This article explores the security implications of serverless authentication across major cloud platforms. It details how attackers target serverless functions to exploit vulnerabilities arising from insecure code and misconfigurations. The mechanics of serverless authentication are explained for AWS Lambda, Google Cloud Functions, and Azure Functions. The article outlines potential attack vectors for token exfiltration, including SSRF and RCE, and provides simulations demonstrating how tokens can be extracted and misused. Detection strategies are discussed, focusing on identifying serverless identities and anomalous behavior. Prevention measures are suggested, emphasizing the principle of least privilege and robust input validation. The article concludes by stressing the importance of understanding serverless credential mechanics and implementing proactive security measures to protect cloud environments.
Fog ransomware attack uses unusual mix of legitimate and open-source tools
Source: https://www.bleepingcomputer.com/news/security/fog-ransomware-attack-uses-unusual-mix-of-legitimate-and-open-source-tools/
Over 80,000 Microsoft Entra ID Accounts Targeted Using Open-Source TeamFiltration Tool
Source: https://thehackernews.com/2025/06/over-80000-microsoft-entra-id-accounts.html
Salesforce Industry Cloud Hit by 20 Vulnerabilities Including Several 0days
Source: https://hackread.com/salesforce-industry-cloud-20-vulnerabilities-0days/
In 2023, During a security assessment of Masa CMS, an open-source content management system.
We discovered 11 vulnerabilities in Masa CMS, some allowing server takeover.
Why does it matter? Because it's easy to assume that "if it's open source, someone must have already reviewed it."
But the truth is:
No one looks until someone really looks.
Now, imagine if these vulnerabilities had been found by a malicious actor instead of a security researcher…
