Back Gbhackers

Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration

Gbhackers •Divya • May 6, 2026

A recent authorized red team operation by Howler Cell has demonstrated a critical attack path that completely bypasses Microsoft Entra ID (Azure AD) Conditional Access. Azure Conditional Access acts as the primary gatekeeper for cloud identity security, enforcing access rules based on user location, device compliance, and calculated risk scores. However, by starting with a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Bypass of Azure AD Conditional Access Discovered An authorized red team operation by Howler Cell has revealed a method to bypass Microsoft Entra ID (formerly Azure AD) Conditional Access. This security feature is crucial for cloud identity management, enforcing access based on user location, device compliance, and risk scores. The attack exploits phantom device registration and PRT abuse, allowing unauthorized access to systems that rely on this security. The full scope of affected organizations is currently unknown, but the implications for cloud security are significant. Microsoft has not yet released a patch or mitigation strategy for this vulnerability. Security teams are advised to review their Conditional Access configurations and monitor for suspicious activities. The attack highlights the need for enhanced security measures in cloud identity systems. 2 sources 68

Attackers Bypass Azure AD Conditional Access Using Phantom Device Registration

The full story

Extracted Entities

APT Groups (1)

Companies (1)