Anomali Cyber Watch spotlights malware delivery, phishing, and supply chain risk

At a glance

What this is: Anomali’s weekly threat watch ties together multiple attack patterns, including malware delivery, browser-based phishing, and supply chain abuse, with a shared emphasis on trust exploitation.

Why it matters: It matters because practitioners need to defend the full access path, from user authentication to script execution and third-party node trust, not just isolated detections.

Context

This watch is really about control failure patterns, not a single malware family or phishing kit. The article groups together intrusion activity that succeeds because security teams often evaluate prompts, scripts, packages, and login flows in isolation instead of as one access chain. That matters for identity governance because third-party trust, credential capture, and execution context all sit on the same path to compromise.

The identity intersection is strongest in the supply chain intrusion and the BitB phishing case. One abuses delegated trust in workflow automation, while the other exploits user trust in an authentication surface that looks legitimate but is entirely attacker-controlled. The broader lesson is that authentication, credential handling, and extension trust need shared governance, not separate teams acting on separate signals.

Key questions

Q: What breaks when authentication is still designed around a single browser session?

A: Single-session authentication breaks when a customer moves between web, mobile, kiosk, and loyalty touchpoints without losing context. The result is duplicate logins, weak session handoff, and broken claims continuity. In practice, that creates abandonment during checkout and makes it harder to apply consistent fraud controls across the full shopping journey.

Q: Why do third-party credentials increase supply chain risk?

A: Third-party credentials increase supply chain risk because they often combine standing privilege with broad operational reach. A vendor token or support account may touch production systems, sensitive data, or automation workflows. If that identity is stolen or misused, the attacker does not need to defeat your primary perimeter first. They can operate through an allowed path.

Q: What signs suggest script-based malware is hiding behind normal Windows tooling?

A: Look for chained events that start with script interpreters, pull down text fragments, and then hand execution to trusted utilities such as PowerShell or MSBuild. The pattern is suspicious when the payload is assembled at runtime rather than delivered as a visible executable. That combination is a stronger signal than any one process alone.

Q: How should teams govern third-party automation extensions that can access secrets?

A: They should treat those extensions as privileged software with scoped runtime access, separate approval workflows, and explicit restrictions on secret retrieval. The important decision is not only whether a package is allowed to install, but whether it is allowed to reach decrypted credentials during execution. That governance boundary needs to be enforced at the platform level.

Technical breakdown

Text-only staging and in-memory reconstruction

The Remcos campaign shows how attackers can move malware delivery away from obvious binaries and into staged text artifacts. An initial script launches PowerShell, which repeatedly fetches fragmented content, then reconstructs and decodes payloads in memory. That design defeats controls that depend on scanning files at rest, because the malicious logic only becomes visible after execution and assembly. The use of reflective loading and obfuscation also reduces the value of sandboxing when each stage looks like ordinary scripting or file retrieval. The real architectural issue is event fragmentation: defenders see harmless-looking components instead of a coherent chain.

Practical implication: correlate script execution, download activity, and memory-resident loading so the chain is visible before the payload runs.

Browser-in-the-Browser phishing and authentication trust

BitB phishing works by reproducing a login window inside a webpage rather than sending users to a separate fake domain. That removes the URL cue many people rely on and makes the prompt look like a normal single sign-on dialog from the browser itself. Fake CAPTCHA steps further normalise the interaction and can lower automated detection. The result is a trust transfer attack, where users authenticate inside an attacker-controlled interface that borrows the visual language of legitimate identity systems. Because the attack succeeds through presentation, not technical compromise, conventional link scanning offers only limited protection.

Practical implication: strengthen authentication controls so users do not have to judge prompt authenticity by appearance alone.

Third-party nodes as credential-harvesting surfaces

The n8n intrusion shows how extensible automation platforms can turn community packages into privileged execution points. Malicious nodes masqueraded as legitimate integrations, then used the platform’s trust model to reach stored OAuth and API credentials during workflow execution. The important detail is not just package abuse, but privilege inheritance: once installed, the node can operate with access that users associate with the platform itself. That creates a governance gap between package approval, runtime privilege, and credential custody. In identity terms, the attack abuses delegated trust over non-human identities and their tokens, not just software supply chain hygiene.

Practical implication: treat community extensions as privileged actors and govern their access to stored secrets separately from the host platform.

Threat narrative

Attacker objective: The objective is to gain durable access to systems or identities while hiding in trusted execution and authentication paths.

1. Entry occurs through malicious delivery channels, including script-based staging, spoofed login surfaces, and rogue community packages.
2. Credential capture or execution is achieved by reassembling payloads in memory, harvesting credentials through fake authentication flows, or abusing workflow trust to reach stored tokens.
3. Impact follows as malware persistence, account compromise, and exfiltration of sensitive credentials or environment access paths.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trust boundary collapse is the common thread across these incidents. The article spans malware, phishing, and supply chain abuse, but each case succeeds by borrowing legitimacy from a trusted channel. In practice that means the security problem is not only malicious content, but the point at which a trusted control surface becomes attacker-controlled. For identity teams, that is where authentication, runtime trust, and delegated access governance begin to converge.

Browser-in-the-Browser attacks expose a verification trust gap. Security awareness programmes still over-rely on visible cues such as URLs, window chrome, and familiar login layouts. BitB removes those cues and replaces them with a counterfeit experience that is functionally close enough to fool legitimate users. The defensive answer is stronger identity assurance, not more polished warnings, because the user interface has become part of the attack surface.

Delegated access is the new supply chain problem for NHIs. The n8n case is not just about malicious npm packages, it is about third-party extensions inheriting access to stored OAuth and API credentials. That is a non-human identity governance failure, because the platform’s trust model grants runtime power that outlives package review. Third-party NHI exposure: when extensions inherit credential reach without separate lifecycle control, the blast radius moves from the package to every integrated service.

Living-off-the-land delivery is now a governance signal, not just an evasion trick. The Remcos chain uses legitimate tooling, text fragments, and in-memory reconstruction to make malicious activity look like normal administration. That means defenders need policy that recognises context, not just indicators, because the abuse lies in sequencing trusted operations. For practitioners, detection strategies must treat script chains and build utilities as governed execution paths.

Phishing-as-a-service is industrialising user trust exploitation. The BitB technique spreads because kits lower the skill barrier and increase consistency across campaigns. That matters beyond email security because the same pattern can be adapted to identity flows wherever users expect a browser-based prompt. Teams should assume that any interface grounded in user recognition rather than cryptographic assurance will be contested.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Identity security has to move closer to execution time. The article shows that the decisive control point is no longer just login or package approval, but what happens when trusted code starts running and credentials become available. Teams that keep identity policy separate from runtime telemetry will miss the moment a trusted path turns hostile.

Credential boundaries are becoming supply chain boundaries. The n8n case shows why a workflow platform with access to OAuth tokens behaves like a high-value identity system, not just an automation layer. Organisations exposing NHIs to third parties create a governance problem that spans procurement, runtime permissions, and offboarding.

Blast radius is the metric that matters now. When a browser prompt, an automation node, or a script chain can each inherit access, the question is not whether the first control failed. The question is how quickly that failure can be contained before token reuse or delegated access expands the compromise.

For practitioners

• Correlate script chains end to end Link script launch events, PowerShell downloads, and in-memory execution so malicious staging cannot hide across separate telemetry sources.
• Harden authentication beyond visual cues Require stronger identity assurance for sensitive logins so users are not deciding trust based on window appearance or browser framing.
• Treat community nodes as privileged software Review third-party workflow extensions as runtime actors with access to stored OAuth and API credentials, not as inert add-ons.
• Separate package trust from credential custody Restrict which integrations can decrypt or retrieve secrets during workflow execution, even if the package has been approved for installation.
• Monitor legitimate tools for malicious sequencing Flag unusual combinations of wscript.exe, PowerShell, MSBuild, and reflective loading as a single kill chain rather than isolated admin activity.

Key takeaways

• Attackers in this watch win by exploiting trust surfaces, not just by dropping obvious malware or phishing pages.
• The n8n supply chain case shows how third-party extensions can turn stored OAuth and API credentials into a high-impact target.
• Defenders need governance that connects authentication, runtime execution, and delegated access, because those controls now fail together.

Key terms

• Browser-based phishing: Browser-based phishing is phishing that executes through the web browser rather than the inbox, often using redirects, malicious sites, consent prompts, or extensions. It matters because the browser is where identity, application access, and session state intersect.
• Living-off-the-land Execution: Living-off-the-land execution is when an attacker uses tools already present on a system to carry out malicious activity. It relies on trusted binaries, scripts, and administrative utilities to blend into normal operations. This technique reduces the need for custom malware and often complicates detection, logging, and response.
• Key Custody: Key custody is the ownership and control of cryptographic keys across their lifecycle, including storage, rotation, emergency use, and retirement. Poor custody turns encryption into a weak barrier because any identity with key access can recover data that should have remained protected.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners translate identity risk into control decisions across modern environments.