You have to invite them in

The Talos Threat Source newsletter highlights rising identity-based attacks, with nearly a third of MFA spray attacks targeting IAM applications and a 178% increase in fraudulent device registrations. Attackers increasingly use social engineering and adversary-in-the-middle phishing kits to capture credentials and session tokens. Additional coverage includes Middle East threats involving Iranian actors, new .NET AOT malware evasion, SideWinder espionage expansion, and an Android trojan using silent audio loops for persistence.