Cybersecurity teams defend organizations by
detecting malware, blocking exploits and
patching vulnerabilities. Yet many of today's most damaging breaches require none of those attack techniques.
Instead, attackers are abusing trust: trust in
identity systems, trust in cloud APIs, trust in search engines and even trust in
enterprise AI assistants. Rather than breaking into networks, they are logging in through legitimate channels and using approved tools to steal sensitive information.
Drawing on more than 1,500 digital forensics and incident response investigations, LevelBlue's Devon Ackerman argues that the common denominator among three very different real-life data breaches isn't failed security controls — it's the misuse of trusted technologies combined with critical visibility gaps.
"One pattern shows up over and over: attackers aren't breaking in," Ackerman said at a cybersecurity analysts' conference earlier this year. "They're logging in, then operating inside tools you've already approved."
Patterns of trust abuse
The three incidents Ackerman presented at the conference look very different on the surface, but they share a common theme: attackers weaponized technologies that organizations already trusted.
In one case it was Microsoft Graph API; in another, a search engine; and in the third, an enterprise AI assistant. Traditional defenses such as
endpoint detection and response (EDR) and
multi-factor authentication (MFA) largely functioned as designed because no malware or software exploit was required. Instead, legitimate identities and services were manipulated to accomplish malicious goals.
"The controls failing aren't the ones you'd expect," Ackerman said. "What's failing is visibility into how legitimate tools like OAuth apps, search engines, AI copilots, your help desk, etc. are being weaponized."
These incidents show that rather than viewing trust as an implicit business enabler, security leaders increasingly need to treat it as an attack surface that requires continuous monitoring and governance.
Data theft through abuse of Microsoft Graph API
The first incident began with a
phishing email advertising an end-of-year bonus. After obtaining a user's authentication token, the attacker registered a malicious OAuth application and used the Bun JavaScript runtime, together with Microsoft Graph API, to enumerate users, SharePoint sites and mailboxes before exfiltrating approximately 8.7 million files from 72 SharePoint subsites in about three days.
The remarkable aspect of the attack was how ordinary it appeared. As Ackerman explained, there was "no DLP alert, no EDR alert, no anomaly. It looked like Outlook."
The lesson is that
cloud APIs themselves have become a primary attack surface. Organizations need visibility into SaaS and API telemetry, not just endpoint activity, to detect abuse that appears completely legitimate.
Insider compromise through SEO poisoning
The second case shows how easily a trusted employee can unwittingly become an insider threat. An employee searching online for a legal template clicked a sponsored search result that redirected to a discussion forum hosting a malicious document that harbored a legitimate remote access tool, or RAT.
The resulting compromise never involved lateral movement, yet within roughly 16 hours, the attackers accessed mapped drives, Outlook and sensitive files before launching a data extortion campaign.
Ackerman emphasized that "no lateral movement" does not mean "low impact."
"A single compromised user with mapped drives, Outlook access, and sensitive file visibility can still create a major data-extortion event," he said in his presentation
The incident also highlights a growing weakness in traditional security awareness training. Employees naturally trust search engines, sponsored links and discussion forums, making browser activity and identity telemetry increasingly important detection sources.
Abuse of a legitimate AI tool by a threat actor
Perhaps the most surprising example involved an unexpected use of artificial intelligence. A social engineer posing as a call-center employee installed a legitimate RAT on the victim's machine — nefarious but not unusual.
But rather than deploying AI-generated malware, the attacker used the victim's own Microsoft Copilot to search SharePoint for spreadsheets containing usernames, passwords and other valuable information. The AI assistant accelerated discovery of data the attacker was already authorized to access.
"AI didn't break security" in this case, Ackerman pointed out. "It accelerated discovery of data the threat actor already had access to."
The lesson here, Ackerman said, is that enterprise AI should no longer be viewed solely as a productivity tool. Like privileged identities, AI assistants require governance, auditing and careful review of underlying permissions.
How to close the blind spots
Across all three incidents, the root problem was incomplete visibility rather than ineffective controls. Graph API activity resembled normal Outlook traffic. SEO poisoning began in a browser into which EDR had limited visibility. AI-assisted data discovery occurred inside legitimate enterprise applications. None of these activities appeared malicious when viewed in isolation.
The lesson from LevelBlue's incident investigations is clear: resilience depends less on adding another prevention tool than on understanding how trusted services are being used.
By treating SaaS APIs as attack surfaces, governing AI like privileged access, and correlating identity, browser, endpoint and cloud telemetry, organizations can close the blind spots that allow trusted tools to become trusted weapons.
