AI agent and NHI exposure are driving new attack surfaces

At a glance

What this is: This Cyber Watch roundup highlights how attackers are combining privilege escalation, credential theft, and post-compromise tooling to expand access across endpoints, browsers, and enterprise infrastructure.

Why it matters: It matters to IAM, PAM, and NHI practitioners because the same patterns that enable endpoint compromise often turn into credential exposure, standing privilege abuse, and broader identity risk once attackers are inside.

By the numbers:

• 27 days
• 17 minutes

👉 Read Anomali's Cyber Watch analysis of privilege escalation, stealer activity, and tunnel-based access

Context

Attack chains rarely stay confined to the first foothold. In this roundup, initial execution, privilege escalation, credential harvesting, and tunnel-based reach all show how quickly attackers turn endpoint access into broader enterprise exposure, including identity, secrets, and privileged control paths.

For IAM and NHI teams, the important question is not whether a single exploit was detected, but whether the surrounding governance model can stop post-compromise abuse of service credentials, admin paths, browser tokens, and delegated access. The cases here are typical of modern intrusion patterns, not edge cases.

Key questions

Q: What breaks when a compromised endpoint can proxy traffic into internal networks?

A: The assumption that endpoint compromise stays local breaks immediately. A reverse tunnel turns one workstation into an internal access point, so the attacker can probe services, reach systems that are not internet exposed, and move as if traffic were originating from inside the network. Segmentation and host egress controls become the real containment boundary.

Q: Why do stolen browser sessions create identity risk after the malware is removed?

A: Because sessions and cookies can remain valid after the stealer disappears. If the attacker captured reusable session material, they may keep accessing email, cloud apps, or admin portals without reentering credentials, which means password resets alone do not close the exposure. Identity containment has to include session and token invalidation.

Q: How should security teams respond when a trusted remediation workflow can be abused for privilege escalation?

A: They should treat the workflow itself as privileged code path and review which policy states enable that path. Where a remediation function can be manipulated, the issue is not only the vulnerability but the authority granted to the cleanup process. Reduce the enabled surface, verify detection remains intact, and test the compensating control before changing policy.

Q: Should organisations prioritise endpoint containment or identity revocation after infostealer activity?

A: They need both, but identity revocation should not wait. Endpoint containment stops further malware activity, while revoking sessions, tokens, and browser-derived credentials prevents the attacker from continuing with stolen access. If the environment lacks complete identity visibility, start with the highest-value providers and then expand containment outward.

Technical breakdown

Post-compromise privilege escalation in security tooling

A local privilege escalation flaw turns a low-privileged foothold into SYSTEM-level control by abusing a remediation workflow that already runs with elevated permissions. That matters because the security product becomes the execution path, not just the detection layer. Once an attacker can manipulate a trusted cleanup function, the host inherits the product's authority and the attacker can alter processes, services, or protections that would otherwise be blocked. In practice, these flaws are attractive because they combine legitimacy with reach, making them harder to spot than custom malware.

Practical implication: Treat elevated remediation workflows as privileged attack surface and constrain which policy combinations are allowed on production endpoints.

ClickFix-style execution and reverse tunnel establishment

ClickFix campaigns work by persuading users to execute attacker-supplied commands themselves, which bypasses many perimeter and attachment controls. The payload chain then mixes signed binaries, DLL sideloading, steganography, and scheduled persistence to survive restart and conceal its communications. A reverse tunnel is especially dangerous because it converts one compromised workstation into an internal proxy point, letting the operator reach internal assets through an apparently trusted path. That changes the problem from endpoint compromise to network-level reachability.

Practical implication: Block standard-user PowerShell execution and monitor for unusual internal proxy behavior after any user-executed command event.

Credential theft, session abuse, and identity-bound persistence

Modern infostealers target far more than passwords. They harvest browser credentials, session cookies, wallet data, VPN access, and password manager material, then erase their own binaries to reduce obvious forensic traces. The identity risk is that tokens and sessions often remain valid even after the malware is removed, which means the attacker can keep using the stolen access without needing to re-enter the endpoint. When the malware also disables defenders or updates, the host can remain compromised long after the original steal event is over.

Practical implication: Assume token and session revocation are required after stealers, not just password resets or file cleanup.

Threat narrative

Attacker objective: The objective is durable post-compromise access that can be used for credential theft, lateral movement, and follow-on intrusion or monetisation.

1. Entry begins with social engineering or exposed credentials that give the attacker a low-privileged foothold on a host or through a user execution path.
2. Escalation follows when the attacker abuses local flaws, sideloading, or stolen session material to gain higher privileges, persistence, or internal network proxying.
3. Impact occurs when the attacker expands reach into internal systems, exfiltrates credentials or data, and leaves the environment with degraded defenses or reusable access.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Privilege escalation is increasingly a governance problem, not just a vulnerability problem. When trusted remediation logic can be manipulated, the control failure is not merely a bad patch state, but an elevated process that was allowed to act on behalf of the attacker. That pattern should be read through NIST-CSF access permissions and MITRE ATT&CK credential access and privilege escalation, because the attacker is borrowing the defender's authority. The practitioner conclusion is simple: treat product-assisted remediation as privileged execution.

Session material now behaves like a non-human identity asset. The stealers in this roundup target cookies, browser state, and other reusable access artefacts, which means identity compromise extends beyond static passwords. In NHI terms, those artefacts function like short-lived machine credentials with weak lifecycle controls, especially when teams rely on reset actions that do not invalidate active sessions. The right governance lens is OWASP-NHI and NIST-800-53 authenticator management, because the attack succeeds when access outlives the event that exposed it. The practitioner conclusion is to manage session invalidation as part of identity containment.

Attacker-built reverse tunnels collapse the boundary between endpoint security and internal trust. Once an infected host can proxy arbitrary traffic, the attacker no longer needs direct internet exposure to reach internal services. That moves the defence problem from signature-based malware detection to reachability control, segmentation, and discovery of unexpected internal pivots. MITRE ATT&CK lateral movement and NIST-CSF network protections both apply here, but the broader lesson is that one compromised workstation can become a temporary internal service account in practice. The practitioner conclusion is to limit what a single endpoint can reach.

Hidden persistence often outlasts the malware family that installed it. Several of the observed modules modify update services, Defender state, Run keys, or scheduled tasks, which means removal of the visible payload does not equal recovery. That is a control-gap story about offboarding hostile changes, not just detecting the original binary. The named concept here is post-compromise control residue, the set of defender and OS changes that remain after the attacker has left. The practitioner conclusion is to verify restored defensive state before declaring cleanup complete.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• The post-compromise window often outlasts binary removal, so pair 52 NHI Breaches Analysis with the Ultimate Guide to NHIs , Key Challenges and Risks to pressure-test session and secret governance.

What this signals

Post-compromise control residue is the operational gap most teams underestimate. When attackers can disable update services, add exclusions, or leave behind persistence that survives the visible payload, cleanup must include state verification, not just malware removal. For identity teams, the same logic applies to sessions and tokens: if access was stolen, expiry and revocation have to be proven, not assumed.

The security programme implication is that endpoint, identity, and network controls need a shared containment model. If one compromised host can proxy internal traffic and stolen sessions can survive host cleanup, then the incident boundary is no longer the endpoint alone. Teams should align response playbooks with session revocation, egress restriction, and internal reachability checks as a single recovery path.

For practitioners

• Harden user execution paths Restrict standard-user PowerShell and other interactive script runners, especially where users can be guided into pasting attacker commands. The goal is to break the execution chain before sideloading or staged payload retrieval begins.
• Invalidate identity artefacts after stealers Treat browser cookies, SSO sessions, VPN tokens, and password manager access as compromised when infostealer activity is confirmed. Require full session revocation and reauthentication rather than relying on password resets alone.
• Review elevated remediation policies Audit any endpoint protection policy that runs cleanup actions with elevated rights, and disable only the smallest specific setting required when vendor guidance calls for mitigation. Recheck whether cloud anti-malware or alternate protections still cover the same file types before changing policy.
• Detect internal proxy behaviour Alert on unusual outbound tunneling, SOCKS-style relays, or workstation-originated traffic that suddenly reaches many internal services. A single compromised host acting as a proxy is a reachability problem, not just an endpoint problem.

Key takeaways

• This roundup shows that post-compromise abuse now spans privilege escalation, credential theft, and internal network pivoting in the same intrusion chain.
• The scale of the problem is reinforced by the speed of secret abuse and the persistence of stolen sessions, which makes containment slower than attacker reuse.
• Teams need to verify remediation, revoke identity artefacts, and constrain host reachability before they can treat a compromise as closed.

Key terms

• Post-Compromise Control: Post-compromise control is any mechanism that limits what happens after an attacker gains initial access. Examples include least privilege, segmentation, monitoring, and identity governance, all of which determine whether a breach stays small or expands across the environment.
• Reverse Tunnel: A reverse tunnel is an access path initiated by the device rather than the operator. It lets the remote system establish an outbound connection to a broker, then carry privileged sessions back through that channel when inbound access is blocked or impractical.
• Session artefacts: Temporary access material such as active login sessions, cookies, tokens, and cached credentials that prove trust without requiring the original password again. These artefacts are often the shortest path from endpoint compromise to cloud or SaaS account abuse.
• Trusted remediation workflow: A cleanup or protection process that runs with elevated authority to remove malicious content or restore security state. If attackers can influence that workflow, they can convert a defensive control into an escalation path and gain more privilege than the original user had.

What's in the full analysis

Anomali's full Cyber Watch covers the operational detail this post intentionally leaves for the source:

• Per-story exploit chain detail for the FalconFlank, TerminalFix, REVSTEALER, Langflow, Rails, Teams, and Chrome findings
• MITRE ATT&CK mappings and technique-by-technique breakdowns for the observed activity
• Indicator lists, detection leads, and remediation notes that help an operations team validate exposure
• Triage context for deciding which incidents are local compromise, which imply broader identity theft, and which need deeper investigation

👉 The full Anomali post covers the attack chains, indicators, and mitigation context behind each story

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps security practitioners translate identity risk into operational containment and lifecycle decisions.