It's been a busy month in cybersecurity. High-profile incidents hit Fortinet, Klue, Oracle PeopleSoft, and others. While the specifics differ, there's a clear throughline – and it goes beyond "identity is important." The attack surface has shifted. Credentials are only one part of the picture now.
When attackers don't break in – they log in
If June's security news felt unusually identity-heavy, that's because it was.
Start with Fortinet. Researchers uncovered a publicly exposed directory containing over 86,600 sets of cleartext credentials and Kerberos hashes harvested from Fortigate firewalls. Once inside those perimeter devices, attackers used packet sniffing to harvest credentials across Active Directory environments – compromising internal accounts without direct internal access. CISA issued a hardening advisory on June 18.
Then look at Klue. Threat group Icarus got in through a legacy credential tied to an abandoned integration project, harvested OAuth tokens Klue held on behalf of its customers, and used those tokens to query connected Salesforce environments directly. No phishing. No brute force. Just legitimate API calls made with stolen keys. Confirmed victims include Recorded Future and HackerOne.
Different incidents, same pattern: attackers are using trusted access paths instead of breaking through defenses.
Other incidents reinforce this from different angles. The Oracle PeopleSoft campaign (CVE-2026-35273, CVSS 9.8) exploited an unauthenticated vulnerability – no login required. A flaw in SimpleHelp (CVE-2026-48558, CVSS 10.0) let attackers forge identity tokens and gain full technician-level sessions because the system never validated them. If systems are overexposed or identity validation is weak, your IAM controls never come into play.
Then there's LiteLLM, which highlights a different problem: authorization failures. The /config/update endpoint didn't enforce admin role checks, so any authenticated user could modify proxy configurations or overwrite admin credentials. Getting authentication right isn't enough. What users can do after they've logged in matters just as much.
The connecting thread
Each incident exploited a different credential type – cleartext passwords, Kerberos hashes, OAuth tokens, forged OIDC tokens, missing role checks. The attack surface isn't just "passwords." It's every access path across your environment, and most organizations don't have consistent visibility across all of them.
Legacy integration credentials, non-human service accounts, and federated identity tokens are often provisioned and left unreviewed for months or years. That's the gap attackers found in June.
Modern IAM controls tend to be strong for cloud and SaaS – but weaker in legacy, remote access, and terminal-based systems. Disconnected applications outside centralized IAM are common, and they frequently rely on weaker authentication. Attackers know that well.
What to do about it
Inventory every access path. Map all active credentials – human and non-human – including OAuth tokens, API keys, service accounts, and integration credentials. You can't secure what you haven't documented.
Treat non-human identities as privileged. Service accounts and integration tokens carry significant blast radius. Apply the same lifecycle management and rotation discipline you'd apply to admin accounts. The Klue breach is exactly what happens when you don't.
Enforce phishing-resistant MFA where it matters most. Perimeter devices, RMM platforms, and identity providers are high-value targets. If a single session provides broad access, it needs stronger protection.
Validate tokens and authorization at every layer. Token validation failures and weak permission models are showing up just as often as credential theft. Authentication alone isn't enough.
Bring legacy and terminal-based access into the same policy plane. Green screen and terminal emulator sessions are often outside modern IAM policy scope. Extending MFA, SSO, and session monitoring to host access environments closes a persistent gap – one attackers are well aware of.
The takeaway
The lesson from June isn't just that identity attacks are increasing. It's that identity has become the connective layer across nearly every type of breach – from stolen credentials to forged tokens to broken authorization. The common thread is trust: too much of it, spread across too many systems, without consistent verification.
Attackers have figured that out. The question is whether your access controls reflect that same reality.
