fwd:cloudsec

Speaker: Marcus Hallberg & Samuel Kelemen

Talk:

This talk covers how the Lovable security team identified and tracked a global attack attempted to compromise our users' Github projects with malicious code. We analysed millions of Lovable projects across hundreds of thousands of customers and tracked the campaign through its different phases meanwhile we built tools to intercept and prevent the attack.

The attacker used a mix of human and non-human identities, introduced malicious code through direct commits and merge paths, and bypassed expected platform provenance. We observed payloads hidden in frontend configuration files and used obfuscated staged JavaScript to fetch and execute encrypted second-stage code. The attack affected anyone who worked with or built the code and the tactics and IOCs correspond to those used by a nation state actor.

This talk shows how to detect and contain this pattern by correlating Git events, CI/CD metadata, and platform edit telemetry. Attendees leave with knowledge of how to prevent similar attacks from happening, deploy detections, triage logic, and conduct incident response.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Kinnaird McQuade

Talk:

In virology, gain-of-function research means deliberately making a pathogen more dangerous so you can study how to stop it. We took the same approach with AI coding agents and fine-tuned guardrail-less models - and built an AI worm.

Unlike prompt injection research that attacks AI systems, this worm uses the AI agent as the attack engine itself. We give it lean prompts and point it at a lab environment mirroring enterprise cloud infrastructure - AWS accounts, Azure subscriptions, CI/CD pipelines, IaC repos, data lakes - and it figures out the rest. It chains cross-account trust relationships we never told it about. It backdoors Terraform state we didn't know was there. It adapts its techniques depending on which cloud provider it lands in and exhibits worrisome emergent behaviors.

Commercial models occasionally refuse when they sense something adversarial - a partial defense. So we went further: using LoRA fine-tuning, abliteration, and other techniques to strip computer safety alignment out of open weights coding models entirely, without degrading effectiveness. We'll walk through these uncensoring techniques - what works, what degrades model quality, and what it costs - so defenders understand the threat model when refusals are off the table.

The good news: time-tested cloud security fundamentals - least privilege, egress filtering, segmentation, CI/CD hardening - are exactly the controls that matter most here. We'll map defenses to each domain the worm exploits and the roadblocks that stop it.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Scott Weston

Scott is a Labs Researcher at NetSPI. He has performed work in the past regarding open source tooling for AWS as well as GCP. He has spoken at past conferences including fwd:cloudsec and the Defcon Cloud Village. He has published a tool called gcpwn for GCP enumeration and pentesting. He is originally from the Southern California area and is currently working out of Minnesota. In his spare time he enjoys soccer/basketball, or pursuing interesting research-oriented tasks in cloud-based technologies.

Talk:

Oracle Cloud Infrastructure has some really interesting IAM quirks compared to AWS and GCP. Its sentence-style policies, tenancy and compartment hierarchy, and identity domain model can make it harder to quickly understand who has access to what — and where privilege escalation paths may exist. To help tackle this, I built a suite of OCI security tools, including an ANTLR-based IAM policy parser (oci-lexer-parser), a Burp Suite request-signing plugin (OCISigner), and an enumeration and graphing framework (OCInferno).

This lightning talk is a quick tour of OCInferno, an open-source OCI reconnaissance framework that uses OpenGraph for BloodHound-style attack path analysis. I’m sure everyone has heard of IMDS abuse, leaked creds, and the usual cloud attack path greatest hits. Instead of making one of those the focus, I’ll cover OCI-specific identity domain concepts, how they fit into attack path graphing, and how OCI can introduce movement patterns that do not always map cleanly to AWS or GCP.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

More on Zapocalypse: https://www.token.security/zapocalypse

Slides: https://docs.google.com/presentation/d/1ex96KlF1vPJboHeVoRXg4hb5hUJ9h3QIvb_DQ8IJ0Kk/edit?usp=sharing

Speaker: Yair Balilti

I’m Yair Balilti, Security Research Team Leader at Token Security. With over 8 years of experience in vulnerability research and offensive security, I now lead my team in uncovering vulnerabilities and securing AI-driven products. I’m passionate about exploring the intersection of cloud-native threats and the evolving AI landscape. When I’m not auditing models or breaking cloud internals, you'll likely find me on a quest for the city’s best burger.

Talk:

Automation platforms and AI agents have become the high-privilege nervous system of the modern enterprise. This session deconstructs a multi-stage exploit chain that began in a sandboxed Python environment and escalated to a full platform account takeover (ATO).

We reveal why the common assumption that Python’s del keyword sanitizes environment variables is a dangerous fallacy, demonstrating the recovery of "orphaned" STS tokens directly from the Lambda heap via /proc/self/mem. We then detail a technique for API-only ECR image extraction that circumvents Docker runtime monitoring to uncover hardcoded Model Context Protocol (MCP) keys and high-privilege NPM tokens. The chain concludes with a Stored XSS via dependency poisoning of a core design system, impacting the authenticated sessions of over 8,000 third-party integrations.

Attendees will leave with a technical checklist for auditing AI "code block" features and strategies for identifying orphaned secrets in serverless memory.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Tal Skverer

Tal holds an M.Sc. in Computer Science and has a decade of experience in reverse engineering, web hacking and cryptography.

Tal is the Head of Research at Astrix Security, where he leads security research focused on non-human identity and AI agents. His work spans identity security, vulnerability discovery and threat detection. Tal has presented at DEF CON (2023, 2025), RSA Conference (2025), BSidesTLV, SNOWFroc, LASCON, and Reversim.

He is the co-lead of OWASP NHI Risks Top 10 and a contributor on Agentic Security. When not hunting identity vulnerabilities, he is likely running, solving puzzles, or rolling dice.

Talk:

What if creating a free GitHub account could give you access to a Fortune 500's AWS production environment? No credential theft, no phishing, just public data recon and a three-line workflow file.

OIDC-based workload identity is the industry's recommended replacement for static CI/CD credentials. But implementations across major developer platforms share a fundamental design flaw: they operate a single global OIDC issuer for all tenants and construct the sub claim from recyclable, human-readable namespace paths. This talk introduces "Sub:jugation," a vulnerability class independently present across all major CI/CD workflow providers (such as GitHub Actions, and GitLab CI).

We present the vulnerability and go beyond the theory: analysis of thousands of real AWS and Azure environments shows that a large percentage of namespace owners are vulnerable, each trusting and thus putting at risk an average of 10-12 distinct cloud identities.

We will show the sophisticated recon pipeline we built using public GitHub Code Search and namespace deletion monitoring to demonstrate that an external attacker can discover and exploit these "Phantom Cloud Identities" at scale. We will demo the full attack chain, share the data, and provide concrete steps practitioners can take to audit and remediate their environments today.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Dan Gansel

Dan Gansel is a cloud security specialist with deep expertise in cloud API research, secure cloud solutions and architecture design. Dan has led cloud security research teams and has a track record of uncovering novel attack techniques in cloud environments.

As a Security Researcher at Upwind Security, Dan continues to push the boundaries of cloud security, focusing on uncovering blind spots in the services organizations trust the most.

Talk:

The Data perimeter is the gold standard for cloud-native security boundary in AWS. It combines all available preventive security tools and guardrails.

In this talk you will learn about a novel attack technique that exploits AWS Bedrock AgentCore’s identity service to establish a fully functional command and control channel (C2) capable of bypassing data perimeter controls - all while using legitimate capabilities. We will demonstrate how an attacker can use two covert channels hidden in plain sight: data exfiltration and unauthenticated data infiltration.

We will demo the complete C2 channel operating end to end - an attacker establishing persistence, issuing commands and exfiltrating sensitive data from an S3 bucket containing user records, all within an enforced data perimeter.

We will also walk through CloudTrail signals which will enable defenders to detect this activity and discuss why new AI services demand security assessment before adoption.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

Speaker: Hillai Ben-Sasson & Nir Ohfeld

Hillai Ben-Sasson (@hillai) is a Security Researcher based in Israel. As part of the Wiz Research Team, Hillai specializes in research and exploitation of web applications, application security, and finding vulnerabilities in complex high-level systems. Hillai is a frequent speaker in security conferences and has been recognized in MSRC's Most Valuable Researchers leaderboard.

Talk:

When examining the security of large-scale cloud environments, one critical component is always present yet often overlooked: the Container Registry. As a key component of modern CI/CD pipelines, these registries serve as a single source of truth for production, staging, and development across customer environments. While this centralization is convenient for DevOps teams, it also creates the ultimate pivot point for attackers.

In this talk, we will unveil a novel technique that allowed us to escalate from a completely unprivileged state to full control over the build pipeline. In multiple engagements across major cloud and SaaS providers, we were able to abuse centralized container registries and poison cloud images with our own custom code.

Unlike traditional supply-chain attacks, this unique method enables lateral movement between otherwise isolated environments. Threat actors can pivot from customer environments to production, staging, and even to developers’ personal machines – all pulling from the same compromised source.

We will illustrate our techniques through real-world case studies, including Alibaba Cloud, IBM Cloud, SAP, Hugging Face, and Azure. Attendees will see firsthand how we gained control over container and artifact registries, ultimately exposing internal artifacts and customer data.

Join us to explore container registries as a powerful attack vector and learn practical strategies to secure your infrastructure against similar threats.

Recorded at fwd:cloudsec North America 2026 - Bellevue, WA

https://fwdcloudsec.org/conference/north-america/

An introduction to fwd:cloudsec North America 2026 by Patrick Sanders

https://youtu.be/rQxc9N4gBqA

Speaker: Eric WoodruffThroughout his 25-year career in the IT field, Eric has sought out and held a diverse range of roles. Currently the Chief Identity Architect for Semperis; Eric previously was a member of the Security Research and Product teams. Prior to Semperis, Eric worked as a Security and Identity Architect at Microsoft partners, spent time working at Microsoft as a Sr. Premier Field Engineer, and spent almost 15 years in the public sector, with 10 of them as a technical manager.Eric is a Microsoft MVP for security, recognized for his expertise in the Microsoft identity ecosystem. His security research has also been recognized by Microsoft, most notably for his findings he dubbed “UnOAuthorized”. Eric is a strong proponent of knowledge sharing and spends a good deal of time sharing his insights and expertise at conferences as well as through blogging. Eric further supports the professional security and identity community as an IDPro member, working as part of the IDPro Body of Knowledge committee.Talk:In June 2023, Descope published research on nOAuth, a critical OpenID Connect implementation flaw that enables user account takeover in vulnerable applications. Following the disclosure, Microsoft and the Microsoft Security Response Center (MSRC) published articles on this issue, highlighting common anti-patterns and their follow-up actions with impacted application owners.Fast forward to the fall of 2024, and nOAuth remains an active security threat. In this session, we will explore its persistence, unveiling new research that builds upon Descope’s original findings to identify additional implementation flaw patterns and methods for staging the abuse. We will also discuss how we uncovered vulnerable applications, the varying responses from developers, and what this means for securing modern SaaS applications.Attendees will leave with a deeper understanding of how nOAuth attacks work, real-world examples of its exploitation, and actionable strategies to mitigate this critical risk.

https://youtu.be/oHlPGzpFT_c

Speaker: Dave SudiaDave Sudia went from Platform Engineering to Product Engineering; in both roles he has had to stand up infrastructure in repeatable but constantly evolving architectures, taking into account usability, security, and scalability. He is the world's biggest fan of Infrastructure-as-Code. By day you'll find him enabling developers to do their best work and by night you'll find him hanging with his kid, whose hobbies are now Dave's hobbies.Talk:With the rise in popularity of open-source standards and tools like SPIFFE and SPIRE, it’s never been easier to get off the ground with issuing all your workloads a flexible cryptographic identity.But this is just the start of your workload identity journey! The real challenge begins in putting these identities to work in your infrastructure in replacing legacy authentication mechanisms such as long-lived shared secrets. It’s difficult to know where to get started.This talk will:Briefly outline SPIFFE and Workload IdentityExplore the options for using SPIFFE for authentication and authorization, with a focus on techniques appropriate for existing infrastructureDive into a handful of practical examples of introducing SPIFFE-based authentication between legacy services, and, between legacy services and Cloud APIsDescribe higher-level strategies for rolling out workload identity in an organization, based on experience helping large organizations approach this work