NOpal : Using Microsoft Project Opal features in Red Team Tradecraft | AltSecCON 2026
Source: YouTube · Altered Security · published Nov 3, 2026 · 39:24
BLUF: This talk shows how Microsoft Project Opal—a computer-using agent operating dedicated, Entra-joined Windows 365 cloud PCs—becomes an ideal attacker foothold, enabling conditional access evasion, credential theft, and machine-speed reconnaissance 3:11, 22:01.
Key Takeaways:
- CA evasion: Opal's cloud PC is Entra-joined, compliant, and org-owned, so a compromised identity can bypass CA policies blocking non-joined devices 18:06.
- Identity Protection bypass: Sign-ins come from a trusted machine, so no risky sign-ins are flagged, defeating risk-based CA 23:07.
- Missing guardrails: No mandatory MFA on Opal (or any Microsoft AI portal), and the cloud PC has no EDR/MDR onboarding 14:28.
- Work IQ enumeration: Opal queries emails, chats, and documents—even locating credentials in files—at machine speed 24:42.
- Opal-in-Opal: Opal can open Opal in its own browser, read user chats via OCR (silent auth transfer), and extract shared credentials 30:05.
- PowerShell execution: Agents can write and run scripts (e.g., network discovery) from a trusted instance; heavily audited and logged 13:59.
Closing: Opal blurs identity and compute—identity compromise now grants a trusted, EDR-free cloud machine ("dream foothold"), and Microsoft's sparse documentation and missing MFA warrant urgent rethinking.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hi, me again. So let's get started. We're going to talk about
features of Opal. So my talk is using Microsoft
Project Opal. That is the project. So I am going to talk about features of Opal
that we can use in Red Team Trait graph. Okay. So what is that
we'll get to know in a moment. So something about me. You can find me on Twitter. I mean, am ITT? I'm the founder of Altered Security. I used to be pretty active on GitHub. There was a time when I used to maintain
multiple open source tools for penetration testers and red teamers. Have not been able to do that
for a long time now. So I'm the creator of Nissan, Cattleya,
and a few more toolkits. I am interested in identity security when it comes
to, you know, anything by Microsoft when it comes to identity security, that is what I'm intereste…