The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI

Google Threat IntelligenceJuly 7, 2026Threat Intel Identity

Written by: Shebin Mathew Introduction The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021 , remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem.

Summary from Google Threat Intelligence.

Read the full article at Google Threat Intelligence

Explained

The technology and terms in this story. Learn more

DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.

The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet