A routine software update can now lead to a cloud breach This article explores cloud credentials attackers. . Malware, disguised as trusted packages and development tools, can run on developer computers and automated build systems before applications launch.

According to a report shared with ZeroOwl (ZeroOwl), developers' environments and cloud infrastructure should be viewed as a single, interconnected attack surface, rather than separate security issues. As demonstrated by attacks on SAP packages, stealing these secrets can expose systems beyond the original software project, even if the compromised application never reaches production. This resulted in the collection of secrets, weakening package verification, intercepting commands, and sometimes adding an attacker key to maintain remote access.

The European Commission's cloud breach highlights the broader implications of stolen cloud credentials, with attackers moving from a poisoned development tool to unauthorized access and data theft. Qualys advises identifying every credential the affected machine or build system could access, revoking or rotating exposed secrets, and reviewing cloud activity during the period of exposure. Teams should reduce installation risks by approving dependencies, pinning versions through lockfiles, and ensuring builds preserve those files.

Short-lived credentials minimize reliance on permanent keys, while stricter cloud policies prevent unauthorized administrator creation and disabled logging. Implement AWS Instance Metadata Service v2 (IMDSv2), prefer federated identities or managed identities when available, and maintain permissions to a minimum.