Researchers reported multiple cases where AWS autonomous agents could be manipulated with prompt injection to reveal or extract cloud credentials. In demonstrations, the agent returned live temporary AWS credentials, enabling access to code, other agents, and sensitive data, showing how a single manipulated “conversation” can expand into broad cloud access if roles are over-permissioned.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Imagine our AWS AI agent casually pasting its own cloud keys into a chat window… to a stranger. Researchers did exactly this: they asked an AWS AgentCore Harness agent, in plain English, to dump its AWS STS credentials, access key, secret, session token, and they were live. Another test told the agent to run a shell command; the built-in shell, running as root, reached into the same memory where plaintext credentials were stored. Once they had those keys, they exported them off the platform, pulled container images, browsed source code as root, even discovered other agents in the region and read their private conversations. One poisoned agent memory basically turned into a Manchurian Candidate sitting inside the cloud. Here’s the move: if you own or build AWS agents, hard-block any prompt or tool call that exposes keys or tokens. Treat the agent like a root user, if it can see a secret, it must never be allowed to print it.
Researchers describe an active, widespread email campaign that tricks employees with voicemail-themed messages and steals Microsoft 365 login sessions (including MFA codes). After taking over accounts, attackers quietly search and collect payroll/HR/finance emails and identify people involved in…
Researchers described how an external user with only chat access to an Amazon Bedrock AgentCore agent could prompt it to fetch a cloud credential endpoint and inadvertently reveal temporary AWS credentials. Those credentials could then be used to enumerate other agents, access container images,…
Threat groups are actively targeting healthcare and pharma staff using phone-based social engineering (“vishing”) and look‑alike medical domains to steal employee login credentials. Researchers say attackers pressure employees to click password-reset or MFA-reset links, and multiple…
Researchers observed a coordinated social-engineering operation (“Spring Ring”) where attackers used external Microsoft Teams accounts to pose as internal IT help desk staff and start voice calls. Victims were pressured to install remote-control tools (like Quick Assist or other RMM software) or…
Research and incident examples show attackers increasingly using trusted collaboration tools (like Microsoft Teams and Slack) to impersonate IT/support or known community members, then push victims to phishing sites, approve MFA prompts, or run malicious files. Because messages come through…
Researchers found an active campaign using fake AWS sign-in pages and an Apple ID decoy page to pull victims onto attacker-controlled websites. Visiting these pages can trigger an iOS exploit chain that installs GHOSTBLADE and steals sensitive data like iCloud, Keychain, and Wi‑Fi credentials.
