Every story in today’s brief follows the same thread: an identity credential that should have been constrained was not, and an attacker pulled the thread until the entire environment unraveled. A laptop with cached API keys became a $6.3 billion loss. A misconfigured AD CS template turned a Teams chat into domain-controller impersonation. Exposed API keys for AI services turned into six-figure daily bills. The common denominator is non-human identity hygiene - or the lack of it.

In the News

Fake Job Interview Gave North Korean Operators a $6.3B Crypto Heist

Binance disclosed new details on the largest cryptocurrency theft in history. North Korean threat actors - tracked by multiple firms as part of the Lazarus cluster - socially engineered a DevOps engineer through an elaborate fake job interview process. The process culminated in malware planted on the engineer’s work laptop.

The laptop held what mattered: API keys, authentication tokens, and cached credentials with access paths that reached wallet infrastructure. The attackers did not need to exploit a zero-day or bypass network controls. They needed one compromised endpoint with overprivileged secrets on it, and the access chain from that endpoint to the target was already built.

GitGuardian published companion research analyzing how developer laptops routinely hold secrets - environment variables, cached cloud credentials, CI/CD tokens - that bridge the gap between a personal workstation and production infrastructure. The $6.3 billion figure is extreme, but the underlying pattern is not: secrets live where they should not, and nobody audits the blast radius until after the breach.

What defenders should do: Inventory non-human identities (API keys, service tokens, cached credentials) on developer endpoints. Implement secrets management that prevents secrets from residing on disk. Enforce credential rotation on a schedule that assumes compromise. Deploy phishing-resistant passwordless authentication (FIDO2) on developer workstations - malware-resident credentials cannot exfiltrate hardware-bound FIDO2 keys. Use ITDR to baseline and alert on anomalous API-key usage patterns.

Source: BleepingComputer

Teams Help-Desk Impersonation Chains to AD CS Certificate Abuse

Microsoft confirmed two intrusions that followed an identical playbook: attackers impersonated IT support staff on Microsoft Teams, convinced employees to grant remote access to their workstations, then escalated privileges through Active Directory Certificate Services. The specific technique - ESC1 abuse - exploits misconfigured certificate templates that allow any authenticated user to request a certificate for any principal, including domain controllers.

With a domain-controller certificate in hand, an attacker can perform DCSync, extract the KRBTGT hash, and forge golden tickets. The entire chain - from a Teams chat to full domain compromise - requires no malware, no exploit, and no zero-day. It requires a misconfigured AD CS template and an employee who trusts a Teams message claiming to be from IT.

Microsoft’s write-up confirms both intrusions resulted in company data theft. The MITRE ATT&CK mapping covers T1566.004 (Phishing: Spearphishing Voice/Chat), T1021.001 (Remote Desktop Protocol), and T1649 (Steal or Forge Authentication Certificates).

What defenders should do: Audit AD CS certificate templates immediately for ESC1, ESC2, and ESC3 misconfigurations - tools like Certify and Certipy automate this. Restrict certificate enrollment permissions to the minimum required principals. Deploy phishing-resistant passwordless authentication to prevent credential relay even during remote-access sessions. Implement ITDR with certificate-enrollment anomaly detection.

Source: The Hacker News

LLMjacking: API Key Theft Runs Up $1M in Cloud AI Bills

Google published research on a campaign pattern it calls “LLMjacking” - attackers compromise exposed API keys for cloud AI services (Vertex AI, OpenAI, Anthropic) and use them to run large-scale inference workloads at the victim’s expense. Some organizations have seen charges exceed $100,000 per day before detection.

The attack surface is familiar: API keys committed to public repositories, hardcoded in CI/CD configurations, or stored in environment variables on developer machines. The payload is novel - instead of cryptomining or data exfiltration, the attacker monetizes access by reselling inference capacity or running their own large-scale AI workloads. The NHI hygiene gap is identical to the Binance theft: secrets stored where they should not be, with permissions broader than they need to be.

What defenders should do: Scan repositories and CI/CD pipelines for exposed AI-service API keys. Implement spending caps and usage-anomaly alerts on all cloud AI service accounts. Enforce least-privilege scoping - API keys should be restricted to specific models, regions, and request-rate limits. Rotate API keys on a schedule that assumes exposure.

Source: BleepingComputer

ARTEX AI Framework Deployed by Chinese APTs Against 200+ Organizations

Chinese state-aligned threat actors deployed ARTEX - an open-source multi-agent AI framework designed for automated penetration testing - in real intrusion campaigns against more than 200 organizations across 14 countries. ARTEX automates reconnaissance, vulnerability identification, exploitation, and lateral movement across multiple attack surfaces simultaneously.

The WorkOS breach disclosed separately also attributed the attack to ARTEX-assisted intrusion. The convergence of AI-assisted attack tooling with nation-state operational tempo compresses the window between initial reconnaissance and exploitation from days to hours. Defenders tuned for human-speed attack patterns will miss the rapid sequential authentication probing and enumeration that characterizes these frameworks.

What defenders should do: Deploy ITDR that baselines normal authentication patterns and detects automated enumeration - rapid sequential auth attempts across multiple services from a single identity are a high-fidelity signal. Phishing-resistant passwordless authentication (FIDO2) remains the preventive layer that automated frameworks cannot bypass. Monitor for anomalous certificate and token requests that deviate from historical principal behavior.

Source: BleepingComputer

Today’s Deep Dive - Non-Human Identity: The $6B Blind Spot

The Binance theft, the LLMjacking campaigns, and the ARTEX-assisted breaches all share a root cause: non-human identities - API keys, service tokens, cached credentials, OAuth app grants - that were overprivileged, unmonitored, and resident in locations that expanded the blast radius of any single compromise.

Non-human identities outnumber human identities in most enterprises by a ratio of at least 10:1, and often closer to 50:1. Every CI/CD pipeline, every cloud service integration, every automated workflow creates credentials that authenticate to production systems. Unlike human accounts, these credentials rarely have MFA, rarely rotate on meaningful schedules, and are frequently exempt from the access reviews that apply to human identities.

The MITRE ATT&CK framework captures this under T1528 (Steal Application Access Token), T1550.001 (Use Alternate Authentication Material: Application Access Token), and T1078.004 (Valid Accounts: Cloud Accounts). Detection requires baselining normal API-key usage - which services each key accesses, at what volume, from which source IPs - and alerting on deviations. The Binance case demonstrates that without this baselining, an attacker using a valid API key from an unusual source is invisible.

The primary controls are: secrets management platforms that eliminate secrets-on-disk, automated credential rotation with lifetimes measured in hours rather than months, least-privilege scoping per credential, and ITDR platforms that treat non-human identity anomalies with the same priority as human account compromise.

Detection Spotlight

Detect anomalous API-key usage patterns that may indicate stolen NHI credentials - a high-fidelity signal for both LLMjacking and the laptop-to-production pivot seen in the Binance case. This KQL query surfaces API keys making requests from new source IPs with unusually high request volumes:

let baseline_period = 30d;
let detection_window = 1h;
let volume_threshold = 5;
ApiServiceLogs
| where TimeGenerated > ago(baseline_period)
| summarize BaselineIPs = make_set(SourceIP), AvgRequestsPerHour = avg(RequestCount) by ApiKeyId
| join kind=inner (
    ApiServiceLogs
    | where TimeGenerated > ago(detection_window)
    | summarize CurrentIPs = make_set(SourceIP), CurrentRequests = sum(RequestCount) by ApiKeyId
) on ApiKeyId
| mv-expand CurrentIP = CurrentIPs to typeof(string)
| where not(CurrentIP in (BaselineIPs))
| where CurrentRequests > AvgRequestsPerHour * volume_threshold
| project ApiKeyId, CurrentIP, CurrentRequests, AvgRequestsPerHour, BaselineIPs

This query establishes a 30-day baseline of source IPs and average request volume per API key, then flags keys that are suddenly used from new IPs at 5x or higher their normal volume. Tune volume_threshold based on your environment - AI-service keys with burst workloads may need a higher multiplier to reduce false positives. For LLMjacking detection specifically, filter on AI-service API endpoints (Vertex AI, OpenAI, Anthropic) to reduce noise.

Defender Action Items

  • Audit AD CS certificate templates for ESC1/ESC2/ESC3 misconfigurations using Certify or Certipy - restrict enrollment permissions to the minimum required principals
  • Inventory non-human identities on developer endpoints - API keys, cached tokens, environment variables - and migrate them to a secrets management platform with automated rotation
  • Configure spending caps and usage-anomaly alerts on all cloud AI service API keys (Vertex AI, OpenAI, Anthropic, Azure OpenAI)
  • Deploy phishing-resistant passwordless authentication (FIDO2) on all developer and privileged-access workstations
  • Baseline API-key usage patterns (source IPs, request volumes, target services) and alert on deviations using the KQL detection above
  • Monitor for rapid sequential authentication attempts across multiple services - a high-fidelity indicator of AI-assisted enumeration tools like ARTEX

References

Subscribe to The Identity Brief

Get The Identity Brief in your inbox (Mon/Wed/Fri) - Human, machine, and AI identity security — NHI, ITDR, and the IAM market.