u/UnixiSecurity

We all know LastPass’s history, but their latest breach from a couple weeks ago is a textbook example of a modern supply chain nightmare.

It wasn't a direct hack on LastPass, and nobody left a personal Plex server unpatched this time. Instead, a threat group (Icarus) compromised Klue, a market intel platform LastPass's go to market teams use.

The technical TLDR:

• The Vulnerability: A dormant, legacy service credential inside Klue’s backend that was built for an old prototype and completely forgotten about.
• The Vector: Attackers used that old credential to slip in and harvest active OAuth tokens Klue held for its clients.
• The Damage: They replayed those stolen OAuth tokens directly against LastPass’s Salesforce API. Because it was a trusted integration token, it bypassed MFA entirely and looked like normal daily traffic while they scraped CRM data via automated SOQL queries.

The irony here is brutal. A password manager, a product built entirely on the concept of credential hygiene - got bit because of a third-party credential that nobody remembered to delete.

Whether it's the 2022 vault leak or this 2026 OAuth hijack, we keep seeing the same root issue: relying on centralized, reusable secrets. Once an attacker finds a way to sit in the middle of that trust relationship, game over.

Curious how everyone else is auditing their third-party SaaS OAuth permissions right now? If you want to dig into the exact logs and the MITRE mapping, we did a full post mortem breakdown here:

https://unixi.io/blog/june-2026-lastpass-breach-analysis

We all saw the news about Vercel getting hit for a $2M ransom, but the actual initial access vector is completely wild. It wasn’t a zero-day or direct phishing. It was literally a combination of an over permissioned dev work account and a vendor employee downloading gaming cheats.

Here is how it went down:

-An employee at a small AI startup (Context.ai) downloaded some Roblox exploit scripts. It dropped a Lumma info-stealer that scooped up their active session cookies and corporate tokens.

-Completely separately, a high-privilege Vercel dev decided to trial a consumer tool called Context AI Office Suite. They logged in with their work account and clicked "Allow All" on the OAuth screen, granting the tool broad scopes into their Workspace (Gmail, Drive, etc.).

-Because OAuth tokens are bearer credentials, the hackers just grabbed those active Vercel tokens from Context.ai’s breached environment and used them to call Google APIs directly. No passwords cracked, zero MFA triggered, because the identity was already delegated.

-Once inside, they hit Vercel's internal systems and bulk extracted customer environment variables that were left unencrypted at rest by default.

The real problem here is that OAuth is the new backdoor.

Traditional tools like CASBs or endpoint agents are completely blind to this because the app looks legitimate (the user approved it) and the traffic comes from an authorized client. Useful AI tools natively demand massive scopes (Mail.Read, Drive, etc.) to actually do anything, turning a quick 5 min user trial into a permanent, unmanaged backdoor into your data layer.

Our team at Unixi mapped out this specific attack path and put together a deeper technical breakdown / MITRE ATT&CK mapping of how this chain works:

https://unixi.io/blog/shadow-ai-vercel-breach-security-risks/

How are your teams actually policing this right now? Are you wholesale blocking non-whitelisted OAuth requests at the tenant level, or are you trying to manage the integration lifecycle some other way?

We’ve been analyzing the systemic architectural differences between traditional static secret management (password vaults) and Key-Derived Authentication (KDA).

The recent "Zero Knowledge (About) Encryption" paper published by ETH Zurich researchers, exposing 27 distinct attacks that a compromised server can execute against leading cloud password managers - highlights a fundamental flaw in enterprise identity strategies: treating credentials as long-lived, reusable secrets that must be stored in a centralized database.

When you map the anatomy of legacy vault breaches (like the multi-phase LastPass incident), the failure vector is structural. A compromise of a single developer's endpoint or a third-party application vulnerability allows attackers to capture master keys, exfiltrate the encrypted database, and crack vaults offline.

Shifting to Key-Derived Authentication (KDA)

To eliminate this central single point of failure, Universal SSO (uSSO) architectures process authentication locally within a browser extension, deriving credentials on demand.

The protocol applies a one-way cryptographic hash (like SHA-512) to concatenate four distinct variables:

`derived_secret = H(user_key || company_key || system_key || employee_key)`

1. User Key: Binds authentication to the base identity (passkey/IdP) without exposing app credentials.
2. Company Key: Establishes an organizational boundary to prevent cross-tenant replay.
3. System Key: Generates a unique key for every specific SaaS application, completely halting lateral movement.
4. Employee Key: Personalized tag to mathematically block credential sharing.

The result is a session-specific derived passphrase exceeding 80 characters.

Because no secrets are stored on Unixi’s servers, there is no centralized target to breach. Additionally, because the user never handles, types, or knows the derived credential, the human risk vector for phishing and keylogging drops to zero.

How traditional password manager breaches happen vs. how Unixi uSSO stops them.

We put together a deep-dive structural comparison breaking down recent password manager CVEs vs. uSSO mitigation strategies.

For those managing enterprise identity infrastructures, does moving to local, on-the-fly cryptographic derivation solve your user adoption gaps (where voluntary vaults typically hover around a low 15-30% adoption rate), or do you see operational hurdles with extension-reliant authentication?

Full technical breakdown and analysis: https://unixi.io/blog/beyond-password-vaults-universal-sso-the-next-evolution-of-identity-security/

We’ve been analyzing the systemic architectural differences between traditional static secret management (password vaults) and Key-Derived Authentication (KDA).

The recent "Zero Knowledge (About) Encryption" paper published by ETH Zurich researchers, exposing 27 distinct attacks that a compromised server can execute against leading cloud password managers - highlights a fundamental flaw in enterprise identity strategies: treating credentials as long-lived, reusable secrets that must be stored in a centralized database.

When you map the anatomy of legacy vault breaches (like the multi-phase LastPass incident), the failure vector is structural. A compromise of a single developer's endpoint or a third-party application vulnerability allows attackers to capture master keys, exfiltrate the encrypted database, and crack vaults offline.

Shifting to Key-Derived Authentication (KDA)

To eliminate this central single point of failure, Universal SSO (uSSO) architectures process authentication locally within a browser extension, deriving credentials on demand.

The protocol applies a one-way cryptographic hash (like SHA-512) to concatenate four distinct variables:

`derived_secret = H(user_key || company_key || system_key || employee_key)`

1. User Key: Binds authentication to the base identity (passkey/IdP) without exposing app credentials.

2. Company Key: Establishes an organizational boundary to prevent cross-tenant replay.

3. System Key: Generates a unique key for every specific SaaS application, completely halting lateral movement.

4. Employee Key: Personalized tag to mathematically block credential sharing.

The result is a session-specific derived passphrase exceeding 80 characters.

Because no secrets are stored on Unixi’s servers, there is no centralized target to breach. Additionally, because the user never handles, types, or knows the derived credential, the human risk vector for phishing and keylogging drops to zero.

How traditional password manager breaches happen vs. how Unixi uSSO stops them.

We put together a deep-dive structural comparison breaking down recent password manager CVEs vs. uSSO mitigation strategies.

For those managing enterprise identity infrastructures, does moving to local, on-the-fly cryptographic derivation solve your user adoption gaps (where voluntary vaults typically hover around a low 15-30% adoption rate), or do you see operational hurdles with extension-reliant authentication?

Full technical breakdown and analysis: https://unixi.io/blog/beyond-password-vaults-universal-sso-the-next-evolution-of-identity-security/