El fabricante de coches Volkswagen se encuentra investigando una posible brecha de datos, tas las afirmaciones del grupo de ransomware 8Base.
Los medios especializados sugieren que la violación se podría haber originado a través de un tercero, como un proveedor, socio o subsidiaria, en lugar de la infraestructura directa de Volkswagen.
Esta banda de ciberdelincuentes, surgida a principios de 2023, aseveraba en septiembre del año pasado haber violado con éxito los sistemas de Volkswagen.
8Base al que se conoce por implementar el ransomware Phobos y emplear tácticas de doble extorsión, supuestamente exfiltró archivos confidenciales el 23 de septiembre del año pasado, amenazando con hacerlos públicos antes del día 26.
Aunque el plazo transcurrió sin que la banda cumpliera su amenaza la banda publicó posteriormente en su página de la dark web distintas informaciones.
Supuestamente los actores de amenazas se habrían hecho con facturas y recibos, documentos contables, expedientes personales de empleados y contratos de trabajo, certificados y registros de personal y acuerdos de confidencialidad del gigante de la automoción.
Desde su surgimiento 8Base ha atacado a más de 400 organizaciones en todo el mundo, obteniendo acceso inicial mediante campañas de phising, principalmente.
Otros problemas de seguridad
Este no es el primer ‘escándalo’ de seguridad al que se enfrenta Volkswagen. Solo hace unos días que se descubrió una filtración de datos ante otro ataque a la filial francesa perpetrada por el grupo Qilin.
Por otro lado, en mayo se encontró una vulnerabilidad en la aplicación móvil que permitía a los atacantes acceder a los datos personales de propietarios de vehículos.
En enero de este año, además, los datos confidenciales de unos 800.000 vehículos eléctricos quedaron expuestos en un sistema de almacenamiento en la nube sin protección, haciendo que la información privada quedara accesible a cualquiera. Todo se originó mediante Cariad, una filial de software de Volkswagen.
En un entorno digital donde los menores navegan con creciente autonomía, proteger su acceso a contenidos apropiados se ha convertido en una prioridad urgente, siendo la verificación de edad una herramienta clave, sin embargo, su implementación plantea al mismo tiempo problemas de seguridad y privacidad.
Si no se cuenta con una supervisión adecuada, los menores pueden acceder fácilmente a contenido inadecuado para su edad, como pornografía, violencia explícita, lenguaje ofensivo o conductas peligrosas como la autolesión o trastornos alimenticios.
Frente a esta realidad, aunque es crucial la educación digital, la supervisión activa por parte de los padres y tutores y las herramientas de control parental, desde organismos reguladores como la Unión Europea (UE) ya se están movilizando opciones para evitar que los menores accedan a contenido no apto en Internet.
Así, como parte del Reglamento de Servicios Digitales (DSA), concretamente en la actualización del Reglamento sobre la identificación electrónica y los servicios de confianza (eIDAS2), se establece que, a partir del año 2027, todas las plataformas de contenidos digitales de la UE deberán verificar la mayoría de edad de sus usuarios.
Es entonces cuando entran en acción los sistemas de verificación de edad de los servicios online, que se basan en distintos mecanismos diseñados para comprobar la edad de los usuarios antes de permitirles acceder a ciertos contenidos o plataformas que están restringidos para su protección.
Según el nivel de seguridad que se quiera garantizar, actualmente los métodos más utilizados incluyen la verificación a través de un documento oficial, ya sea el DNI, el pasaporte o documentos similares, que se ha de compartir y validar posteriormente mediante servicios de terceros conocidos como Know Your Customer (KYC).
Igualmente, también se recurre a soluciones de reconocimiento facial e inteligencia artificial (IA) para estimar la edad de los usuarios.
¿Son seguros los sistemas de verificación de edad?
Como principal ventaja, estos sistemas permiten el control de acceso a contenidos regulados, esto es clave en servicios como plataformas de juegos, redes sociales u otro tipo de páginas como los sitios de apuestas.
Además, como ha valorado el director de Operaciones Globales de Consumo de Panda Security, Hervé Lambert, en declaraciones a Europa Press, estos sistemas refuerzan la seguridad jurídica de las empresas, ya que sirven como prueba de que han empleado herramientas para cumplir las normativas.
Sin embargo, también presentan un riesgo para la seguridad de los usuarios y de su información personal. Principalmente porque implican el tratamiento y almacenamiento de datos personales sensibles, como los documentos de identidad.
Al tratarse de sistemas que utilizan bases de datos para tratar esta información, se convierten en un objetivo llamativo para los actores maliciosos que intentan robar información personal, con múltiples consecuencias negativas, desde la usurpación de identidad para actividades maliciosas hasta el robo de cuentas financieras.
Un ejemplo reciente de este tipo de riesgos ha sucedido con la plataforma Discord. En este caso, un incidente de ciberseguridad relacionado con un proveedor de servicios de atención al cliente externo se saldó con la exposición de los datos de 70.000 usuarios de Discord, incluyendo información personal como los últimos cuatro dígitos de la tarjeta bancaria y documentos oficiales de identidad.
Según Discord, el proveedor externo respalda sus esfuerzos de atención al cliente, concretamente, recogiendo fotos de identificaciones oficiales de los usuarios, como carnets de conducir o pasaportes de personas que apelaron verificaciones de edad.
El Segundo Congreso Nacional de Ciberseguridad en Fraude Digital, organizado por CyberMadrid, Clúster de Ciberseguridad de Madrid, se celebra este jueves 23 de octubre en la Escuela Técnica Superior de Ingenieros de Telecomunicación, de la Universidad Politécnica de Madrid. Programa
Bernardino Cortijo, director del Máster en Ciberdelincuencia de la Universidad de Nebrija y vocal del Consejo de CyberMadrid, abordará “Seguridad y fraude en el ciberespacio”. Eloy Velasco, magistrado de la Audiencia Nacional, impartirá la conferencia magistral “Fraude digital. Impacto digital y social”. David Moreno Verdugo, inspector jefe de Sección de Comercio Electrónico de la Unidad Central de Ciberdelincuencia, de la Brigada Central de Fraudes Informáticos de la Policía Nacional, tratará la “Situación actual del ciberfraude: realidad”. Ruth García Ruiz, responsable de Alerta Temprana y Prospectiva de INCIBE, hablará sobre “Fraudes online al descubierto: lo que sabemos y cómo podemos blindar ciudadanía y empresas”. Pablo de la Riva, director de Acoru, se ocupará de “La red de mulas”.
“Nuevas amenazas del sector asegurador” será el asunto sobre el que versará la ponencia de Daniel Largacha, director de Ciberseguridad de Mapfre. De “Gobernanza antifraude: desde la fragmentación al control consciente” se ocuparán Javier Migoya, director Forensic, y Juan Galdón, director de Ciberseguridad (ambos de KPMG). Juan Ignacio Ruiz Zorrilla, presidente del Instituto Internacional de Prevención del Fraude, participará sobre “Fraude a nivel internacional. Certificaciones internacionales». En la mesa coloquio “Ciberfraude y confianza digital; nuevos desafíos para las organizaciones”, moderada por Saúl González, senior manager Forensic en KPMG, intervendrán Juan Ignacio Calvo López-Casero, director de Prevención de Fraude Externo de Santander España; Pablo Blanco, director de Riesgo Operacional de CBNK; y Teresa Andrés, vocal de la Junta directiva de AEECF.
Contra el fraude
Mar Sánchez, Country Manager Iberia & Latam de Cyber Guru, tratará “La concienciación como herramienta clave para prevenir el fraude digital impulsado por la IA”. Francisco Valencia, director general de Secure&IT, expondrá “Las r3des del fraude_desmantelando el cibercrim3n”. Mario Bricio, manager de Desarrollo de Negocio de IA y responsable de Fraud Prevention & Financial Crime, y Saturnino Fernández, responsable de Ciberseguridad (ambos de Minsait Cyber), disertarán sobre “Voces contra el fraude: agentes de IA y análisis del habla para prevenir, detectar y actuar”.
Completan la agenda Jordi Sánchez Zamorano, gerente en la Financial Crime Unit de CaixaBank, y Miguel Ángel Soler, responsable del área de Prevención de Crimen Financiero de NTT Data IBIOL, para explicar “Los retos del fraude para el sector financiero”; Concepción Cordón, ingeniera asesora 360 en Ciberseguridad en Hispasec Sistemas, con “De la detección técnica a la decisión estratégica: ¿ciberseguridad o gestión del riesgo?”; y la mesa coloquio “Medidas contra el ciberfraude”, moderada por Jorge Hurtado, vicepresidente de CyberMadrid.
La OTAN ha iniciado una transformación estratégica hacia un modelo en el que la tecnología, los datos y la inteligencia artificial se convierten en aliados esenciales para garantizar la seguridad de los estados miembros. Este avance marca un punto de inflexión en la defensa moderna, donde la prevención y la anticipación se imponen sobre la mera reacción ante los ataques.
Una nueva frontera digital en defensa
El uso de la inteligencia artificial en el entorno militar no es nuevo, pero su aplicación en la predicción de amenazas cibernéticas y operativas ha cobrado fuerza en los últimos años.
En 2024, el Centro de Excelencia de Ciberdefensa Cooperativa de la OTAN (CCDCOE), con sede en Tallin, presentó un informe que destacaba la necesidad de adoptar herramientas basadas en aprendizaje automático para anticipar ciberataques y movimientos enemigos en el ciberespacio.
Estas tecnologías permiten procesar millones de datos en tiempo real procedentes de redes, sensores, satélites y fuentes abiertas.
Gracias a algoritmos capaces de identificar anomalías o correlaciones invisibles para los analistas humanos, las fuerzas aliadas pueden detectar campañas de desinformación, sabotajes digitales o intentos de infiltración antes de que afecten a infraestructuras críticas o despliegues militares.
Los responsables del CCDCOE han señalado que esta estrategia no solo mejora la capacidad defensiva, sino que también optimiza la toma de decisiones estratégicas.
La posibilidad de anticipar un ataque o un cambio de comportamiento hostil ofrece una ventaja operativa significativa, especialmente en conflictos híbridos donde las fronteras entre guerra física y digital se difuminan.
Datos, algoritmos y decisiones en tiempo real
El reto para la OTAN consiste en transformar la enorme cantidad de información que maneja diariamente en inteligencia útil.
Los sistemas de ciberinteligencia predictiva permiten convertir datos dispersos en conocimiento estructurado mediante el uso de modelos de IA que aprenden de comportamientos pasados.
La Alianza ha invertido en plataformas que integran sensores militares con herramientas de big data y análisis avanzado.
Estas soluciones son capaces de detectar indicios de actividad anómala en redes militares y civiles, prever posibles escenarios de ataque y ofrecer recomendaciones tácticas automáticas a los mandos operativos.
Según un informe del NATO Communications and Information Agency (NCIA), se estima que para 2026 la mitad de las operaciones digitales aliadas incorporarán algún tipo de componente de inteligencia artificial.
Esto incluirá desde la predicción de vulnerabilidades en sistemas de mando hasta la supervisión de ciberinfraestructuras en misiones internacionales.
La capacidad de respuesta en tiempo real se ha convertido en un elemento clave. En lugar de reaccionar a los incidentes una vez detectados, la inteligencia predictiva busca adelantarse, neutralizando amenazas antes de que se manifiesten.
Este enfoque reduce el riesgo de daño a infraestructuras esenciales y evita interrupciones operativas, lo que representa un importante ahorro en términos de recursos y coste estratégico.
Cooperación transatlántica y soberanía tecnológica
La iniciativa no se limita a la esfera militar. Los países miembros han reconocido la necesidad de compartir datos, algoritmos y conocimientos técnicos de forma segura para garantizar la interoperabilidad de los sistemas.
La OTAN trabaja con la Unión Europea y aliados tecnológicos como Estados Unidos, Canadá o Reino Unido en la creación de estándares comunes que aseguren que las herramientas de IA puedan operar de manera coordinada en diferentes escenarios.
Uno de los principales desafíos es mantener la soberanía tecnológica dentro de un marco cooperativo. Las soluciones basadas en inteligencia artificial requieren infraestructuras de datos robustas y seguras, así como proveedores confiables.
Evitar dependencias tecnológicas de potencias externas se ha convertido en una prioridad para la Alianza, que busca desarrollar sus propias capacidades en ciberseguridad y procesamiento de datos.
Además, se están estableciendo laboratorios conjuntos de investigación en países como Estonia, Alemania y los Países Bajos, donde equipos multidisciplinarios trabajan en el desarrollo de algoritmos explicables y sistemas auditables.
El objetivo es garantizar que las decisiones generadas por la IA puedan ser comprendidas y validadas por humanos, evitando así el riesgo de errores no detectados o decisiones automatizadas fuera de control.
Ética y control humano en la era digital
La introducción de inteligencia artificial en el ámbito de la defensa plantea dilemas éticos de gran magnitud.
La OTAN ha subrayado que la supervisión humana seguirá siendo obligatoria en todas las decisiones operativas críticas. Ningún sistema autónomo tendrá autoridad para actuar sin aprobación humana directa.
El marco ético adoptado por la Alianza en 2023 establece que toda aplicación de IA deberá ser segura, transparente y responsable.
Esto implica revisar constantemente los algoritmos para evitar sesgos y garantizar que las herramientas se utilicen exclusivamente con fines defensivos. Los comités de ética militar de la OTAN supervisan la implementación de estas normas y evalúan los riesgos asociados al uso de datos en operaciones.
La Alianza reconoce que la confianza pública en el uso de inteligencia artificial en defensa dependerá de la transparencia de sus procesos.
Por ello, se promueve la publicación de informes anuales que evalúan el rendimiento, la fiabilidad y las implicaciones éticas de cada sistema implementado.
Qué duda cabe que esta transición hacia una defensa predictiva basada en IA, marca el inicio de una etapa en la que la anticipación se convierte en la principal herramienta de protección.
Investigadores de seguridad de distintas empresas han advertido de la existencia de múltiples vídeos en TikTok que proporcionan instrucciones, tutoriales y guías sobre cómo activar herramientas de software populares, como Adobe Premiere o Microsoft 365 e incluso paquetes de productos que ni siquiera existen, como en Spotify o Netflix. Tras estos ataques está el malware ClickFix. Este indica a los usuarios que copien y peguen un comando en Ejecutar de Windows, que es un comando de PowerShell malicioso que implementa y ejecuta Aura Stealer.
Aura Stealer es un ladrón de información que se encarga de robar contraseñas almacenadas en navegadores, cookies de autenticación, datos de monederos de criptomonedas y credenciales de otras aplicaciones.
El investigador Xavier Mertens también ha añadido que el código de ClickFix también descarga un malware adicional, cuyo verdadero propósito no se conoce.
Una amenaza veterana
ClickFix no es una amenaza nueva. De hecho, esta técnica de estafa existe desde hace décadas. A principios de la década de los 2000 ya operaba con notificaciones de virus falsas que se manifestaban mediante ventanas emergentes.
Su modus operandi es engañar a la gente para hacerles creer que tienen un problema con su equipo y luego ofrecer una solución sencilla y rápida.
Esta herramienta maliciosa ha mutado y ahora ‘se la cuela’ a los usuarios a través de ofertas exclusivas, documentos ‘bloqueados’ falsos y activadores de software.
AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how to evaluate framework choices, and what runtime evidence proves an agent behaved as intended.
Identity and access management (IAM) for AI agents treats each agent as a non-human identity with a human owner, a defined purpose, scoped authorization, an expiration, and continuous monitoring. The complication is architectural. IAM platforms express intended access, while applications and infrastructure reveal what the agent actually executed.
Between the two sits identity dark matter: the agents, credentials, application-local accounts, and authentication paths that central identity data never reports. A framework that cannot observe that surface produces policy intent, not assurance.
Why traditional IAM systems fall short for AI agents
That intent-to-execution gap is where conventional identity programs were never designed to operate. IAM platforms generally work along two dimensions. At design time, they handle lifecycle management, policy definition, provisioning, and joiner-mover-leaver workflows. At runtime, they enforce authentication and authorization through single sign-on (SSO) and access checks at the perimeter of an application.
Both dimensions describe access as configured. Neither describes what an autonomous agent did with that access once inside the application.
Static permissions cannot match agent autonomy
A human user typically follows a predictable task path. An agent chains tasks, selects tools dynamically, and composes actions that no entitlement review anticipated. OWASP’s Top 10 for Large Language Model Applications names this failure mode directly as excessive agency (LLM06): an agent granted broad functionality, permissions, or autonomy exercises capability beyond its approved task.
Static role assignment cannot bound that behavior, and configuration review cannot measure it. Misconfiguration is also not automatically exploitability. Exposure depends on the permissions actually attached to the agent identity, the systems reachable from its execution context, and the runtime conditions under which it operates. Configuration findings describe possibility; telemetry describes what occurred.
Nonhuman identity lifecycle and credential risks
Agent identities are commonly created by infrastructure automation, deployment pipelines, or application teams rather than by HR-driven lifecycle events. They therefore bypass the governance workflows that catch human access anomalies, and they accumulate outside the inventory that compliance reporting depends on.
Recurring lifecycle failure modes
Absent ownership: No named human is accountable for the agent’s purpose, scope, or continued existence.
Long-lived secrets: Static API keys and tokens persist across deployments, with no rotation event tied to agent retirement.
Unbounded delegation: Agents inherit user or service permissions wholesale rather than receiving task-scoped authority.
Invisible instantiation: Agents spawned by other workloads never register in the identity provider (IdP) or governance system.
No expiration: Access granted for a pilot remains active long after the pilot concludes.
Not every environment exhibits all five, but each maps to a control layer an agent identity framework has to supply.
Essential components of an AI agent identity framework
Because these failures span lifecycle, authorization, and runtime, an agent framework is usually assembled rather than purchased whole. The components divide cleanly: establishing who the agent is, constraining what it may do, and proving what it did.
Agent identity, authentication, and credential management
Every agent requires a distinct, attributable identity, never a shared service account and never a borrowed human credential. Attribution is the precondition for every downstream control, because audit evidence that cannot separate agent activity from human activity cannot support implementation-level compliance.
Credential design should favor workload identity federation and short-lived, automatically rotated credentials over embedded secrets. Where an agent acts on behalf of a user, OAuth 2.0 Token Exchange (RFC 8693) provides delegation and impersonation semantics that preserve the distinction between the agent’s own identity and the authority it has been lent. That distinction disappears the moment an agent simply reuses a user’s session token.
Fine-grained authorization and policy enforcement
Authentication establishes identity; authorization determines blast radius. The access control (AC) family in NIST SP 800-53 Rev. 5 applies to agent identities without modification, including least privilege (AC-6), separation of duties (AC-5), and explicit authorization boundaries. The enforcement point, though, has to sit closer to the action than a login gateway.
Authorization controls that constrain agent behavior
Task-scoped grants: Authority is issued for a specific task and expires with it, rather than persisting as a standing role.
Tool allowlisting: The agent may invoke only the APIs and functions its purpose requires.
Data boundaries: Retrieval sources are constrained, because agents reasoning over manipulated data will act on it faithfully.
Action thresholds: High-consequence operations require human approval or a second authorization path.
Auditability, monitoring, and revocation controls
Design-time controls become defensible only when the environment can show what the agent executed. The NIST AI Risk Management Framework (AI 100-1) treats accountability and transparency as trustworthiness characteristics that depend on traceable system behavior, and the audit and accountability (AU) family in SP 800-53 assumes records sufficient to reconstruct a sequence of actions, not a record that a policy existed.
Monitoring for agents must be behavioral rather than purely log-based. Identity attacks, including the valid-accounts abuse (T1078) and privilege-escalation techniques catalogued in MITRE ATT&CK, generate normal-looking authentication records because the credentials are legitimate.
Detection depends on comparing the agent’s intended task against its actual execution across applications and infrastructure, and on the ability to revoke delegated authority when the two diverge. That comparison is the selection lens for the framework itself.
Choosing the best IAM framework for AI agents: what IAM framework should I use for AI agents?
Revocation speed and evidence quality are the two capabilities framework evaluations most often skip, because provisioning features are easier to demonstrate. The question of what IAM framework to use for AI agents is best answered by evaluating architecture patterns against the full control chain, ownership through execution evidence, rather than by counting connectors. The weighting will differ by environment: a regulated enterprise with certification obligations optimizes differently than a team running a single internal agent.
Evaluation criteria for enterprise IAM for AI agents
Decision criteria for AI-agent identity architectures
Ownership model: Can every agent identity be traced to a named human accountable for its purpose and expiration?
Credential architecture: Does the pattern support federated workload identity and short-lived credentials, or does it depend on stored secrets?
Delegated authorization: Is the agent’s own identity preserved separately from the user authority it exercises, with scoped and revocable delegation?
Discovery coverage: Are agent identities discovered from applications and infrastructure, or only from what the IdP and IAM platform already know?
Runtime telemetry: Does the architecture capture application-layer actions such as tool invocation, data access, and privilege use, not just authentication events?
Enforcement reach: Can authority be constrained or revoked at the point of action, within the timeframe an autonomous task chain executes?
Audit evidence: Does the system produce telemetry-backed proof of agent behavior, or attestations that a control was configured?
Build, buy, or extend an existing IAM platform
For most enterprises that already run an identity governance program, extending the existing IAM platform is the reasonable starting position. Lifecycle workflows, approval chains, certification cycles, and policy governance already exist, and rebuilding them for agents fragments an identity program that is usually fragmented enough. Governance platforms such as SailPoint and Saviynt address the design-time half of the problem, and both have published non-human and agent identity capabilities, though feature coverage changes release to release and should be verified against current documentation.
Building is easiest to justify where agent frameworks are proprietary and authorization must be embedded in the runtime itself. Buying becomes relevant for the layer governance platforms generally do not supply: discovery of agent identities directly from applications and infrastructure, and verification that execution matched intent.
Many programs end up combining all three, extending for lifecycle, building for in-application enforcement, and buying for observability, which is what the implementation models below reflect.
Real-world use cases and implementation models
The extend-build-buy split becomes concrete once specific agents enter production, because each agent class fails differently. The scenarios below are illustrative patterns, not measured case studies.
Securing customer-facing and internal AI agents
Consider an internal operations agent that resolves support tickets across a CRM, a ticketing system, and an internal knowledge base. The IdP records a handful of successful authentications per day, an unremarkable pattern. Inside the applications, the same agent queries customer records, exports data, and updates entitlements.
An identity-provider-only view reports the agent as well-governed. Application-layer telemetry reveals the actual data access and tool invocation. Detection fidelity depends on the second view, because the behavior that matters never reaches the authentication log.
Delegated access across tools, APIs, and data sources
A procurement agent illustrates the delegation problem precisely. Its approved task is retrieving supplier pricing. Its granted permissions include the full procurement API surface. Its executed actions may include initiating purchase orders, because the task chain reasoned its way there.
Three distinct artifacts, then: intent, entitlement, execution. Only the third describes what actually happened.
A code-delivery agent holding a control-plane identity raises the stakes further. Infrastructure automation credentials require broad permissions, which makes them high-value targets and allows a compromised agent to reshape the environment, including the controls meant to detect it.
Phased implementation and governance rollout
Maturity stages for agent identity governance
Static account-and-role governance: Agents are inventoried as non-human identities with owners, purposes, and expirations; access is reviewed periodically. Workable for pilots, insufficient for autonomous action.
Automated, event-driven governance: Provisioning, credential rotation, and revocation trigger on deployment and retirement events rather than on review calendars.
Continuous identity observability: Agent behavior is observed across applications and infrastructure, execution is compared against intended task scope, and audit evidence is generated from telemetry.
Stage three is where Orchid Security operates. Orchid discovers identities directly from applications and infrastructure rather than relying on IAM configuration data alone, surfacing agent identities, credentials, and access paths that fragmented identity systems may not report. It is designed to complement enterprise IAM platforms, leaving governance and provisioning where they are, and adds a verification and remediation layer intended to turn configured policy into telemetry-backed audit evidence. Coverage depends on which applications and infrastructure are connected.
The future of identity management in an AI-driven world
Observability at stage three becomes harder, not easier, as agents begin authorizing one another.
Machine-readable policies and agent-to-agent trust
When one agent delegates a subtask to another, authority propagates through a chain no human approved step by step. Machine-readable policy, meaning authorization expressed in a form agents can evaluate and enforce at runtime, is one emerging response, alongside in-progress standards work on verifiable agent credentials and constrained delegation. These efforts are early, and interoperability across agent frameworks is not yet settled.
The governance requirement does not change. Every link in the chain needs an identity, a scope, an expiration, and a human ultimately accountable for it. MITRE ATLAS catalogues adversary tactics and techniques against AI-enabled systems and is a useful reference point for how such chains are likely to be attacked.
Continuous authorization for adaptive AI systems
Continuous authorization replaces the single admission decision with an ongoing evaluation, re-scoring authority as the agent’s behavior, data sources, and execution context shift. It functions only where behavioral signal exists, which returns the argument to its starting point.
An AI-agent identity framework that governs provisioning without observing execution produces policy intent, not operational assurance. The agents are already acting; the question is whether your environment can prove what they did. Book a demo to see how Orchid discovers agent identities across connected applications and infrastructure and maps the identity controls it finds to your applicable regulatory obligations.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
⚡ Threat of the Week
Citrix Warns of Actively Exploited NetScaler ADC and Gateway Flaws — Citrix released patches to address multiple vulnerabilities, including CVE-2026-88771 and CVE-2026-88772, that have come under active exploitation. CVE-2026-88771 is an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands, while successful exploitation of CVE-2026-88772 could allow for remote code execution or denial-of-service. CISA said «threat actors are actively exploiting these vulnerabilities globally,» urging federal agencies to apply patches by Wednesday.
🔔 Top News
Bitget Resumes Withdrawals After Hack — Cryptocurrency exchange Bitget resumed Bitcoin withdrawals in phases after suspected North Korean hackers breached its systems last week and stole over $387 million. «At 18:31 UTC on September 24, 2026, Bitget’s security systems identified unauthorized transfers involving a limited number of hot wallets,» Bitget said. «Bitget’s cold wallets and the overwhelming majority of platform assets remain secure and unaffected.» According to a real-time fund tracing dashboard published by Coindesk, Circle and Tether have frozen stablecoins worth $339,100 linked to the hack.
PamStealer Adds Live C2 Payload Decryption — A new version of PamStealer has been found to incorporate a new anti-analysis trick that ensures the main payload can only be recovered using a server-side decryption chain. The latest artifacts continue to rely on the same JavaScript for Automation (JXA) dropper mechanism, but modify the lure and the delivery method. «Where earlier variants embedded their payload key material directly in the JXA source, it now fetches a purpose-built decryption utility and completes a key exchange with the server before the payload can be unwrapped,» Jamf said. «Without the server’s cooperation, the payload cannot be recovered statically.»
Placeholder Domain Found References in ~1.7K Repos — The «third-party[.]com» domain, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users. «third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,» Manifold Security said. «Unlike ‘example[.]com,’ third-party[.]com is not IANA-reserved. Anyone could register it, and someone did. Every doc, test, and skill that hard-coded it now points readers at attacker infrastructure.» As of writing, the domain has been marked as malicious and unsafe on both VirusTotal and Google’s Safe Browsing list. Manifold also identified 13 more placeholder domains that are not IANA-reserved, with two of them – yoursite[.]com and your-domain[.]com – serving scams and scareware to macOS visitors and an ordinary parking page to other users.
UNK_CondorFiltration Abuses TeamFiltration in New Campaign — An active TeamFiltration campaign codenamed UNK_CondorFiltration has targeted over 5,700 accounts across 28 Microsoft 365 tenants. The activity has primarily focused on Chilean retail and financial institutions. It originated from 1,487 unique AWS EC2 source IP addresses. «The campaign compromised 7 accounts – all of which were unmanaged functional or service accounts rather than individual employee accounts – highlighting a critical exposure gap around forgotten, non-human identities carrying default or unrotated passwords and no MFA,» Proofpoint said. The activity took place over three waves from late July to August 2026.
EvilTokens Taken Down in Law Enforcement Action — A coalition of law enforcement and private-sector tech companies led by Microsoft dismantled the EvilTokens phishing service, arresting two suspected website admins, Felix Utomi and Waidi Segun Adams, taking down more than 50 websites, and notifying victims of compromised email accounts. Per Coinbase, the EvilTokens operators were said to be working on expanding the kit to target Gmail and Okta accounts at the time of the takedown. Microsoft attributes the development and support of the platform to Storm-2992. EvilTokens is the latest example of professionalization of cybercrime, allowing bad actors to mount phishing campaigns with little effort and at scale. EvilTokens’ notable feature was the device code phishing flow, which took advantage of security gaps in devices that cannot support standard sign-in methods like smart TVs, printers, conferencing tools, and Teams devices. In these attacks, victims are sent a short code and are told to enter that code into a phishing page to complete authentication. The important aspect here is that instead of a legitimate device requesting access, the threat actor initiates the flow and provides the user with a code through a phishing lure. When the code is entered, victims unknowingly authorize the cybercriminals’ session and grant them access without ever handing over their password.
OpenAI Linked to More Website Hacks — AI research lab Transluce found three instances between May and June 2026 in which OpenAI’s agents resorted to hacking when traditional methods failed. This included an attempt on an Australian government public health website. «Notably, the agents did this while attempting mundane data retrieval tasks which were not cyber-related,» Transluce said. «This traffic goes back at least to March 6, 2026 and extends as recently as September 16, 2026, suggesting agents may still be exploiting these services to bypass restrictions.»
️🔥 Trending CVEs
Bugs drop weekly, and the gap between a patch and an exploit is shrinking fast. These are the heavy hitters for the week: high-severity, widely used, or already being poked at in the wild.
Your Next Insider Threat May Not Be Human→ AI agents can access credentials, systems, and sensitive data just like employees. Learn how to uncover these hidden insiders, understand their access, and reduce risk without slowing AI adoption.
📰 Around the Cyber World
Clop Gang Moves Site After ShinyHunters Hack — The Clop ransomware gang moved its data leak site to a new Tor address after its previous server was compromised and defaced by ShinyHunters through an unpatched Grav CMS flaw that’s now assessed to be an unauthenticated path traversal vulnerability (CVE-2026-42608). The vulnerability was patched by Grav in April 2026. In a statement shared with Bleeping Computer, Clop denied having any relationship or ongoing negotiations with ShinyHunters. «We do not know them, we have never worked with them, and at the moment we are not in contact with them; furthermore, we have not provided them with any information, nor will we do so – either now or in the future,» the group was quoted as saying. The development comes in the aftermath of ShinyHunters seizing the FBI’s FBIjobs.gov portal by what it said was a new zero-day in Oracle PeopleSoft.
Konni Targets Ukraine with Malicious LNK Lures — The North Korean threat group known as Konni has been observed using ZIP archives with malicious LNK files masquerading as PDF documents as lures in spear-phishing attacks targeting Ukraine-focused individuals and organizations to deliver a malware called VelvetCake as part of a campaign codenamed Operation Conflict Compass. The LNK file launches a VBScript that establishes persistence via a scheduled task, and triggers a PowerShell script to run every minute. The invoked PowerShell payload functions as a modular downloader designed to fetch and execute secondary server-side scripts. «VelvetCake embeds no fixed post-exploitation capability set locally. It operates as a lightweight task runner that continuously retrieves and executes server-side PowerShell modules, allowing operators to modify functionality without redeploying the core payload,» SOCRadar said. «The campaign likely aimed to gather intelligence on the trajectory of the Russian invasion to gauge the medium-term outlook of the war.»
Kimsuky Conducts Git-Based C2 Attacks — In more North Korea-related malicious activity, the Kimsuky group has resorted to conducting Git-based C2 attacks through malicious LNK files contained within ZIP archives. The activity has been dubbed Operation GitPower. The LNK files use filenames disguised as documents related to financial and corporate operations, including fund disbursement, insurance premiums, interest payments, policy funds, certificate renewal, store master data, customer documents, and Visa payments. These documents are said to have been mass-produced using AI models, spotlighting a trend where the threat actor has used local large language models (LLMs) using Ollama, GPT4All, and Msty to prepare attacks and create decoys. The LNK files serve as delivery vectors for follow-on PowerShell commands retrieved from GitHub Raw Content paths using a GitHub PAT. Select variants have also been observed using Pastebin as an alternative channel. The PowerShell code sets persistence, exfiltrates system information to GitHub, and takes steps to erase itself and the PowerShell command history file.
CISA Flags TeamCity Flaw as Exploited in Ransomware Attacks — CISA confirmed that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July. The flaw, CVE-2026-63077, is a critical authentication bypass vulnerability that lets attackers with HTTP(S) access execute arbitrary operating system commands. «An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,» JetBrains said. It’s currently not known which ransomware group is behind the exploitation activity.
DeepMind Gives Private AI Compute a Secure, Server-Side Memory — Google has announced plans to bring a private, server-side memory to its Private AI Compute platform, giving AI systems long-term continuity across devices without sacrificing privacy. «With this new technical capability, a new persistent memory layer will be able to function like a secure digital vault in the cloud,» Google DeepMind said. «Under this model, the information needed to assist you is sealed within dedicated, encrypted storage, while the cryptographic keys required to unlock it are held exclusively on your personal devices — ensuring your data is inaccessible to anyone else, even Google.»
SectopRAT Hides Inside Legitimate Application — A new campaign has been observed delivering SectopRAT by concealing it within a legitimate program developed by an Italian digital-audio company. It’s suspected that the operators added the malware after the application was installed on customer systems rather than compromising the vendor itself. «SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands,» Fortinet said. «These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.»
Armenian National Sentenced to 2 Years for Ryuk Ransomware Attacks — Karen Serobovich Vardanyan, 34, who was extradited from Ukraine to the U.S. in June 2025, has been sentenced to 24 months in federal prison and 3 years’ supervised release. In July 2026, Vardanyan pleaded guilty to conspiracy and computer fraud for his role in Ryuk ransomware attacks and an extortion conspiracy targeting companies across the U.S. «Between November 2019 through April 2020, Vardanyan illegally accessed computer networks of victim companies to deploy Ryuk ransomware on compromised servers and workstations,» the U.S. Justice Department said. «Ryuk ransomware is a type of malicious software designed to encrypt data on a victim’s computer or network and prevents the victim from accessing the encrypted files until a ransom is paid. Vardanyan worked with his co-conspirators to attack a company in Michigan that paid 200 bitcoin, or over $1.1 million at the time of payment, to restore access to their network. They also attacked a company in Wilsonville, Oregon, and in February 2020 attacked a school in Texas.» Vardanyan and his co-conspirators are said to have illegally accessed computer networks of victim companies and deployed ransomware on hundreds of compromised servers and workstations, receiving over $15 million in illicit proceeds at that time. Vardanyan has also been ordered to pay over $1.21 million in restitution.
Scattered Spider Member Gets 45-Month Prison Sentence for Cybercrime Spree — Ahmed Hossam Eldin Elbadawy, of Texas, who admitted to being a member of the notorious cybercrime group Scattered Spider, has been sentenced to 45 months in prison. Following that, Elbadawy will face a three-year parole and is prohibited «from using privacy-based blockchain virtual currencies» without prior approval. Elbadawy was charged in November 2024 along with four other defendants.
Using Rogue External MFA Provider to Steal Passwords — Varonis has demonstrated a new attack technique called TrustSink which turns a rogue external MFA provider into a «persistent credential trap» within a legitimate sign-in flow. «An attacker with high privileges can register a rogue External Authentication Method (EAM) and place a convincing password page inside the legitimate sign-in flow,» Varonis said. «The page captures the password in plaintext while the provider returns a valid signed token, completing the login without an error. Resetting a captured password did not remove the rogue provider. It remained in the authentication flow and captured the replacement password at the user’s next sign-in.» TrustSink builds on previous research by security researcher Dirk-Jan Mollema, who found that a rogue registered EAM provider can be used to bypass MFA by returning a signed JWT without performing a real authentication check.
New x47.c Botnet Drains AI API Credits — A previously undocumented Windows botnet dubbed x47.c has been advertised as capable of supporting 18 DDoS attack methods, browser credential theft, SOCKS5 proxies, and an AI module that uses SpaceXAI Grok to establish persistence on infected machines based on the current state. It’s sold by a threat actor named WraithTools for a $200 base package with a $150 DDoS add-on. The entire toolset costs $950. «One of the advertised methods, ‘AI API drain,’ is designed to exhaust a victim’s paid AI credits,» Qrator Research Labs said. «Using a valid API key, an operator can send repeated requests that consume the account’s balance or increase its bill. The AI drain command starts with a valid API key for the account being targeted. Because those requests go straight to the provider, they do not need to pass through the victim’s application. The website can remain reachable while the account behind its AI features runs out of credits. If the provider rejects further requests once the account balance is exhausted or an enforced limit is reached, legitimate users lose access to those features.»
Hundreds of Leaked GitHub App Keys Still Active — A new analysis from GitGuardian has found that hundreds of GitHub App private keys leaked in public code still work. From over 500,000 exposed RSA keys, 474 have been found to authenticate as 440 distinct Apps on GitHub’s API. «72% of the compromised Apps had some content permissions, meaning that they could access private repositories of the organizations that use them,» GitGuardian said. » 207 of them have content write permissions and can modify those repositories. Even worse, 44 Apps have organization administration privileges, 40 can administer self-hosted runners, and 98 can control workflows. Those permissions could allow a complete takeover of the target organization, or code execution on its internal infrastructure, with or without further supply-chain compromise.»
Conclusion
The common thread this week was not sophistication. It was neglect. Forgotten accounts, stale assumptions, old flaws, exposed services, and tooling that keeps getting more capable faster than the controls around it.
That is usually how these weeks land: the dramatic stories get attention, but the quieter failures keep doing the real work underneath. The patch nobody rushed, the identity nobody owned, the placeholder nobody questioned, the service nobody hardened.
That’s it for this week. Patch the obvious stuff, check the forgotten stuff, and assume somebody else already noticed it too.
