AI-assisted attacks are compressing the window for credential defence

At a glance

What this is: FireCompass’s weekly incident report shows that ransomware, zero-day exploitation, phishing, and supply-chain compromise are converging into faster, broader intrusion paths.

Why it matters: IAM, PAM, and NHI teams should treat this as a warning that exposed credentials, privileged access, and file-transfer controls now need to be monitored and contained as one attack surface.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read FireCompass’s weekly cybersecurity intelligence report on the 20 Jan to 26 Jan 2026 breach landscape

Context

The security gap here is speed, not just volume. Once credentials are exposed or a high-severity flaw is publicly known, adversaries move faster than most enterprise response cycles can contain, especially when identity controls, endpoint detection, and network monitoring sit in separate operational lanes. For IAM and NHI programmes, the practical issue is that exposure windows have become short enough to defeat manual workflows.

This weekly report is a useful snapshot of how modern compromise chains now blend identity abuse, exploit weaponisation, and data theft. The Nike breach discussion, the McDonald’s India exfiltration, the Office phishing exploit, and the Cloudflare Wrangler command-injection issue all point to the same governance problem: access pathways are being abused faster than organisations can validate, revoke, or isolate them.

Key questions

Q: How should security teams respond when credentials are exposed at massive scale?

A: Start with session invalidation, then rotate or revoke the affected secrets, tokens, and passwords. After that, map the exposed identities to privileged access paths, service accounts, and third-party integrations. The key is to treat exposed credentials as active until proven otherwise, especially when cookies or persistent sessions may still work.

Q: What problem does ownership attribution solve for service accounts and API keys?

A: It closes the gap between exposure detection and accountable remediation. Many organisations can find the secret, but not the human who introduced it, maintains it, or can safely replace it. Ownership attribution gives security teams a practical way to assign action without relying on informal knowledge that disappears during staff changes.

Q: What are the warning signs that file-share exfiltration is already underway?

A: Look for large downloads from sensitive directories, unusual archive creation, access from non-standard accounts, and repeated activity outside normal business hours. In many cases, exfiltration starts with seemingly ordinary file reads and only becomes obvious when transfer volume or compression behaviour spikes.

Q: Should organisations prioritise identity controls or endpoint controls first for phishing and exploit campaigns?

A: Neither should stand alone. Phishing and exploit chains often begin in email, execute on the endpoint, and finish in identity misuse or data theft, so the stronger approach is correlated control. Prioritise the identity response path for containment, while keeping endpoint telemetry tight enough to show how the attack started.

Technical breakdown

How exposed credentials become an immediate entry point

Exposed API keys, service-account tokens, and cloud credentials are often the fastest route into a compromise because they bypass human login friction and can be used from anywhere. Attackers do not need to break authentication if they can reuse a valid secret before it is rotated or revoked. In NHI environments, the risk rises further when secrets are embedded in code, build pipelines, or collaboration tools because the credential itself becomes portable access.

Practical implication: shorten credential lifetime, detect public exposure quickly, and require revocation workflows that do not depend on manual approval.

Why phishing and document exploits still work together

Office-based phishing remains effective because attackers combine social engineering with executable behaviours inside trusted desktop applications. In the reported CVE-2026-21509 pattern, the security failure is not just malicious content in a file, but a mitigation bypass that allows document handling logic to influence code execution. That means email controls, application hardening, and endpoint telemetry all need to be correlated, because one layer alone rarely explains the full intrusion path.

Practical implication: tune email, endpoint, and process-creation detections together, and treat Office child-process abuse as a priority hunting pattern.

How supply-chain access expands lateral movement and exfiltration

Supply-chain compromise gives attackers legitimate pathways into trusted environments, which is why file-share theft and long-dwell exfiltration are so damaging. Once inside, adversaries can move across business units, stage archives, and export data in ways that look like normal collaboration if controls are weak. The key technical issue is not just access, but the absence of segmentation and behavioural exfiltration controls that would constrain what an authenticated user can remove.

Practical implication: segment partner access, monitor bulk file movement, and enforce data-loss controls that trigger on abnormal archive creation and transfer volume.

Threat narrative

Attacker objective: The attacker wants rapid, low-friction access that can be converted into data theft, extortion leverage, or operational disruption before defenders can contain it.

1. Entry occurs through exposed credentials, phishing-delivered Office exploitation, or trusted supply-chain access that gives the attacker a legitimate foothold.
2. Escalation follows when the attacker reuses the access to reach broader file systems, build infrastructure, or administrative functions.
3. Impact comes from exfiltration, extortion, or downstream compromise of partner systems and sensitive data repositories.

Breaches seen in the wild

• Cisco Active Directory credentials breach — Kraken ransomware group leaked Cisco Active Directory credentials.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity compromise is now an acceleration layer for every major intrusion path. This weekly report does not describe isolated incidents so much as a common operating model: once a secret, token, or administrative pathway is exposed, attackers turn it into immediate access and then widen the blast radius through file systems, collaboration tools, and remote access. For IAM and PAM teams, that means identity governance has to be measured in minutes, not review cycles. The practitioner conclusion is that standing access windows are now the attack surface.

Credential exposure windows are the new control boundary. The most important concept this report surfaces is exposure-to-use latency, the gap between a credential becoming visible and an attacker attempting it. That gap is short enough to make delayed rotation, delayed revocation, and delayed alert triage operationally weak. In NHI governance terms, the control failure is persistence of usable access after discovery. The practitioner conclusion is to treat public or discoverable secrets as already contested.

Supply-chain access is not just a third-party issue, it is an identity issue. Nike’s reported compromise narrative shows how partner access, internal file shares, and collaboration systems can combine into a single exfiltration path. That matters because IAM and NHI programmes often stop at provisioning and miss the downstream question of what an authenticated third party can actually reach. The practitioner conclusion is to govern partner identities by reachable data, not just by account ownership.

Attackers are exploiting the overlap between exploitability and trust. The Office mitigation bypass, command injection in CI/CD, and data theft from internal repositories all show that security teams cannot rely on a single control family to hold the line. Endpoint, email, identity, and data controls need to be evaluated together, because modern intrusion campaigns cross those boundaries quickly. The practitioner conclusion is to design detection and containment around kill-chain continuity, not control silos.

From our research:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• Two-thirds of enterprises have endured a successful cyberattack resulting from compromised non-human identities, with a quarter encountering multiple attacks. That pattern shows how quickly identity weakness becomes operational breach exposure.
• For the control gap behind this pattern, see 52 NHI Breaches Analysis for real-world root causes and response lessons.

What this signals

Exposure-to-use latency is becoming a board-level risk metric for IAM and NHI programmes. If a secret can be abused in under 20 minutes, the practical control question is whether your revocation workflow is automated enough to beat the attacker. That is why lifecycle visibility, not just inventory completeness, now determines whether identity governance is operational or ceremonial.

Standing access is increasingly a liability measure, not a convenience measure. The more systems a credential can reach without additional verification, the more damage one compromised secret can do. Aligning containment with least privilege and the NIST SP 800-53 Rev 5 Security and Privacy Controls means treating every trusted path as a potentially contested asset, especially where partner access or build-system access is involved.

The next phase of defence will be determined by how well organisations connect identity events to exfiltration detection. If file movement, phishing, and command injection are monitored separately, attackers will continue to cross the seams. Security teams should prepare for control convergence across IAM, EDR, and data monitoring rather than assume one platform can close the gap.

For practitioners

• Rebuild revocation around minutes, not hours Define automated revocation triggers for exposed secrets, suspicious file-share activity, and impossible-travel access so teams can cut off access before an attacker has time to reuse it. Tie those triggers to SOC workflows and NHI inventory records.
• Correlate email, endpoint, and identity telemetry Hunt for Office child-process abuse, suspicious file-open behaviour, and credential use that follows phishing delivery. Treat successful phishing as an identity event, not only an endpoint event, so the response includes account containment and token resets.
• Segment third-party access by reachable data Map vendor and partner identities to the file systems, repositories, and operational data they can reach, then remove broad access paths that do not have a clear business need. Add quarterly review of partner entitlements and file-transfer volume.
• Detect bulk movement and archive staging Alert on large downloads, unusual compression activity, and after-hours access to sensitive repositories. These patterns often appear before exfiltration and give defenders a narrow but valuable containment window.
• Harden CI/CD and build tooling against command injection Validate untrusted inputs before they reach shell commands, restrict build-system permissions, and monitor for unexpected child processes inside pipeline runners. Treat build infrastructure as a privileged identity zone, not a disposable utility.

Key takeaways

• This report shows that modern attacks now move from initial access to exfiltration faster than manual identity workflows can react.
• The scale of recent breaches and the speed of credential abuse make standing access windows the main governance problem.
• Practitioners need automated revocation, correlated detections, and segmented third-party access to reduce blast radius.

Key terms

• Exposure-to-exploitation latency: The time between a vulnerability or misconfiguration becoming known and an attacker using it in the wild. In operational terms, this is the window defenders must compress with fast discovery, validation, and containment before initial access turns into persistence or theft.
• Standing access window: The period during which a credential or entitlement remains usable without fresh approval or revalidation. When standing access is broad or long-lived, one compromise can turn into lateral movement, exfiltration, or persistence before defenders have a chance to contain it.
• Credential reuse path: A sequence of trust relationships that allows one stolen password, token, or session to unlock additional systems. These paths are especially dangerous when privilege is broad, segmentation is weak, or accounts are allowed to authenticate across multiple platforms without strong constraints.
• Data exfiltration staging: The preparation step in which attackers gather, compress, and organise files before removing them from the environment. Staging is important because it often creates detectable behaviour, such as archive creation, bulk reads, and unusual transfer volume, before the final leak occurs.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Incident-by-incident breakdowns for Nike, McDonald’s India, Fortinet, Microsoft Office, Cloudflare Wrangler, and the Pakistan-linked APT activity
• Detailed remediation guidance for phishing, zero-day exploitation, ransomware exfiltration, and CI/CD command injection
• Detection rule examples for SIEM, EDR, email security, and network monitoring
• The full weekly timeline of events between 20 Jan and 26 Jan 2026

👉 FireCompass’s full report includes the incident details, remediation notes, and detection guidance for each case

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It is designed for practitioners who need to connect policy, operations, and risk across modern identity programmes.