All news with #cloud account compromise tag

🔒 Nikkei has disclosed unauthorized access to two employee cloud accounts, one of which was used to send about 9,000 phishing emails to staff and contacts. The company says a Google Workspace account was accessed since late July, potentially exposing 1,646 names and email addresses, and a Microsoft 365 account was abused on September 30 to distribute malicious messages. Nikkei reset passwords, notified affected individuals, and reported both incidents to Japan's data protection regulator while investigations continue.

🛠️ Microsoft has enabled the Windows settings backup and restore feature by default for enterprise devices that are Microsoft Entra-joined or hybrid-joined and upgraded to Windows 11 26H2. The tool, originally introduced as an opt-in feature and later made generally available, backs up users' Windows settings and Microsoft Store app lists after device resets, replacements, upgrades, or reimages. The default-on policy applies only where admins have not explicitly configured the setting and excludes devices in DMA-regulated regions, sovereign clouds, or restricted environments. Restore remains admin-controlled and can be managed or disabled via Intune or Group Policy.

🔒 Microsoft DART investigated an incident where the Storm-3068 actor turned a self-service password reset into persistent access across Azure DevOps, development pipelines, and Kubernetes. The actor used legitimate identity and cloud services to enumerate repositories, create malicious pipelines to harvest kubeconfig files, and deploy remote access tools like Atera and Chisel. DART worked with the customer to contain the intrusion, reconstruct activity from audit logs and Git history, and provide remediation guidance to reduce future identity-driven risks.

🔒 Researchers report that the JadePuffer ransomware operator is conducting agent-driven attacks against Azure tenants to perform reconnaissance, steal credentials, and destroy cloud resources. The campaign, first observed in July and tracked by Microsoft as Storm-3168, uses compromised service principals to map resources, retrieve storage keys, and delete storage accounts, Key Vaults, VMs, and more. Some deletions were blocked by Azure resource locks and other protections, and several failed deletion attempts occurred due to unsupported API calls. Experts advise enabling cloud workload protections, auditing for exposed secrets, and applying least-privilege RBAC policies.

🔒 Bitget resumed Bitcoin withdrawals on 28 September after halting them following unauthorized transfers totaling around $387.5m from parts of its hot and warm wallet infrastructure. The exchange says the vulnerability was traced to a flaw in a third-party security product that allowed attackers to obtain high-level internal credentials and issue fraudulent withdrawal commands. Bitget reports cold wallets and user balances were not impacted, is working with Mandiant and SlowMist, and intends to restore other assets in phased stages while pursuing recovery and coordination with law enforcement.

🛡️ Microsoft warns that an autonomous attacker known as Jadepuffer (Storm-3168) has expanded into Azure, using compromised service principals to enumerate resources, delete cloud assets and harvest credentials. The campaign involved two service principals splitting reconnaissance and destructive duties, with rapid automated actions that deleted storage accounts, a Key Vault, Function App and other resources. After destruction the actors requested storage account keys, raising concerns about recovery and potential future exfiltration. Microsoft urges securing workload identities, enforcing least privilege and protecting backup and recovery controls.

🔒 Bitget has resumed Bitcoin withdrawals after suspending them following a large theft attributed to suspected North Korean state-sponsored hackers. The exchange says it patched the exploited vulnerability and provided a staggered schedule to restore withdrawals for ETH, USDT, and other assets. Bitget emphasized user balances remain intact and that its Protection Fund covers losses while trading and deposits continue to operate. The company also launched a Recovery Bounty Program to incentivize recovery of frozen funds.

🛡️ Bitget confirmed unauthorized transfers from a limited set of hot wallets on September 24, 2026, resulting in a theft of $351.6 million. The exchange says cold wallets and most platform assets remain secure, deposits and trading continue, but withdrawals are temporarily suspended during a comprehensive security review. Bitget has engaged Mandiant and SlowMist for investigation and reports the pattern aligns with known North Korean threat actors.

🔍 The 2026 Cloud-Native Threat Landscape Report, based on FortiCNAPP intelligence, shows that adversaries are automating cloud attacks to find, exploit, and monetize vulnerabilities at unprecedented speed. The report documents billions of reconnaissance, brute-force, and exploitation attempts and stresses that identity compromise and misconfigurations remain prime intrusion vectors. It urges security teams to adopt AI-driven, automated defenses across the entire application lifecycle to detect and respond at machine speed.

🔎 This article examines how AWS mitigates publicly exposed IAM access keys through the AWSCompromisedKeyQuarantine managed policy, tracing its evolution across versions and explaining its role in responding to leaked credentials. It details the GitHub secret scanning partnership with AWS, a real-world timeline from a public exposure test, and practical monitoring strategies security teams can use to detect quarantine events in their logging environments. The piece also outlines Palo Alto Networks services that can assist organizations in assessment and incident response.

🔐 The author dissected GraphWorm, a OneDrive‑based backdoor used by the Webworm APT, and found revoking tokens often fails to remove access. The implant authenticates as an OAuth application with embedded credentials and polls a OneDrive folder for tasks, allowing operators to replace credentials remotely. Because the registration itself is durable and the implant identifies hosts by hardware fingerprints, simple token revocation or network changes do not reliably contain the threat. The piece recommends treating application registrations as primary targets for response and hunting in cloud identity telemetry.

🔐 Google’s GTIG reports that state-affiliated groups and cybercriminals are increasingly targeting AI-related assets — from model weights and proprietary source code to API keys and cloud compute — to support espionage, extortion, and resource theft. The quarter’s incidents included exfiltration of proprietary models, distillation campaigns using hundreds of millions of prompts, and cloud compromises that enabled attackers to run unauthorized AI workloads. Attackers also deploy automated, agent-driven frameworks to scale reconnaissance, credential harvesting, and exploitation.

🛡️ A large-scale campaign is scanning internet-exposed Vite development servers to extract AWS and Azure credentials by exploiting CVE-2026-39364 in affected Vite versions. F5 detected over 800 attacks and ~32,000 events, observing attackers append parameters like ?raw or ?import&raw to bypass file access controls and retrieve sensitive files. The operation targeted environment files, cloud credential/config files, Terraform and serverless state, and system files, using traversal and encoding tricks for evasion.

🛡️ Microsoft disclosed two related campaigns: one sent over a million CEO-impersonation invoice scams in August 2026 to induce ACH transfers, and the other used passkey-themed social engineering since May 2026 to compromise cloud accounts. The fraud campaign leveraged generative AI, forged threads, and bogus domains to target enterprise finance teams. Cloud intrusions employed voice/SMS pretexts, counterfeit sign-in pages, AitM and device-code flows, and persistent MFA enrollment to enable extensive Microsoft Graph, SharePoint, OneDrive, and mailbox access.

🔒 Microsoft Security Research describes coordinated intrusions beginning with passkey-themed social engineering and progressing to authentication persistence, cloud reconnaissance, and targeted data collection. The actors use phone and trusted internal messages to lure victims to convincing phishing sites or device-code flows, then add authentication methods and leverage Microsoft Graph, SharePoint, OneDrive, and Exchange to enumerate and collect data. Defenders are urged to investigate identity and Microsoft Graph signals, revoke sessions, and remove unauthorized auth methods.

🛡️ FortiGuard Labs examines an AWS incident where a long-lived IAM access key with Administrator privileges was abused to create identities, subscribe to foundation models on AWS Marketplace, and invoke those models for profit. The report outlines the concept of LLMjacking, the steps observed in the compromise, and why valid cloud credentials make detection challenging. It also lists FortiCNAPP (Lacework) detections and recommended posture changes to reduce risk.

🔒 The Cybersecurity and Infrastructure Security Agency (CISA) warns that threat actors are actively exploiting a critical MLflow vulnerability (CVE-2026-64849) that enables a DNS-rebinding SSRF bypass in MLflow's outbound webhook delivery. The flaw, patched in MLflow 3.15.0, allows unauthenticated attackers to make the tracking server issue requests to internal and cloud-metadata endpoints and read responses, risking theft of cloud credentials. CISA added the issue to its KEV catalog and ordered federal agencies to remediate under BOD 26-04, urging all defenders to prioritize patching.

🛡️ A threat actor using the alias “TheHatman” is advertising employee databases allegedly exfiltrated from Microsoft Azure tenants of multiple large companies, claiming a total of 3.64 million records. The posted dumps, beginning July 31, target organizations such as McDonald’s, Tata Consultancy Services, Gap Inc., Vodafone, HCL, IHG, and Kyndryl and include names, emails, titles, phone numbers, addresses, and tenant account details. Several affected firms say investigations show no evidence of current breaches and that much of the data appears dated and non-sensitive, while cyber intelligence firm Hudson Rock assessed the samples as authentic and noted presence of service and admin accounts that could enable targeted attacks.

🔒 Beacon attributes a cyber-attack to a compromised AWS access key likely exposed in public Javascript build artifacts, allowing an attacker to download CRM data belonging to about 1,500 UK charities. The incident, identified in activity starting on July 27, saw data decrypted during download despite being encrypted at rest. Beacon has reset credentials, found no evidence of persistence, and instructed customers to report the breach to the ICO. Affected charities have been notified, and there is no confirmation that stolen data has been published or misused.

🔎 Google and Mandiant attribute a recent wave of data extortion to UNC6671, which uses vishing to trick employees into spoofed login portals and capture credentials and MFA tokens. The group deploys automated scripts to exfiltrate data from cloud and SaaS environments, including Microsoft 365 and Okta, and operates multiple extortion brands. UNC6671 targets employees’ personal devices, spoofs help desk numbers, and registers adversary-controlled MFA devices to maintain persistence.