Cloud Threat Highlights: H1 2026

What it is

Four detection techniques and one supply-chain mitigation from Wiz's H1 2026 cloud threat report. The existing summary names these signals ("stolen access keys, Kubernetes VM Run Command abuse, GCP org-policy tampering, CloudTrail user-agent/boto3 mismatches") but does not carry the actual detection logic, which is the reason to open the page.

What to do

Hidden persistence via CreateAccessKey. After planting a backdoor admin, attackers profile IAM users, find an active administrator, and add a second access key on that legitimate account — persistence that hides behind a real employee rather than a new user. Detect: monitor CreateAccessKey events where the calling principal is not the account owner.

Kubernetes node escape via VM Run Command. Attackers with access to managed Kubernetes call the VM Run Command API against the underlying nodes for root code execution outside the Kubernetes layer, bypassing container controls. Detect: monitor VM Run Command calls in Azure Activity Logs.

GCP org-policy tampering. With compromised service-account keys, an attacker adds a foreign domain to the org's allowedPolicyMemberDomains, grants an external account editor on a project, then removes both the grant and the policy change within thirty minutes — transient and rarely audited. Detect: SetOrgPolicy calls on allowedPolicyMemberDomains from identities that are not known IAM admins, especially when followed by SetIamPolicy in the same session.

Stolen instance-role credentials (near-zero false positive). Boto3 reads the local OS at runtime, so credentials stolen from a Linux EC2 instance and run from an attacker's Windows machine surface in CloudTrail with os/windows in the user-agent — an OS mismatch against the instance. Additionally, the Boto3 feature-flag combination m/e (CREDENTIALS_CODE) means credentials were loaded explicitly into a script rather than sourced from the metadata service, which legitimate EC2 workloads almost never do. The combination of an OS mismatch on an instance role plus that flag is described as a near-zero-false-positive signal.

Supply-chain cooldown. Because community focus has shortened how long malicious packages stay downloadable, Wiz recommends a "cooldown" policy: do not install packages published less than 24 hours ago.

Caveats

Wiz assesses only with moderate confidence that FulcrumSec is JINX-0163's public identity, and cannot rule out an Extortion-as-a-Service model with separate actors per role.