An extortion group called Icarus reportedly broke into Klue’s systems using a credential issued back in 2022, exposing keys to customers’ cloud services and enabling data theft for extortion.
In the cloud, identity is the perimeter — a single leaked or stale key can be escalated into control of an entire environment.
Our analysis
The real story is not a zero-day — it is a governance failure. A 2022 credential still working in 2026 tells you everything: stale, long-lived, over-privileged credentials are the most common and least glamorous way cloud environments fall. Once inside, extortion crews head straight for customer keys because that maximises leverage. This is a preventable class of breach, and it is squarely within your control.
What you should do
- Rotate credentials on a schedule and replace long-lived static keys with short-lived tokens.
- Enforce least privilege and review IAM for unused or over-scoped access.
- Monitor for anomalous use of old credentials and impossible-travel sign-ins.
- Run periodic cloud configuration reviews and assumed-breach tests to find these paths before attackers do.
How AgentOffense helps: our cloud configuration review and AWS penetration testing map the privilege paths a stale credential could take, while an assumed breach assessment quantifies the blast radius.
Source: TechCrunch.