OWA XSS, domain hijack PoC, and AI-driven attacks raise risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Anomali's report: Browser-session implants, certificate abuse, Telegram C2 and autonomous AI-assisted attacks are converging on the same operational weakness: compromise paths that survive standard cleanup.

Why it matters: IAM, PAM and NHI teams need to treat persistent access, delegated credentials and certificate trust as active attack surfaces because normal remediation may not remove the foothold.

Context

Attackers are increasingly chaining short-lived exploitation with longer-lived access mechanisms, which means a patch or endpoint reset may close the entry point without removing the working foothold. In identity terms, the real risk sits in browser state, delegated permissions, certificates and service accounts that remain trusted after the original exploit is blocked.

This article spans cloud and identity governance at the same time. TA488’s OWA activity shows browser-session persistence, Certighost shows how certificate services can be abused to impersonate domain control, TELESHIM shows how command and control can hide in legitimate messaging traffic, and the AI-driven campaign shows how automation changes the speed of reconnaissance and target selection. The common thread is trust that survives beyond the event that created it.

Key questions

Q: What breaks when an internet-facing OWA endpoint is hit by XSS?

A: The immediate break is session trust. If attacker-controlled script runs inside an authenticated OWA page, the browser can act within the victim's Exchange context, which can expose mailbox data, enable token theft, and support internal phishing from a trusted account path. That makes the issue an identity and access problem, not only a web flaw.

Q: Why do certificate services abuse and domain compromise so often travel together?

A: Because certificate services can be used to mint trust, not just to store it. If enrollment fallback or request validation can be steered toward attacker-controlled infrastructure, a low-privileged account may obtain a certificate that behaves like high-value domain identity. That turns one trust failure into privileged authentication and directory replication risk.

Q: How do teams know when exposed services are being targeted by autonomous attackers?

A: The main signal is speed. If discovery, exploit selection and attack retries begin faster than your normal triage window, exposed systems are already in play. Watch for repeated scanning, rapid target switching, and exploitation attempts that track public CVEs soon after disclosure. The control issue is exposure inventory, not just patch availability.

Q: What should incident responders do when browser-based persistence survives cleanup?

A: They should look beyond endpoint reimaging and password resets and inspect the browser and service layers that keep access alive. That includes OWA offline storage, mailbox delegate permissions, OAuth tokens, certificate trust paths and any account or add-in relationships that can restore the foothold. The priority is to remove the governing trust path, not only the visible malware.

Technical breakdown

OWA XSS creates authenticated-session execution

Cross-site scripting in Outlook Web Access matters here because the payload runs inside an already authenticated browser session. That removes the need for the attacker to steal credentials first and instead gives them the victim’s live session context, which can include mailbox actions, add-in permissions and local browser storage. When a JavaScript implant lives inside the OWA tab, conventional endpoint cleanup can miss the persistence layer because the code is tied to browser state and server-side content rather than a traditional executable on disk.

Practical implication: Treat authenticated browser sessions and mailbox add-in permissions as governed access paths, not just user convenience features.

Certificate services can be abused as a trust bridge

Certighost is a useful example of how Active Directory Certificate Services can become a domain impersonation mechanism when fallback logic is not tightly bound to trusted identity checks. In this chain, a low-privileged domain user can influence certificate issuance by steering validation toward attacker-controlled infrastructure, then use the forged trust to authenticate as a domain controller and extract high-value directory secrets. The problem is architectural: once certificate trust is extended to the wrong request path, the attacker no longer needs elevated initial privilege to reach domain compromise.

Practical implication: Review AD CS trust paths and enrollment fallbacks as identity-critical infrastructure, not just certificate administration detail.

AI-assisted attack cycles compress reconnaissance and target choice

The autonomous AI element in the article shows a different risk pattern: an agent can enumerate exposed systems, evaluate vulnerable services, select an exploit path and retry without human direction after the initial task. That changes the defender’s timing model because exposure discovery becomes continuous and target selection becomes adaptive. The interesting control question is not whether an LLM can think, but whether offensive automation can chain scanning, exploit selection and execution faster than human patch and triage cycles can respond.

Practical implication: Assume automated reconnaissance will queue exposed assets before your normal patch process begins.

Threat narrative

Attacker objective: The objective is persistent access to mail, tokens and domain trust that survives normal cleanup and enables ongoing espionage or follow-on compromise.

1. Entry via OWA XSS in an authenticated Outlook Web Access session allowed JavaScript execution without user interaction beyond opening the email.
2. Credential and token access followed when the OWAReaper implant harvested saved credentials, stole OAuth tokens from mailbox add-ins and stored persistence data in browser storage.
3. Escalation and lateral access emerged through mailbox permissions and session abuse that survived credential resets and even reimaging.
4. Impact included durable mailbox access, command delivery through trusted channels, and the ability to keep re-establishing the implant after basic remediation.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Persistent access is now the primary compromise unit. The article is not just about initial intrusion methods, but about access paths that remain usable after patching, resetting and reimaging. That shifts the governance problem from incident closure to access lifecycle control, especially where browser state, delegated permissions and service trust are involved. Practitioners should treat persistence as an identity governance issue, not only as a malware issue.

Certificate trust has become an identity boundary, not a supporting service. Certighost shows that AD CS failures can convert ordinary domain membership into control-plane impersonation when fallback validation is weak. That is a direct challenge to assumptions that certificate infrastructure sits outside identity governance. Teams need to view certificate issuance paths through the same lens they use for privileged authentication and access delegation.

Autonomous attack automation shortens the time between discovery and exploitation. The AI-driven chain suggests exposed systems may be targeted as soon as they are observed, not after a human operator schedules the work. That makes exposed-service inventory and vulnerability exposure windows more important than narrative discussions about AI capability. The practical conclusion is that patch discipline must now be measured against machine-speed reconnaissance.

Legitimate transport channels are becoming the new hiding place for adversary control. Telegram C2, mailbox commands and image-delivery exfiltration all show that attackers prefer channels defenders already trust operationally. This increases the burden on detection engineering because traffic legitimacy no longer maps cleanly to benign behaviour. Practitioners should focus on trust context, not only protocol reputation.

Identity governance now has to include browser, certificate and service-account persistence. The article’s common thread is that access survives in places many IAM programmes do not routinely govern. That creates a named problem we can call persistence after remediation, where the original intrusion vector is gone but the usable identity foothold remains. Security leaders should align controls to that failure mode rather than to the initial exploit alone.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• Read next: NHI Lifecycle Management Guide

What this signals

Persistent access is now the operational problem to solve. Patch cycles still matter, but they no longer define containment on their own when browser state, certificates and delegated permissions can retain access after the original exploit is closed. The practical shift is toward access-path review and identity-layer forensics, especially where service accounts and mailbox permissions are part of the compromise chain.

Persistence after remediation: when a breach survives resets, the organisation is dealing with a trust problem, not only an intrusion problem. That framing should shape how teams prioritise OWA hygiene, AD CS review and service-account visibility. Service-account visibility remains weak in many environments, with only 5.7% of organisations having full visibility into their service accounts according to the Ultimate Guide to NHIs.

Teams should expect the next wave of activity to favour whatever channels look operationally normal, including email, messaging platforms and browser-native state. That means monitoring has to correlate identity change, token creation and unusual access reuse rather than relying on isolated alerts from a single control plane.

For practitioners

• Audit browser-based persistence paths Review OWA, mailbox add-ins and browser storage for session-bound artefacts that can outlive password resets or device rebuilds. Focus on saved credentials, OAuth tokens and any server-side settings that can rehydrate access after cleanup.
• Revalidate certificate issuance trust paths Check AD CS enrollment fallback behaviour, machine account creation controls and any request flow that can redirect identity validation away from a legitimate domain controller. Treat abnormal certificate issuance as a domain-compromise indicator, not a certificate-only issue.
• Inventory exposed services before the next patch cycle Prioritise internet-facing or broadly exposed applications, because autonomous reconnaissance can identify and queue targets before human triage starts. Reduce the window between discovery and remediation for anything that can be reached without internal controls.
• Map trusted comms channels used for C2 Look for command traffic hidden in email, Telegram, image delivery networks or other sanctioned services that blend into normal operations. Tune detections around unusual timing, privilege changes and repeated polling rather than protocol alone.

Key takeaways

• The common failure mode in these campaigns is not just exploitation, but access that survives cleanup and lets attackers return through trusted identity paths.
• The article ties together browser implants, certificate abuse and AI-assisted reconnaissance, which shows how adversaries are reducing the time between discovery and usable compromise.
• Teams need to govern persistence as an identity problem by reviewing browser state, certificate trust and delegated access with the same urgency as patching.

Key terms

• Browser persistence mechanism: A browser persistence mechanism is any configuration or load path that lets code survive across restarts and user sessions. Force-installed extensions, trusted DLL loading paths, and profile-level autostart behaviours can all preserve attacker control without repeated phishing or exploitation.
• Certificate Authority Trust Path: A certificate authority trust path is the route by which a server decides which signed SSH certificates it will accept. For machine identities, the trust path determines the blast radius of issuance mistakes and must be designed with consistent parsing and narrow scope.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.
• Autonomous Attack Chain: A sequence of offensive actions executed by a system that chooses its own next steps, tools, and timing without human approval gates. In identity terms, the concern is not only compromise, but the ability to convert access into multi-stage progress faster than governance workflows can respond.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is designed for practitioners who need to govern machine identities, delegated access and persistent trust paths in real programmes.