Incidents tagged AWS

The incident involved the mass-theft of authentication tokens from Salesloft's Drift application, leading to significant data exfiltration from integrated corporate Salesforce instances and other cloud services. Threat actors, tracked as UNC6395, leveraged these stolen credentials to perform "authorization sprawl," accessing and siphoning sensitive data including AWS keys and VPN credentials.

Threat actor UNC6395 exploited compromised OAuth and refresh tokens associated with the Drift AI chat agent, accessible via Salesloft, to gain unauthorized access to Salesforce customer instances. This systematic campaign led to the exfiltration of sensitive data, including AWS access keys, passwords, and Snowflake tokens, from over 700 organizations, indicating a potential supply chain attack.

The Amazon Q Developer Extension for Visual Studio Code (version 1.84.0) was compromised via a software supply chain attack, embedding a prompt injection that bypassed security reviews. This malicious prompt, detailed in AWS Security Bulletin AWS-2025-015, instructed the AI assistant to systematically delete local file systems and AWS cloud resources, including S3 buckets, EC2 instances, and IAM users.

Researchers have uncovered "EchoLeak," a critical zero-click vulnerability in Microsoft 365 Copilot that exploits design flaws inherent to Retrieval Augmented Generation (RAG) applications. This flaw, leveraging an "LLM Scope Violation" technique, allows for the automatic exfiltration of sensitive corporate data from the LLM's context without requiring user interaction.

The article highlights critical security gaps in Large Language Model (LLM) applications, detailing common vulnerabilities such as prompt injection, sensitive information disclosure, and supply chain compromises. These flaws, categorized by the OWASP Top 10 for LLM Applications, can lead to unintended LLM behavior, data exposure, and other serious consequences.