Anomali Cyber Watch spotlights malware delivery, phishing, and supply chain risk

At a glance

What this is: This weekly watch brings together several threat patterns, from stealthy malware delivery to credential theft and supply chain abuse.

Why it matters: It matters to IAM and security teams because these attacks target authentication trust, exposed secrets, and operational blind spots that conventional controls often evaluate too late.

👉 Read Anomali's Cyber Watch on Remcos RAT, BitB phishing, and supply chain intrusion

Context

The primary security issue across these threats is not a single malware family or phishing kit, but the way attackers turn routine trust into an entry path. Text-only staging, spoofed authentication prompts, and malicious workflow extensions all exploit assumptions that file scanners, users, and platform owners will treat familiar activity as safe. That makes the primary keyword, malware delivery, relevant here because the article is really about how delivery methods bypass detection and control boundaries.

For identity and access teams, the overlap is direct when campaigns move from initial access to credential capture, token theft, or abuse of trusted execution paths. BitB phishing challenges user authentication, while supply chain intrusion against workflow nodes can expose OAuth credentials and API keys that behave like non-human identities. The article’s starting position is typical of current threat reporting: it shows that attackers increasingly work through the control plane, not just against the endpoint.

Key questions

Q: What breaks when attackers can hide inside trusted scripts and build tools?

A: File reputation and signature-based controls lose much of their value because the malicious logic is assembled or executed through legitimate tooling. The result is a detection gap between what the binary is and what the process is doing. Security teams need behaviour-based telemetry, parent-child process correlation, and script monitoring to close that gap.

Q: Why do phishing kits that imitate browser login windows still work?

A: They work because many users still rely on visual cues and URL checks that disappear when the prompt is rendered inside the webpage itself. The attack exploits trust in familiar login flows, not a cryptographic flaw. Phishing-resistant authentication and stronger session controls reduce the chance that stolen credentials can be reused.

Q: What do security teams get wrong about workflow automation and secrets?

A: They often treat integrations and community nodes as convenience features rather than privileged execution paths. If a node can decrypt stored credentials or access OAuth tokens, it effectively becomes part of the identity attack surface. Teams should govern these components with the same care they apply to administrative access.

Q: How should organisations respond when trusted access becomes the attack path?

A: Organisations should tighten the scope of every credential, prioritise attack-path analysis for crown-jewel systems, and unify governance across human, machine, and delegated identities. The key question is not who logged in. It is what the identity could do once trust was inherited, because that determines the true containment boundary.

Technical breakdown

Text-only staging and in-memory reconstruction

Text-only staging breaks payload delivery into fragmented, often obfuscated files that are reconstructed during execution rather than stored as a normal executable on disk. This reduces the usefulness of static detection because the malicious logic is only assembled at runtime, often inside scripting hosts or loader processes. In the SHADOW#REACTOR pattern, the sequence includes VBS, PowerShell, and .NET loading, which means defenders need to understand the whole execution chain, not just the final malware family. The technical challenge is not that any one component is unusual, but that the chain stays within expected administrative tooling long enough to evade simple signatures.

Practical implication: Monitor script-to-script execution chains and flag fragmented payload reconstruction before it reaches memory.

Living-off-the-land execution in Windows malware

Living-off-the-land, or LOLBin, abuse means attackers use legitimate binaries such as MSBuild.exe to run malicious code, establish persistence, or blend into normal system activity. This matters because detection logic often treats trusted binaries as low-risk by default, even when they are launched from unusual parents or contexts. The result is that the tool itself looks benign while its provenance and behaviour are malicious. In a campaign like this, the binary is not the vulnerability. The weakness is the gap between trust in the executable and trust in the process relationship, command line, and network behaviour surrounding it.

Practical implication: Correlate trusted binaries with parent-child process context and suspicious command-line patterns.

Browser-in-the-Browser phishing and credential capture

Browser-in-the-Browser phishing creates a fake login window inside a webpage using standard web technologies, so the prompt appears to belong to the browser rather than an external site. That removes many of the visual cues users rely on, including URL inspection and tab switching, and it often sits behind fake CAPTCHA steps to make the interaction feel legitimate. The technique is effective because it attacks the user’s trust in familiar authentication flows, not because it breaks cryptography. Once credentials are entered, the attacker can use them immediately or pair them with session tokens and OAuth abuse in later stages.

Practical implication: Treat login prompts inside webpages as high-risk and require phishing-resistant authentication for high-value accounts.

Threat narrative

Attacker objective: The attacker aims to gain durable access, harvest credentials or tokens, and reuse trusted execution paths to expand control and exfiltrate data.

1. Entry begins with delivery of obfuscated script and text-only payload fragments through staged execution or deceptive login flows.
2. Escalation occurs when attackers reconstruct payloads in memory, abuse trusted Windows tools, or capture credentials and tokens through spoofed authentication.
3. Impact follows as remote access trojans, stolen OAuth material, or workflow-integrated secrets enable persistence, exfiltration, and broader compromise.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trust abuse is now the common denominator across modern intrusion paths. The article spans malware staging, fake browser login flows, and malicious workflow packages, but the shared issue is not technical novelty. Attackers are exploiting trusted mechanisms that defenders still over-assume are safe because they are familiar. That makes trust, not only vulnerability, the primary security boundary that must be governed.

Credential capture increasingly sits inside operational ecosystems, not just phishing sites. BitB phishing and supply chain node abuse both show that secrets can be taken from the browser context or from workflow execution itself. For IAM and NHI programmes, this means OAuth grants, API keys, and session artifacts need governance as actively as passwords. The control gap is visibility into where credentials are created, used, and silently copied.

Text-only staging creates detection latency that traditional file-based controls cannot close. When payloads are reconstructed in memory and launched through scripting or build utilities, the decisive signal is process behaviour, not file reputation. This is where NIST CSF detection and response functions, plus ATT&CK mapping, become more useful than binary blocking alone. Practitioners should expect increasingly modular intrusion chains that require behavioural correlation across endpoints and identity systems.

Workflow platforms are becoming non-human identity concentration points. The n8n intrusion pattern shows that community extensions can inherit broad platform privilege and expose stored credentials, which makes them a governance problem as much as a supply chain problem. In NHI terms, the issue is lifecycle and scope control for tokens embedded in automation systems. The specific concept here is credential trust compounding: each trusted integration adds access surface that can be repurposed by attackers if offboarding, scoping, and execution controls are weak.

Identity security is now inseparable from execution context. Whether the attacker starts with a spoofed login or a malicious loader, the path to impact depends on how much privilege the compromised process can inherit. That means IAM, PAM, and NHI governance need to be evaluated alongside endpoint and application controls. The practical conclusion is simple: authority must be conditional on context, not just on successful authentication.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.
• For deeper identity context, see Top 10 NHI Issues for the governance patterns that often fail when secrets spread across automation.

What this signals

The signal for practitioners is that secret exposure is now a speed and scope problem, not just a disclosure problem. When remediation lags and trust-heavy workflows proliferate, attackers can reuse credentials across systems faster than review cycles can react. That is why identity governance, secret lifecycle control, and runtime detection need to be treated as one programme, not separate backlogs.

Credential trust compounding: each additional integration that can decrypt, forward, or reuse a secret expands the blast radius of a single compromise. Teams should assess whether automation platforms are concentrating access in ways that their IAM and PAM models never explicitly approved. The practical response is to reduce inherited privilege, not simply to rotate it after exposure.

For the AI and automation angle, this also reinforces the need to treat prompts, tokens, and workflow permissions as governed assets. Where an agent, script, or node can reach sensitive systems, access has to be time-bound, context-bound, and revocable. Aligning those controls with the NIST Cybersecurity Framework 2.0 helps connect identity, detection, and recovery into one operating model.

For practitioners

• Harden script execution telemetry Log and alert on VBS, PowerShell, and MSBuild execution chains, especially when scripts launch other scripts or rebuild fragments in memory. Prioritise cross-process correlation so text-only staging cannot hide behind individual benign events.
• Require phishing-resistant authentication for critical accounts Move high-value users and administrators to phishing-resistant methods and treat browser-embedded login prompts as unsafe by default. Layer this with session binding and conditional access so stolen credentials are harder to reuse.
• Review trusted automation for credential exposure Inventory workflow nodes, plugins, and integrations that can decrypt or access stored OAuth credentials and API keys. Reclassify community extensions as privileged software and enforce code review, allowlisting, and execution restrictions.
• Separate secret storage from broad platform runtime Reduce the number of systems that can both store and decrypt secrets during execution. Where possible, isolate decryption rights, shorten token lifetime, and require explicit approval for workflows that touch sensitive credentials.

Key takeaways

• Modern intrusion campaigns increasingly succeed by abusing trust in scripts, browsers, and workflow extensions rather than by exploiting a single technical flaw.
• Secret exposure becomes materially worse when remediation takes weeks and automation platforms can reuse credentials at execution time.
• Practitioners should govern trusted execution paths, credential reuse, and phishing-resistant authentication as one control problem across identity and security teams.

Key terms

• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Browser-based phishing: Browser-based phishing is phishing that executes through the web browser rather than the inbox, often using redirects, malicious sites, consent prompts, or extensions. It matters because the browser is where identity, application access, and session state intersect.
• Credential trust compounding: A governance failure mode where each integration, workflow node, or service that can decrypt or reuse secrets increases the blast radius of a compromise. It matters because the accumulation of small trust grants can create a large, hidden access surface across automation systems.

What's in the full analysis

Anomali's full Cyber Watch covers the source details this post intentionally leaves at the pattern level:

• MITRE ATT&CK mappings for each campaign and the specific technique sequence used by the malware.
• Original source links for the Remcos, BitB, and supply chain items so analysts can trace each report back to primary evidence.
• The analyst commentary around why these threats matter operationally for defenders.
• The broader weekly context that ties these stories to the current threat landscape.

👉 Anomali's full post includes the original source references and analyst notes behind each threat item.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and agentic AI identity. It helps security practitioners connect identity control design to the broader operational risks highlighted by modern intrusion patterns.