Defending SaaS-based applications against ShinyHunters OAuth abuse

Microsoft Security Blog highlights multiple security updates and threat findings: Microsoft Threat Intelligence observed activity linked to ShinyHunters abusing OAuth and SaaS workflows — using vishing, supply‑chain compromise, and misconfigured guest access to gain OAuth consent and persist in tenant app access. Microsoft also announced Entra ID changes: passkeys become the default sign-in method and a new model for SMS/voice authentication is being introduced (prepare for deployment). Separately, Microsoft analyzed GigaWiper (aka BLUERABBIT), a destructive backdoor that combines wiping and r