No Malware Required: The Complete Defender's Playbook for Identity-Based Attacks in 2026

TL;DR: The majority of significant breaches in 2026 don't involve exploiting a single CVE or dropping a single payload. They walk in through the front door with stolen credentials. The Coinbase Cartel ransomware group hit 164 companies — 80% of them had pre-existing infostealer infections in their employee base. Adversary-in-the-Middle (AiTM) phishing harvests valid session tokens through attacker-controlled proxies, bypassing MFA entirely. Your EDR is blind to this. This is a complete operational playbook: what the attacks look like, where they leave traces, how to detect them layer by layer, and how to respond before ransomware or exfiltration completes.

---

Background: The Paradigm Shift That Makes Your Firewall Irrelevant

For three decades, enterprise security operated on a single axiom: attackers need malware or exploits to gain entry. Build a wall (firewall), watch for bad code (AV/EDR), correlate anomalies (SIEM). The architecture assumed that authentication events were trustworthy — that a successful login represented a legitimate user.

That assumption is gone.

A significant portion of 2026 breach investigations conclude without ever finding a remote code execution vulnerability or a novel payload. The attacker logged in. Their traffic looked normal. Their credentials were valid. And yet they exfiltrated terabytes of sensitive data — or dropped ransomware — while every sensor in the stack logged clean.

This is the identity-as-perimeter threat model. The boundary is no longer the network edge; it is the authentication event. Once a valid credential or session token crosses that boundary, controls designed to stop lateral movement often operate blind.

Understanding this shift is not academic. It dictates every detection priority, every tooling investment, and every incident response step in your playbook.

---

The Attack Surface: Four Techniques Defining 2026

1. Adversary-in-the-Middle (AiTM) Phishing and Token Interception

AiTM attacks use a reverse proxy — most commonly frameworks like Evilginx, Modlishka, or custom tooling built on standard open-source components. The victim receives a convincing phishing email with a link to a spoofed login page. Their credentials flow through the attacker's proxy to the real identity provider (Microsoft Entra, Okta, Google Workspace). They complete MFA normally. The proxy captures the resulting session cookie.

The attacker now holds a valid, authenticated session token. MFA is irrelevant — it was already completed by the victim.

In March 2026, the EvilTokens campaign specifically targeted the Microsoft OAuth Device Code flow. Rather than needing the victim's credentials at all, attackers generated a device code, sent the victim a phishing page, and captured the access token post-authorization. The victim completed their normal login flow; the attacker walked away with a persistent token.

This is zero-malware, zero-exploit, fully authenticated access.

2. Infostealer Credential Pipelines: The Pre-positioned Threat

Infostealers — RedLine, Lumma, Vidar, Raccoon, and their derivatives — operate in a shadow economy that continuously feeds stolen credentials into underground marketplaces. In April 2026, Vidar was observed distributing through fake CAPTCHA pages, hiding staging payloads inside JPEG and TXT files to evade static detection, and using IP-based delivery infrastructure (documented C2 at 62.60.226.200) to pull encrypted second-stage modules.

The critical intelligence finding from Hudson Rock's analysis of the Coinbase Cartel operation: of 164 breached organizations, 80% had documented infostealer infections in their employee or contractor base — in many cases, years before the ransomware event. The cartel simply purchased old credential logs, validated which ones still worked against cloud portals and file transfer services, and walked in.

The attacker's pipeline:

1. Buy bulk infostealer logs from underground markets

2. Filter for credentials matching target organization domains

3. Test against cloud SSO, VPN, and file-sharing portals

4. Identify valid sessions or credentials

5. Escalate to full environment access — without any malware on corporate infrastructure

3. Pass-the-Cookie and Session Token Replay

Session cookies grant authenticated access until expiry. Modern SaaS platforms often issue long-lived tokens (hours to days) to reduce authentication friction. An infostealer that extracts a browser's cookie store gives an attacker access to every authenticated session on that device.

Token theft is now more operationally valuable than credential theft. A stolen password can be reset; a session token only needs to be replayed before expiry. The attack leaves no authentication log entry — from the IdP's perspective, the original session is continuing normally.

4. MFA Fatigue, Social Engineering, and Help Desk Manipulation

Scattered Spider — the English-speaking social engineering collective now operating under the DragonForce ransomware umbrella — built their entire operation on one insight: humans answer phones.

Their model: obtain credentials from leaked databases or infostealer logs, trigger repeated MFA push notifications until the victim approves one out of annoyance, then call the help desk impersonating the target employee to reset MFA entirely. They have documented success rates in the 40–60% range against enterprise help desks lacking strict verification protocols.

No CVE required. No exploit code required. Just a phone.

---

Where Legitimate Tools Fail

| Detection Layer | What It Sees | What It Misses |

|---|---|---|

| Firewall/NGFW | Malicious traffic patterns | Legitimate HTTPS to IdP |

| AV/EDR | Malware payloads | Clean browser cookie extraction |

| SIEM correlation | Failed logins, malware alerts | Successful logins from stolen tokens |

| MFA | Unauthenticated access attempts | Token replay (auth already completed) |

| DLP | File movement from corporate devices | Exfil from attacker's device with valid token |

The pattern is consistent: every layer is bypassed because the attacker is inside the authentication boundary with valid credentials. Detection has to shift to post-authentication behavioral analysis. This is the domain of Identity Threat Detection and Response (ITDR).

---

Detection: Building the Signal Stack

Layer 1: Pre-Authentication — Infostealer Exposure Monitoring

The infostealer pipeline is pre-positioned. Your credentials are already for sale before the attack begins. Monitoring for this gives you days to years of advance warning.

Actions:

• Subscribe to commercial credential intelligence feeds (Hudson Rock Cavalier, SpyCloud, Flare, Have I Been Pwned Enterprise)
• Integrate infostealer exposure alerts directly into your SIEM with auto-escalation rules
• Cross-reference exposed credentials against current Active Directory accounts — any exposed credential that hasn't been rotated is an open door
• Monitor dark web marketplace listings for domain-specific credential batches

KQL query for Entra ID (Microsoft Sentinel) — logins from credentials flagged in infostealer feeds:

SigninLogs
| where UserPrincipalName in (infostealer_flagged_accounts)
| where TimeGenerated > ago(24h)
| project TimeGenerated, UserPrincipalName, IPAddress, DeviceDetail, LocationDetails, ResultType
| where ResultType == 0  // Successful logins only

Layer 2: Authentication Anomaly Detection

AiTM attacks and token replay create characteristic authentication patterns that differ from normal user behavior:

Signals to hunt:

• Successful login immediately followed by anomalous location (IP geo diverges from registered devices)
• Session continuation from IP address that never authenticated (token replay from different device)
• MFA approval followed immediately by a credential reset request (Scattered Spider pattern)
• OAuth consent grants for applications not in your approved app registry
• Conditional Access policy triggers on trusted location abuse (authentication from "trusted" IP that geolocates inconsistently)
• Simultaneous sessions from different countries within an impossible travel window

KQL hunting query for impossible travel:

SigninLogs
| where ResultType == 0
| project TimeGenerated, UserPrincipalName, IPAddress, Location
| join kind=inner (
    SigninLogs
    | where ResultType == 0
    | project TimeGenerated2=TimeGenerated, UserPrincipalName, IPAddress2=IPAddress, Location2=Location
) on UserPrincipalName
| where abs(datetime_diff('minute', TimeGenerated, TimeGenerated2)) < 120
| where Location != Location2
| where IPAddress != IPAddress2

Okta System Log hunting for MFA anomalies:

eventType eq "user.mfa.attempt_bypass" OR
eventType eq "user.session.impersonation.grant" OR
(eventType eq "user.authentication.auth_via_mfa" AND 
 result eq "SUCCESS" AND 
 actor.type eq "User")
// Cross-correlate with: help desk ticket opened for same user within ±30 minutes

Layer 3: Post-Authentication Behavioral Detection

Once an attacker has a valid session, their behavior diverges from the legitimate user's baseline.

Behavioral signals:

• Access to SharePoint/OneDrive resources the user has never accessed previously
• Bulk download operations (>X MB in N minutes for a non-administrative account)
• Email forwarding rules created for external addresses
• New service principal or OAuth application registrations
• Changes to MFA methods, especially removal of phone-based authenticators
• Password spraying originating from the compromised account against internal resources
• First-time access to administrative portals or privileged resource groups

Microsoft Entra — Hunting for malicious OAuth app registration:

AuditLogs
| where OperationName == "Add application"
| where InitiatedBy.user.userPrincipalName !in (approved_app_admins)
| where TimeGenerated > ago(48h)
| extend AppName = TargetResources[0].displayName
| project TimeGenerated, InitiatedBy, AppName, TargetResources

Layer 4: Endpoint Correlation (EDR + ITDR)

The disconnection between endpoint events and identity events is exactly what attackers exploit. An infostealer infection on a personal device (which has no EDR) feeds credentials used to access corporate cloud — and the corporate EDR never sees the theft.

Unified EDR+ITDR correlation closes this gap by linking endpoint compromise indicators to subsequent identity events:

• If EDR detects a credential-harvesting process (e.g., LSASS dump, browser database read) on Device A, flag all authentication events from that user's account for the next 48 hours as high-risk — regardless of where the login originates
• Correlate infostealer signatures (file hashes, network IOCs for Lumma/RedLine/Vidar C2 infrastructure) with the user's subsequent cloud authentication timeline

---

Indicator Set: AiTM and Infostealer Infrastructure (April 2026)

| Type | Value | Context |

|---|---|---|

| IP | 62.60.226.200 | Vidar infostealer delivery infrastructure (April 2026) |

| Pattern | Device Code OAuth flow + external IP | EvilTokens AiTM campaign (March 2026) |

| Pattern | Browser cookie store access by non-browser process | Pass-the-cookie extraction |

| MITRE | T1539 | Steal Web Session Cookie |

| MITRE | T1621 | Multi-Factor Authentication Request Generation (fatigue) |

| MITRE | T1566.002 | Spearphishing Link (AiTM delivery) |

| MITRE | T1111 | Multi-Factor Authentication Interception |

| MITRE | T1528 | Steal Application Access Token |

---

Response Playbook: Step-by-Step

T+0 to T+15 minutes: Triage and Scope

1. Identify the authentication method that was abused. Was it credential theft? Session token? OAuth application? This determines whether you need to reset passwords, revoke sessions, or revoke app permissions.

2. Revoke all active sessions for the affected account immediately. In Entra ID: Revoke-AzureADUserAllRefreshToken or via the portal. In Okta: terminate all sessions from the admin console.

3. Do not just reset the password. If the attacker holds a session token, a password reset alone does not invalidate active sessions unless you also explicitly revoke refresh tokens.

4. Preserve evidence. Export the full sign-in log for the affected account before session revocation. Sign-in logs in Entra ID only retain 30 days by default; archive to Log Analytics workspace.

T+15 to T+60 minutes: Containment

5. Block all external OAuth app registrations temporarily if an unauthorized app was identified. Enable Conditional Access policies requiring admin approval for new OAuth consent.

6. Audit MFA methods for the affected account. Remove any authenticator devices or phone numbers you cannot verify. Require re-registration through an out-of-band, verified channel.

7. Check for mail forwarding rules and inbox manipulation. Attackers commonly create forwarding rules as persistence before gaining deeper access. Remove any rules pointing to external addresses.

8. Search for lateral movement. Using the attacker's authenticated session, they may have accessed other accounts, administrative portals, or created new service principals. Run:

- Audit logs for any object creation in the 2-hour window after the anomalous login

- Check for new privileged role assignments

- Review all Conditional Access policy modifications

9. Notify help desk with a lockout protocol. If Scattered Spider-style social engineering is suspected, place a flag on the account: no authentication changes via phone support, require in-person or cryptographic verification.

T+1h to T+24h: Eradication and Recovery

10. Identify the source of the credential compromise. Pull infostealer intelligence feeds for the affected email address. If a prior compromise is found, identify the timestamp — when was the device infected? This may reveal a much larger scope.

11. Audit all accounts that shared device access with the compromised user. If a personal device was infected, any corporate credentials stored on that device are also compromised.

12. Require FIDO2 hardware keys or certificate-based authentication for all administrative accounts and all accounts with access to sensitive data. AiTM attacks cannot intercept FIDO2 challenges — the key is bound to the originating domain and the challenge is cryptographically signed.

13. Review OAuth application registry. Audit all third-party apps with access to your tenant. Revoke any app that does not have documented business justification and a responsible owner.

14. Enable Continuous Access Evaluation (CAE) in Entra ID. CAE enables near-real-time token revocation — when a sign-in policy changes or a user is disabled, tokens are invalidated within minutes rather than at their normal expiry.

T+24h+: Hardening

15. Implement phishing-resistant MFA across all accounts. FIDO2 (hardware keys, passkeys) or certificate-based authentication are the only MFA types that defeat AiTM. Authenticator push and SMS are both bypassable.

16. Deploy token binding where supported. Token binding cryptographically ties an access token to the TLS session that created it — replaying the token from a different TLS context fails.

17. Reduce session token lifetime. Long-lived tokens maximize attacker dwell time after theft. For high-risk roles, reduce access token lifetime to 1 hour and require reauthentication for sensitive resource access.

18. Integrate infostealer monitoring into your onboarding and offboarding process. Check new employee credentials against breach intelligence before provisioning access. Check departing employees for any last-minute infostealer activity that might have caught their credentials.

---

Lyrie Take: Machine-Speed Detection Is the Only Viable Answer

The fundamental problem with this attack class is the time window. An AiTM token is valid from capture to expiry. An infostealer-acquired credential may be valid for months or years before the attacker decides to use it. Human-paced incident response — open a ticket, escalate to Tier 2, schedule an analyst — operates on a cycle measured in hours to days.

The Coinbase Cartel's victims had infostealer exposure documented years in advance. They had the data to act. The problem was that no system correlated "credentials in underground markets" with "active employee accounts" in real time, or automatically triggered remediation.

This is the exact problem that Lyrie is built to solve. Identity-based attacks leave traces — anomalous session origins, impossible travel, new OAuth grants, bulk download events — but those traces require continuous, automated correlation across identity logs, endpoint telemetry, and external threat intelligence simultaneously. That correlation cannot happen at analyst speed when attacks complete in under 90 minutes from initial token capture to exfiltration.

Autonomous, machine-speed detection and automated response — session revocation, Conditional Access policy enforcement, account isolation — is the architectural requirement. Any playbook that routes through a human analyst as the primary response mechanism has already lost the race.

---

Defender Playbook: Priority Actions (Ranked by Impact)

| Priority | Action | Defeats |

|---|---|---|

| P0 | Deploy FIDO2/passkeys for all admin + high-value accounts | AiTM, token replay, MFA fatigue |

| P0 | Enable session revocation + CAE in Entra/Okta | Token replay persistence |

| P1 | Subscribe to infostealer credential monitoring (SpyCloud, Hudson Rock) | Pre-positioned infostealer access |

| P1 | Enable ITDR with impossible travel + anomalous session detection | All four attack types |

| P1 | Audit OAuth app consent grants monthly | OAuth persistence |

| P2 | Reduce access token lifetime for privileged roles | Token replay window |

| P2 | Implement strict help desk verification protocol | Social engineering / MFA reset |

| P2 | Correlate EDR cookie-theft events with identity log anomalies | Pass-the-cookie |

| P3 | Deploy Conditional Access with device compliance requirements | Unmanaged device token replay |

| P3 | Train employees on AiTM phishing recognition (check URL bar, domain) | Initial phishing success rate |

---

Sources

1. Andrea Fortuna, "When identity becomes the perimeter: breaking in without malware" (April 26, 2026) — andreafortuna.org

2. Hudson Rock / InfoStealers.com, "Inside the Coinbase Cartel: How Infostealer Credentials Fueled a 100+ Company Ransomware Spree" (April 2026)

3. Huntress, "Unified EDR + ITDR: Closing the Identity Gap Before Attacks Spread" (April 2026)

4. HackRead, "Vidar Infostealer Spreads via Fake CAPTCHAs, Hides in JPEG and TXT Files" (April 2026)

5. SecurityWeek, "Why Cybersecurity Must Rethink Defense in the Age of Autonomous Agents" (April 2026)

6. MITRE ATT&CK: T1539, T1621, T1566.002, T1111, T1528

7. Microsoft, Conditional Access and Continuous Access Evaluation documentation (2026)

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk