What is tunnel-vision-toolkit?

Tunnel Vision Toolkit is a security research project that was presented at x33fcon 2026 and demonstrates weaknesses in Microsoft Global Secure Access (GSA), which is Microsoft's cloud-based replacement for traditional corporate VPNs. The research is intended for authorized penetration testing and academic study of how the service works internally. Microsoft's GSA is designed to sit between a company's employees and its internal resources -- servers, file shares, applications -- verifying that each connecting device meets certain security requirements before allowing access. The core finding of this research is that the device compliance checks are self-reported by the connecting software and are not independently verified by Microsoft's servers. A custom client can claim to be a compliant Windows machine while actually running on Linux or macOS. The toolkit has two main parts. The first is a standalone Python client that can connect to Microsoft's edge servers from any operating system by speaking the same internal protocol that Microsoft's own client uses. The protocol was reverse-engineered from the Windows service binaries. This client creates a private network tunnel and routes arbitrary traffic through it, giving the attacker access to the company's internal network as if they were a legitimate employee. The second part consists of payloads designed to run inside penetration testing frameworks on a compromised Windows machine that is already enrolled in GSA. These payloads can enumerate the GSA configuration and extract authentication tokens that the Windows system stores locally. Those tokens can then be moved to the attacker's own machine and used with the rogue client to open a tunnel, bypassing all device compliance controls. The window of access using a stolen token lasts roughly 75 minutes until expiry. The repository includes the reconstructed protocol definition files, build instructions, and a documented step-by-step attack flow for use in authorized testing engagements.