Emergency Data Request abuse just cost a major fintech its customers’ financial data. A malicious browser extension silently harvested OAuth tokens from 31,000 users. And a CVSS 10 GitLab flaw is exposing CI/CD secrets to unauthenticated attackers. Three stories, one theme: identity validation failures - at the process level, the token level, and the API level.

In the News

Revolut Handed Customer Data to Fraudsters via Fake Emergency Data Request

Revolut disclosed customer financial data to fraudsters who submitted fake Emergency Data Requests through a compromised legitimate government email account. The stolen data was subsequently used to target victims in cryptocurrency impersonation scams, according to The Record.

Emergency Data Requests exist so law enforcement can obtain information without a court order during imminent threats to life. The mechanism is built on trust - the receiving company assumes the request is legitimate because it arrives from a verified government domain. Threat actors have learned to exploit that trust by compromising government email accounts first, then weaponizing the EDR process against technology companies that lack callback verification procedures.

This is the second major EDR abuse incident in six months. The attack vector does not require any technical sophistication against the target - no exploit code, no credential stuffing, no malware. The identity failure is procedural: the requesting entity’s identity was validated by email domain alone, which is insufficient when the email account itself is compromised.

What defenders should do: Organizations that process law enforcement data requests need documented callback verification to a known-good number at the requesting agency - not a number provided in the request itself. Every emergency disclosure should generate an auditable record reviewed by legal within 24 hours. Treat EDR processing accounts as privileged access and enforce phishing-resistant authentication on them.

Malicious Twitch Extension Exfiltrates OAuth Tokens from 31K Users

A browser extension targeting Twitch users harvested live OAuth session tokens and forwarded them to proxy servers linked to a Russian bot service, as reported by The Hacker News. Approximately 31,000 users were affected.

The extension operated within normal OAuth grant flows and held legitimate browser permissions. It did not exploit a vulnerability in Twitch’s OAuth implementation - it exploited the trust model. Users granted the extension access, the extension received valid tokens, and it silently forwarded those tokens to infrastructure controlled by the threat actor. From Twitch’s perspective, the API calls made with those tokens appeared to come from legitimate, authorized applications.

This pattern is the core NHI risk that identity teams struggle with: third-party applications that hold valid delegated access and operate within granted scopes, but exfiltrate the credentials themselves. Standard endpoint detection does not flag this behavior because the extension is operating as permitted. Detection requires monitoring token usage patterns - specifically, tokens being used from infrastructure that does not match the expected application origin.

What defenders should do: Audit all third-party OAuth app grants across your SaaS estate. Enforce scope restrictions that limit what tokens can access. Monitor for token usage from unexpected IP ranges or geographies. Implement automated revocation for apps that exhibit anomalous token forwarding behavior.

GitLab CVSS 10 Path Traversal Actively Exploited - CISA KEV Listed

CVE-2026-85706 is a maximum-severity path traversal vulnerability in GitLab’s repository commits API that allows unauthenticated attackers to read arbitrary files from self-hosted GitLab instances, per The Hacker News. CISA added it to KEV within hours of disclosure after confirming active exploitation probes.

The identity impact is secondary but severe: self-hosted GitLab instances routinely store CI/CD secrets, API keys, service account credentials, and database connection strings on the local filesystem. A single unauthenticated file-read vulnerability converts into a mass NHI credential exposure event. Every secret accessible from the GitLab server - runner tokens, deploy keys, integration credentials - should be assumed compromised if the instance was exposed to the internet during the vulnerability window.

What defenders should do: Patch immediately. Then rotate every secret that was accessible from the GitLab server filesystem. Review CI/CD pipeline configurations for hardcoded credentials. Consider migrating secrets to a dedicated secrets manager with short-lived credential issuance rather than static files on the GitLab host.

Unit 42 Publishes Behavioral Clustering for Cloud Identity Threat Detection

Palo Alto’s Unit 42 published research demonstrating SQL-based behavioral clustering that maps cloud identity roles from audit logs without requiring manual IAM policy review. The technique groups identities by their observed API call patterns and flags access that deviates from the behavioral cluster baseline.

This addresses a real operational gap. Most cloud environments have IAM policies that grant far more permissions than identities actually use. Manually auditing every policy to determine what each service account or user role actually does is not feasible at scale. Behavioral clustering inverts the problem: instead of reading policies, it watches what identities do and builds role maps from observed behavior. Anomaly detection then becomes a comparison between what an identity has historically done and what it is doing now.

What defenders should do: Evaluate ITDR tooling that performs behavioral analysis on cloud audit logs. The gap between granted permissions and used permissions is where lateral movement hides - any identity suddenly exercising permissions it has never used before is a high-fidelity detection signal. T1078 (Valid Accounts) and T1098 (Account Manipulation) are the MITRE ATT&CK techniques to map these detections against.

Defender Action Items

  • Revolut EDR abuse: Implement callback verification for all Emergency Data Request processing. Enforce phishing-resistant passwordless authentication (FIDO2) on accounts that handle law enforcement requests. Audit all emergency disclosures from the past 90 days.
  • OAuth token theft: Enumerate all third-party OAuth app grants across SaaS environments. Revoke grants with overly broad scopes. Monitor for token usage from IP ranges that do not match the application’s expected infrastructure.
  • CVE-2026-85706 (GitLab): Patch self-hosted GitLab instances immediately. Rotate all CI/CD secrets, deploy keys, runner tokens, and integration credentials stored on the GitLab server filesystem. Segment GitLab instances from direct internet exposure using application-layer access controls.
  • CVE-2026-42016 (Artifactory): Patch JFrog Artifactory. Review API access logs for unauthorized artifact downloads or container image pulls. Treat Artifactory API tokens as high-value NHI credentials requiring rotation.

Detection Queries

Cloud audit log query to detect identities exercising permissions outside their behavioral baseline - relevant to the Unit 42 behavioral clustering research and general ITDR monitoring. This Splunk SPL example targets AWS CloudTrail:

index=cloudtrail sourcetype="aws:cloudtrail"
| stats dc(eventName) as unique_actions values(eventName) as actions by userIdentity.arn
| where unique_actions > 15
| join type=left userIdentity.arn
  [| search index=cloudtrail sourcetype="aws:cloudtrail" earliest=-30d@d latest=-1d@d
   | stats dc(eventName) as baseline_actions by userIdentity.arn]
| eval new_action_ratio = (unique_actions - baseline_actions) / unique_actions
| where new_action_ratio > 0.4
| sort -new_action_ratio
| table userIdentity.arn, unique_actions, baseline_actions, new_action_ratio, actions

This identifies IAM identities whose current API call diversity exceeds their 30-day baseline by more than 40% - a high-fidelity signal for T1078 (Valid Accounts) abuse or compromised service account credentials. Tune the new_action_ratio threshold based on your environment’s normal variance.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.