Cloud Credential Misuse: Detection & Prevention Guide 2026 | Qualys
Summary: Qualys reports that cloud compromise now runs through authentication rather than exploitation, with adversaries using the legitimate open-source scanner TruffleHog to find exposed credentials and confirm they are still live by calling AWS APIs such as sts:GetCallerIdentity. The 'Crimson Collective' group used exposed long-term access keys and IAM misconfigurations to escalate privileges and exfiltrate data from S3 buckets and EC2 instances, while the Shai-Hulud worm infected more than 500 NPM packages and affected over 25,000 repositories across roughly 500 GitHub users, exposing approximately 14,000 secrets.
What's compelling: Credential harvesting, verification, exploitation and exfiltration can unfold within minutes where long-lived keys and excessive permissions remain in place, and an exposed but active key is immediate access rather than hygiene debt. Detection hinges on identity telemetry and correlated API monitoring, since a user-agent string of 'TruffleHog' or a GetCallerIdentity call followed by rapid permission enumeration is the observable signal, and tool signatures can change while the behavior sequence stays the same.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026