Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1098.001

T1098.001Additional Cloud Credentials

T1098.001 — Additional Cloud Credentials is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 8 detection use cases covering it and 79 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
8Use cases
79Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1098 · Account Manipulation

Use cases covering this technique (8)

OAuth consent / suspicious app grant Internal actions · alerting DSΣP [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW Azure AD Service Principal New Client Credentials ESCU actions · alerting P O365 Service Principal New Client Credentials ESCU actions · alerting P [LLM] Budibase: API key minted via /api/global/self/api_key then /api/public/v1/roles/assign within 5m Bespoke exploit · alerting SPDD [LLM] nebula-mesh CVE-2026-47724 — cross-tenant host identity hijack via /hosts/{id}/reenroll → /enroll chain Bespoke install · alerting SPDD [LLM] Shadow Credentials: msDS-KeyCredentialLink attribute modification Bespoke install · alerting DSΣPDDCS

Articles citing this technique (79)

crit Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication art-09
high Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit art-17
high Google Sues Chinese Smishing Network Accused of Using Gemini AI in Phishing art-18
crit [GHSA / CRITICAL] CVE-2026-48150: Budibase: Workspace-scoped builder escalates to global admin via /api/public/v1/roles/assign art-20
crit China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade art-22
crit Early Warning Signs of Supply-Chain Attacks Live in the Dark Web art-27
high Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code art-28
crit Rethinking MDR as Attackers and Defenders Embrace AI art-30
crit LangGraph Flaw Chain Exposes Self-Hosted AI Agents to Remote Code Execution art-32
high INTERPOL Operation Takes Down Sniper Dz Phishing Platform, Arrests Administrator art-33
high Europol Disrupts AudiA6 Crypto Laundering Service Used by Ransomware Gangs art-36
crit ShinyHunters Exploits Oracle PeopleSoft Zero-Day (CVE-2026-35273) to Breach Universities art-37
high New Attacks Trick OpenClaw AI Agent Into Running Code and Leaking Secrets art-41
crit New GreatXML Exploit Bypasses Windows BitLocker via Recovery Partition XML Files art-42
crit The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm art-44
crit [GHSA / CRITICAL] CVE-2026-48039: Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access Token art-47
crit Cybersecurity Stars Awards 2026: Winners Announced Across 95 Categories art-48
high AI Broke Vulnerability Management. That's Why CISOs Are Moving Budget to BAS. art-51
crit OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack art-53
high GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks art-55
crit China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance art-59
crit Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities art-61
crit Langflow Vulnerability CVE-2026-5027 Exploited for Unauthenticated RCE art-62
crit Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs art-67
high 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums art-69
crit Microsoft Defender RoguePlanet Zero-Day Grants SYSTEM Access on Updated Windows art-71
high Meta to Use Off-Site Business Data for Feed and AI Personalization art-81
crit Microsoft Restores Some GitHub Repos, Keeps Others Offline as Miasma Probe Continues art-82
crit WinRAR Flaw Exploited by Russia-Aligned Groups to Deploy Stealers in Ukraine art-86
crit Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models art-87
crit New FROST Attack Lets Websites Track What Sites and Apps You Open via SSD Timing art-89
high Hades PyPI Attack: 19 Packages Poisoned to Auto-Run Bun Credential Stealer art-90
crit LiteLLM Flaw CVE-2026-42271 Exploited in the Wild, Chains to Unauthenticated RCE art-92
crit [GHSA / CRITICAL] CVE-2026-47724: nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation art-96
crit One-Character Linux Kernel Flaw Enables Local Root Access, Exploits Now Public art-100
crit Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order art-101
crit AI Phishing Is Crushing SOCs with Alert Volume: How to Reduce Tier 1 Overload art-103
crit [GHSA / CRITICAL] CVE-2026-47430: Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from art-105
crit VerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances art-107
crit UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign art-108
high Free Apps Are Quietly Turning Smart TVs Into Web-Scraping Proxies for AI art-114
high Reporting from Vegas: Networking, AI, and good boys art-126
crit Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign art-139
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-159
high Typosquatted npm packages used to steal cloud and CI/CD secrets art-183
high What MDM can't protect on developer machines (and what to do about it) art-186
crit Out of the Crypt: The Evolving Cyber Extortion Economy art-193
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-194
crit Laravel Lang Supply Chain Advisory art-211
crit [GHSA / CRITICAL] CVE-2026-46716: Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron art-213
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-215
crit Paved With Intent: ROADtools and Nation-State Tactics in the Cloud art-218
high Dev Machine Guard Now Supports Linux art-234
crit The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-248
crit [GHSA / CRITICAL] CVE-2026-46354: Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft art-249
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-254
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-269
crit Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools art-316
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-333
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-335
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-343
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-346
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-348
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-352
high It's time to treat browser extensions like supply chain attack vectors art-354
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-403
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-404
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-465
high The Future of AI Agent Security Is Guardrails art-547
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-564
high G_Wagon: npm Package Deploys Python Stealer Targeting 100+ Crypto Wallets art-604
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-624
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-642
crit Shai-Hulud: Self-Replicating Worm Compromises 500+ NPM Packages art-690
crit s1ngularity: Popular Nx Build System Package Compromised with Data-Stealing Malware art-778
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-789
med Common SAML vulnerabilities and how to remediate them art-1307
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1332
med Control your role! Kubernetes RBAC explored art-1411