NebulaDrop Cloud Credential Theft Surge Threatens Enterprises

On August 25, 2026 the SANS Internet Storm Center flagged a fast‑moving campaign dubbed NebulaDrop that hijacks Azure Functions to siphon cloud credentials. By stealing OAuth tokens and service‑principal secrets, the malware grants attackers unfettered access to corporate workloads, making the threat immediate for any organization that relies on serverless compute. The rapid spread across public repositories means defenders must act now to seal the gap before attackers pivot to full‑scale data exfiltration.

Technically, NebulaDrop leverages a malicious Azure Function deployed through compromised GitHub Actions. The function runs a lightweight PowerShell payload that queries the instance metadata service for Azure AD tokens, then uses the stolen JWTs to call Azure Resource Manager APIs. It extracts service‑principal keys, encrypts them with a hard‑coded RSA key, and exfiltrates the payload over HTTPS to a C2 domain that mimics legitimate Microsoft endpoints. Because the code executes entirely in a serverless environment, it leaves no persistent binaries on the host, evading traditional endpoint AV.

The campaign arrives amid a broader shift toward serverless supply‑chain attacks. Gartner predicts that by 2027, 45% of cloud breaches will involve compromised CI/CD pipelines, up from 22% in 2023. Competitors such as Magecart and TrickBot have already adopted similar tactics, but NebulaDrop’s focus on Azure Functions distinguishes it by targeting the most widely used PaaS offering in the enterprise. Cloud security spend in Asia‑Pacific is projected to exceed $12 billion this year, underscoring the market’s urgency to address identity‑theft vectors that bypass network firewalls.

For India’s booming tech ecosystem, the fallout could be severe. Major Indian SaaS providers and fintech firms that host APIs on Azure are prime targets, and a breach could trigger RBI compliance penalties and breach notification obligations under the Personal Data Protection Bill. The Indian Computer Emergency Response Team (CERT‑India) has already issued an advisory, urging developers to audit their GitHub Actions secrets and enforce least‑privilege IAM roles. Start‑ups that rely on rapid cloud deployment may lack mature security controls, making them especially vulnerable to credential‑theft attacks.

Key Highlights

• Detect and quarantine malicious Azure Functions deployed via compromised CI/CD pipelines
• Steals OAuth tokens and service‑principal secrets using fileless PowerShell payloads
• Potentially exposes up to 30% of Azure‑based workloads in the Asia‑Pacific region
• Cloud admins and DevOps teams benefit most by tightening secret management
• Expect Microsoft to roll out Azure Function hardening updates in Q4 2026

Real-World Impact

Security operations centers now need to add serverless‑specific detection rules, while cloud administrators must rotate all Azure AD tokens issued after the breach window. DevOps engineers are forced to audit CI/CD secrets and implement short‑lived credentials. MSSPs serving Indian enterprises will see a spike in demand for identity‑focused managed services, and compliance officers must update audit trails to satisfy upcoming data‑protection regulations.

Why This Matters

NebulaDrop marks a strategic pivot from traditional malware to identity‑theft attacks that live entirely in the cloud. CTOs must rethink perimeter‑only defenses and adopt zero‑trust principles for cloud identities, including continuous token monitoring and automated credential rotation. Developers should embed secret‑scanning tools into their pipelines, and security teams need to expand threat‑intel feeds to include serverless‑specific indicators of compromise.

Watch for Microsoft’s forthcoming Azure Function security patch and the next SANS advisory that will detail detection signatures. Organizations that integrate automated secret rotation and serverless monitoring now will be better positioned to neutralize NebulaDrop before it compromises critical workloads.