The Week Identity Attacks Started Looking Like SaaS

This week broke a pattern I've grown comfortable with. The usual identity-adjacent noise — credential stuffing, a sloppy phish, somebody's S3 bucket left wide open — gave way to something that looks a lot more like a product roadmap.

Start with the supply-chain worm code now sitting in a public repository. The package itself is less interesting than the packaging. Build instructions. Config flags. Helpful comments. Whoever forks this next won't need to understand how token theft works at the npm install layer. They just need a target list.

Then the $5,000-a-month RAT making the rounds. The pitch: full browser cloning. Cookies, session tokens, the works. That matters because most enterprise SSO deployments still treat a live browser session as proof of life. If an attacker can replay your authenticated state from their machine, your IdP sees a happy, already-authenticated user. The SAML assertion was valid yesterday. The OIDC ID token hasn't expired. Why would the relying party complain?

Would MFA have helped? Honestly, only sometimes. Phishing-resistant factors bound to the device — passkeys per FIDO2, or hardware-backed WebAuthn — break the replay. TOTP and push notifications do not. If the session cookie is already minted, the second factor was already satisfied. RFC 8705's token binding would matter here, if anyone shipped it.

The third thread is the one I keep chewing on. Researchers showed AI agents can be talked into leaking real credentials — not hypothetical secrets, actual API keys and OAuth tokens from connected tools. The attack surface is the agent's willingness to be helpful. Prompt injection meets authz boundaries that were never designed to survive a chatty intermediary. Your agent has scopes. Someone else's instructions are now driving it.

This is where auth and authz separate in a useful way. The agent authenticated correctly. It proved who. The failure is what it was allowed to do once a third party hijacked the steering wheel. OAuth scope grants assume the client is acting on the user's behalf. An injected prompt is also, technically, acting on the user's behalf. The protocol can't tell.

What ties the three stories together is operational polish. Mule networks now have onboarding flows. Malware-as-a-service has tiered pricing. The worm kit has a README. The maturity curve on the offense side is steeper than the one on most identity teams' roadmaps.

A few things worth doing this quarter:

• Audit which of your workforce SSO flows accept a bare session cookie as sufficient. Add device-bound signals or step-up for sensitive scopes.
• Move admin and break-glass accounts to passkeys. Not next year.
• Treat AI agent credentials as standing privileged access. Rotate, scope tightly, log every tool call.
• Assume any token an attacker can read from a browser, they can replay.

The password isn't dying fast enough. Neither is the long-lived session cookie behind it.