Mitiga Labs (Internal Build)

A Skill Is Just Text.
So Is a Backdoor.

INSTRUCTION FILES YOUR AGENT READS — AND NOBODY OPENS.

Rule files, hooks, and CLAUDE.md run automatically the moment an agent loads them. Mitiga Labs found instruction files quietly recording prompts, tokens, and environment variables, then shipping them out. No malware, often no audit log.

See How it Works

Let them come

PromptLogger: The Hidden Exfiltration Layer in AI Instruction Files

A Research Report from Mitiga Labs

What We Saw in 2025.
What Comes Next.

The cloud attack campaigns and research that defined a year.

2025 was the year the threat got smarter. Attackers skipped zero-days and walked in through trusted identities, OAuth links, API chains, and lateral SaaS paths.

See How it Works

Let them come

What We Saw in 2025.
The Year the Threat Got Smarter

A Threat Intelligence Report from Mitiga Labs

From Attacks to Zero Impact

Mitiga Labs is where we take apart cloud, SaaS, identity, third-party services and AI attacks, then write what they find into the detections customers run. Those detections interrupt the next attack before it reaches the business. That's Zero-Impact Breach Prevention.

Meet the Team

Latest from the Labs

Explore the latest discoveries, deep dives, and technical how-tos from the Mitiga Labs team. Our research is dedicated to informing defenders and disrupting attackers.

PromptLogger: The Hidden Exfiltration Layer in AI Instruction Files

A Mitiga Labs report on PromptLoggers and exfiltration hidden in AI instruction files — six real public-repo case studies, the techniques, and how to detect them before an agent runs.

Mitiga Research Team

Read the Post →

Hunting Third-Party App Abuse in Entra

Stolen ConnectWise app credentials gave attackers app-only access to Microsoft 365. A six-part method for hunting third-party app abuse in Entra ID.

Ucha Gobejishvili

Read the Post →

When Detection Engineering Becomes a Data Engineering Problem

In a security data lake, a detection can be correct and still never finish. How two months of PySpark tuning became 34 rules that cut runtime up to 60%.

Yafit Shayo

Read the Post →

SaaS Applications

Threat Hunting & Detection

Google Workspace - Log Insights to Your Threat Hunt

Keep corporate cloud collaboration platforms secure using Mitiga's technical guide to leveraging Google Workspace log insights for enterprise threat hunting.

Read the Post →

AWS

Cloud Forensics & Logging

How Transit Gateway VPC Flow Logs Help Incident & Response Readiness

In this blog, we will focus on the security and forensic aspects of Transit Gateway VPC flow logs and expand the way they can be used by organizations to respond to cloud incidents.

Or Aspir

Read the Post →

AWS

Cloud Forensics & Logging

How Identifying UserData Script Manipulation Accelerates Investigation

UserData script manipulation by threat actors is a technique that has been known in the wild for several years and has been observed being exploited by many attack groups, but monitoring and detecting malicious manipulation of user data script is not trivial with standard AWS Cloudtrail logging.

Doron Karmi

Read the Post →

Google Cloud

Attack Research

Hidden Dangers in the Cloud Control Plane

The cloud control plane can be difficult to understand. In this article we examine attack scenarios and how to harden your GCP environment. Learn more.

Read the Post →

Identity & Access

Threat Hunting & Detection

Okta Logs Threat-Hunting Guide: Hunt for Breach Evidence

Understand your Okta system logs with this comprehensive guide, helping you enhance security, monitor activity, and respond effectively to incidents.

Read the Post →

AWS

Cloud Forensics & Logging

Log4Shell — Forensic Investigation in AWS

Learn how to forensically investigate your AWS environment for Log4Shell exploitation using CloudTrail, VPC Flow Logs, ALB access logs, and AWS Athena queries.

Pablo Ariel Sirota

Read the Post →