From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
2026-09-21T20:51:32Z•dcc322a5230a8e055ab97b1f5be02d50842b25465b8e305151e6887ba7ee6936
AI securityAWS IAMCI/CD securityKubernetesMicrosoft Entra IDMicrosoft TeamsSEO poisoningSOC operationsSPIFFE/SPIREcloud securitycredential theftidentity abuseinfostealermacOS malwaremalware campaignsphishingprompt injectionsoftware supply chainthreat detectionvoice phishing
What happened
Unit 42 research covering cloud and workload identity abuse, exposed AWS IAM credentials, prompt injection and agent credential exfiltration, macOS infostealers, malware delivery campaigns, AI-assisted attacks, voice phishing, SDLC supply-chain risks, collaboration-channel identity phishing, and large-scale Microsoft Entra credential attacks. The feed is primarily defensive threat intelligence and security guidance, with several topics involving credential theft and cloud compromise.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- dcc322a5230a8e055ab97b1f5be02d50842b25465b8e305151e6887ba7ee6936
- Enrichment time
- 2026-09-21T20:51:32Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.