Notifications
Clear all
Topic starter
06/09/2026 6:21 pm
TL;DR: The late-August threat landscape was defined by AI-assisted developer reconnaissance, OAuth token abuse, signed-driver evasion, and active exploitation of Git and SaaS supply chain weaknesses, according to FireCompass’s weekly report, with more than 700 organisations affected by the Salesloft Drift breach. The pattern is clear: attacker speed, persistence, and trust abuse are now outpacing quarterly control cycles.
NHIMG editorial — based on content published by FireCompass: Weekly Report on new hacking techniques and critical CVEs for 09 Sep to 15 Sep, 2025
By the numbers:
- The Salesloft Drift breach affected over 700 organisations, showing how a single compromised SaaS integration can cascade across many tenants.
- The Git arbitrary file write flaw was actively exploited on August 26, 2025, which made developer and CI/CD environments immediate targets for attackers.
Questions worth separating out
Q: What fails when OAuth tokens are treated as harmless integration glue?
A: Governance fails because the token is a delegated identity with real authority, not a neutral connector.
Q: Why do exposed secrets and tokens get abused so quickly in developer environments?
A: Because attackers now use automation to search code, logs, and environment variables at machine speed.
Q: What signs show that SaaS token abuse is becoming a persistence problem?
A: Watch for unexpected app reauthorisations, unusual API query bursts, deleted jobs or logs, and access that continues after normal password resets.
Practitioner guidance
- Inventory delegated SaaS integrations Map every OAuth-connected application to the business systems it can reach, then remove stale or unowned integrations before attackers can reuse those trust paths.
- Reduce secret exposure in developer environments Strip environment variables, tokens, and credentials from build logs, shells, and package workflows, and restrict where AI tools can search code or local state.
- Add integrity checks for signed drivers Validate driver provenance, runtime state, and hash consistency instead of relying only on signature status, especially on endpoints with legacy compatibility exceptions.
What's in the full article
FireCompass's full weekly report covers the operational detail this post intentionally leaves for the source:
- The incident-by-incident breakdown of each campaign and how the attack paths differed across SaaS, supply chain, and endpoint targets.
- The practical CISO response list for Git exploitation, OAuth token abuse, and driver evasion, including the sequence of containment actions.
- The source article's observations on why AI tools changed reconnaissance speed and why standard patching alone did not address the attack patterns.
- The report's broader week-over-week threat context for teams tracking emerging techniques across development, identity, and resilience operations.
👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs →
OAuth persistence and supply chain abuse: are your controls keeping up?
Explore further
06/09/2026 6:22 pm
Trusted integration persistence is becoming the new identity failure mode. OAuth abuse in SaaS environments shows that authentication success no longer guarantees safe access. Once a delegated app token is stolen, the attacker can behave like an authorised system inside the trust boundary, which makes token lifecycle governance as important as user authentication. IAM teams should treat delegated SaaS access as a governed identity class, not a background integration detail.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
Q: Should organisations prioritise token revocation or endpoint hardening first?
A: If the report’s patterns are your concern, token revocation should come first where SaaS persistence or secret theft is active, because those paths preserve attacker access immediately. Endpoint hardening still matters, but it will not contain a live OAuth compromise or a reused developer secret. The right sequence depends on where trust is already exposed.
👉 Read our full editorial: SaaS, supply chain and OAuth abuse are converging in 2025
