SaaS Platforms Face Identity Attacks: 100M-Weekly Library Hijacked in H1 2026

For SaaS companies, the platform you’re building on is now the attackers’ preferred launching pad. Darktrace’s latest findings show that in H1 2026, cloud and SaaS environments became the top target, with threat actors weaponizing everything from non-human identities to widely used libraries like Axios—downloaded 100 million times a week. A compromised SaaS account isn’t just an isolated incident; it’s a gateway to inbox rule tampering, internal phishing, and supply chain sabotage, undermining the product integrity your customers depend on.

The cybersecurity landscape has undergone a significant transformation in the first half of 2026, with cloud and SaaS environments emerging as the primary targets for sophisticated threat actors. According to a new report by Darktrace, attackers have completed a pivot away from traditional malware and vulnerability exploitation toward a strategy centered on compromising identities. While 2025 saw a heavy focus on stealing account credentials, H1 2026 has witnessed an alarming expansion into email authentication protocols, cloud entitlement abuse, software supply chain corruption, AI gateway infiltration, remote administration tooling, and non-human identities. This shift effectively makes 'trust' the new attack surface, as malicious actors inherit established permissions and legitimate access rather than forcibly bypassing them.

“

Darktrace’s latest findings show that in H1 2026, cloud and SaaS environments became the top target, with threat actors weaponizing everything from non-human identities to widely used libraries like Axios—downloaded 100 million times a week.

The implications are profound. In one illustrative case highlighted by Darktrace, a single compromised SaaS account triggered a cascade of malicious activity across email, SaaS applications, and network layers—including inbox rule modifications and internal phishing campaigns. Crucially, none of these individual indicators were severe enough to trip traditional detection mechanisms on their own; only when correlated did they reveal a clear intrusion. This underscores a fundamental challenge for defenders: as attack patterns grow more subtle and span multiple platforms, security teams must evolve from isolated alerting to holistic behavioral analysis.

The threat multiplies further when attackers target the software supply chain. In April 2026, malicious actors hijacked Axios, a widely used JavaScript library downloaded over 100 million times per week, to distribute remote access trojans (RATs). Because Axios is deeply embedded in countless developer environments and CI/CD pipelines, the breach not only infected end-user machines but gave attackers a foothold in the software development lifecycle itself. Similarly, Darktrace observed the abuse of legitimate blockchain infrastructure to disseminate infostealers like AMOS and Phexia, preying on users who often lack robust security measures. These tactics demonstrate a disturbingly efficient model: by compromising a single trusted node—be it a library, a SaaS account, or a blockchain service—attackers can reach an exponentially larger victim base with minimal effort.

Behind these developments lies a broader industrial trend: the rapid adoption of cloud services has expanded the organizational attack perimeter far beyond the traditional network boundary. Businesses now rely on a web of interconnected SaaS applications, APIs, and third-party integrations, each representing a potential trust relationship that can be exploited. Darktrace's observation that attackers no longer need to bypass trust controls but instead inherit them through compromised identities or delegated access is a sobering reminder that the very mechanisms designed to enable seamless collaboration—single sign-on, OAuth tokens, service accounts—are now prime vectors for intrusion.