CISA Contractor Leaks GovCloud Keys on GitHub; Microsoft Dismantles 'Fox Tempest' Malware-Signing Service

A new Darktrace report details how AI adoption in manufacturing exposes operational technology (OT) environments to significant cyber risks. The report introduces 'agentic AI systems'—highly autonomous AIs—as a critical new threat vector due to their broad permissions. Survey findings indicate 90% of manufacturing security professionals believe AI will increase social engineering success, and 49% are concerned about adaptive malware. This update emphasizes the IT/OT convergence and the potential for physical harm, production disruption, and IP theft in the manufacturing sector.

Further investigation into the CISA contractor data leak reveals more critical details. The exposed data included administrative credentials for three AWS GovCloud accounts and plaintext passwords for internal CISA systems, specifically found in a file named 'importantAWStokens'. The private RSA key provided access to all CISA code repositories, not just a single GitHub app. The contractor was identified as an employee of defense firm Nightwing. Additionally, the AWS GovCloud keys remained valid for 48 hours after the GitHub repository was taken down on May 18, 2026, extending the window of vulnerability. The credentials reportedly followed a weak, predictable pattern, highlighting significant security failures.