Browser extension phishing and AI credential abuse raise NHI risk

At a glance

What this is: Anomali’s roundup highlights browser-extension phishing, live Okta credential harvesting, mobile malware spread, and credential-driven backdoors as current attack patterns.

Why it matters: For IAM and NHI practitioners, the common issue is trust in authentication, extensions, and standing credentials that attackers can abuse faster than traditional review cycles catch them.

By the numbers:

• Around 100 organizations were targeted across technology, finance, healthcare, and logistics sectors in the ShinyHunters-linked Okta campaign.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to Astrix Security & CSA.

👉 Read Anomali’s Cyber Watch roundup on browser phishing, credential theft, and mobile malware

Context

Browser extension phishing, live credential harvesting, and credential-led post-compromise activity all point to the same governance problem: attackers are abusing trusted identity paths, not just technical vulnerabilities. For IAM and NHI teams, the primary question is whether authentication, extension control, and secret management are governed as one access system across human and non-human identity estates.

The article’s examples are useful because they show how quickly identity abuse can move from access capture to follow-on compromise. That timing gap is where conventional review processes often fail, especially when service accounts, browser sessions, and user approvals are treated as separate control domains.

Key questions

Q: What breaks when browser extensions are allowed to modify login pages?

A: Browser extensions can replace or overlay a legitimate login surface while the address bar still shows the correct site, which defeats visual trust cues. That breaks assumptions built into user training and many phishing defenses. The control failure is usually too much extension privilege and too little enterprise oversight of what extensions can read, inject, or intercept.

Q: Why do live phishing campaigns defeat traditional identity review processes?

A: They capture credentials, one-time codes, or approvals and use them immediately, often before logs are reviewed or alerts are triaged. Traditional review assumes a delay between theft and abuse. Live phishing compresses that window to minutes or seconds, so organisations need phishing-resistant authentication and stronger context binding.

Q: What do security teams get wrong about credential theft in endpoint incidents?

A: Teams often focus on the infected device and miss the identity blast radius. Browser-stored passwords, session tokens, API keys, and service account material can all be exposed in one compromise. If those artifacts are not checked and revoked, the attacker may retain access long after the endpoint is cleaned.

Q: Who is accountable when a leaked NHI credential is reused in production?

A: Accountability should sit with the team that owns the workload and the identity lifecycle, not with the person who discovered the leak. Governance needs clear ownership, a revocation path, and audit evidence showing when the secret was issued, used, and retired. NIST CSF and OWASP NHI both reinforce that lifecycle control is part of the control environment.

Technical breakdown

Browser-extension phishing turns the address bar into a false trust signal

Browser extensions can modify page content after load, which lets attackers inject a convincing login surface while the address bar still shows the correct domain. That breaks the user’s ability to rely on the browser chrome as an authentication cue. The attack is not an exploit in the classic sense. It is a permission abuse pattern, where broad extension rights become a delivery channel for credential theft and session hijacking. Practical security depends on controlling which extensions can run, what permissions they receive, and whether enterprise users can install them at all.

Practical implication: enforce extension allow-listing and review extension permissions as part of access governance.

Real-time credential harvesting defeats delayed review models

In live phishing flows, attackers capture passwords, one-time passcodes, or approval events and use them immediately. This matters because many identity programmes still assume credentials are exfiltrated first and abused later, leaving time for review or alerting. In reality, the attacker’s session may complete before the defender sees a meaningful signal. The control problem is therefore not only MFA strength, but also phishing resistance, prompt fatigue, and whether login decisions are bound to a trusted device or origin context.

Practical implication: move high-risk users and admin paths to phishing-resistant authentication and contextual access policies.

Credential-driven intrusion chains turn one foothold into broader identity abuse

Backdoors and stealers often do not seek immediate impact. They first establish persistence, then enumerate browser-stored credentials, local context, and accessible files so the operator can expand later. This is a classic identity compounding effect: one compromised account or endpoint can reveal many more identities, tokens, and business processes. In NHI-heavy environments, the same pattern applies to secrets, API keys, and service credentials. Once those are exposed, the attacker’s next move is usually not noise, but privilege reuse and targeted staging.

Practical implication: separate endpoint compromise from identity compromise in incident workflows and investigate stored credentials as primary evidence.

Threat narrative

Attacker objective: The attacker wants immediate access to accounts and downstream systems by turning trusted identity workflows into reusable footholds for further compromise.

1. Entry occurs through phishing, malicious browser extensions, or credential-harvesting workflows that present a trusted login surface to the victim.
2. Escalation follows when the attacker captures valid credentials, one-time codes, or session access and reuses them before defenders can intervene.
3. Impact comes from persistence, lateral movement, or extortion activity driven by the newly obtained identity foothold.

Breaches seen in the wild

• Hard-Coded Secrets in VSCode Extensions — 500+ VSCode extensions expose hardcoded tokens and credentials creating massive developer supply chain risk.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser trust has become an identity control surface. The Stanley-style extension attack shows that browser chrome can no longer be treated as a reliable boundary between legitimate and malicious login activity. If an extension can alter what the user sees after navigation, then the trust model for web authentication has already shifted. IAM and security teams need to treat browsers, extensions, and login pages as a linked policy domain, not as separate user convenience layers.

Real-time credential theft exposes the weakness of delayed governance. The ShinyHunters pattern demonstrates that authentication review and alerting are often too slow for in-band phishing and live support scams. This is especially relevant where human approval, push prompts, or one-time codes still serve as proof of intent. The governance gap is not just MFA adoption, but whether the organisation can detect and block a credential being used the same minute it is captured.

Credential reuse is the bridge between human compromise and NHI exposure. Once an endpoint, browser session, or user account falls, attackers frequently pivot into stored tokens, API keys, and service credentials. That is the same problem space that underpins NHI abuse: one identity event becomes a broader trust failure across systems. Identity chaining: the compounding of human and non-human credentials into one attack path. Practitioners should assume cross-identity propagation unless credentials are isolated and monitored as a single estate.

The article reinforces that visibility, not just prevention, is now a governance requirement. The defender rarely sees one clean event. Instead, compromise shows up as extension abuse, unusual approval behavior, browser credential extraction, and later account misuse. That pattern aligns with broader NHI governance gaps where secrets, service accounts, and delegated access remain partially observed. Security teams should prioritise continuous detection across identity activity, endpoint behavior, and secret exposure.

Attackers are optimising for access reliability, not novelty. The most worrying thread in the roundup is that multiple campaigns use ordinary trust relationships, valid logins, and common software behavior rather than exotic exploits. That means the control objective is resilience against repeatable abuse patterns. Practitioners should expect these techniques to persist because they scale well, evade simple filtering, and fit both criminal and espionage tradecraft.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
• Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37%.
• For a broader view of how identity exposure compounds across real incidents, see The 52 NHI breaches Report.

What this signals

The operational signal for practitioners is that identity compromise is increasingly multi-surface. Browser controls, authentication workflows, SaaS access, and NHI secrets now need to be managed as one exposure chain because attackers are using the weakest transition point between them. Credential chain visibility: the ability to see how a single authentication event can cascade into token reuse, service access, and downstream abuse. That is the control boundary teams should be hardening first.

If your programme still separates browser risk, IAM risk, and NHI risk into different workstreams, you are likely missing the point of these campaigns. The threat pattern is not just theft, but rapid reuse and cross-system propagation. The most effective response is a unified view of who or what can authenticate, what can be extracted from a device or session, and what can be revoked before the attacker completes the chain.

For practitioners

• Govern browser extensions as enterprise software Inventory installed extensions, restrict installation to an allow-list, and review permissions that allow page modification, credential access, or navigation control. Browsers and extensions should be handled as governed assets because they can become an identity attack path.
• Replace in-band authentication with phishing-resistant controls Move privileged users, admins, and support workflows to phishing-resistant authentication where possible, and reduce reliance on push approvals or codes that can be captured during a live session. The goal is to remove the attacker’s ability to reuse the same login conversation.
• Investigate credential exposure as a time-critical event Treat exposed keys, tokens, and browser-saved credentials as an active incident, not a routine hygiene issue. Build workflows that revoke, rotate, and trace use immediately, because attacker access can begin minutes after exposure and may outpace manual review.
• Correlate identity and endpoint evidence in one incident path When browser theft, malware, or suspicious login behavior appears, examine local credential stores, session tokens, and connected SaaS accounts together. That broader view is necessary because the first observable compromise may only be the opening move in a larger identity chain.
• Separate user compromise from service credential risk Include API keys, automation tokens, certificates, and service accounts in the same response playbook as human identities. If one endpoint or browser profile is compromised, assume non-human credentials may already have been exposed and validate their scope before containment closes.

Key takeaways

• Browser extension abuse, live phishing, and credential-driven post-compromise activity all exploit the same governance weakness: trust in identity flows that can be manipulated in real time.
• The practical risk is speed as much as technique, because attacker access can begin minutes after exposure and often before conventional review cycles can respond.
• Practitioners should govern extensions, phishing-resistant authentication, and NHI secret revocation as one coordinated access-control problem, not separate security tasks.

Key terms

• Browser Extension Abuse: Browser extension abuse occurs when a trusted add-on is used to capture data, alter browser behaviour, or reuse authenticated sessions. In enterprise environments, the risk is not just malware delivery but silent access to cookies, tokens, and page content inside the user’s trusted browser session.
• Credential Chain: A credential chain is the sequence of identities, tokens, sessions, and secrets an attacker can reuse after an initial compromise. The concept matters because one exposed password or API key often leads to broader access, especially when human and non-human credentials are not governed together.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full analysis

Anomali's full post covers the operational detail this post intentionally leaves for the source:

• The original article includes the specific campaign descriptions and linked reporting for each threat item, which is useful if you are tracking source intelligence rather than governance implications.
• It also preserves the MITRE ATT&CK references and incident context around each threat, helping analysts map observations to known tactics and techniques.
• The source post gives the vendor’s full analyst commentary on why each event matters across browser abuse, credential harvesting, mobile malware, and supply chain compromise.
• If you need to compare the roundup against your own telemetry or alerting rules, the source article is the place to extract the precise event wording and references.

👉 Anomali’s full Cyber Watch post includes the linked source articles and analyst notes for each threat item

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle control. It helps practitioners connect access governance to the broader identity estate their programmes depend on.