Loading story…
CISA and NIST released NIST IR 8587, Protecting Tokens and Assertions from Forgery, Theft, and Misuse, with implementation recommendations for federal agencies and cloud service providers using tokens in single sign-on, identity federation, API access, and workload-identity environments. Developed through CISA’s Joint Cyber Defense Collaborative in support of Executive Order 14306, the final report addresses attacks involving token forgery, theft, replay, weak validation, compromised signing keys, and misuse—risks that can allow attackers to bypass multifactor authentication.
The guidance calls for protected signing-key management, rigorous token verification, short validity periods, credential scoping, revocation and replay controls, sender-constrained tokens, and continuous monitoring. It also covers token exposure in CI/CD pipelines, machine-to-machine and agentic-AI use cases, and preparation of public-key infrastructure for post-quantum cryptographic migration; the final version incorporates feedback from nearly 250 public comments and more than 20 contributors.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
CISA and NIST released NIST Interagency Report 8587, “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” with implementation recommendations for federal agencies and cloud service providers. The final guidance covers protections for tokens used in single sign-on, federation, APIs, and workload identities, including signing-key management, validation, lifecycle, replay resistance, and monitoring controls.
NIST and CISA collected feedback on the developing token and assertion security guidance through a public webinar, alongside Joint Cyber Defense Collaborative engagement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecsrc.nist.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Organizations are increasingly challenged by the rapid proliferation of non-human identities (NHIs), such as service accounts, API keys, digital certificates, access tokens, automated bots, IoT devices, and AI agents. More than half of enterprises surveyed express uncertainty about their ability to secure these NHIs, highlighting a significant gap between the adoption of automated digital identities and the maturity of tools and processes to protect them. The complexity and diversity of NHIs, which now form the backbone of modern digital infrastructure, have outpaced traditional identity and access management strategies, leaving organizations exposed to new risks. The exponential growth of NHIs, especially in cloud-native and automated environments, has led to a situation where non-human accounts vastly outnumber human users. This expansion, combined with issues like "secrets sprawl"—where credentials are scattered across codebases and pipelines—creates opportunities for account hijacking, privilege escalation, and lateral movement by threat actors. Security experts emphasize the need for unified visibility, consistent identity policies, and automated responses to address these risks, particularly as NHIs and AI agents become more integral to business operations and the attack surface continues to expand.
Jun 29, 2026
Cybercriminals are increasingly targeting identity credentials rather than exploiting software vulnerabilities, fueling a thriving underground market for stolen usernames, passwords, tokens, and access rights. This so-called 'identity economy' has become a central pillar of the cybercrime ecosystem, with credentials being traded much like commodities on illicit marketplaces. Financial services and healthcare organizations remain prime targets, but the threat is universal, as evidenced by a 2023 study indicating that 95% of enterprises experienced some form of identity fraud. The financial impact is significant, with banks losing an average of $310,000 per incident and high-profile breaches, such as the $1.5 billion theft from a cryptocurrency exchange by North Korean hackers, underscoring the scale of the problem. Attackers employ a mix of traditional and modern techniques, including phishing, man-in-the-middle attacks, session hijacking, and social engineering, with AI now making phishing attempts more convincing and attacks more efficient. The rise of AI has supercharged these traditional attacks, enabling threat actors to accelerate reconnaissance and discovery phases by up to tenfold. AI is also being weaponized in new ways, such as compromising organizations' own AI instances to exfiltrate sensitive data or subvert security defenses, a tactic likened to 'living-off-the-land' but with AI agents. The cybercrime-as-a-service model further lowers the barrier to entry, allowing even less sophisticated actors to launch credential stuffing, fraudulent registration, and synthetic identity attacks at scale. To counter these evolving threats, experts emphasize the need for robust identity controls, particularly for managing access by both human users and AI agents. Industry leaders advocate for open standards, such as the draft Cross App Access extension to OAuth, which aims to provide centralized, standardized authorization for AI-driven and app-to-app interactions. The IPSIE working group and protocols like MCP and A2A are also working to establish consistent identity security profiles and authentication frameworks to safely manage AI agents' access and communication. With quantum computing on the horizon, the long-term value of stolen credentials is expected to rise, as encrypted data from past breaches could eventually be decrypted, turning old compromises into renewed threats. Multi-factor authentication (MFA) remains a critical defense, but attackers are adapting with tactics like MFA fatigue, where users are bombarded with prompts until they approve access. Insiders continue to pose risks, and the combination of human error and advanced AI-driven attacks makes comprehensive identity security more urgent than ever. The consensus among security professionals is that industry alignment on open standards and the implementation of strict access controls are essential to securing the future of digital identity in an AI-driven threat landscape.
Jun 29, 2026
CISA has revised its **Insider Threat Mitigation Guide** with updated case studies, statistics, and resources to help security, HR, and organizational leaders build or assess insider-risk programs at any maturity level. The guidance addresses risks created by hybrid and remote work, adverse employee separations, and AI-enabled manipulation and deception, while broadening its scope from data protection to physical security, violence prevention, access control, and visitor screening. The agency urges organizations to identify behavioral warning signs and improve preparedness and early-risk detection because trusted users, contractors, vendors, machine identities, and AI agents can misuse, compromise, or unintentionally expose organizational assets through otherwise legitimate credentials and workflows. Recommended measures include least-privilege and just-in-time access, identity and behavioral analytics, governance for non-human identities, adaptive controls for high-risk actions, data-loss prevention, and continuous security education.
Sep 10, 2026