Notifications
Clear all
Topic starter
02/08/2026 12:10 pm
TL;DR: Holiday phishing, infostealer distribution, credential attacks, and React2Shell exploitation are converging into a single operational pattern that targets identity, session data, and exposed services, while MITRE ATT&CK mappings show the breadth of abuse, according to Anomali’s Cyber Watch. The practical lesson is that identity telemetry, user execution controls, and rapid exposure reduction matter more than chasing each malware family in isolation.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on SantaStealer, Christmas scams, React2Shell, and related threats
Questions worth separating out
Q: How should security teams reduce breach risk from stolen credentials?
A: Security teams should reduce credential lifetime, remove stale secrets from code and tooling, and make access revocation faster than attacker reuse.
Q: Why do phishing campaigns still work even when organisations have security tools in place?
A: They often succeed before tooling has a chance to intervene.
Q: What should teams do when an exposed web application has likely been compromised?
A: Assume the host may have exposed secrets, tokens, and metadata, then contain the identity blast radius by revoking affected credentials, hunting for persistence, and reviewing outbound connections.
Practitioner guidance
- Harden browser and session artefact exposure Restrict where passwords, cookies, and session tokens are stored, and review endpoint controls that allow infostealers to harvest browser data without resistance.
- Prioritise phish-resistant login paths Use MFA methods that resist replay and automate checks for anomalous login attempts, especially on remote access portals and high-value accounts.
- Treat ISO files and mounted media as executable risk Alert on mounted disk images, archive execution, and unusual child processes so finance and accounting users are not the only line of defence.
What's in the full analysis
Anomali's full article covers the operational detail this post intentionally leaves for the source:
- MITRE ATT&CK mappings for each campaign and exploit pattern.
- The specific malware behaviours and payload delivery paths tied to each threat item.
- The exact telemetry and detection cues referenced in the analyst commentary.
- The broader weekly Cyber Watch context around how these incidents fit together.
👉 Read Anomali's Cyber Watch roundup on phishing, infostealers, and exploit chains →
Identity theft, malware delivery, and exploit chaining: what teams should watch?
Explore further
02/08/2026 1:14 pm
Identity theft is now the common denominator across malware, phishing, and exploit activity. The article’s examples are different delivery paths, but the security outcome is the same: attackers want working credentials, cookies, or authenticated sessions. That means identity teams should read these stories as one control problem, not several disconnected threats. The practitioner conclusion is that identity artefact protection must be treated as a core defensive layer.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
A question worth separating out:
Q: What is the difference between malware delivery and identity compromise?
A: Malware delivery is the path into the environment, while identity compromise is the point where stolen credentials, session artefacts, or privileged access become usable. A team can remove the malware and still remain exposed if the attacker kept a valid session or harvested secrets before detection.
👉 Read our full editorial: Phishing, infostealers, and exploit chains are converging on identity
