A spread pattern where stolen automation credentials are reused to publish, sign, or deploy malicious software from trusted accounts. This turns a single compromise into repeated downstream exposure and is one of the clearest signs that a supply chain attack has crossed from theft into expansion.
Expanded Definition
Token-driven propagation describes a compromise pattern in which an attacker does not need to pivot through traditional endpoint malware or interactive login. Instead, the attacker reuses valid automation tokens, OAuth grants, API keys, or signing credentials to keep publishing, deploying, or authenticating as a trusted system. In NHI security, that makes the token itself the propagation vehicle.
Definitions vary across vendors on whether the term should apply only to software delivery pipelines or more broadly to any downstream action taken with stolen machine credentials. NHI Management Group treats it broadly: if a trusted token is reused to extend malicious reach across build, release, package, or integration workflows, it fits the pattern. That distinction matters because the risk is not just credential theft, but durable trust abuse inside systems that were designed to automate. The concept aligns closely with supply chain compromise language used in the NIST Cybersecurity Framework 2.0, but token-driven propagation is more specific to non-human identities and their operational blast radius. It is often discussed alongside token replay, secret sprawl, and trust propagation, yet it is not identical to any one of those terms. The most common misapplication is treating a single leaked token as a one-time access issue, which occurs when teams ignore its ability to repeatedly trigger trusted automation.
Examples and Use Cases
Implementing controls against token-driven propagation rigorously often introduces tighter release friction, requiring organisations to weigh automation speed against the cost of shorter token lifetimes, stronger rotation, and more constrained deployment permissions.
- A compromised CI/CD runner uses an exposed deploy token to publish a malicious package, then repeats the action each time the pipeline runs, similar to patterns documented in the Guide to the Secret Sprawl Challenge.
- An attacker reuses a stolen OAuth refresh token to access SaaS integrations and push fraudulent updates from a trusted automation account, as seen in the Salesloft OAuth token breach.
- A build system signing key is reused after theft to sign tampered artifacts, allowing malicious releases to inherit the organization’s normal trust posture.
- A leaked API key in documentation or chat is used to trigger repeated deployments across environments, even after the original incident is discovered, echoing the exposure patterns in the MongoBleed breach.
- External research from the NIST Cybersecurity Framework 2.0 supports treating identity misuse as a core risk, not just a code or malware issue.
In practice, token-driven propagation is most visible where automation has broad write access, weak revocation discipline, and long-lived credentials that outlast the incident response window.
Why It Matters in NHI Security
Token-driven propagation is dangerous because it collapses the boundary between compromise and execution. Once a valid NHI token is stolen, the attacker can continue operating as a trusted identity, often bypassing controls that focus on usernames, devices, or human authentication events. That is why the problem is not only exposure, but reuse under legitimate trust conditions. In the 2025 State of NHIs and Secrets in Cybersecurity, Entro Security reported that 44% of NHI tokens are exposed in the wild and 91% of former employee tokens remain active after offboarding. Those figures show how persistent token risk becomes when lifecycle governance is weak. The State of Secrets Sprawl 2026 also found that 59% of compromised machines in a major 2025 supply chain attack were CI/CD runners rather than personal workstations, underscoring how automation environments are now prime propagation targets. Organisations typically encounter the operational consequences only after a malicious release, credential-abuse alert, or unexpected downstream compromise, at which point token-driven propagation becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Covers improper secret and token handling that enables propagation. |
| NIST CSF 2.0 | PR.AC-1 | Identity and access control failures are central to token reuse abuse. |
| NIST Zero Trust (SP 800-207) | SC-7 | Zero Trust limits implicit trust that stolen tokens exploit. |
| NIST SP 800-63 | AAL2 | Assurance levels help frame the strength needed for sensitive automated access. |
| CSA MAESTRO | Addresses agentic workflows where tokens can extend tool execution authority. |
Shorten token lifetimes, rotate secrets, and remove reusable automation credentials from high-trust paths.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
