Borrowed Credit: Attackers Keep Winning on Trust They Didn't Earn, and the Fixes Are the Boring Ones
Update (2026-11-01): after this post went up, Northflank told customers to assume every secret stored on its platform was decrypted, and confirmed customer reports of unauthorized AI API key use. A platform that holds other people's secrets is one more case of the pattern below. The rotation order is in our Northflank post. Northflank post
Look at this year's breaches in a row and a pattern shows up that has nothing to do with clever exploits. The attacker did not break the hard outer layer. They borrowed credit that someone else had already built: a platform's reputation, a verified account, a security tool's good name, a publisher's identity, a vendor's script. Whatever sat behind that credit then waved them through.
None of the fixes below are new. They are the habits people who ran their own racks before the cloud took for granted, and that a generation of SaaS convenience quietly retired.
Borrowed SaaS legitimacy
Attackers rent reputation from platforms that nobody blocks.
Zscaler's October 8 report on a suspected TraderTraitor toolchain lists payload downloads from raw.githubusercontent.com, a vercel.app host and a Pastebin link, alongside a lookalike of HashiCorp's domain. A network team that would block an unknown domain on sight does not block GitHub, Vercel or Pastebin. The attacker is spending those platforms' credibility, not their own.
The same move works on accounts. Hudson Rock and ADAMnetworks traced 108 ClickFix ads over roughly 48 hours to HBO Max's verified Reddit account, as we covered in September. A verified badge is a statement about identity, not about what is being posted today. Nobody had set an alert on how often the account posted.
It works on marketplaces. A tampered build of the Claude Code extension sat in Cursor's own marketplace for about 11 hours on October 29. Cursor says at most 5,000 users were exposed and that the compromise was in its marketplace, not Anthropic's distribution. And it works on a maintainer's own automation: Radware found shell commands hidden in the titles and comments of 83 GitHub issues and pull requests across 61 repositories, and in at least two projects the maintainers' workflows ran them.
The boring controls: let developer machines reach only the hosts they need, so a download from a platform nobody blocks still has to clear a list. Treat a verified badge as the start of a question. Stop extensions auto-updating on any machine that holds keys. Never paste event text, such as an issue title, into a script.
Outsourced security
The tool you bought to protect you carries the same trust, and an attacker who gets into it inherits that trust.
Between late February and March 19, Wiz and BleepingComputer report that TeamPCP used a misconfigured GitHub Actions environment to extract a privileged token from Aqua Security's Trivy scanner, and that Aqua's containment was incomplete, which let the actor return. On March 19 it published a trojanized Trivy release, live for roughly three hours, and compromised Actions tags that stayed active for up to 12 hours. Anyone who ran the scanner in CI handed a stealer the same secrets the scanner was meant to protect. The tool people trusted to find bad software was the bad software for that window.
On October 31, Chainalysis disclosed an intrusion in which an outside actor used what it called offensive agentic techniques to reach its systems and internal tools. Chainalysis says the exposed data was user IDs, names, email addresses and organization role labels, and that investigation content, credentials and session tokens were not reached. It did not say how the actor got in. A security vendor's customer list is a targeting list, and customers never chose to hand that list to an attacker.
The boring controls: pin every GitHub Action to a full commit hash, because a tag can be moved to point somewhere new. When a vendor says containment was complete, ask what rotated. And keep a plain inventory of what each security vendor holds about you, because that is your exposure the day they are breached.
Outsourced development
Everything you pull in is development you did not do yourself, and it arrives wearing its publisher's name.
On May 11, according to The Register, an attacker submitted a malicious commit from a fork to the TanStack repository. Automation ran the build, poisoned the GitHub Actions cache and pulled a publishing token out of runner memory. Eighty-four malicious package versions went out between 19:20 and 19:26 UTC, about six minutes. TanStack says no maintainer was compromised. The malware read more than 100 hardcoded credential paths and installed a switch that wipes the disk if a stolen token is revoked. The identity that signed those versions was real, and nobody had stolen a person.
Polymarket is the same idea at the web layer. A page-speed script it loads from DebugBear was replaced after DebugBear's DNS was compromised through its registrar, according to DebugBear, and it ran inside signed-in traders' browsers. About $2.7 million was refunded to 726 wallets. Polymarket's own servers were not reported as breached. We wrote that up here.
Two more show where the middle layer is soft. Lidl said its own shop was unaffected while customer data held by an IT service provider walked out, the same shape as the Nissan cases we covered earlier. And SentinelOne reports that an India-based IT services provider was compromised through a DevOps engineer's MacBook while the hunters were chasing the same North Korean backdoors. SentinelOne does not describe an outsourcing arrangement, and we are not claiming one. We are pointing out that a small IT vendor's engineer laptop is somebody's trusted path.
The boring controls: short-lived publishing tokens and no secrets available to builds that start from a pull request. No third-party script on a page where someone signs anything, and registry lock plus hardware-key login on the registrar for any domain you depend on. Minimize what each provider holds and expire what they no longer need. And treat a stranger's code, a recruiter's coding test included, as hostile until it runs on a disposable machine.
The creamy middle
Every case above has the same architecture: a hard shell and a soft interior where trust is passed along and nobody checks it again. A package is trusted because its publisher is trusted. A script is trusted because its host is trusted. A scanner is trusted because it is a scanner. Once an attacker is wearing any of those, the interior behaves as if the attacker were a colleague.
The Binance theft is the same architecture at the largest scale on record. Binance's first account is that an engineer's laptop gave access to a service container, and no researcher outside Binance has said how the laptop was first compromised. We wrote about it in Binance Lost $6.4 Billion in One Afternoon.
The argument for a thicker skin is not a new product category. It is layers inside the shell, so that borrowing one credential does not unlock the rest: egress lists, signing keys that live nowhere near a developer's laptop, pinned dependencies, tokens that expire in minutes, alerts on the behavior of accounts you own, and an inventory of who holds what about you. Each is old. Each costs less than the incident it replaces.
These are our suggestions, not findings from the reports above.
What we hold, and what we don't
We hold the file hashes and domains from Zscaler's October 8 report as TraderTraitor-suspected tooling, ingested on November 1 as a third-party source and not as our own detection. We left out raw.githubusercontent.com, pastebin.com and the vercel.app host because blocking those platforms would hit innocent users, which is the point of this post. We hold the indicators from the Cursor extension backdoor. We did not check each of the other cases for indicators and make no claim about them.
Limits
This post draws on public reporting by Zscaler, SentinelOne, Hudson Rock, ADAMnetworks, Radware, Wiz, BleepingComputer, The Register, Chainalysis and The Hacker News, plus our earlier coverage. We have not independently verified any of it. Some details differ by source, such as Trivy's tag counts, and the Chainalysis intrusion method was not disclosed. Zscaler and SentinelOne describe the FLATROOF and ROOFDECK implants differently, and we have not reconciled the two. Zscaler itself calls the TraderTraitor link suspected.
Five percent of this is wrong somewhere. It always is. The numbers will move again before you finish reading.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments