Trust is becoming the attack surface. |
Today’s threats are exploiting everything from forgotten cloud credentials and convincing phishing lures to trusted software and nearby devices.
Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
Thousands of Leaked AWS Keys Still Work |
Thousands of publicly exposed AWS keys remain active, including hundreds with full administrative access to corporate cloud accounts. Truffle Security found 817 exposed corporate keys, including 526 root keys and 242 IAM credentials with full administrator privileges. |
Attackers could use these credentials to steal or delete data, compromise cloud resources, establish persistent access, or deploy cryptominers.
Treat exposed credentials as compromised by revoking them, removing root keys, rotating aging credentials, and enabling budget alerts. |
ReliaQuest Thwarts ShinyHunters After Employee Phished |
ShinyHunters tricked a ReliaQuest employee into entering credentials on a fake SSO page and approving an MFA request. The attacker gained temporary, view-only access to ReliaQuest’s identity dashboard, but device-trust controls blocked access to applications, systems, and customer data.
ReliaQuest terminated the sessions, revoked the compromised credentials and tokens, and found no evidence of persistence or additional account access.
Require device-trust checks for sensitive applications and replace push-based MFA with phishing-resistant methods such as FIDO2 security keys or passkeys. |
AI Data Firm Alation Hit by Cyberattack |
Alation is investigating unauthorized activity in one of its systems, with the full scope still unclear. The company has not disclosed how attackers gained access or whether customer data, credentials, or connected systems were affected.
No threat actor has claimed responsibility, and it remains unclear whether the attack was related to an earlier service disruption. Review Alation-related authentication activity, audit connected accounts and integrations, and monitor for signs of unauthorized access. |
|
|
|
Android Car Head Units Infected With Botnet Malware |
Threat actors used a legitimate update app to turn Android car head units into proxy botnet nodes for ad fraud. Kaspersky attributed the supply-chain attack to the MoYu group, which delivered malware through DoFun’s TWCore system app. |
The malware can collect device data, execute code, and route traffic through infected vehicles, but does not affect critical vehicle controls.
Organizations managing connected vehicle fleets should inventory Android head units and verify their software and update sources, especially devices using DoFun components. |
Manic Malware Steals Data Through Nearby Android Phones |
A new Android malware family can steal banking credentials and sensitive data even when an infected device loses direct internet access. Manic abuses Android Accessibility permissions to steal credentials and sensitive data while enabling surveillance and remote control. It can also relay stolen data through nearby infected phones via Wi-Fi Direct or Bluetooth. If Manic infection is suspected, disable Wi-Fi and Bluetooth in addition to internet access, then isolate the device from other mobile devices while investigating. |
|
|
|
Shadow AI is the new shadow IT: AI agents already inside your environment that were never approved by IT or security. Join Forrester Research and Portnox’s Field CISO to learn practical steps to regain visibility into AI agents, enforce policy on machine identities, and reduce exposure from unmanaged AI access. |
|
|
|
Focus on the Vulnerabilities That Matter |
AI is accelerating vulnerability discovery and patch releases, making it harder for security teams to keep pace and prioritize which flaws pose the greatest risk. |
How to reduce vulnerability exposure: |
- Prioritize vulnerabilities by real-world risk by focusing on actively exploited flaws, internet-exposed assets, and other critical systems first
-
Use patch management solutions to automate deployments, enforce remediation timelines, and track patching across your environment.
- Mitigate and verify remaining exposure by applying temporary controls when needed and rescanning systems after remediation.
|
As vulnerability volume grows, remediation speed and exposure time become more meaningful measures than total patch counts. |
|
|
|
Security Tools You Can Use |
|
|
|
Could a leaked cloud key expose your environment? |
|
|
|
Yesterday's Pulse Check Results |
Pocket Security Test: If your phone became a target today… |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
