A developer receives an unexpected message on LinkedIn—a promising job opportunity. The assessment involves installing a seemingly harmless Python package. Unbeknownst to them, that package silently harvests GitHub tokens, AWS API keys, and Azure service credentials, granting attackers direct access to cloud environments within minutes. The breach? No email alert, no firewall trigger, no traceable entry point.

This isn’t a hypothetical scenario. It’s the blueprint for a $2 billion cryptocurrency heist executed by a single adversary group, now fragmented into specialized units targeting fintech, espionage, and cloud infrastructure. The attack chain—dubbed the identity and access management (IAM) pivot—exposes a critical flaw: most security stacks are designed to stop threats that no longer exist.

Key vulnerabilities in the attack chain

  • Entry: Trojanized packages delivered via WhatsApp, LinkedIn, or direct messages bypass email security entirely. Recruitment-themed lures, tailored to specific industries, trick developers into installing malware-laced dependencies.
  • Pivot: Stolen credentials enable attackers to assume IAM roles undetected. In one case, a European fintech firm’s cloud configurations were hijacked, diverting cryptocurrency to attacker-controlled wallets—all without triggering perimeter alerts.
  • Objective: AI infrastructure, governed by the same IAM policies, becomes the final target. A hijacked developer identity can disable logging, enumerate models, and execute lateral movement through autonomous AI agents like OpenClaw, which integrates with corporate systems via Model Context Protocol (MCP).

The speed of these attacks is alarming. Sysdig documented a breach where compromised credentials escalated to cloud admin privileges in eight minutes, traversing 19 IAM roles before disabling audit logs. No exploit, no malware—just a valid credential and unmonitored behavior.

Why traditional defenses fail

Dependency scanning catches malicious packages, but most organizations lack runtime behavioral monitoring—the critical second layer that detects credential exfiltration during installation. Cloud IAM policies authenticate identities but don’t analyze whether a developer suddenly accessing 50 models is anomalous. AI gateways validate tokens, yet ignore whether the accessing identity is probing infrastructure or disabling security controls.

Google Cloud’s 2025 Threat Horizons Report underscores the scale: 76.5% of cloud incidents stem from weak credentials or misconfigurations. Attackers don’t need exploits when they already have the keys.

What organizations should audit in the next 30 days

  • Developer workstations: Deploy runtime monitoring to detect credential access during package installation. Most dependency scanners stop at the package—they don’t watch what happens next.
  • Cloud IAM: Implement Identity Threat Detection and Response (ITDR) to baseline identity behavior. A developer who normally queries a code-completion model twice a day shouldn’t suddenly enumerate every Bedrock model in the account.
  • AI infrastructure: Enforce behavioral access controls for model endpoints. Logs should be immutable, and model invocation requests should correlate with historical identity patterns.

The perimeter is no longer the battleground. Identity is. Without monitoring how credentials are used—not just whether they authenticate—the gap between compromise and full cloud dominance shrinks to minutes. And the attackers are already moving faster.