The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

A Palo Alto Networks Unit 42 RSS collection covering current threat research, including SPIFFE/SPIRE workload identity abuse after Kubernetes node compromise, commodity malware campaigns, AI-assisted attacks and AI-enabled malware, Microsoft Teams voice phishing, SDLC and npm supply-chain threats, credential attacks against Microsoft Entra, Android IoT botnets, blockchain-based command and control, and theft of AI developer tokens. The collection describes identity theft, credential harvesting, malware delivery, supply-chain compromise, botnet activity, and abuse of trusted or decentralized C2