Bitsight Report Finds Exposed Secrets Dominate Identity-Access Signals
Summary
Bitsight analyzed identity-related threat intelligence from the past year, finding the most results for non-human identity exposure. The figures are indicators, not confirmed breach counts; code repositories accounted for most results in that category.
Key points
- The analysis covered five pathways and reported 67,145 total results; Bitsight cautions that these are breach-adjacent indicators, not confirmed breach counts.
- Non-human identity exposure had the most results: 42,189, including API keys, tokens, service accounts, and hardcoded credentials. Code repositories accounted for 36,466.
- Stolen or compromised credentials produced 15,228 results, the largest signal among the report’s traditional human-credential categories.
- The report counted 5,142 MFA and session-bypass results and 4,207 infostealer-related results, including references to RedLine, Raccoon, Lumma Stealer, and Vidar.
- OAuth consent abuse had 379 results; the report describes malicious apps and illicit permissions as possible routes to cloud and SaaS access.
- Bitsight says the results include varied material and may contain tools, code, advertisements, or discussion—not evidence of a confirmed incident in every case.
- The report recommends attention to credential hygiene, session and token protection, OAuth permissions, service-account management, and secret scanning in code repositories.
Article Details
- Publisher
- Bitsight
- Report Period
- Past 12 months
- Scope
- Identity-related threat intelligence associated with breach, intrusion, compromise, unauthorized access, or incident-related language.
- Sample Size
- 67,145 total results across five identity-related access pathways.
- Key Statistics
- Non-human identity exposure: 42,189 results (62.8%); 36,466 were from code repositories. These are indicators, not confirmed breaches.
- Stolen or compromised credentials: 15,228 results (22.7%).
- MFA and session bypass: 5,142 results (7.7%).
- Infostealers: 4,207 results (6.3%).
- OAuth consent abuse: 379 results (0.6%).
- Recommendations
- Strengthen credential hygiene and use phishing-resistant MFA.
- Monitor sessions and protect tokens.
- Govern OAuth permissions.
- Manage service accounts.
- Scan code repositories for exposed secrets.
MITRE ATT&CK
T1078 · Valid AccountsThe report describes attackers using stolen, reused, compromised, or otherwise valid credentials to gain access.T1528 · Steal Application Access TokenThe report describes theft and reuse of tokens, including OAuth-related tokens, to gain access.T1539 · Steal Web Session CookieThe report describes stealing session cookies to access authenticated sessions.T1566 · PhishingThe report discusses phishing as a way attackers obtain identity material, including consent phishing.
Threat Actors
Malware
ChainDropPublic reporting on TeamPCP and Mini Shai-Hulud shows how exposed developer and non-human identities create real world risk. TeamPCP has carried out repeated software supply chain attacks involving malicious codeLumma StealerThe infostealer category returned 4,207 results and included malware families like RedLine, Raccoon, Lumma Stealer, and Vidar. These tools help attackers collect the identity material they need before trying to accessRaccoonactivity. The infostealer category returned 4,207 results and included malware families like RedLine, Raccoon, Lumma Stealer, and Vidar. These tools help attackers collect the identity material they need beforeRedLinemeaningful activity. The infostealer category returned 4,207 results and included malware families like RedLine, Raccoon, Lumma Stealer, and Vidar. These tools help attackers collect the identity material they needVidarcategory returned 4,207 results and included malware families like RedLine, Raccoon, Lumma Stealer, and Vidar. These tools help attackers collect the identity material they need before trying to access an
Products
Azurebut they show that OAuth tokens, refresh tokens, app passwords, backup codes, TOTP setup, passkeys, Azure AD, M365, and Google Workspace are being discussed at much greater volume across the broader threatAzure ADbut they show that OAuth tokens, refresh tokens, app passwords, backup codes, TOTP setup, passkeys, Azure AD, M365, and Google Workspace are being discussed at much greater volume across the broader threatGitHubsearch reinforces how widespread this issue is. Terms tied to exposed secrets, including .env, AWS keys, GitHub tokens, private keys, SSH keys, service accounts, API tokens, cloud keys, and access keys, returnedGoogle WorkspaceOAuth tokens, refresh tokens, app passwords, backup codes, TOTP setup, passkeys, Azure AD, M365, and Google Workspace are being discussed at much greater volume across the broader threat landscape. In other words,Microsoft 365 Apps for Enterpriseor illicit consent grants. The top products associated with this category included Azure, Microsoft 365, Azure AD, M365, and OneDrive, which reinforces that this risk is closely tied to cloud identity andMicrosoft OneDriveThe top products associated with this category included Azure, Microsoft 365, Azure AD, M365, and OneDrive, which reinforces that this risk is closely tied to cloud identity and SaaS environments. OAuth consent