Material Security

Helping lean security teams protect the email, data, and identities that live in Google Workspace and Microsoft 365.

[Material Security @material_sec]

Some flagged files are fine. The Drive Agent works that out and closes the issue itself, including when a trusted partner has access that fits their role. Fewer alerts, and nobody had to open them.

https://t.co/5CcPF4imUc

[Material Security @material_sec]

Enrollment-time registration also closes the window attackers use for persistence. After an AiTM session steal, the persistence move is registering their own device as a new authentication factor, which survives the password reset.

If passkeys are bound at Entra/Intune enrollment, any method added later from an unmanaged device becomes an event to alert on rather than routine self-service.

[Material Security @material_sec]

Railway’s logs show who read the variables; they can’t show where the decrypted keys went next. Each secret in an env file is a credential to some other system, and use of a stolen copy only shows up in that issuer’s logs.

A leaked key with no rotation schedule behind it can stay usable for months, so the keys nobody remembers storing there are the ones to chase first.

[Material Security @material_sec]

Obscurity also covers access nobody remembers granting. In our OAuth research, Clockwise still showed up with active read and write grants to calendar and email in several Google Workspace environments after the product was wound down: vendor gone, access intact.

Suspending an account doesn’t revoke those grants either, so anything probing every crevice finds tokens with no owner left to notice them.

[Material Security @material_sec]

A browser warning on the paste step catches ClickFix at its last stage, after an emailed lure has already been opened and trusted. Kits rewrite the copy and links on every send, so signature filters rarely stop the first wave. Pulling the message from every inbox once one user reports it shortens the window more than another banner does.

[Material Security @material_sec]

No interactive sign-in means MFA never gets a vote. An app that was consented once isn’t asked to authenticate as a person again, so password resets and user-focused sign-in alerts miss it entirely. The signals that matter are the ones in the post: service principal sign-ins, new credentials added to the app, and privilege changes on it.

[Material Security @material_sec]

The long-standing risks agents surface first won’t all be in code. Plenty are grants: in our OAuth research across 21 Google Workspace environments, 1,064 apps had zero active users and still held live tokens, 463 of them with sensitive or restricted scopes. Scanning finds those in an afternoon; deciding who owns each revoke is the slow part.

[Material Security @material_sec]

Alert cannon, noun: a tool that finds thousands of sensitive files and fires every one of them at the people who own the data. We built the opposite. Meet the Drive Agent.

https://t.co/qeAMYfGzVH

[Material Security @material_sec]

@cotoolai @ycombinator @WeAreLegora @HelloSurgeAI Thanks for having Rajan on the panel, and for putting this together. Starting where you already have buy-in is a good rule for a team of one!

[Cotool @cotoolai]

Last week, Cotool teamed up with @ycombinator to host security leaders from @WeAreLegora , @HelloSurgeAI , and @material_sec to talk about building a security org from 0 to 1 in hyper-growth environments.

Much of the conversation was around how to get the most leverage out of a lean (or non-existent!) team: starting where you already have buy-in, hiring builders over operators, and using AI agents to take on the noise humans used to spend time triaging.

Special thanks to our fantastic panelists @aluveaux, @ffwang2, Rajan Kapoor, and @maxpollard415.

And a huge shoutout to @koomen and team for the beautiful space and making the event happen in the first place!

[Material Security @material_sec]

Device code phishing finishes on a genuine Microsoft sign-in page, so every check a user is trained on passes: real domain, real MFA prompt. GTIG’s UNC5976 reporting showed the same design on the Google side, where a real “Sign in with Google” flow handed tokens to an attacker-controlled cloud project.

A successful authentication is the start of the investigation, and what the new token does in the mailbox over the next hour is where detection has to sit.

[Material Security @material_sec]

Capturing MFA codes through a search-ad lure is the step to close first, since OTPs and push prompts relay through a phishing proxy as easily as passwords do. FIDO2 hardware keys are the control that holds up against that.

Downgrading the legitimate billing admins is the same persistence move seen in mailbox takeovers, where attackers register their own device as a new MFA factor so a password reset doesn’t evict them.

[Material Security @material_sec]

Point-but-can’t-click is the property that matters, because the remote-support scams run the opposite flow. Storm-1811 and Black Basta email-bomb an inbox, then message the victim on Teams posing as IT offering to fix the spam, and talk them into installing a remote access tool. Same screen-share experience, except the attacker initiated the contact and ends up holding the mouse.

[Material Security @material_sec]

Shadow IT was an app nobody approved. Shadow AI is an agent someone connected in ten seconds.

We’re getting into the difference at ASCII San Antonio today at 2:35 PM, then giving a keynote on how fast-growing companies get breached through Google Workspace tomorrow at 11 AM.

After that, come by the booth for a live OAuth attack demo and a Lego R2-D2 raffle.

Book time with us: https://t.co/6VGjac6nnc

[Material Security @material_sec]

Who's trusting Material these days? Lumbra, which is putting email, Drive files, and account takeover protection under one roof across Google Workspace.

Zach Morris there calls the new Material UI “amazing” and “a great force multiplier.” We’re printing that on something.

[Material Security @material_sec]

App control in Google Workspace fails the same way: flip third-party access to admin-approved overnight and every broken integration becomes a ticket, then an exception, then the rollback.

The rollouts that stick tier apps by scope first, so narrow-scope tools stay a default yes and the friction lands only on Gmail, full Drive, and offline access. Give each high-risk app a named business owner before enforcement, and most of the people conversation is done before the switch flips.

[Material Security @material_sec]

Revoking the app and auditing for planted credentials is containment; scoping is the part that takes weeks. For each tenant the questions are what the app was authorized to touch, what it actually read, and whose mail and files that was, and sign-in risk signals don’t show mailbox read behavior. Tenants that can’t pull that from audit data end up reconstructing it by hand.

[Material Security @material_sec]

Cloud Discovery answers which apps people use; the connected-app layer answers which ones still hold access, and those two lists drift apart fast.

An app nobody opens can keep a live grant to mail and files, and resetting the user’s password doesn’t touch it.

The Workspace version of part 3 is a short scorecard: apps with Gmail access, apps with full Drive access, apps with offline access, and high-risk apps with no owner.

[Material Security @material_sec]

Reimaging the dev box closes the infection, not the exposure. Whatever the stealer lifted, tokens, API keys, OAuth grants, keeps working from the attacker’s machine until it’s revoked at each provider, and a GitHub OAuth token can carry write access to private repos and CI/CD workflows depending on scope.

Composio showed how slow that gets: 5,001 GitHub OAuth tokens revoked, and for API-key connections the vendor couldn’t revoke on customers’ behalf, so each user had to go to the provider directly.

[Material Security @material_sec]

Long-lived admin credentials that never expired is the root cause Zeabur named, and most SaaS tenants carry the same shape in OAuth refresh tokens that renew until someone revokes them.

In our OAuth Risk Report, 47.2% of 22,332 apps across 21 Google Workspace environments had no usage in 90 days, with every authorization still intact. Revoking all sessions after the breach was right; expiry and a named owner per credential shrink the next one.