Phishing, account takeover and AI abuse remain the month’s stop-list

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: Phishing, account takeover, supply chain compromise, subscription bombing, and indirect prompt injection keep converging on identity abuse and AI misuse month after month.

Why it matters: It matters because identity teams cannot treat phishing, credential theft, and AI-enabled abuse as separate problems when attackers are using the same trust gaps to move between them.

Context

Phishing, account takeover, and AI abuse are not isolated threat classes when they repeatedly land in the same attack paths. The governance gap is that organisations still separate email security, identity controls, and AI risk management even though adversaries now chain them together through trust, delegation, and stolen access.

This article is a monthly index of recurring criminal techniques, so the useful lens is pattern recognition rather than a single incident. The identity bridge is direct: phishing, account takeover, and prompt injection all exploit weak authentication confidence, over-trusted delegation, and insufficient control over non-human or AI-driven actions.

Key questions

Q: What breaks when AI phishing is treated as only an email problem?

A: Teams miss the identity layer of the attack. AI phishing often aims to capture credentials, sessions, or trusted actions, so filtering messages without correlating authentication and account behaviour leaves the highest-risk part of the compromise unaddressed. Effective defence has to connect inbox signals to identity and response workflows.

Q: Why do delegated identities and CI/CD runners create supply chain risk?

A: Because they often hold the authority to move code, access secrets, or trigger deployments without the same scrutiny applied to human users. If an attacker captures those credentials, the resulting access looks like normal automation. That makes inventory, ownership, and least-privilege scoping central to reducing blast radius.

Q: What are the warning signs that AI SOC automation is becoming unsafe?

A: Look for actions taken without a linked case, approvals that happen after execution, investigation summaries that cannot be traced back to source evidence, and workflow changes that only one team member understands. Those signals show the SOC has moved from governed orchestration to opaque automation.

Q: How should teams decide whether to prioritise phishing controls or account takeover controls first?

A: Prioritise the control that reduces the most reusable trust. If phishing is feeding token theft, focus on authentication assurance, session binding, and rapid revocation. If the main exposure is delegated access or automation, focus on identity inventory and privilege containment. The right sequence depends on where trust is being reused, not where the alert appears.

Technical breakdown

How phishing becomes identity compromise

Phishing is not just message delivery. It is a mechanism for capturing credentials, MFA tokens, or session state and then reusing that trust in a different control plane. Once an attacker has a valid account, the original email event stops mattering and the problem becomes identity assurance, session governance, and privilege scope. In practice, the boundary between phishing and account takeover is crossed when a human trust decision is converted into an authenticated session that downstream systems accept as legitimate.

Practical implication: identity controls must validate session integrity, not just initial login success.

How supply chain access turns into lateral abuse

Supply chain compromise often succeeds because third-party access is treated as a trusted shortcut rather than a tightly governed identity relationship. CI/CD runners, vendor tokens, and delegated integrations frequently sit outside ordinary human-access review, yet they can reach code, secrets, and deployment pathways at machine speed. That creates a durable governance blind spot: the attacker does not need a user desktop if the pipeline already has the authority to move, modify, or sign artefacts.

Practical implication: inventory and constrain non-human identities with the same rigor used for privileged human access.

Why indirect prompt injection changes the identity problem

Indirect prompt injection weaponises content the model ingests, rather than the model interface itself. The attacker places instructions in data, documents, or web content so the AI system executes them as if they were task input, which makes trust boundaries much harder to reason about. For agentic or tool-using systems, the risk escalates when the model can act on those instructions through connected identities, APIs, or workflows. The result is not just bad output but unauthorised action through a delegated runtime.

Practical implication: constrain tool permissions and treat model inputs as untrusted execution material.

Threat narrative

Attacker objective: The attacker wants to convert a single trust break into repeatable access that can be used for fraud, data theft, workflow abuse, or broader compromise.

1. Entry begins with phishing, malicious delivery, or indirect prompt injection that exploits a human or system trust decision.
2. Credential access follows when the attacker captures login data, session state, or delegated access that can be reused across services.
3. Escalation occurs when the compromised identity reaches email, cloud, CI/CD, or AI-connected workflows with broader authority than intended.
4. Impact is account takeover, supply chain abuse, AI misuse, or subscription bombing that turns trusted access into operational harm.

Breaches seen in the wild

• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Recurring attack patterns matter more than isolated campaigns: Proofpoint’s stop-list is useful because it shows that adversaries are converging on a small set of repeatable trust failures. Phishing, account takeover, and indirect prompt injection all exploit the same governance weakness, which is overconfidence in the legitimacy of a session or instruction source. Practitioners should treat these as linked control failures, not separate threat silos.

Non-human identity governance now sits inside supply chain risk: The article’s supply chain examples underline that CI/CD runners, delegated tokens, and machine accounts are no longer back-office plumbing. They are active paths into code, secrets, and deployment authority, and they need explicit ownership, inventory, and constraint models. That makes NHI governance a practical control requirement, not a specialist side topic.

AI abuse becomes an identity problem the moment tools are attached: Once an AI assistant can call APIs, manipulate workflows, or access data, prompt injection becomes a privileged access issue. The named concept here is delegated trust collapse: the point at which untrusted content is transformed into authorised action by an over-permissive runtime. The practitioner response is to narrow tool scope and remove implicit authority from AI-linked sessions.

Security programmes need one control narrative across email, identity, and AI: The stop-list cuts across business email compromise, cloud account takeover, supply chain compromise, and subscription abuse because attackers reuse the same trust failures in different channels. That means teams should align email security, IAM, PAM, and AI governance under a single operating model for verification and delegation. Fragmented ownership leaves gaps that modern attackers are specifically looking for.

From our research library:

• 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, according to the State of Secrets Sprawl 2026.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: CI/CD Pipeline Identity Security Guide

What this signals

Delegated trust collapse: The recurring failure mode across phishing, supply chain compromise, and indirect prompt injection is that untrusted input becomes trusted action. Once that happens, identity, workflow, and AI controls are all bypassed through the same mechanism, so teams need a single verification model for human and non-human actors.

Identity programmes will need to treat non-human identities as first-class attack surfaces rather than operational conveniences. CI/CD runners, third-party tokens, and AI-connected accounts can all become the place where stolen trust turns into business impact, which makes lifecycle control and privilege scoping the practical boundary lines.

For practitioners

• Map recurring deception paths across channels Correlate phishing, account takeover, supply chain abuse, and prompt injection events so the same trust failure is not investigated in separate queues.
• Inventory non-human and delegated identities Build a complete register of CI/CD runners, third-party tokens, service accounts, and AI-connected integrations that can act without direct human approval.
• Constrain AI tool permissions by task Limit model and agent access to the smallest viable set of APIs, workflows, and data sources so indirect prompt injection cannot trigger broad action.
• Separate authentication from authorisation review Treat successful sign-in as only the start of the control check, then validate whether the session, token, or delegated identity is allowed to perform the requested action.
• Review third-party access paths for implicit trust Reassess vendor integrations, shared workflows, and automation accounts that inherit access to email, code, or cloud resources without tight lifecycle governance.

Key takeaways

• Recurring attack classes in this stop-list point to one underlying issue, which is fragile trust in sessions, delegated access, and AI-connected workflows.
• Supply chain compromise, phishing, and prompt injection are increasingly interchangeable from a governance perspective because each can end in authenticated abuse.
• Teams need a single operating model for identity assurance across human accounts, non-human identities, and AI tool permissions.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Delegated Access: Delegated access is permission granted to one identity to act on behalf of another user, service, or system. In NHI environments, this usually appears in OAuth-connected apps and automation tooling. It is powerful, but it must be tightly scoped and reviewed because it can persist long after the original business need ends.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It is designed for practitioners who need to connect identity control to broader security operations and governance.