Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1098.001

T1098.001Additional Cloud Credentials

T1098.001 — Additional Cloud Credentials is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 5 detection use cases covering it and 74 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
5Use cases
74Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1098 · Account Manipulation

Use cases covering this technique (5)

OAuth consent / suspicious app grant Internal actions · alerting DSΣP [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW Azure AD Service Principal New Client Credentials ESCU actions · alerting P O365 Service Principal New Client Credentials ESCU actions · alerting P

Articles citing this technique (74)

high Russian hackers exploit Exchange OWA zero-day for long-term mailbox access art-02
high Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare art-07
crit OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach art-27
crit New Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell Commands art-28
crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct art-42
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-50
high Operation BlueDash Deploys Level RMM and ScreenConnect via Fake Teams Update art-64
high Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable art-71
crit Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available art-72
high Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git art-73
crit CTM360 Research Reveals How Insurance Phishing Has Evolved Into Real-Time Account Hijacking art-74
crit Cl0p Affiliates Target Internet-Exposed PTC Windchill and FlexPLM with Unauthenticated RCE art-75
crit DevMan RaaS Portal Centralizes Payload Builds, Victim Management, and Affiliate Payouts art-76
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-77
crit [GHSA / CRITICAL] GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Defa art-89
crit [GHSA / CRITICAL] GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision art-95
crit BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery art-96
crit Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller art-97
high ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link art-99
crit Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry art-102
crit Golden Chickens Resurfaces With Four New Malware Families and Modular Implants art-103
crit NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats art-104
crit Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say art-105
crit Email threat landscape: Q2 2026 trends and insights art-108
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-114
crit [GHSA / CRITICAL] CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session art-126
high New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery art-132
crit Begun, the Patch Wars have art-150
high Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery art-157
high Turning threat intelligence into decisive action with Defender Experts art-167
crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-204
crit [GHSA / CRITICAL] CVE-2026-54072: Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL art-206
crit [GHSA / CRITICAL] CVE-2026-53513: @better-auth/sso provider registration has server-side request forgery via unvalidated OIDC endpoints art-224
crit [GHSA / CRITICAL] CVE-2026-55500: 9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete C art-234
crit [GHSA / CRITICAL] GHSA-vjc7-jrh9-9j86: 9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats art-237
crit When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website art-246
crit Authentication Bypass in the default configuration phpBB art-247
crit [GHSA / CRITICAL] CVE-2026-50027: mcp-memory-service: Missing Authentication on Document API Endpoints Allows Unauthenticated Memory Read/Wr art-263
high When a vendor's breach becomes yours: lessons from the Klue incident art-307
crit Pickle in the Middle – Hijacking Vertex AI Model Uploads for Cross-Tenant RCE art-327
high EvilTokens: A phishing attack that doesn’t steal your password art-331
high 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums art-348
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-380
high What MDM can't protect on developer machines (and what to do about it) art-386
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-388
crit Laravel Lang Supply Chain Advisory art-399
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-401
high Dev Machine Guard Now Supports Linux art-410
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-423
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-427
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-456
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-458
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-466
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-469
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-471
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high It's time to treat browser extensions like supply chain attack vectors art-477
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-525
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-526
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-585
high The Future of AI Agent Security Is Guardrails art-647
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-664
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-710
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-728
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-852
med Common SAML vulnerabilities and how to remediate them art-1451
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1488
med Control your role! Kubernetes RBAC explored art-1626
crit API Security Guide art-1751
high Supply chain security incident at CircleCI: Rotate your secrets art-1872
crit Getting started with React Native security art-2329
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2750
med How Snyk is normalizing authentication strategies with Gloo Edge art-3120
med Automating vulnerability monitoring with Snyk, Prometheus and Grafana art-3202