Threat Analysis · October 20, 2026
A new white paper from Mesh Security, Top Ten Active Persistent Threats of 2026, reconstructs ten of the most consequential breaches of the past three years, from the U.S. Treasury intrusion to the CDK Global ransomware attack that paralyzed thousands of car dealerships. Its central argument is blunt: attackers are no longer breaking in, they are logging in. Stolen credentials, abused OAuth tokens and compromised vendors carried most of these campaigns, and each security tool saw only a fragment of the chain.[1]
That thesis deserves a careful answer from anyone selling file security, including us. If most attacks are identity attacks, where does a Content Security Layer (CSL) such as FileDNA CADR actually belong? The honest answer is narrower than marketing usually allows, and more useful for it. Many identity-led chains begin with a file: an infostealer hidden in a phishing attachment or a fake installer is often how the credentials were stolen in the first place. Others end in content: AI agents and SaaS repositories that ingest untrusted files become the next pivot point. A CSL belongs at those boundaries, and nowhere else.
Below, each breach is summarized and then marked with a highlighted panel showing where FileDNA CSL would sit in the kill chain. Where a CSL has no role, we say so plainly.
The Boundaries a CSL Guards
FileDNA analyzes, disarms and reconstructs files at the point where they cross from an untrusted source into a trusted system. Across these ten breaches, four such crossings matter: inbound email and web downloads, where infostealers and weaponized documents arrive; third-party marketplaces and package sources, where agent skills and extensions are pulled in; uploads into SaaS repositories such as support desks and collaboration platforms; and the ingestion path of AI agents, which read documents and act on what they contain.
A CSL acts on files in transit. It does not authenticate users, govern OAuth grants or monitor sessions, which is where most of the chains below were won.
Measured against those boundaries, FileDNA sits directly inside one of the ten kill chains, upstream of the credential theft in three of them, adjacent to the attack path in two, and plays only a limited part in one. In the remaining three kill chains, it has no role at all.
| Breach | Decisive vector | FileDNA CSL position | Fit |
|---|---|---|---|
| 1. OpenClaw / Moltbot | Agent CVEs, malicious skills | Skill intake and agent content ingestion | Direct |
| 2. Salesloft Drift | Stolen OAuth tokens | Support-ticket attachments carrying secrets | Adjacent |
| 3. U.S. Treasury | PAM zero-days, API key | None | None |
| 4. Snowflake customers | Infostealer credentials, no MFA | Email and download boundary | Upstream |
| 5. Midnight Blizzard | Password spray, legacy OAuth app | Content governance on mail stores | Adjacent |
| 6. Cloudflare via Okta | Unrotated service tokens | None | None |
| 7. Cyberhaven extension | OAuth consent phishing | Extension package approval gate | Limited |
| 8. Coinbase / TaskUs | Bribed insiders, phone cameras | None | None |
| 9. Change Healthcare | Credential on Citrix, no MFA | Email and download boundary | Upstream |
| 10. CDK Global | Compromised credentials | Email and dealer document intake | Upstream |
Direct: a file-borne stage is part of the documented chain. Upstream: a file-borne stage plausibly supplied the credentials used later. Adjacent: a CSL reduces collateral exposure but does not touch the intrusion path. Limited: a CSL could inspect a component, but the decisive step was not a file.
1. OpenClaw and Moltbot: The Shadow AI Agent Crisis
In January 2026 the open-source agent platform OpenClaw, earlier known as Clawdbot and briefly as Moltbot, went viral on GitHub and brought a cluster of serious flaws with it. Unlike a chatbot, OpenClaw runs shell commands, manages files, sends email and connects to more than 100 services, and it stored credentials in plaintext local configuration files. CVE-2026-25253 (CVSS 8.8) let a malicious web page leak the agent’s authentication token and hand an attacker administrative control, and two further flaws, CVE-2026-24763 and CVE-2026-25157, allowed arbitrary command execution on the host.[1][2]
The supply chain followed close behind. Threat actors uploaded malicious skills to the ClawHub repository, disguised as productivity tools, and used them to deploy malware including the Atomic macOS Stealer (AMOS).[2][3] Infostealer families then added OpenClaw’s configuration paths to their collection lists, and harvested tokens let attackers move into Salesforce, GitHub and Slack through the agent’s own pre-authorized integrations, without triggering a single anomalous login.[1]
Where FileDNA CSL sits · Direct fit
A CSL belongs at two points in the OpenClaw chain. The first is the skill intake path: skills pulled from a marketplace are files and packages entering a trusted endpoint, and inspecting them before installation would have exposed embedded droppers and installers rather than letting them run with the agent’s privileges. The second is the agent’s content ingestion path. The Mesh Security’s report itself names the danger as the “lethal trifecta” of private data access, exposure to untrusted content and the ability to communicate externally. Every document an agent reads is untrusted content, and sanitizing it before the agent acts on it is the core of the AI Trust phase of the CSL roadmap.
What a CSL does not fix here: the token-leakage and command-injection CVEs, the default lack of authentication and the plaintext credential store. Those require patching, secrets management and agent governance.
2. Salesloft Drift: OAuth Tokens at Supply-Chain Scale
From August 2025, a group tracked as UNC6395 used OAuth tokens stolen from the Salesloft Drift chatbot integration to reach Salesforce instances at more than 700 organizations. Automated tools queried Cases, Accounts, Users and Opportunities, and in confirmed cases the attackers ran Bulk API jobs that exported entire databases in about three minutes. Support cases proved especially valuable because customers had pasted AWS keys, Snowflake tokens and other secrets into them, which fueled follow-on intrusions.[1]
Where FileDNA CSL sits · Adjacent
The intrusion itself was a token abuse that no file inspection can see. A CSL’s role is collateral: support desks receive a steady flow of customer attachments, including logs, screenshots and configuration exports, and those files are where many leaked secrets live. Content analysis at upload, which the Mesh Security’s report recommends as “real-time enforcement at ingestion points,” would reduce what an attacker finds once inside. That is a Content Governance capability on the CSL roadmap.
What a CSL does not fix here: OAuth grant hygiene, token rotation, IP allowlisting and bulk-export monitoring.
3. U.S. Treasury: A Compromised PAM Vendor
In late 2024, Chinese state-sponsored actors exploited two zero-day vulnerabilities, CVE-2024-12356 and CVE-2024-12686, in BeyondTrust’s remote support platform, stole an API key and used it to reach Treasury workstations. The report says more than 3,000 unclassified files were taken from roughly 419 computers, including systems in the Office of Foreign Assets Control and the Office of the Secretary, over a dwell time of about three months.[1]
Outside FileDNA’s scope
No file crossed a boundary on the way in. The chain ran through an exploited vendor appliance and a stolen key, and the files that moved were going out, not in. Just-in-time vendor access, short-lived tokens and segmentation are the relevant controls.
4. Snowflake: Infostealer Credentials at Cloud Scale
Between April and June 2024, UNC5537 logged into about 165 Snowflake customer instances using credentials harvested by infostealers, some dating back to 2020. Victims included AT&T, Ticketmaster, Santander and LendingTree, and AT&T reportedly paid about $370,000 to have stolen data deleted. The report traces the infections to VIDAR, RedLine, Raccoon, Lumma and other stealers distributed through phishing and malvertising, and identifies the absence of MFA as the decisive weakness.[1]
Where FileDNA CSL sits · Upstream
This is the pattern that ties a file boundary to an identity breach. The credentials used against Snowflake were stolen on employee and contractor machines, and stealers usually arrive as an attachment, a weaponized document or a fake download. A CSL at the email and web download boundary removes the active content that launches the stealer and blocks executable payloads by policy, which cuts the supply of fresh credentials at the source. This stage sits years before the Snowflake logins and often on unmanaged personal devices, so a CSL narrows the funnel rather than closing it.
What a CSL does not fix here: years-old reused passwords, missing MFA and unrestricted bulk queries. Phishing-resistant MFA would have stopped these logins regardless of how the credentials were stolen.
5. Midnight Blizzard: Microsoft’s Corporate Email
Beginning in November 2023, Russia’s Midnight Blizzard password-sprayed a legacy test tenant that lacked MFA, then abused a legacy OAuth application with elevated permissions to read the mailboxes of Microsoft’s senior leadership, security and legal teams. The group mined those emails for secrets and intelligence and, by February 2024, had increased its password-spray volume tenfold.[1]
Where FileDNA CSL sits · Adjacent
The Mesh Security’s report describes email as a credential repository. Attachments carrying passwords, keys and infrastructure detail turned a mailbox compromise into a campaign. Content analysis of attachments as they enter and rest in mail stores could flag that material before an attacker finds it. This is a Content Governance use case and a modest one: it shrinks the reward for a successful intrusion without affecting the intrusion itself.
What a CSL does not fix here: password spraying, a forgotten test tenant without MFA and an over-privileged OAuth application.
6. Cloudflare: The Okta Aftershock
On Thanksgiving Day 2023, Cloudflare found a nation-state actor in its self-hosted Atlassian environment. The intruder had used service tokens and credentials exposed in Okta’s October 2023 breach that Cloudflare had not rotated. Over several days the attacker reviewed 120 source code repositories, downloaded 76 and installed the Sliver framework for persistence, while Cloudflare’s zero-trust architecture limited further movement.[1]
Outside FileDNA’s scope
Access came through valid but stale tokens, and the attacker installed tooling with legitimate credentials rather than delivering it in a file a user would open. Automated credential rotation after third-party breaches is the control that would have broken this chain.
7. Cyberhaven: A Poisoned Browser Extension
On Christmas Eve 2024, a Cyberhaven employee received a convincing email that impersonated the Chrome Web Store and authorized a malicious OAuth application. No MFA prompt appeared because consent flows do not trigger one. The attackers then published a malicious version of Cyberhaven’s extension, which updated itself on about 400,000 browsers and stole session cookies and credentials. The same campaign touched more than 36 extensions and about 2.6 million users.[1]
Where FileDNA CSL sits · Limited
The phishing step used a link and an OAuth consent screen, not an attachment, so the email boundary offers a CSL nothing to disarm. The poisoned update was a software package, and an organization that pins extension versions and inspects new packages at an internal approval gate could catch unexpected code before rollout. That is a software supply chain control in which a CSL can contribute analysis, but the version pinning and allowlisting, do most of the work.
What a CSL does not fix here: OAuth consent phishing against developer accounts and automatic store updates.
8. Coinbase: Bribed Support Contractors
From September 2024 to January 2025, criminals bribed outsourced support staff at TaskUs to photograph Coinbase customer records with their phones, reportedly paying about $200 per image. The data enabled impersonation scams against customers, and when the scheme surfaced in May 2025 the attackers demanded $20 million. Coinbase refused, disclosed the breach, which affected 69,461 customers, and estimated costs of $180 million to $400 million.[1]
Outside FileDNA’s scope
A camera pointed at a screen bypasses every file control. Data minimization, field masking, just-in-time record access and behavioral analytics on contractor accounts are the relevant defenses.
9. Change Healthcare: One Credential, a National Outage
In February 2024, the ALPHV/BlackCat group logged into a Change Healthcare Citrix portal that lacked MFA, moved through the network for nine days and then deployed ransomware that crippled claims and prescription processing across the United States. UnitedHealth Group paid a $22 million ransom, yet the stolen data was still used for a second extortion attempt. The report cites more than 100 million affected patients; HHS’s Office for Civil Rights has since put the total at about 192.7 million individuals.[1][4]
Where FileDNA CSL sits · Upstream, conditional
The Mesh Security’s report says the credential was likely obtained through infostealer malware or an earlier breach, but the method has not been confirmed. If an infostealer was the source, the position is the same as in the Snowflake case: the email and download boundary where the stealer arrived. Healthcare is also among the most document-heavy industries, with claims, referrals and records exchanged as files between thousands of partners, so a CSL at those exchange points reduces the number of ways an attacker can get in.
What a CSL does not fix here: a remote access portal without MFA, flat internal networks and domain-wide privilege escalation.
10. CDK Global: An Industry Taken Offline
In June 2024, the BlackSuit ransomware group compromised CDK Global, whose dealer management system serves more than 15,000 North American dealerships. Dealers handling roughly a quarter of U.S. vehicle sales fell back to paper for weeks, some reported losing $1 million a day, and CDK paid a reported $25 million ransom. The report lists the initial access method as unconfirmed, most likely phishing or purchased credentials.[1]
Where FileDNA CSL sits · Upstream, conditional
If phishing opened the door, the email boundary is the CSL position, as in the previous two cases. Automotive retail adds a second one. Dealerships run on documents: credit applications, scanned licenses, insurance cards, payoff letters and lender forms arrive from customers and partners all day and flow straight into dealer and finance systems. A CSL at that document intake protects the platform the whole industry depends on, because every file that reaches it has been reconstructed clean first.
What a CSL does not fix here: concentration risk on a single multi-tenant SaaS platform, administrative access without strong MFA and the destruction of backups.
What the Pattern Means for a Content Security Layer
The Mesh Security’s report is right that identity carried most of these breaches. Seven of the ten turned on a credential, a token or a person, and no file control would have changed the outcome at the decisive step. A CSL is not a substitute for phishing-resistant MFA, OAuth governance or credential rotation. The credential economy that powered Snowflake, and possibly Change Healthcare and CDK, is fed by infostealers that arrive mostly through files, so every stealer disarmed at the boundary means one fewer set of credentials for sale. The newest threat in the report, OpenClaw, shows where the next boundary is forming: AI agents that read untrusted documents and act on them with real credentials. As agents spread, the files they ingest become an attack surface in their own right, and that is precisely the layer a CSL is built to guard.
The Mesh Security is arguing that point tools fail because they see fragments of a chain. A CSL is one of those fragments, but it covers the first link in many chains. Paired with strong identity controls and attack-path visibility, it removes the file-borne stage that makes many of these chains possible, so attackers have to rely entirely on what they can steal some other way.
References
- Mesh Security, Inc., Top Ten Active Persistent Threats of 2026: Analyzing Common Attack Paths and Eliminating Them, white paper, 2026. mesh.security
- Aviatrix Threat Research Center, “OpenClaw ClawHub Malicious Skills Supply Chain Attack,” 2026. Link
- Bitdoze, “OpenClaw Security Guide: CVE-2026-25253, Malicious Skills, and 40+ Fixes,” 2026. Link
- CyberInsider, “Change Healthcare Revises Breach Impact to 192.7 Million Individuals,” August 15, 2025. Link
- IBM, “IBM Report: Half of Breached Organizations Unwilling to Increase Security Spend Despite Soaring Breach Costs,” Cost of a Data Breach Report 2023, July 24, 2023. Link
This analysis is published by CyberQuay, Inc. Positioning statements describe where a Content Security Layer applies in principle and do not imply that FileDNA was deployed in, or would have prevented, any specific incident described. Three points were adjusted after verification of the Mesh Security report. Change Healthcare’s affected population has been revised from the report’s “over 100 million” to about 192.7 million under HHS figures. The report credits its closing statistic, that only a third of breaches are detected by internal teams and tools, to a “Verizon Cost of a Data Breach Report 2024”; the Cost of a Data Breach study is IBM’s, and the one-third finding comes from its 2023 edition. Finally, the report names an individual contractor in the Coinbase case; this article does not.