Intelligence Insights: July 2026

Throughout July, our team tracked two developments that highlight how modern attackers continue to favour trusted Windows functionality and legitimate cloud authentication workflows over overt malware. The first was LegacyHive, an unpatched local privilege escalation vulnerability affecting the Windows User Profile Service (ProfSvc). Publicly disclosed by the researcher Nightmare Eclipse, LegacyHive enables a low-privileged user to manipulate how Windows loads registry hives, potentially allowing access to or modification of another user's registry data, including administrative profiles. The vulnerability is particularly notable because it affects fully patched Windows systems and targets a trusted operating system component that routinely operates with elevated privileges. While the publicly released proof-of-concept is intentionally restricted, multiple independent researchers have confirmed its viability, reinforcing the continued trend of post-compromise privilege escalation techniques focused on trusted Windows services rather than traditional kernel exploitation.

Alongside this, July continued to highlight the growing threat posed by device code phishing, an increasingly popular technique used by threat actors to bypass traditional credential theft controls and gain access to cloud identities. Rather than stealing usernames and passwords directly, device code phishing abuses legitimate OAuth authentication workflows, tricking users into authorising attacker-controlled sessions through genuine Microsoft login infrastructure. Multiple threat actors, including nation-state operators and cybercriminal groups, have adopted the technique because it allows them to obtain valid access tokens without harvesting credentials and can remain effective even when multifactor authentication is enabled. As organisations continue to prioritise cloud-first services, attacks targeting identity and authentication workflows are likely to increase, reinforcing the importance of monitoring token-based access, OAuth authorisations, and anomalous authentication activity alongside traditional endpoint security controls.

LegacyHive is an unpatched local privilege escalation vulnerability affecting the Windows User Profile Service (ProfSvc), a core Windows component responsible for loading and managing user profiles. The flaw allows a low-privileged local user to manipulate how Windows loads registry hives, enabling access to or modification of another user's registry data. In practical terms, this can allow an attacker to influence what executes when a targeted user logs on and, under the right circumstances, achieve privileged code execution through trusted Windows processes. Unlike many privilege escalation vulnerabilities that rely on kernel memory corruption or driver abuse, LegacyHive exploits weaknesses in how Windows resolves and loads user profile registry hives.

What makes LegacyHive significant is its applicability across modern Windows environments. The proof-of-concept released by Nightmare Eclipse has been reported to function on fully patched Windows desktop and server operating systems, including systems carrying Microsoft's July 2026 security updates. Independent researchers have confirmed exploitation is possible, and although the released proof-of-concept intentionally requires additional credentials and targets only specific registry hives, the researcher responsible for the disclosure stated that the original exploit was considerably more capable. As with previous privilege escalation disclosures this year, the vulnerability is not a standalone initial access vector; its value lies in enabling attackers who have already obtained a foothold to strengthen their position, establish persistence, manipulate user environments, and potentially execute code within higher-privileged user contexts.

At the time of writing, Microsoft is investigating the vulnerability and has not released an official security update. Until a patch becomes available, organisations should focus on behavioural detection and hardening. Monitoring for unexpected registry hive loading activity, suspicious use of the Windows Offline Registry Library (offreg.dll), unusual modifications to User Shell Folder registry values, and user profile redirection behaviour may help identify attempted exploitation. Application control technologies such as WDAC or AppLocker, combined with strong least-privilege enforcement and monitoring of non-standard file activity in root-level directories, provide valuable compensating controls whilst defenders await an official vendor fix.

Device code phishing has rapidly emerged as one of the most effective methods for bypassing traditional credential-based security controls in Microsoft 365 and other cloud environments. The technique abuses the legitimate OAuth Device Code Authentication flow, a feature originally designed to allow devices with limited input capabilities, such as smart TVs and conference room systems, to authenticate users. Rather than creating a fake login page to harvest credentials, attackers convince victims to enter a legitimate device code into Microsoft's real authentication portal, unknowingly authorising an attacker-controlled session. Because users authenticate through trusted Microsoft infrastructure and often complete multifactor authentication themselves, device code phishing can significantly reduce the effectiveness of conventional phishing detection and user awareness measures.

The technique has seen increasing adoption across both financially motivated and state-sponsored threat activity. Research by Microsoft, Proofpoint and other security vendors shows that threat actors have evolved from manually operated campaigns to highly scalable operations that use automated infrastructure, realistic business-themed lures and cloud-hosted tooling to maximise success rates. Common lures include collaboration requests, document-sharing notifications, electronic signature requests, voicemail alerts and meeting invitations. Once a victim completes the authentication process, attackers receive valid OAuth access and refresh tokens, allowing them to access email, cloud storage and other Microsoft 365 resources without ever obtaining the user's password. This shift reflects a broader trend away from credential theft and towards the abuse of trusted identity workflows.

The risk posed by device code phishing extends beyond initial account access. Once authenticated, attackers frequently establish persistence through malicious inbox rules, mailbox forwarding, OAuth application abuse, or the registration of additional devices within the victim's identity environment. Access to email also enables follow-on business email compromise, internal phishing and intelligence gathering activities that can facilitate further compromise across an organisation. Because the authentication itself is legitimate, many traditional security controls focus on detecting abnormal post-authentication behaviour rather than the initial access event. This makes visibility into token issuance, device registrations, OAuth consent events and unusual geographic authentication activity increasingly important for defenders.

Unlike a software vulnerability, there is no vendor patch for device code phishing. Mitigation instead relies on layered identity security controls. Organisations should review whether device code authentication is required within their environment, implement phishing-resistant authentication methods where possible, monitor for anomalous device code sign-ins and OAuth token activity, and ensure incident response procedures include token revocation alongside password resets. As cloud identity systems continue to become the primary gateway to corporate resources, device code phishing demonstrates how attackers are increasingly targeting authentication workflows themselves rather than attempting to compromise endpoints directly.