SaaS, supply chain and OAuth abuse are converging in 2025

At a glance

What this is: This weekly threat report highlights how AI-assisted reconnaissance, OAuth persistence, signed-driver evasion, and Git exploitation are converging across SaaS, supply chain, and endpoint attack paths.

Why it matters: It matters because identity, secret, and privileged access controls now sit on the fault line between developer tooling, SaaS integrations, and downstream business compromise.

By the numbers:

• The Salesloft Drift breach affected over 700 organisations, showing how a single compromised SaaS integration can cascade across many tenants.
• The Git arbitrary file write flaw was actively exploited on August 26, 2025, which made developer and CI/CD environments immediate targets for attackers.

👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs

Context

The primary security gap in this report is not a single vulnerability but the speed at which trusted software paths are being converted into attack paths. AI-assisted recon, OAuth token abuse, and supply chain tampering all exploit environments where credentials, integrations, and code pipelines are assumed to be trustworthy after initial approval. For IAM and NHI teams, that means the boundary between application trust and identity governance is now operational, not theoretical.

The report also shows how attackers are chaining access across domains that defenders often manage separately. A compromised integration can become persistence, a developer tool can become secret discovery infrastructure, and a signed driver can become a defence-evasion mechanism. That is typical of modern intrusion tradecraft, not an edge case, and it forces identity programmes to treat third-party access and machine credentials as first-class attack surfaces.

Key questions

Q: What fails when OAuth tokens are treated as harmless integration glue?

A: Governance fails because the token is a delegated identity with real authority, not a neutral connector. If teams do not track scope, ownership, expiry, and revocation, a partner compromise can become trusted access into customer data and hidden secrets. The control failure is lifecycle blindness, not just weak authentication.

Q: Why do exposed secrets and tokens get abused so quickly in developer environments?

A: Because attackers now use automation to search code, logs, and environment variables at machine speed. Once a secret appears in a repository, pipeline, or shell history, the time between exposure and abuse can be measured in minutes, not days. That is why secret visibility, rapid revocation, and hard separation of developer tooling matter.

Q: What signs show that SaaS token abuse is becoming a persistence problem?

A: Watch for unexpected app reauthorisations, unusual API query bursts, deleted jobs or logs, and access that continues after normal password resets. Those signals suggest the attacker is operating through delegated trust rather than interactive login. The control question is whether the organisation can revoke the integration cleanly and trace all affected accounts.

Q: Should organisations prioritise token revocation or endpoint hardening first?

A: If the report’s patterns are your concern, token revocation should come first where SaaS persistence or secret theft is active, because those paths preserve attacker access immediately. Endpoint hardening still matters, but it will not contain a live OAuth compromise or a reused developer secret. The right sequence depends on where trust is already exposed.

Technical breakdown

AI-assisted developer reconnaissance in supply chains

Attackers are increasingly using AI CLI tools to accelerate discovery inside compromised development environments. In practice, that means the tooling itself becomes a search layer over repositories, variables, logs, and build artefacts, turning ordinary developer workflows into high-yield credential hunting grounds. The risk is not the model alone, but the fact that AI can compress the time required to locate exposed secrets and map adjacent trust relationships. This is especially dangerous where build systems, developer shells, and package managers all share access to the same token set.

Practical implication: reduce secret exposure in developer environments and treat AI-enabled tooling as part of the attack surface.

OAuth token abuse as a persistence mechanism

OAuth tokens are often treated as convenience artefacts, but in SaaS environments they function as durable delegated access. When an attacker steals those tokens, they can operate through normal application trust without re-entering passwords or triggering some authentication controls. That makes revocation, app allowlisting, and integration lifecycle management central to defence. The problem becomes worse when integrations are reused across Salesforce, email, and collaboration systems, because one token can unlock multiple business processes at once.

Practical implication: inventory delegated SaaS apps continuously and revoke tokens as soon as integration trust looks abnormal.

Signed-driver evasion and control bypass

The driver campaign described in the report shows how attackers can abuse trust in code-signing to bypass endpoint controls. By altering a signed driver in a way that preserves apparent validity, adversaries can evade hash-based blocklists and load code that disables or suppresses security tooling. This is a reminder that signature status alone is not enough when the underlying object has been manipulated or when legacy compatibility creates gaps. Behavioural detection and kernel-level monitoring matter because trust in the signer can be decoupled from trust in the binary’s current state.

Practical implication: validate driver integrity beyond signature checks and monitor for abnormal kernel-level loads.

Threat narrative

Attacker objective: The attacker objective is durable access to business SaaS, development secrets, and endpoint control planes that can be reused for theft, persistence, and disruption.

1. Entry occurs through compromised SaaS integrations, malicious packages, or developer environments that already hold trusted credentials and tokens.
2. Escalation follows when attackers use OAuth reuse, secret discovery, or signed-driver manipulation to gain durable access and bypass ordinary controls.
3. Impact comes from mass exfiltration, persistent SaaS access, ransomware disruption, or endpoint compromise that spreads across business systems.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Trusted integration persistence is becoming the new identity failure mode. OAuth abuse in SaaS environments shows that authentication success no longer guarantees safe access. Once a delegated app token is stolen, the attacker can behave like an authorised system inside the trust boundary, which makes token lifecycle governance as important as user authentication. IAM teams should treat delegated SaaS access as a governed identity class, not a background integration detail.

AI-assisted reconnaissance turns secret exposure into a time problem. The report’s AI-assisted developer recon example matters because discovery speed now compresses the window between secret exposure and abuse. That means the decisive control is not only secret storage, but how quickly exposed credentials can be found, revoked, and invalidated across build and developer environments. The named concept here is recon-to-exfiltration compression, where automation shortens the interval between leak discovery and attacker use. Practitioners should assume that exposed secrets may be weaponised before standard review cycles begin.

Endpoint trust controls still fail when code-signing becomes a disguise. The signed-driver evasion example shows a classic governance blind spot: defenders often trust signed code too much when the real control problem is binary integrity and runtime behaviour. That is relevant to broader identity governance because privileged code paths can disable the tools that enforce access rules. Security teams should map this to endpoint attestation and integrity verification, not just malware detection.

Supply chain compromise now spans identity, data, and continuity outcomes. The report connects developer tooling compromise, SaaS token theft, and ransomware into one operational picture. That matters for the market because identity governance, data protection, and resilience controls can no longer be treated as separate programmes when the same adversary path crosses all three. Practitioners should expect board-level pressure to show cross-domain containment, not isolated point fixes.

Attack surface management must now include delegated trust and AI tooling. The report signals that exposure management is no longer limited to internet-facing assets or known vulnerabilities. It also includes which AI tools can inspect sensitive environments, which integrations can act on behalf of users, and which machine credentials can be reused silently. That is a stronger governance problem than traditional patching, and it pushes IAM teams toward continuous trust review.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
• From our research: 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to The State of Secrets in AppSec.

What this signals

Recon-to-exfiltration compression: this report shows why the period between exposure and abuse is shrinking across developer, SaaS, and endpoint environments. Teams should expect AI-assisted search, token theft, and supply chain abuse to occur before conventional review cycles finish, which means detection and revocation have to run continuously rather than as periodic hygiene.

Identity programmes will increasingly be judged on their ability to govern delegated trust, not just human login events. That pushes SaaS integration reviews, machine credential inventory, and secret discovery into the same operational plane as privileged access management and incident response.

Practitioners should align this work with the MITRE ATT&CK Enterprise Matrix and the OWASP Non-Human Identity Top 10, because the report’s attack patterns map directly to credential access, persistence, and lateral movement across trusted systems.

For practitioners

• Inventory delegated SaaS integrations Map every OAuth-connected application to the business systems it can reach, then remove stale or unowned integrations before attackers can reuse those trust paths.
• Reduce secret exposure in developer environments Strip environment variables, tokens, and credentials from build logs, shells, and package workflows, and restrict where AI tools can search code or local state.
• Add integrity checks for signed drivers Validate driver provenance, runtime state, and hash consistency instead of relying only on signature status, especially on endpoints with legacy compatibility exceptions.
• Prioritise continuous containment drills Test how quickly teams can revoke OAuth tokens, isolate affected SaaS tenants, and block malicious package paths when compromise appears in development or collaboration tools.

Key takeaways

• Attackers are now chaining AI-assisted reconnaissance, OAuth abuse, and supply chain compromise to reach trusted systems faster than many teams can respond.
• Secret exposure remains a control failure with a long remediation tail, which gives adversaries more time than defenders usually assume.
• Identity governance has to extend into delegated SaaS trust, developer tooling, and runtime integrity if organisations want to contain these attack paths.

Key terms

• OAuth Token Abuse: The misuse of valid OAuth access or refresh tokens to gain unauthorized access without repeating the original login. In NHI terms, the token becomes the credential, so the real control problem is issuance, storage, scope, and revocation rather than passwords alone.
• Secret exposure window: A secret exposure window is the period between when a credential becomes visible to an attacker and when it is detected, revoked, or rotated. In CI/CD environments that window can be extremely short, which is why detection speed and identity-linked revocation matter as much as storage hygiene.
• Signed-driver evasion: Signed-driver evasion is a technique where an attacker manipulates a code-signed driver so it still appears legitimate enough to bypass basic trust checks. The tactic exploits overreliance on signature status while hiding malicious runtime behaviour that can disable security tooling or enable persistence.

What's in the full article

FireCompass's full weekly report covers the operational detail this post intentionally leaves for the source:

• The incident-by-incident breakdown of each campaign and how the attack paths differed across SaaS, supply chain, and endpoint targets.
• The practical CISO response list for Git exploitation, OAuth token abuse, and driver evasion, including the sequence of containment actions.
• The source article's observations on why AI tools changed reconnaissance speed and why standard patching alone did not address the attack patterns.
• The report's broader week-over-week threat context for teams tracking emerging techniques across development, identity, and resilience operations.

👉 FireCompass's full post covers the attack chains, impact details, and defender takeaways behind each incident.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and identity lifecycle fundamentals. It helps practitioners translate identity controls into operational governance across modern enterprise environments.