🎯 T1078.004 Valid Accounts

The items that name it 3

• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
  writeup2026-10-21It is written here as T1078.004 Valid Accounts: Cloud Accounts: using compromised cloud accounts.
• ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
  writeup2026-10-16It is written here as T1078.004 Valid Accounts: Cloud Accounts - use of the stolen vendor credential (client assertion) to obtain Microsoft Graph tokens from 144.172.64[.]128 on October 15, 06:13 to 08:34 UTC.

  client assertion

• GhostAction Attack Escalates By Targeting GitHub Users
  writeup2026-10-09It is written here as T1078.004 Valid Accounts: Cloud Accounts (Initial Access).

  Initial Access