Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Persistence/ T1098.001

T1098.001Additional Cloud Credentials

T1098.001 — Additional Cloud Credentials is a MITRE ATT&CK technique in the Persistence tactic. Clankerusecase tracks 7 detection use cases covering it and 55 threat-intel articles citing it.

PersistencePrivilege Escalation
View on the matrix → Filter Detection Library MITRE official spec ↗
7Use cases
55Articles
0Sub-techniques
2Tactics
↑ Parent technique: T1098 · Account Manipulation

Use cases covering this technique (7)

OAuth consent / suspicious app grant Internal actions · alerting DSΣP [WEEKLY] OAuth Device-Code Consent Phish to Cross-IP Cloud Token Replay Internal c2 · alerting DSPDD [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Internal exploit · alerting DSPDDCW Azure AD Service Principal New Client Credentials ESCU actions · alerting P O365 Service Principal New Client Credentials ESCU actions · alerting P [LLM] AI resource key creation paired with logging/alert teardown in cloud control plane Bespoke install · hunting SPDDCW [LLM] High-privilege OAuth consent grant to Flowise application (offline_access / Mail / Files) Bespoke install · hunting DSΣDD

Articles citing this technique (55)

crit Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic art-10
crit [GHSA / CRITICAL] CVE-2026-64859: New API: User List API Leaks Root User Access Token Leading to Privilege Escalation art-15
crit CTM360 Uncovers Over 3,000 Recruitment Phishing URLs Using Browser-in-the-Browser (BitB) Credential Traps art-45
high The Agent Baseline: 35 Controls, But Where Should You Start? art-77
crit Show, Don't Tell: What Evo Continuous Offensive Security Found in a Real Enterprise SaaS art-101
high Token Jacking: Cybercriminals Could Be Stealing Your AI Resources art-112
crit [GHSA / CRITICAL] CVE-2026-70478: Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any art-121
crit CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft art-151
crit [GHSA / CRITICAL] CVE-2026-54725: vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-ser art-154
crit [GHSA / CRITICAL] CVE-2026-54588: Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construct art-186
crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188
crit Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials art-193
crit [GHSA / CRITICAL] GHSA-r277-6w6q-xmqw: kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Defa art-205
crit [GHSA / CRITICAL] GHSA-rjg6-39jm-rgg4: @better-auth/scim: account takeover and stale access via SCIM provider-id collision art-211
high Find Unused, Stale, and OIDC-Replaceable GitHub Actions Secrets Across Your GitHub Organization art-221
crit [GHSA / CRITICAL] CVE-2026-56750: Gitea Remember-Me Token Theft Not Invalidating Attacker Session art-232
crit Begun, the Patch Wars have art-253
crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-299
crit [GHSA / CRITICAL] CVE-2026-54072: Authorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URL art-301
crit Authentication Bypass in the default configuration phpBB art-320
high When a vendor's breach becomes yours: lessons from the Klue incident art-356
high EvilTokens: A phishing attack that doesn’t steal your password art-377
high 10 year old critical vulnerability in phpBB affecting tens of millions of users across thousands of forums art-394
high Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages art-426
high What MDM can't protect on developer machines (and what to do about it) art-432
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-434
crit Laravel Lang Supply Chain Advisory art-445
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-447
high Dev Machine Guard Now Supports Linux art-456
high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-473
crit Shai-Hulud Worm Pivots to Multi-Cloud: intercom-client@7.0.4 Hijacked — 361,000 Weekly Downloads, AWS, GCP, and Azure Credentials Now in Sco art-501
crit Bitwarden CLI Hijacked on npm: Bun-Staged Credential Stealer Targets Developers, GitHub Actions, and AI Tools art-503
crit lightning PyPI Compromise: A Bun-Based Credential Stealer in Python art-511
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-514
high "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages art-515
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high It's time to treat browser extensions like supply chain attack vectors art-522
high hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far art-570
crit Cline Supply Chain Attack Detected: cline@2.3.0 Silently Installs OpenClaw art-571
crit Securing the Agent Skills Registry: How Snyk and Tessl Are Setting the Standard art-620
high The Future of AI Agent Security Is Guardrails art-681
crit How a Malicious Google Skill on ClawHub Tricks Users Into Installing Malware art-697
high ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations art-741
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-758
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-875
med Common SAML vulnerabilities and how to remediate them art-1473
high Snyk Apps now GA: An easy, standardized, and secure framework for building custom integrations art-1511
med Control your role! Kubernetes RBAC explored art-1649
crit API Security Guide art-1774
high Supply chain security incident at CircleCI: Rotate your secrets art-1895
crit Getting started with React Native security art-2352
high Responsible disclosure: CodeCov CEO & CTO share learnings from the breach art-2773
med How Snyk is normalizing authentication strategies with Gloo Edge art-3143
med Automating vulnerability monitoring with Snyk, Prometheus and Grafana art-3225