Loading story…
Organizations are facing increasing risks from the proliferation of hardcoded credentials, access tokens, and API keys, which are often exposed in code repositories and other unexpected locations. Recent high-profile attacks, such as those targeting Salesforce customers through stolen OAuth tokens, have demonstrated how attackers exploit poor secret management practices to gain unauthorized access to sensitive systems. Security experts warn that both cybercriminals and nation-state actors are capitalizing on this widespread issue, urging organizations to improve their secret hygiene and reduce over-privileging of credentials.
In response to these threats, enterprises are moving away from static secrets and adopting managed identities and platform-native identity services. This transition is driven by the need to eliminate manual credential management, reduce the risk of credential leakage, and streamline authentication across complex, multicloud environments. Case studies show that organizations implementing managed identities experience significant reductions in time spent managing credentials and improved security posture, highlighting the importance of modernizing identity and access management strategies to counter evolving attacker tactics.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
Attackers breached Red Hat Consulting and gained access to thousands of private repositories along with client secrets. The incident highlighted the broader risk of sensitive data sprawl and poor secret management practices.
A campaign targeted Salesforce environments by abusing OAuth tokens stolen from a third-party application, demonstrating how exposed secrets outside traditional code repositories can enable downstream compromise. Cloudflare was identified among the affected companies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
github.blog
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are increasingly challenged by the rapid proliferation of non-human identities (NHIs), such as service accounts, API keys, digital certificates, access tokens, automated bots, IoT devices, and AI agents. More than half of enterprises surveyed express uncertainty about their ability to secure these NHIs, highlighting a significant gap between the adoption of automated digital identities and the maturity of tools and processes to protect them. The complexity and diversity of NHIs, which now form the backbone of modern digital infrastructure, have outpaced traditional identity and access management strategies, leaving organizations exposed to new risks. The exponential growth of NHIs, especially in cloud-native and automated environments, has led to a situation where non-human accounts vastly outnumber human users. This expansion, combined with issues like "secrets sprawl"—where credentials are scattered across codebases and pipelines—creates opportunities for account hijacking, privilege escalation, and lateral movement by threat actors. Security experts emphasize the need for unified visibility, consistent identity policies, and automated responses to address these risks, particularly as NHIs and AI agents become more integral to business operations and the attack surface continues to expand.
Jun 29, 2026
Security teams are reporting a growing loss of certainty in **identity and access management** as enterprises accumulate large numbers of poorly governed identities across cloud platforms, CI/CD pipelines, and automation frameworks. The reporting describes this as **identity sprawl**—a systemic drift where identity creation, usage, and governance fall out of sync with traditional lifecycle and access review models designed for predictable human users. A key driver is the rapid proliferation of **non-human identities** (service accounts, APIs, workloads, and increasingly autonomous/agentic systems) that can be created and discarded in seconds, outpacing visibility and privilege management controls. The articles cite investigations and threat analysis indicating attackers are **weaponizing exposed identity data at scale**, and report survey data that **72% of identity leaders** say the threat level of identity-related attacks increased or stayed the same over the past year.
Jun 29, 2026
Enterprises are facing significant challenges in managing the rapidly expanding attack surface created by both human and non-human identities. Reports highlight that permissions and entitlements are growing at a pace that outstrips the ability of security teams to maintain oversight, with hundreds of millions of active entitlements and billions of permissions in large organizations. This complexity leads to persistent blind spots, including dormant and orphaned accounts that remain active and pose a risk for misuse, as well as the accumulation of 'identity debt' where excessive and unused access quietly increases risk over time. Non-human identities (NHIs), such as machine accounts, tokens, and keys, are becoming increasingly critical in cloud environments. Effective management of these NHIs is essential for reducing risk, improving compliance, and increasing operational efficiency. Automation and centralized secrets management are emphasized as key strategies for maintaining visibility and control over both human and non-human identities, helping organizations address security gaps and reduce operational costs associated with manual oversight and credential management.
Jun 29, 2026