Cloud identity weakness is driving a surge in cloud attacks
Trend
Summary
Hide ▲
Show ▼
Identity-related weakness is now a major driver of cloud attacks, raising compromise risk across organizations with large identity footprints. In Q3 2025, 44% of true-positive alerts were tied to identity problems, and 99% of cloud identities were described as over-privileged. The pattern expands exposure across AWS, Azure, Google Cloud, and SaaS applications by making legitimate logins easier for attackers to abuse.
Related Happenings
Storm-2949 Microsoft 365 and Azure data-theft campaign
Campaign
H score33
First: 19.05.2026 22:35
Last: 19.05.2026 22:35
Sources 1
About this happening:
The Storm-2949 campaign is targeting Microsoft 365 and Azure production environments to steal sensitive data, increasing the risk of privileged-account takeover and cloud...
Storm-2949 Microsoft 365 and Azure data-theft campaign
CampaignAbout this happening: The Storm-2949 campaign is targeting Microsoft 365 and Azure production environments to steal sensitive data, increasing the risk of privileged-account takeover and cloud...
Zealot autonomous AI cloud intrusion proof of concept
Technical Analysis
H score28
First: 23.04.2026 13:09
Last: 23.04.2026 13:09
Sources 1
About this happening:
Palo Alto Networks Unit 42 built Zealot, an autonomous AI agent that successfully attacked an isolated Google Cloud Platform environment, showing that machine-speed ad...
Zealot autonomous AI cloud intrusion proof of concept
Technical AnalysisAbout this happening: Palo Alto Networks Unit 42 built Zealot, an autonomous AI agent that successfully attacked an isolated Google Cloud Platform environment, showing that machine-speed ad...
Unit 42 Zealot proves autonomous cloud attack chaining in GCP
Technical Analysis
H score28
First: 23.04.2026 13:00
Last: 23.04.2026 13:00
Sources 1
About this happening:
Unit 42's Zealot PoC shows autonomous AI can chain cloud attack stages in a live Google Cloud Platform environment, shrinking defender reaction time to minutes. The system...
Unit 42 Zealot proves autonomous cloud attack chaining in GCP
Technical AnalysisAbout this happening: Unit 42's Zealot PoC shows autonomous AI can chain cloud attack stages in a live Google Cloud Platform environment, shrinking defender reaction time to minutes. The system...
OAuth device-code phishing campaign targeting SaaS accounts
Campaign
H score43
First: 04.04.2026 17:17
Last: 04.04.2026 17:17
Sources 1
About this happening:
A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
OAuth device-code phishing campaign targeting SaaS accounts
CampaignAbout this happening: A device code phishing campaign now includes EvilTokens, a phishing-as-a-service kit sold on Telegram that uses the OAuth 2.0 device authorization flow to hija...
XM Cyber maps eight validated AWS Bedrock attack vectors across connected enterprise integrations
Technical Analysis
H score26
First: 23.03.2026 13:55
Last: 23.03.2026 13:55
Sources 1
About this happening:
XM Cyber mapped eight validated attack vectors in AWS Bedrock, showing how over-privileged permissions can expose logs, knowledge bases, agents, flows, guardrails, and...
XM Cyber maps eight validated AWS Bedrock attack vectors across connected enterprise integrations
Technical AnalysisAbout this happening: XM Cyber mapped eight validated attack vectors in AWS Bedrock, showing how over-privileged permissions can expose logs, knowledge bases, agents, flows, guardrails, and...
Timeline
-
04.11.2025 15:00 2 articles · 8mo ago
ReliaQuest says identity-related weakness is driving cloud attacks
Initial DisclosureReliaQuest says 44% of true-positive alerts in Q3 2025 were tied to identity-related weakness, including excessive permissions, misconfigured roles and credential abuse, while 99% of cloud identities were over-privileged. The company also says poor DevOps practices can systematically redeploy legacy vulnerabilities in new software, and that 71% of critical vulnerability alerts it managed during the quarter came from four CVEs dating back to 2021.
Show sources
- Identity Is Now the Top Source of Cloud Risk — www.infosecurity-magazine.com — 04.11.2025 15:00
- Identity Is Now the Top Source of Cloud Risk — www.infosecurity-magazine.com — 04.11.2025 15:00