🎯 Valid Accounts

The items that name it 6

• “Black October” for AI Developer Platforms
  writeup2026-10-30It is written here as Valid Accounts: Cloud Accounts.

  Attackers used stolen cloud and API keys from vendor environment variables to call Bedrock; the page does not give an ATT&CK id.

• The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk
  article2026-10-13It is written here as Valid Accounts: use of compromised credentials.

  The attacker authenticated to internal systems through the VPN gateway with compromised credentials

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeup2026-09-25It is written here as Valid Accounts: Cloud Accounts.

  Compromised service principals were used for Azure resource discovery and destruction.

• Threat Hunter's Guide to GitHub (Datadog Security Labs)
  writeup2026-09-16

  Successful login events from new device and geo-location; attacker uses stolen valid credentials (personal access token, OAuth access token, or compromised user account) to gain initial access

• Passkey-themed social engineering leads to identity and cloud compromise
  writeup2026-09-09It is written here as Valid Accounts: Cloud Accounts.

  Compromised cloud identity used to authenticate to Microsoft cloud services.

• The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
  writeup2026-06-15It is written here as Valid Accounts (external remote services).

  Actor authenticated to internet-facing RDWeb/RDP portal using a stolen valid domain credential, without MFA in place