CYBERDOM

Turning an approved blueprint into a rogue cloud identity.

Notes from the other side, from the Agent Skills side.

On my way to another vulnerability (which was submitted to MSRC), I found vast misconfigurations and abuses in Azure IMDS.

Think of Entra Agent ID like a passport for an AI worker.

When you hunt for vulnerabilities long enough, you keep tripping over abuses hiding in plain sight.

We’re in 2026, and inbox persistence is still here, and it’s one of the core pillars of the Microsoft 365 attack playbook.

Exchange Online’s split architecture creates blind spots that BEC operators have been quietly exploiting.

Harvest Now, Decrypt Later, or Decrypt Later, Damage Forever… Attackers are already collecting data.

Web browsers quietly handle credentials, tokens, and sensitive data for every tab we open, turning the browser into a critical security boundary.

I love middleware, if it’s on Cloud Vendor, AI components, etc.