Two intrusions documented by Microsoft this week show exactly how fast a Teams message becomes a domain compromise - and the pivot point is Active Directory Certificate Services. Separately, AI is showing up on both sides of the identity fight: as the attack tool (Chainalysis breach), as the target (Northflank API key theft), and as the post-exploitation analyst (VOLTA infostealer). Every story this week circles back to the same question: do you know what identities - human and non-human - can authenticate to your critical systems, and would you notice if one of them started behaving wrong?

In the News

Teams Help-Desk Impersonation Chains to AD CS Cert Theft and DCSync

Microsoft’s Incident Response team published a detailed analysis of two separate intrusions that followed nearly identical playbooks. Both began with Teams messages impersonating IT help-desk personnel, convincing targets to grant remote access via Quick Assist. From there, attackers pivoted to Active Directory Certificate Services exploitation - specifically ESC1 (misconfigured certificate templates allowing arbitrary SAN enrollment) and ESC8 (NTLM relay against HTTP-based enrollment endpoints).

The result: domain-controller authentication certificates minted for attacker-controlled accounts. In one intrusion, the actor used the forged certificate to perform a DCSync operation, extracting every password hash in the domain without ever touching LSASS memory. The entire chain - from Teams message to full domain compromise - relied on identity-layer weaknesses: a pushable MFA prompt the target approved under social pressure, an unrestricted certificate template, and an enrollment endpoint exposed over HTTP.

Microsoft’s writeup includes specific detection guidance: Event ID 4886 (certificate request received), Event ID 4887 (certificate issued), and correlation with Quick Assist session events. The defensive priority is clear - audit AD CS templates using Certipy or PSPKIAudit, enforce FIDO2 for privileged accounts, and restrict Quick Assist to approved support channels.

What defenders should do: Audit all AD CS certificate templates for ESC1/ESC8 misconfigurations immediately. Enforce phishing-resistant passwordless authentication for any account that can enroll certificates or access domain controllers. Monitor Event IDs 4886/4887 for anomalous certificate requests and correlate with remote-access tool sessions.

Chainalysis Breach - AI Agents Used to Access Internal Systems

Blockchain analytics firm Chainalysis disclosed a breach in which attackers used what the company described as “offensive agentic techniques” to access internal systems and exfiltrate customer identity data - names, emails, user IDs, and organizational roles. This is the first publicly confirmed breach where a security vendor was compromised through AI-agent-driven automation rather than conventional credential theft or vulnerability exploitation.

The disclosure raises a question most organizations have not yet answered: how do AI agents authenticate to internal services, and are those authentication tokens inventoried and monitored with the same rigor as human credentials? In most environments, the answer is no. AI agents typically authenticate via long-lived API keys or OAuth tokens that are provisioned once and rarely rotated - exactly the kind of non-human identity that falls outside traditional IAM governance.

What defenders should do: Inventory all AI agent integrations and their authentication methods. Enforce short-lived tokens with automatic rotation. Apply the same behavioral monitoring to non-human identities that you apply to human accounts - anomalous access patterns from service accounts and API keys should generate the same alerts as a human logging in from an unexpected location.

Northflank Breach Leads to Mass Abuse of Customers’ AI API Keys

Cloud platform Northflank disclosed a security breach in which attackers exfiltrated customers’ stored AI API keys for OpenAI, Anthropic, and other LLM providers, then used those keys to run unauthorized workloads at the customers’ expense. Affected organizations face unexpected usage charges and potential data exposure through their AI integrations - any data those API keys could access through the LLM provider is now presumed compromised.

This is the third AI-API-key-theft incident reported in a single week. The pattern is consistent: organizations store LLM credentials as environment variables or secrets in CI/CD and PaaS platforms, and when the platform is breached, every customer’s AI credentials go with it. The keys are non-human identities with broad access scope and minimal monitoring - exactly the gap attackers are targeting.

What defenders should do: Move AI API keys from environment variables into dedicated secrets vaults with automatic rotation. Enable usage-anomaly alerting on LLM provider dashboards - a spike in API calls from an unexpected region or at unusual hours is the first signal. Treat LLM API keys as privileged non-human identities subject to the same lifecycle governance as database service accounts.

VOLTA Infostealer Uses LLMs as Post-Exfiltration Analysts

Cisco Talos published research on VOLTA, a self-deleting infostealer that exfiltrates credentials, browser sessions, and crypto wallets, then sends the stolen data to multiple LLMs - Claude, Gemini, and Kimi - for automated victim profiling. The malware ranks stolen identities by monetization value: high-privilege enterprise credentials and active session tokens are flagged for immediate exploitation, while low-value targets are deprioritized. If one LLM refuses to process the data, VOLTA chains to the next provider.

This is the first confirmed malware using LLMs as post-exfiltration analysts. The identity implications are direct: stolen credentials are now automatically triaged, meaning high-value accounts (domain admins, finance users, DevOps engineers with production access) face faster exploitation than ever before. Detection teams need to watch for outbound API calls to LLM endpoints from endpoints that should not be making them.

What defenders should do: Monitor outbound connections to LLM API endpoints (api.anthropic.com, generativelanguage.googleapis.com, api.moonshot.cn) from corporate endpoints. Enforce phishing-resistant authentication so exfiltrated credentials cannot be replayed. Deploy ITDR to detect stolen-session usage from anomalous contexts.

Defender Action Items

  • Audit AD CS certificate templates for ESC1 and ESC8 misconfigurations using Certipy or PSPKIAudit - remediate unrestricted SAN enrollment and HTTP enrollment endpoints immediately
  • Enforce FIDO2/passwordless authentication for all privileged accounts, especially those with certificate enrollment or domain-controller access rights
  • Inventory all non-human identities (AI agent tokens, API keys, service accounts) and apply lifecycle governance: short-lived tokens, automatic rotation, usage-anomaly detection
  • Rotate all AI API keys stored in CI/CD or PaaS platforms - move credentials to secrets vaults with access logging
  • Monitor outbound connections to LLM API endpoints from corporate endpoints that should not be calling them
  • Enable Event ID 4886/4887 monitoring and correlate certificate issuance events with remote-access tool sessions

Detection Queries

The following KQL query detects anomalous AD CS certificate enrollment events that may indicate ESC1 or ESC8 exploitation - specifically, certificate requests where the Subject Alternative Name (SAN) does not match the requesting account, which is the hallmark of ESC1 abuse:

SecurityEvent
| where EventID == 4887
| extend RequestedSAN = extract(@"Subject Alternative Name:.*?DNS Name=([^\s]+)", 1, EventData)
| extend RequesterAccount = extract(@"Requester:.*?\\(.+?)[\s]", 1, EventData)
| where RequestedSAN !contains RequesterAccount
| where RequestedSAN has_any ("dc", "admin", "controller", "ca")
| project TimeGenerated, Computer, RequesterAccount, RequestedSAN, TemplateName = extract(@"Certificate Template:.*?(\S+)", 1, EventData)
| sort by TimeGenerated desc

This query flags certificates issued where the SAN contains domain-controller or admin-related names but the requester is a different account. False positives may occur in environments with legitimate delegation patterns - correlate hits with Quick Assist or remote-access session logs to confirm abuse.

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.