How to Hack Accenture

In this episode, we break down four major cybersecurity stories showing how modern attacks are shifting from traditional malware to identity abuse, cloud compromise, endpoint telemetry, and security-tool exploitation.

First, we look at Accenture’s confirmed “isolated matter” after a criminal attempted to sell an alleged 35GB data haul containing source code, keys, Azure tokens, and cloud credentials. Then we examine how Microsoft device telemetry reportedly helped investigators unmask an alleged Scattered Spider hacker, highlighting the growing role of endpoint identifiers, device intelligence, VPN correlation, and digital forensics.

We also cover Helix, a data extortion group linked to BlackFile and ShinyHunters-style activity, using voice phishing, device code phishing, MFA enrolment abuse, and automated SharePoint data theft. Finally, we dive into RoguePlanet, the Microsoft Defender privilege-escalation vulnerability that exposed how even trusted endpoint security tools can become part of the attack surface.

This episode goes beyond the headlines with a technical deep dive into secrets management, Azure Personal Access Tokens, SSH keys, cloud storage access, device telemetry, identity-based attacks, SaaS data theft, SharePoint enumeration, race conditions, TOCTOU vulnerabilities, and Windows SYSTEM privileges.

If you want to understand where cyber attacks are heading in 2026, this episode explains why identity, cloud control planes, endpoint telemetry, and security tooling are now central to both attackers and defenders.

You can contact us at: cyberinvestigationsau@gmail.com

Thanks for listening.

Follow the podcast for more cyber security news, malware analysis, threat intelligence, AI security, and real-world attacker tradecraft.

For contact or story tips, email: cyberinvestigationsau@gmail.com

Disclaimer: This podcast is for education and awareness only. Technical details are shared to help defenders improve detection, response, and security controls.

Transcript

SPEAKER_00 0:05

Welcome back to the show. Today we're covering four cyber stories, an alleged Accenture data leak, Microsoft Telemetry helping unmask an alleged scattered spider hacker, a new extortion group called Helix, and a Microsoft Defender vulnerability called Rogue Planet. So let's get into it. First story that's come out of InfoSec this week is that Accenture's confirmed what it called an quote-unquote isolated matter after a cyber criminal tried to sell what they claimed was 35 gig of Accenture data. According to the report, the seller claimed the data included source code, RSA keys, SSH keys, Azure Personal Access tokens, Azure Storage Access Keys, config files, and other technical material. Accenture said it had investigated, remediated the source, and that there was no impact to operational or service delivery. Let's dive a bit deeper into what this could mean technically. Source code is valuable because it tells an attacker how systems are built. It can reveal internal APIs, authentication flows, dependency versions, naming conventions, deployment scripts, and sometimes mistakes like hard-coded secrets. Even when source code does not contain passwords, it can show where the real authentication systems live. The keys and tokens are even more serious. An SSH private key can be used to authenticate to servers or repositories if it has not been revoked. An RSA key might be used for signing, encryption, or authentication depending on the environment. An Azure DevOps personal access token or PAT can act almost like a password for developer tooling depending on its scope. It may allow access to repositories, pipelines, or build artifacts. Furthermore, Azure Storage Access Keys are also powerful because they bypass more granular identity controls. If an attacker gets a storage account key, they may not need to compromise a normal user account at all. They can potentially talk directly to the storage service as a trusted client. I guess thinking about this story, I think the lesson here for cyber defenders and white hat hackers is that secrets should be treated as radioactive material. I mean, we all know this, but what can we do other than keep banging on the door of this message because this alleged Accenture hack has only confirmed that? Organizations should use secret scanning in repositories, rotate exposed credentials immediately, prefer short-lived tokens, use manage identities where possible, and all that stuff. You know, the blast radius should be small enough that one exposed repo does not become a map to the whole cloud estate. Let's quickly move on to story two, where Microsoft device telemetry was reportedly key to identifying an alleged scattered spider hacker. Scattered spider has been in the news a lot this week. So it's quite interesting to find out who the identity of these people are. And while Scattered Spider has increasingly had this uh many wins on the board, the operators are looking like pretty inexperienced cyber operators. So according to IT News, Peter Stokes, a 19-year-old, just 19, American Estonian extra data from Finland to the United States, was allegedly linked to a ransom case through a Microsoft Global Device Identifier or GDID. Now I've been seeing this GDID all through cyber news this week because it's it's one of those technologies where something major happens in the cyber world. And we all just have now learnt a new term. The FBI affidavit reportedly said Microsoft had access to data such as machine IDs, IP addresses, and malware samples associated with cyber groups. The allegation is that Stokes used a VPN and NGROC, but the Windows installation still had a persistent device identifier that investigators could correlate with other records. Once you think your OPSEC is good, it's probably not as good as Microsoft. The Department of Justice says that uh Peter Stokes was charged with conspiracy, computer intrusion, and fraud, and alleged a scattered spider has targeted companies by compromising employee accounts, uh, exfiltrating or encrypting data and demanding crypto. The USDOJ also said that the group has been linked to more than a hundred intrusion and intrusions and more than a hundred million US dollars in ransom payments. If only had gotten away, but he will not see that a hundred million, will he? This story really got me thinking about OPSEC, you know, the potential OPSEC to OPSEC of a you know an illegal cyber operator and the mistakes that they will inevitably run into. So let look let's look at the technical details of what happened here. A VPN hides network location. You probably already know this, but it does not magically erase endpoint identity. Right? A device can still generate telemetry, installation identifiers, crash data, diagnostic data, software fingerprints, so on and so forth. That telemetry can be useful for security because it helps correlate activity across accounts and networks. Think of it like this. An IP address tells you where traffic appeared to come from. A device identifier, however, can suggest which machine generated the activity. If one machine logs into a tunnel service at one time, then around the same time the same device identifier appears near other accounts or services. Investigators can build a timeline. This is a computer science concept of correlation. Digital correlation. No single event necessarily proves everything, but many weak signals can become strong when combined. Timestamp Ngrop records, VPN exit nodes, device IDs, cloud logs, social media login records, and identity provider logs. So for defenders, this is why endpoint telemetry and identity logs need to be joined together. And it really shows us that looking at IP addresses is weak because attackers use VPNs, proxies, and residential IPs. We know this. Looking only at usernames is also weak because credentials get stolen. But looking at user devices, token location, sessionage, MFA events, this metadata, if you will, can paint a much stronger picture. And it's one of these things that hackers think they're nobody's looking at. Go through multiple hops, use Tor, but simple things like this can get you popped. It also shows why privacy and security telemetry are always intentional. I think it's worth noting. The same data that helps detect abuse can also be sensitive. Mature organizations need governance around retention, access control, and so on and so forth. Let's quickly move on to the third story that I found quite interesting this week. Helix, a previously unreported data extortion group, has been linked by Reliquest to the wider black file and Shiny Hunter's ecosystem. The report says Helix used voice phishing. This is sort of a new technique, isn't it, voice phishing? Um, but they've reportedly been using it. They've also been reported as using device code phishing, automated SharePoint theft across multiple instances. The attackers allegedly used shared infrastructure including target-specific phishing subdomains and focused on identity systems rather than traditional malware. In one case, it looks like the attacker reportedly spoofed a manager's caller ID and used knowledge of the company's structure to make the approach more believable. Just classic social engineering. So at a high level, this social engineering fused with cloud automation, it shows that the attackers did not need to drop ransomware. If they can just convince a user to authorize access, register MFA, and then mass-download data from SaaS platforms. An interesting sort of new spin on attacking techniques, you know, was interesting for me to read coming out of this news article. And it really had me thinking about the technical concepts and the technical uh uh TTPs of of this campaign. So I want to dive a bit more into the technical details of what we're seeing here. Device code phishing abuse it sort of takes advantage of a legitimate login flow, which is the interesting thing here. The device code flow was designed for devices that are hard to type on, right? Like smart TVs or CLI tools. The user is shown is shown a code, right? Visits a Microsoft login page, enters the code, and approves the access. The danger is that an attacker can initiate the flow on their own ad own device, then trick the victim into entering the code. The victim thinks they are helping IT or approving something routine, but they are actually granting the attacker a valid session. You know, once inside, heal it's reportedly registered a new MFA authenticator within minutes. That's important, right? MFA is supposed to protect accounts, but if an attacker can enroll their own factor after compromising a session, MFA becomes part of the attacker's persistence. The post-access behavior is also interesting. In the report says the operators move from manual discovery to automated SharePoint collection. That means they likely first browsed around to understand what the account could access, then used scripts to enumerate and download content in bulk. This is a key point for defenders. The suspicious event may not be right malware.exe execute. It might be normal user account suddenly searching SharePoint at machine speed from unusual infrastructure with a strange user user agent. Shortly after a new MFA method was added. Reliquest also reported residential proxies geo-matched to the victim's city. This is designed to avoid impossible travel alerts. Instead of logging in from a foreign data center, the attacker appears to come from a local consumer IP address. This is why detection needs to look beyond geography. Watch for new MFA enrollments, device code authentication events, unmanaged devices accessing sensitive SaaS environments, so on and so forth. I think the the takeaway I've found is clear. Disable device code authentication, we can. Might be difficult for admin, but we're seeing these attacks happen in the wild. We need to restrict it to managed devices where you cannot require compliant endpoints for SharePoint and exchange, and alert on new MFA registrations followed by high volume access. Okay. Fourth and final story of today, and this one is incredibly interesting. Microsoft has been having a bit of a time this year with Zero Days being dropped by a lot of people. We've all heard about the what is it, the midnight eclipse feud that Microsoft is having with a rogue actor is dropping zero day after zero day. Well, it looks like we've got another one. Microsoft has patched Rogue Planet, which is a Microsoft Defender vulnerability tractor CV 2026 5065.6. Looks like this flaw affects the Microsoft malware protection engine, the component behind Defender Scanning, detection, and cleaning capabilities. This issue is described as a privileged escalation vulnerability with a CVSS score of 7.8. Microsoft fixed it in malware protection engine version 1.126060. Just stumbling through my notes here. The floor was publicly described as a race condition that allows an attacker to spawn a shell with system level privileges. If you're a Microsoft admin, or if you work in InfoSec, you know this is just all around not a happy day at the office. At a high level, this is fairly serious if you think about it, because Defender runs deep with runs deep on a machine with deep system privileges, right? Security tools often need high privileges so that they can inspect files, processes, memory, and system activity. But it also means a bug inside a security tool can become a powerful local privilege escalation path. Let's get a bit further into the technical details of what's actually going on here. Erase condition happens when software behavior depends on timing. Imagine one process checks whether a file is safe, but before it actually uses that file, another process swaps it out. The check was true at one moment, but the object changed before the privileged action happened. This is this class of bug is often called time of check to time of use or talk to. In endploit security products, race conditions can be especially dangerous because antivirus engines constantly inspect attacker-controlled files. If the scanning engine opens, copies, quarantines, deletes, or repairs files as system, then any unsafe file handling logic becomes a possible privilege boundary. The reason system matters is that it is one of the highest local privilege contexts on Windows. And when I mean system, I mean all caps system. A normal user is limited. An administrator is powerful, but all caps system is the operating system itself. Code running as system, all caps system, can modify protected areas, tamper with services, access sensitive files, and disable controls. I think the key lesson here is that security software has a huge attack service, particularly Microsoft. You probably already knew that. It passes archives, scripts, executables, documents, disk images, and weird edge case file formats. That means defenders need to patch security tools just as aggressively as operating systems and browsers. Microsoft says no customer action is required in default configurations because the malware protection engine updates automatically. But in enterprise environments, if you're out there, it's still worth verifying the engine version. Checking update health and making sure isolated or offline machines are not stuck on an old engine. I think these were the main stories that I saw this week in cybersecurity. Thank you very much for tuning in. Relatively new podcast, so trying to run up the downloads, please give me a like, a comment, all of it helps. See you next time.