness PhaaS platform and the massive supply chain poisoning campaign dubbed ChainDrop. We investigate how threat actors are abusing legitimate OAuth 2.0 Device Authorization Grants to seize control of Microsoft 365, Google Workspace, and iCloud accounts. The briefing also breaks down the findings from GitGuardian regarding n8n API token leaks and Securonix’s discovery of the Smoke#Screen campaign targeting ScreenConnect instances. We conclude with a look at the Unitel telecommunications breach in Angola and what it reveals about infrastructure resilience during high-stakes financial events like an IPO.

Topics Covered

• 🔐 Greatness PhaaS Evolution: The shift toward device code phishing to bypass MFA and exploit vendor trust.
• 📦 ChainDrop npm Poisoning: A Shai-Hulud variant affecting 1,300+ packages with 2 billion monthly downloads.
• ⚙️ Automation Platform Risk: Analysis of leaked n8n API tokens and the resulting downstream credential exfiltration paths.
• 🏢 Infrastructure Resilience: The Unitel IPO breach and the persistence of RMM-based takeover gambits like Smoke#Screen.
• 🛡️ Practitioner Controls: Implementing conditional access policies and behavioral EDR for remote management tools.

Disclaimer: The information provided is for educational purposes and is based on reported cybersecurity events as of August 5th, 2026.

Neural Newscast is AI-assisted, human reviewed. View our AI Transparency Policy at NeuralNewscast.com.

• (00:11) - Introduction
• (00:11) - Infrastructure and RMM Risks
• (00:11) - Greatness PhaaS and MFA Bypass
• (00:11) - Supply Chain Poisoning and API Leaks