Key Takeaways
- Attackers don’t always start by exploiting a vulnerability. Stolen credentials, third-party access and publicly available information can all create opportunities.
- The first stage of an attack may happen beyond your direct visibility. Information held by third parties or circulating in criminal sources can create risks for your organisation.
- Exposure alone doesn’t guarantee compromise. What matters is whether attackers can turn that exposure into access, greater privileges or control.
- Understanding what’s exposed is only the beginning. Threat-informed testing helps establish what an attacker could realistically achieve.
On this page
Already Exposed: What This Month’s Attacks Reveal
Your security programme protects your known perimeter. Your systems, endpoints, accounts and network.
But attackers don’t always start there.
They might already have:
- Credentials from a previous breach
- Information about your employees online
- Access through a third party you’ve trusted with permissions to your systems
This information often sits beyond your organisation’s direct visibility, circulating in criminal marketplaces or accessible through public sources.
The risk isn’t simply what’s exposed. It’s knowing what an attacker could do with it.
For Cyber Security Awareness Month, October’s WRAITH Threat Report examines three cases where compromised credentials, third-party access and publicly available information created opportunities for attackers.
Case 1: Vercel and Context.ai
Sources: Vercel, CyberScoop, The Hacker News
- In April 2026, cloud platform Vercel disclosed a security incident linked to a compromised third-party application, Context.ai.
- Researchers at Hudson Rock linked the compromise to an earlier infection involving Lumma Stealer, malware designed to collect saved credentials and other sensitive information. The infection reportedly originated from a Context.ai employee downloading software disguised as Roblox game cheats.
- Context.ai subsequently reported unauthorised access to its cloud environment, including access tokens associated with users who had connected external accounts to its application.
- One affected account belonged to a Vercel employee who had connected their corporate Google Workspace account to Context.ai and granted the application broad permissions.
- Attackers used the compromised third-party access to reach the employee’s Google Workspace account and subsequently accessed a limited number of Vercel environments, including environment variables not designated as sensitive.
- Vercel was not a Context.ai customer. The connection existed because an individual employee had authorised the external application.
Implication: A compromised third-party application created a route into Vercel’s environment through permissions granted by an employee, demonstrating how trusted connections can extend an organisation’s exposure.
Case 2: Fortibleed
Sources: Fortinet, BleepingComputer, SecurityWeek, The Hacker News
- In October 2026, the FBI and US Secret Service warned of ongoing FortiBleed attacks targeting Fortinet FortiGate firewalls and VPN gateways, with compromised credentials playing a central role.
- Attackers targeted exposed VPN and administrative login services, using credentials obtained through previous compromises alongside brute-force techniques to attempt access.
- Threat intelligence researchers reported that stolen credentials were being checked, filtered and prioritised, including according to the potential value of the organisations being targeted.
- SOCRadar previously reported identifying approximately 86,644 compromised devices across 194 countries. This was a reported figure from earlier in the campaign, not a new October count.
- Once attackers gained access, they could create additional administrator accounts. In some cases, legitimate accounts were deleted or passwords changed, locking administrators out of their own devices.
- US authorities warned that the activity had been associated with initial access used by ransomware affiliates, including INC/Lynx and Payload.
Implication: Attackers don’t always need an unpatched vulnerability. Stolen credentials can provide access to exposed systems, and once attackers establish additional accounts or sessions, simply resetting passwords may not be enough to remove them.
Case 3: Contagious Interview
Sources: Joint Cybersecurity Advisory, The Hacker News, Help Net Security
- A September 2026 joint cybersecurity advisory highlighted Contagious Interview, a North Korean-linked campaign targeting technology professionals through fraudulent recruitment processes since at least 2022.
- Attackers impersonated recruiters and employers, approaching potential targets through professional networking platforms, including LinkedIn.
- Developers and other technology professionals were offered attractive job opportunities and encouraged to participate in recruitment processes.
- As part of these processes, targets were asked to complete coding assessments or run software presented as legitimate interview tasks.
- The malicious instructions or files initiated a multi-stage infection, installing malware and remote access capabilities that could enable persistent access and data theft.
- Authorities warned that compromised developers could also create opportunities for attackers to access the organisations employing them, potentially enabling espionage, intellectual property theft and further movement through connected environments.
Implication: Attackers used publicly available professional information and convincing job offers to trick individuals into running malicious code, creating a potential route into their employers’ environments.
Key Patterns Across This Month’s Attacks
Three cases. Three different routes towards compromise. One recurring lesson: attackers can exploit opportunities that organisations don’t always have full visibility of.
- Attackers can prepare before attempting entry. Compromised third-party access, stolen credentials and publicly available professional information can create opportunities beyond an organisation’s direct visibility.
- A newly disclosed vulnerability wasn’t necessary. These attacks relied on compromised access, existing credentials, trusted permissions and social engineering rather than newly discovered software flaws.
- Exposure needed a route to become access. Broad application permissions, valid credentials on internet-facing services and malicious code disguised as a recruitment task each provided that next step.
- Removing the initial weakness may not remove the attacker. If additional accounts, active sessions or persistent access have already been established, remediation needs to address more than the original point of entry.
In each case, the eventual compromise depended on more than the initial information or opportunity available to the attacker.
The exposure created an opening. What happened next determined the impact.
Why This Matters for Enterprise Security Leaders
Attackers don’t always arrive empty-handed.
They may already have stolen credentials, information about your employees or knowledge of exposed systems before attempting to gain access.
Flashpoint’s 2026 midyear threat intelligence report recorded more than 1.7 billion stolen credentials and identity data points harvested by infostealer malware in the first half of the year alone.
But not every exposed credential still works, and not every piece of information presents a genuine risk.
The challenge is knowing what’s already out there, what matters and how an attacker could use it.
This is where threat intelligence becomes valuable. Understanding what information is circulating and how attackers operate helps security teams identify potential threats before they develop into incidents.
But intelligence alone doesn’t tell you whether an attacker could succeed.
The real value comes from using that intelligence to test what an attacker could actually achieve.
How WRAITH Addresses This
The answer isn’t just knowing what’s exposed.
WRAITH combines continuous exposure discovery, live threat intelligence and operator-led adversary emulation to test realistic attack paths.
Its threat intelligence draws on breach datasets, credential leaks, stealer logs and other sources used by attackers. Rather than simply reporting what it finds, WRAITH incorporates relevant intelligence into live campaigns.
That means its operators can ask the same questions an attacker would:
- Do the exposed credentials still work? WRAITH can test whether compromised credentials provide a route into the environment.
- What else is accessible? Continuous exposure discovery identifies externally visible assets, services and potential entry points.
- Where could that access lead? Operators investigate whether initial access or exposed information can be used to build a wider attack path.
As new exposure emerges, campaigns can adapt, reflecting how real attackers gather intelligence, identify opportunities and change their approach over time.
Threat intelligence tells you what’s exposed. WRAITH tells you what it’s worth to an attacker.
Jennifer Goulbourne
Jennifer is a Digital Marketing Executive at OmniCyber Security, where she's responsible for engaging the company's existing customer base across digital channels and creating helpful resources on threat intelligence and security operations for cybersecurity professionals and business leaders.
