From Black Hat to DEF CON: 10 Hacker Summer Camp Standouts

What Happened

Security researchers presented new ways that cloud browser terminals (CloudShell) can be abused to run hidden workloads and persist access even after credentials are revoked. Another presentation showed that AI assistants can be tricked into running harmful commands when they read data containing hidden instructions, even if a firewall blocks the original attack. A threat actor accidentally exposed their own methods by installing security software on their attack machine. Education sector breaches affecting millions of students and teachers were also discussed. Organizations using cloud terminals or AI agents should review their access controls and consider how untrusted data might influence AI behavior.

Key Takeaways

• CloudBasher toolkit automates environment discovery, enumeration, and deployment of distributed workloads using reverse-engineered CloudShell protocols for AWS, Azure, and GCP.
• CloudShell IAM design weaknesses include websocket sessions persisting after API token revocation and default access tied to consumer email accounts.
• Indirect prompt injection via Model Context Protocol (MCP) can turn blocked WAF requests into actionable malicious instructions for AI agents, combining OWASP LLM01:2026 and LLM03:2026 risks.
• Threat actor trial abuse incident revealed attacker workflows, AI usage, and reconnaissance activity after they installed an EDR agent on their attack machine.
• Education sector breaches including PowerSchool and Canvas/Instructure highlight ongoing risks to student and educator PII.

Affected Systems

• AWS CloudShell
• Azure CloudShell
• GCP CloudShell
• AI agents using Model Context Protocol (MCP)
• Sentry telemetry integration with AI coding agents

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Attacker gains access to a cloud environment via browser-based CloudShell terminal.
2. Discovery: Attacker uses AWS CLI and shell commands to enumerate environment variables, IAM identity, and container metadata endpoints.
3. Credential Access: Attacker retrieves security credentials from the container metadata URL using curl.
4. Persistence: Attacker deploys distributed workloads with persistent storage and private networking using CloudBasher toolkit, maintaining access even after API token revocation.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules or queries are provided in the article.

Detection Engineering Assessment

Required Log Sources

• AWS CloudTrail
• AWS VPC Flow Logs
• Azure Activity Log
• GCP Audit Logs
• DNS logs
• WAF logs
• MCP API gateway logs

Hunting Hypotheses

Control Gaps

• Traditional EDR products lack visibility into cloud-native browser terminal sessions.
• WAFs may block malicious requests but do not prevent the blocked request content from being ingested by AI agents as instructions.
• Cloud IAM token revocation does not terminate active websocket sessions in CloudShell.

Key Behavioral Indicators

• CloudShell sessions initiating workload deployments after API token revocation.
• Shell commands querying AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_AUTHORIZATION_TOKEN environment variables.
• Curl requests to localhost metadata endpoints from CloudShell sessions.
• AI agents executing commands after ingesting telemetry data containing embedded instructions.

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing additional monitoring and conditional access policies around CloudShell usage, if supported by your cloud provider.
• Evaluate whether websocket sessions in your cloud provider's CloudShell can be forcefully terminated upon token revocation.
• If using AI agents with MCP, consider implementing strict tool-use allowlists and data sanitization pipelines to prevent indirect prompt injection.

User Protection

• Consider enabling MFA on all cloud accounts with CloudShell access, if not already required.
• Consider reviewing which user accounts have default CloudShell access and whether consumer email accounts should be restricted.

Security Awareness

• Consider incorporating indirect prompt injection risks into existing security awareness programs for development teams using AI coding agents.
• Consider briefing cloud administrators on CloudBasher techniques and the risk of websocket session persistence after token revocation.

MITRE ATT&CK Mapping

Additional IOCs

• Command Lines:
  • Purpose: Retrieve AWS caller identity to confirm access and permissions in CloudShell environment. | Tools: aws-cli | Stage: Discovery | aws sts get-caller-identity
  • Purpose: Check AWS container environment variables for credential retrieval endpoints. | Tools: shell | Stage: Discovery | echo "$AWS_CONTAINER_CREDENTIALS_FULL_URI"
  • Purpose: Check AWS container authorization token for metadata access. | Tools: shell | Stage: Discovery | echo "$AWS_CONTAINER_AUTHORIZATION_TOKEN"
  • Purpose: Retrieve container metadata and security credentials via curl. | Tools: curl, jq | Stage: Credential Access
• Other:
  • arn:aws:iam::05*********79:user/aws_user - AWS IAM User ARN observed during CloudBasher demonstration at DEF CON 2026.
  • AIDAQ************EWS - AWS IAM User ID pattern observed during CloudBasher demonstration at DEF CON 2026.