Notifications
Clear all
Topic starter
02/08/2026 12:04 pm
TL;DR: Browser-extension phishing, real-time credential harvesting, and AI credential abuse are recurring attack patterns in Anomali’s Cyber Watch roundup, with attackers exploiting trusted login flows, compromised accounts, and exposed secrets to reach downstream systems. The lesson is that identity controls must cover how credentials are captured, used, and abused, not just how they are issued.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on Stanley malware, ShinyHunters, WhatsApp, and related threats
By the numbers:
- Around 100 organizations were targeted across technology, finance, healthcare, and logistics sectors in the ShinyHunters-linked Okta campaign.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to Astrix Security & CSA.
Questions worth separating out
Q: What breaks when browser extensions are allowed to modify login pages?
A: Browser extensions can replace or overlay a legitimate login surface while the address bar still shows the correct site, which defeats visual trust cues.
Q: Why do live phishing campaigns defeat traditional identity review processes?
A: They capture credentials, one-time codes, or approvals and use them immediately, often before logs are reviewed or alerts are triaged.
Q: What do security teams get wrong about credential theft in endpoint incidents?
A: Teams often focus on the infected device and miss the identity blast radius.
Practitioner guidance
- Govern browser extensions as enterprise software Inventory installed extensions, restrict installation to an allow-list, and review permissions that allow page modification, credential access, or navigation control.
- Replace in-band authentication with phishing-resistant controls Move privileged users, admins, and support workflows to phishing-resistant authentication where possible, and reduce reliance on push approvals or codes that can be captured during a live session.
- Investigate credential exposure as a time-critical event Treat exposed keys, tokens, and browser-saved credentials as an active incident, not a routine hygiene issue.
What's in the full analysis
Anomali's full post covers the operational detail this post intentionally leaves for the source:
- The original article includes the specific campaign descriptions and linked reporting for each threat item, which is useful if you are tracking source intelligence rather than governance implications.
- It also preserves the MITRE ATT&CK references and incident context around each threat, helping analysts map observations to known tactics and techniques.
- The source post gives the vendor’s full analyst commentary on why each event matters across browser abuse, credential harvesting, mobile malware, and supply chain compromise.
- If you need to compare the roundup against your own telemetry or alerting rules, the source article is the place to extract the precise event wording and references.
👉 Read Anomali’s Cyber Watch roundup on browser phishing, credential theft, and mobile malware →
Browser extension phishing and AI credential abuse: what should teams do?
Explore further
02/08/2026 1:10 pm
Browser trust has become an identity control surface. The Stanley-style extension attack shows that browser chrome can no longer be treated as a reliable boundary between legitimate and malicious login activity. If an extension can alter what the user sees after navigation, then the trust model for web authentication has already shifted. IAM and security teams need to treat browsers, extensions, and login pages as a linked policy domain, not as separate user convenience layers.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, according to The State of Non-Human Identity Security.
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37%.
A question worth separating out:
Q: Who is accountable when a leaked NHI credential is reused in production?
A: Accountability should sit with the team that owns the workload and the identity lifecycle, not with the person who discovered the leak. Governance needs clear ownership, a revocation path, and audit evidence showing when the secret was issued, used, and retired. NIST CSF and OWASP NHI both reinforce that lifecycle control is part of the control environment.
👉 Read our full editorial: Browser extension phishing and AI credential abuse raise NHI risk
