--- title: "BSides Las Vegas 2026: Following the Trust Relationships Attackers Are Targeting" url: https://daily.dev/posts/bsides-las-vegas-2026-following-the-trust-relationships-attackers-are-targeting-gjrm6mhsh source_url: https://blog.gitguardian.com/bsideslv-2026 type: article source: "GitGuardian" published: 2026-08-14T14:05:08.065Z updated: 2026-08-14T14:05:36.129Z tags: ["security", "cloud", "cicd", "prompt-injection"] reading_time: 9 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # BSides Las Vegas 2026: Following the Trust Relationships Attackers Are Targeting **[GitGuardian](https://daily.dev/sources/gitguardian)** · 9 min read · 0 upvotes · 0 comments ## Summary A recap of BSides Las Vegas 2026 talks covering how attackers increasingly exploit valid trust relationships rather than breaking through defenses directly. Topics include misconfigured GCP Workload Identity Federation, CI/CD pipelines as a new Tier 0 attack surface, session cookie theft via infostealers, and slow prompt-injection attacks that poison persistent AI agent memory. The overarching theme is that trust records (DNS entries, session cookies, workload identities, agent memory) often outlive the conditions that made them legitimate, creating latent attack surface that security teams must actively audit and revoke. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can attackers abuse Google Cloud Workload Identity Federation even without stealing long-lived keys? Misconfigurations such as an empty attribute_condition, a quiet change to a provider's Common Expression Language expression, or compromise of a trusted certificate authority can let unauthorized identities exchange tokens for access. Administrative logs show configuration changes, but actual token exchanges require additional STS and IAM Credential Data Access logging to detect. Deny-by-default organization policies are recommended to prevent overly open federation setups. _Teams hardening cloud IAM setups follow security research like this through daily.dev to catch configuration blind spots early._ ### Why are CI/CD pipelines considered a new Tier 0 attack target instead of Active Directory? CI/CD systems often hold powerful credentials, have broad network access, and can deploy directly into sensitive environments, making a compromised runner capable of inheriting the full authority of every trust relationship tied to its identity. Attack paths commonly start with plaintext secrets in pipeline configs and move through runners into cloud infrastructure, deployment systems, and IAM, extending far beyond what traditional Active Directory hardening covers. _Engineers securing build pipelines track threat modeling approaches like these on daily.dev before a runner compromise spreads._ ### Why is a stolen session cookie more dangerous than a stolen password protected by MFA? A stolen password can still be blocked by MFA, but a stolen session cookie or token represents authentication that has already been completed, letting an attacker skip the MFA step entirely. Infostealers harvest these browser cookies and session tokens, and attackers use anti-detection browsers and cookie-editing tools to mimic the victim's environment and keep sessions usable. Enabling device-bound sessions in Chrome, which is not on by default, helps mitigate this. _Anyone hardening session security against infostealers can follow emerging countermeasures like this via daily.dev._ ## Similar posts on daily.dev - [BSides San Antonio 2026: Following Trust Across Applications, Cloud, and Compliance](https://daily.dev/posts/bsides-san-antonio-2026-following-trust-across-applications-cloud-and-compliance-vb7uz7pos) · GitGuardian · 0 upvotes · 0 comments - [BSides SF 2026: Looking At Security Beyond The Next Big Bet](https://daily.dev/posts/bsides-sf-2026-looking-at-security-beyond-the-next-big-bet-b6e7cm3ui) · GitGuardian · 0 upvotes · 0 comments - [BSides312 2026: Security Basics Under New Pressure](https://daily.dev/posts/bsides312-2026-security-basics-under-new-pressure-al52qlzpi) · GitGuardian · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#cicd](https://daily.dev/tags/cicd), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/bsides-las-vegas-2026-following-the-trust-relationships-attackers-are-targeting-gjrm6mhsh)