BadSuccessor After Patch: Using dMSAs for Credential Theft and Lateral Movement in AD

According to Akamai, researchers evaluated Microsoft’s patch for the BadSuccessor vulnerability (CVE-2025-53779) to determine its scope and limitations. The update blocks the original direct escalation path, but the core mechanics of BadSuccessor remain exploitable under specific conditions. The article explains how attackers can still leverage delegated Managed Service Accounts (dMSAs) for credential theft and lateral movement in Active Directory after patching.

It notes that BadSuccessor introduced during DEF CON 2025 abused the dMSA account type to elevate privileges, with a mutual link pairing required to mimic a legitimate service account migration and access the Kerberos ticket, though the patch now enforces stricter ticket issuance. Defenders are advised to monitor for dMSA-related link edits and rapid dMSA password retrievals, audit creation of dMSAs and migration link attributes, and harden delegation to mitigate the evolving threat.