Weekly threat escalation shows credential abuse and EDR evasion

At a glance

What this is: This weekly threat report tracks five major attack patterns, from Hyper-V based EDR evasion to zero-click spyware and large-scale data theft.

Why it matters: It matters to IAM and NHI practitioners because several of the incidents depend on stolen tokens, exposed credentials, or prolonged access that identity governance and privilege controls should limit but often do not.

By the numbers:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs

Context

Credential abuse now sits inside a broader attack economy that blends stealth, extortion, and supply chain compromise. In this report, FireCompass pulls together incidents that show how quickly exposed secrets, session tokens, and privileged access can turn into operational intrusion across banking, retail, media, and endpoint environments.

For identity practitioners, the relevant pattern is not just volume but dwell-time advantage. Once attackers obtain valid access, whether through infostealer tokens, exposed API credentials, or compromised accounts, they can avoid noisy exploitation and move through systems as trusted users or services rather than obvious malware.

The starting position described in this weekly report is increasingly typical, not exceptional, for enterprises that still rely on fragmented secrets management and incomplete runtime visibility.

Key questions

Q: What breaks when session tokens are stored insecurely?

A: If tokens are readable by browser scripts or are not rotated and revoked correctly, a single XSS issue or stolen token can preserve attacker access after login. Secure session design requires short-lived access tokens, protected storage, regeneration on authentication, and working revocation across logout and account changes.

Q: Why do exposed secrets keep creating risk after they are detected?

A: Because detection does not stop a credential from remaining valid, and exposed values often persist in repositories, logs, backups, and configuration files. Risk remains until revocation, cleanup, and dependency removal are complete, which is why exposed secrets are really lifecycle failures rather than alerting failures.

Q: How should security teams reduce EDR blind spots in virtualised environments?

A: Teams should monitor the creation and use of local virtual machines, not just host processes, because attackers can hide execution inside legitimate virtualisation layers. Coverage should include platform events, suspicious NAT use, and out-of-band network patterns. If the sensor cannot see the execution boundary, the attacker controls the boundary.

Q: How can organisations stop service account abuse after a compromise?

A: Organisations should classify service accounts, API keys, and third-party credentials by business purpose, then enforce expiry, rotation, and immediate offboarding when the purpose ends. The key control is not just rotation frequency. It is eliminating persistent trust that outlives the system or vendor relationship.

Technical breakdown

Hyper-V abuse turns platform features into an EDR blind spot

Attackers can abuse native virtualisation features to hide execution from endpoint tooling rather than fight the EDR product directly. In the Hyper-V case, a small guest VM ran the malicious payload outside the host operating system’s normal inspection boundary, while NAT made traffic appear to originate from the legitimate host. This is a control evasion pattern, not just malware hiding. The practical issue is that endpoint visibility assumptions fail when the attacker moves execution into infrastructure the sensor cannot observe.

Practical implication: extend detection and policy coverage to virtualisation features and VM creation events, not just process activity inside the host OS.

Infostealer to session token reuse is a privilege problem

Infostealer malware often targets browser storage, where session tokens and cached credentials can be reused without re-entering passwords. Once the attacker has a valid token, authentication controls may still see a legitimate session rather than a theft event. That is why token theft behaves differently from password compromise. The real weakness is the absence of session binding, token lifecycle controls, and anomaly checks that tie access to device, location, or behaviour changes.

Practical implication: treat session tokens as high-value credentials and enforce revocation, binding, and short-lived access where possible.

Cloud and supply chain compromise depend on exposed secrets and weak offboarding

The report’s bank, retail, and software examples all point to the same mechanism: once valid credentials or trusted access paths are obtained, attackers can remain quiet, extract data, and escalate laterally with little friction. In cloud and SaaS environments, this is often enabled by overbroad service access, forgotten tokens, or stale third-party accounts. The security failure is lifecycle control, not simply malware sophistication. If credentials outlive the business need that created them, the attack surface remains open.

Practical implication: combine access reviews with automated revocation for service accounts, API keys, and third-party access paths.

Threat narrative

Attacker objective: The objective is to obtain durable trusted access that can be used for stealthy theft, extortion, surveillance, or follow-on compromise.

1. Entry began with exposed or reused credentials, browser session tokens, or trusted access paths that gave attackers a legitimate foothold.
2. Escalation followed through hidden virtual machines, valid sessions, or extended dwell time that let attackers avoid endpoint detection and preserve access.
3. Impact came from data theft, ransomware coordination, spyware collection, and broader supply chain and identity exposure across multiple sectors.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Valid access is now the preferred attacker primitive: The weekly pattern here is not exotic malware alone but the reuse of legitimate access paths, whether through stolen session tokens, exposed credentials, or trusted integrations. That shifts the defensive problem from perimeter blocking to lifecycle governance of credentials, sessions, and third-party access. OWASP Non-Human Identity Top 10 and NIST SP 800-53 Rev 5 both point to the same control reality: access must be short-lived, observable, and revocable. Practitioners should treat every durable token as an intrusion waiting to happen.

EDR blindness is increasingly a design issue, not a tuning issue: Hyper-V based concealment shows how attackers can move execution into spaces the host sensor does not fully inspect. This is a broader lesson for endpoint and cloud teams because legitimate platform features can become attacker hiding places when controls assume inspection at the process layer only. MITRE ATT&CK captures this as evasion and persistence through legitimate mechanisms. Practitioners should map security coverage to platform boundaries, not just to malware signatures.

Secrets fragmentation remains a structural weakness: The report’s credential-heavy incidents reinforce a named concept we call credential dwell amplification, where fragmented secrets estates and slow remediation extend the usable life of stolen access. When secrets are spread across multiple managers, tokens, and SaaS sessions, recovery becomes operationally slow and attackers gain more time than defenders assume. That is why secret lifecycle governance and offboarding discipline matter more than isolated rotation events. Practitioners should reduce the number of live trust domains and shorten the time any one secret can remain useful.

AI-assisted malicious tooling lowers the barrier, but governance still decides blast radius: The ransomware extension example shows that AI can accelerate malware development, yet the decisive advantage still comes from exposed tokens, poor separation of duties, and weak repository hygiene. Agentic or AI-assisted workflows do not change the underlying governance problem: if secrets are reachable in code, browser storage, or CI paths, they can be harvested and reused. AI security and NHI governance now intersect directly in the same control plane. Practitioners should align code, secret, and identity controls as one risk surface.

Sector-wide compromise is becoming more interconnected: Banking, retail, and media incidents in the same week show that attackers are optimising for scalable access and secondary monetisation, not only immediate encryption. That makes identity and access governance a resilience issue, not just an IAM hygiene issue. NIST Cybersecurity Framework alignment should focus on protective identity controls, continuous monitoring, and recovery of trust relationships after compromise. Practitioners should assume cross-sector credential reuse and design for containment, not just detection.

From our research:

• Organisations maintain an average of 6 distinct secrets manager instances, creating fragmentation that undermines centralised control, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• Follow 52 NHI Breaches Analysis to see how exposed credentials and token reuse translate into real intrusion patterns.

What this signals

Credential dwell amplification: the more fragmented the secrets estate, the longer attackers can keep valid access alive before defenders can revoke it. That makes consolidation and lifecycle governance a resilience issue, not an administrative preference.

The operational signal for identity teams is clear. Session tokens, API keys, and service accounts now behave like interchangeable intrusion paths unless they are tightly bound to purpose, time, and context. The next control maturity step is not more inventory. It is faster trust destruction after compromise.

For practitioners

• Harden virtualisation visibility Monitor Hyper-V and other local virtualisation events as part of endpoint detection, and alert on unexpected guest VM creation, NAT reuse, and hidden execution paths.
• Revoke and bind session tokens Shorten session lifetime, bind tokens to device or context where possible, and trigger revocation when infostealer indicators, impossible travel, or token reuse appear.
• Reduce secrets fragmentation Inventory all secrets manager instances, SaaS tokens, and service credentials, then consolidate ownership so no credential estate depends on six disconnected control planes.
• Automate third-party offboarding Tie access removal to contract end, project closure, or vendor inactivity so API keys, service accounts, and privileged integrations are revoked before they become stale trust paths.
• Map exposed secrets to attack paths For every leaked key or token, predefine the systems it can reach, the logs that can confirm use, and the containment step needed before attackers expand laterally.

Key takeaways

• This weekly threat window shows that attackers now win through legitimate access paths as often as through payload sophistication.
• Session tokens, exposed secrets, and hidden execution layers create dwell time that weakens both endpoint and identity controls.
• Reducing fragmentation, shortening trust lifetimes, and automating revocation are the controls most likely to change the outcome.

Key terms

• Credential Dwell Amplification: The extension of attacker access time caused by fragmented secrets, slow revocation, and weak session controls. It describes how a single leaked token or key can remain usable long enough for attackers to move, harvest, and exfiltrate before defenders can contain the compromise.
• Session Token Reuse: Session token reuse is the abuse of an already authenticated session to avoid a fresh login or MFA challenge. It matters because the attacker can inherit trust from the original user session, which makes suspicious access look like ordinary activity unless correlated with other signals.
• Virtualisation Evasion: A technique where malware or attacker tooling runs inside a legitimate virtual machine or similar isolated layer to evade endpoint inspection. The host may appear clean while malicious activity occurs outside the sensor’s normal visibility boundary, forcing defenders to monitor the platform layer as well as the process layer.
• Secrets Fragmentation: Secrets fragmentation occurs when credentials are spread across multiple tools, environments, or ownership boundaries. It weakens central control because no single team can reliably see every secret, enforce consistent rotation, or prove that all exposures have been removed.

What's in the full article

FireCompass's full blog covers the operational detail this post intentionally leaves for the source:

• Chronology and technical breakdown of each attack chain across the week, including the Hyper-V evasion sequence and zero-click spyware delivery path.
• Expanded description of the financial-sector and retail breaches, including attacker dwell time, exfiltration scope, and public disclosure milestones.
• The report’s dark web intelligence on credential trafficking, initial access brokers, and active exploit trading.
• Source screenshots, technical indicators, and breach context that implementation teams can use to validate their own monitoring assumptions.

👉 FireCompass's full post covers the attack chains, breach scope, and dark web threat patterns in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance and secrets management for practitioners who need to secure service accounts, tokens, and workload access. It helps security teams translate identity policy into operational control across modern environments.