Ghost Credentials Expose Cloud Systems to Hidden Identity Risks
What Happened — Security researcher Aleksandr Krasnov disclosed that dormant, non‑human identities (service accounts, automation bots, “ghost” credentials) remain active in many cloud environments. These hidden accounts create undocumented trust paths that attackers can exploit to gain unauthorized access. An open‑source tool was released to automatically discover and map these ghost credentials.
Why It Matters for Compliance & Audit Readiness
- SOC 2 CC6.1 (Logical Access) requires documented, enforceable access rights for every identity; ghost accounts violate this control.
- Continuous‑compliance programs must provide auditable evidence that provisioning and de‑provisioning processes are enforced and that all identities are regularly reviewed.
- Detecting and evidencing the removal of unused identities supplies the “defensible audit trail” auditors look for when assessing access‑control effectiveness.
Who Is Affected — Cloud‑native SaaS providers, enterprises running workloads on public clouds (AWS, Azure, GCP), and any organization that relies on automated service accounts for CI/CD, monitoring, or data pipelines.
Recommended Actions
- Conduct a full inventory of non‑human identities and map their permission sets.
- Enforce least‑privilege policies and automate de‑provisioning of unused service accounts.
- Integrate continuous monitoring of identity‑sprawl into your SOC 2 evidence collection (e.g., periodic screenshots, API logs).
- Use the open‑source trust‑path scanner to validate that no undocumented access routes remain.
Source: Dark Reading
Technical Notes — The risk stems from misconfiguration and credential sprawl rather than a specific vulnerability (no CVE). Attackers can hijack ghost credentials to perform lateral movement, privilege escalation, or data exfiltration. Source: same as above