Identity Is the New Perimeter: Five Security Lessons for Australian Businesses This Week

A fresh wave of identity attacks, passkey changes and access infrastructure vulnerabilities is making one point clear: cyber security now starts with proving who or what is requesting access.

For small and mid-sized organisations, the challenge is not buying every new security product. It is reducing unnecessary access, strengthening authentication and making sure identity systems are treated as business-critical infrastructure.

1. Fake AI advertising portals are harvesting credentials and MFA codes

Security researchers this week reported a phishing operation impersonating advertising and business portals associated with ChatGPT, Gemini, Claude, Perplexity and other AI services. The campaign targeted advertising teams, agencies and account administrators with convincing pages that appeared to help users connect marketing accounts or analyse campaign performance.

The operation used browser-in-the-browser techniques. Instead of sending users to a basic fake login page, the attacker displayed a realistic sign-in window inside the browser. The platform could capture usernames, passwords and MFA codes in real time, while human operators controlled which authentication prompts appeared next. A major security news report said the campaign included lookalike services and workflows designed to capture access to Google, Meta, TikTok and Okta accounts.

This matters because marketing and finance teams often control valuable advertising accounts, customer audiences and payment methods. A compromised account can result in fraudulent spending, damaged brand reputation, stolen customer data or a wider compromise through connected SaaS applications.

MFA remains important, but this incident is a reminder that not all MFA is equally resistant to phishing. If a user is persuaded to type a password and one-time code into a fake page, the attacker may be able to relay those details to the real service before the code expires.

Practical steps for business leaders:

• Require staff to open AI, advertising and cloud services from approved bookmarks or managed application portals rather than search advertisements.
• Prioritise phishing-resistant authentication such as passkeys or hardware security keys for administrators, finance staff, marketing teams and external agencies.
• Review who can create advertising campaigns, change payment details, export audiences or invite new users.
• Set spending limits, approval workflows and alerts for unusual advertising activity.
• Train staff to treat unexpected connect, verify or account recovery prompts as security events, not routine administration.

According to the research coverage from The Hacker News, the operation was not simply a static credential collector. Live operators could adjust the fake page during the sign-in process and request different authentication methods. That is a useful warning for organisations that rely on SMS codes, authenticator prompts or number matching without monitoring the surrounding sign-in context.

2. Passkeys are moving from optional feature to default expectation

Passkeys were also prominent in this week’s technology coverage, with a major consumer technology publication highlighting their growing role as an alternative to passwords. Passkeys use cryptographic credentials stored on a device or password manager, with the user typically approving access using a biometric check or device PIN. The private key is not shared with the website, and the credential is designed to work only with the legitimate service.

The business significance is more immediate than the consumer headlines suggest. Microsoft has announced that passkeys will become the default authentication experience in Microsoft Entra ID for eligible users, while Microsoft-provided SMS and voice authentication are scheduled to end for public cloud tenants on February 1, 2027. Organisations that still need those methods will need to review supported alternatives and plan their migration. Microsoft’s identity advisory outlines the rollout dates and fallback considerations.

For Australian businesses, this is a practical planning issue. A passkey rollout can reduce phishing risk, help lower help desk password reset costs and improve the sign-in experience. It can also create disruption if employees lose devices, contractors use unmanaged endpoints or recovery processes are poorly designed.

The key is to treat passkeys as an identity lifecycle project rather than a switch to turn on. Registration, device replacement, staff departures, emergency access and administrator recovery all need to be documented and tested.

Practical steps for business leaders:

• Identify which systems support passkeys, FIDO2 security keys or other phishing-resistant authentication.
• Start with privileged administrators and high-impact roles before expanding to the wider workforce.
• Create at least two approved recovery paths that do not depend on the same device or phone number.
• Test joiner, mover and leaver processes, including device loss and contractor offboarding.
• Communicate the change clearly so staff recognise legitimate registration prompts and do not follow unsolicited links.

The FIDO Alliance continues to position passkeys as part of a broader move toward simpler and stronger digital identity. For smaller organisations, the lesson is not that every password must disappear immediately. It is that password and SMS-only access should no longer be treated as the long-term default for sensitive systems.

3. Cloud identity attacks are becoming more convincing and more persistent

Recent Microsoft security research has described an attack pattern in which criminals impersonate IT support, use passkey or MFA setup as a pretext, and then establish their own authentication method on a compromised cloud account. Once inside, the attackers can conduct reconnaissance through cloud APIs, access SharePoint and OneDrive content, collect email and potentially exfiltrate data.

The most important point is that the attacker may not need to steal a password in the traditional way. Social engineering, device-code flows, session tokens and fraudulent authentication registration can all help an attacker turn a legitimate account into a foothold. Microsoft Security Research recommends investigating the sequence across identity, Microsoft Graph, SharePoint, OneDrive and Exchange signals.

This is particularly relevant to smaller businesses because cloud accounts often combine email, files, customer information, finance workflows and administrative access. One compromised employee account can therefore become a route into several business processes.

It also exposes a common weakness in zero trust programmes. An organisation may have MFA, conditional access and device policies in place, but still rely on a weak help desk process or an unverified phone call when a new user needs access. If the first identity check is wrong, later controls are working with a false assumption.

Practical steps for business leaders:

• Require strong identity verification before changing MFA methods, registering a new device or resetting access.
• Restrict who can add authentication methods, approve device-code requests or change recovery details.
• Alert on new authentication methods, unusual consent grants, impossible travel and high-volume file downloads.
• Revoke active sessions and remove unauthorised authentication methods immediately after a suspected compromise.
• Include personal mobile phones and remote support calls in security awareness training because they may not appear in endpoint logs.

A useful operational exercise is to ask your IT provider to demonstrate how it would investigate a suspicious login from start to finish. The answer should include identity logs, endpoint telemetry, email activity, cloud file access and administrator changes, not just a firewall review.

4. Zero trust is expanding beyond employees and laptops

This week’s discussion around the agentic enterprise focused on a major shift in how organisations think about identity. Traditional access management was designed around human employees signing in from known devices. Businesses now also use service accounts, APIs, automation platforms, software agents and AI systems that can make decisions or take actions.

A recent TechRadar Pro analysis argued that the difficult question is no longer only whether an identity was verified at the first login. Organisations must also understand what that identity can do, whether its behaviour remains normal and when its access should expire.

The same issue is appearing in zero trust discussions across government and industry. Breaking Defense reported that security teams are grappling with the challenge of assigning and governing identities for users, devices and AI agents across complex environments.

For small and mid-sized organisations, this does not mean every business needs a large AI security programme. It does mean that old shared credentials and permanent service accounts deserve urgent attention. A forgotten API key or over-privileged automation account can provide an attacker with a quiet route around normal employee controls.

Practical steps for business leaders:

• Build an inventory of service accounts, API keys, automation tools, bots and AI services connected to business data.
• Give each workload or agent its own identity rather than sharing a human administrator account.
• Apply least privilege and limit access to only the systems and data required for a defined task.
• Set expiry dates, rotation schedules and approval requirements for credentials and tokens.
• Log actions performed by automation and review whether the behaviour matches the stated business purpose.

The most useful question is simple: if this account were compromised tonight, what could it access and how quickly could we shut it down? If the answer is unclear, the account is not ready for a zero trust environment.

5. Access gateways remain high-value targets

Identity is not only about directories and login pages. The infrastructure that brokers remote access can be just as important. This week, Citrix published security bulletins covering multiple NetScaler ADC and NetScaler Gateway vulnerabilities. The vendor said exploitation of two vulnerabilities in the broader bulletin had been observed on unmitigated deployments. A separate bulletin covered a memory overflow vulnerability affecting configurations using SAML as a service provider or identity provider. Citrix’s security bulletin recommends upgrading affected deployments, while the SAML-specific bulletin lists the relevant preconditions and fixed releases.

The lesson extends beyond Citrix. VPN gateways, remote desktop services, identity proxies and secure access appliances sit at the intersection of the public internet and internal resources. They often handle authentication, federation and session management, which makes them attractive targets and operationally sensitive systems.

SonicWall also published an October security advisory for SMA1000 appliances covering a critical pre-authentication SSRF vulnerability with a CVSS score of 10.0. The vendor said the affected vulnerabilities had been actively exploited. SonicWall’s advisory identifies impacted firmware and remediation requirements.

Practical steps for business leaders:

• Maintain a current list of internet-facing VPN, remote access, identity and application delivery appliances.
• Subscribe to vendor security advisories and define who owns emergency patch decisions.
• Prioritise patches for systems that are internet-facing, authenticate users or provide access to internal applications.
• Confirm that management interfaces are not exposed directly to the public internet.
• Review logs for unexpected administrator activity, new accounts, configuration changes and authentication failures after emergency patching.

If your business relies on a managed service provider, ask for evidence that these systems are covered by its patching and monitoring process. Responsibility should be clear even when the equipment is hosted or managed by someone else.

What This Means For Your Business

The common thread across this week’s identity and zero trust news is that access must be treated as a continuously managed business decision. A login is only one moment in the lifecycle. Organisations also need to verify account recovery, device registration, privilege changes, application consent, automation activity and access gateway health.

Start with the accounts and systems that could cause the most damage if compromised. Protect administrators, finance staff, marketing platforms, cloud email and file storage with phishing-resistant authentication where possible. Remove unused accounts, reduce standing privileges and ensure that every access change leaves an auditable trail.

Then test the human processes around your technology. Can a caller convince the help desk to add an authentication method? Can a departing contractor retain access? Can an AI tool or automation account download sensitive data without triggering an alert? These questions often reveal more risk than another generic security awareness presentation.

The goal is not to create unnecessary friction. It is to make legitimate access easier for the right people while making impersonation, privilege abuse and lateral movement much harder. For Australian businesses, a focused programme built around strong identity, practical least privilege and rapid patching can deliver meaningful risk reduction without requiring an enterprise-sized budget.

Call Webwire on 08 9386 0053 or contact us at enquiries@webwire.com.au.