The Breach Did Not Knock on the Front Door

This ColorTokens threat advisory documents an expanding attack surface where attackers bypass perimeter defenses via trusted software, vendor access, and single-sign-on accounts, resulting in significant incidents: large healthcare breaches (affecting tens to hundreds of thousands), a fintech ransomware/data theft event impacting ~672k people, SSO compromises through vishing, and active exploitation of high-severity CVEs including a supply-chain compromise of an axios npm package delivering a RAT. The report highlights active exploitation in the wild, named criminal groups, and prescribes mitigations—patching, phishing-resistant MFA, SaaS permission audits, employee vishing training, EDR, and microsegmentation to reduce lateral movement and blast radius.