Poisoned Pipeline / Techniques / T0137
Weak authentication methods
Weak authentication methods are a common attack technique used by threat actors to gain unauthorized access to cloud environments or code repositories. This attack technique relies on exploiting vulnerabilities in the authentication methods used to control access to resources.
In cloud security, weak authentication methods can be exploited through several vectors, such as stolen credentials, brute force attacks, and password spraying.
Threat actors can also take advantage of misconfigured security groups or network access control lists (ACLs) to bypass authentication and gain access to cloud resources.
In code security, weak authentication methods can be exploited through vulnerabilities in source code management platforms, such as Git repositories.
For instance, if developers use weak passwords or if the authentication protocols used by the repository are vulnerable, attackers can steal source code or inject malicious code into the codebase.
Where this idea came from
Cited from a security article or vendor blog in the original YAML; not a first-party incident report.
Mitigations
- M1130 Implement password rotation
- M1132 Enable MFA for user accounts
- M1550 Implement strict access control for clouds
- M1860 Implement strong authentication mechanisms
- M1861 Implement strong authorization mechanisms
Detections
- D1261 Implement penetration testing
- D1510 Implement Intrusion Detection System and anti-malware
- D1520 Implement endpoint detection and response system
Observed in incidents (5)
- CCleaner 5.33 signed ShadowPad backdoor
- php.net git server Zerodium backdoor
- In-the-wild JFrog Artifactory auth bypass (CVE-2026-42016/42018/82329)
- npm is 3.3.1 / 5.0.0 via phished old maintainer
- 3CX Desktop