Kubernetes Service Account Token Theft Surges 282% as Cybercriminals Target Cloud Infrastructure Cybercriminals are increasingly targeting Kubernetes environments, with attacks involving stolen service account tokens rising 282% over the past year. The IT sector bore the brunt of these breaches, accounting for 78% of incidents, as threat actors exploit misconfigurations and exposed applications to gain footholds in cloud infrastructure. Rather than relying on complex container escapes, attackers now focus on stealing Kubernetes identities allowing them to move laterally from a single compromised container to an organization’s core cloud systems. Two recent high-profile attacks underscore the severity of this threat. In mid-2025, North Korea’s Slow Pisces (Lazarus Group) responsible for a $1.5 billion cryptocurrency heist earlier in the year breached a major crypto exchange by phishing a developer. The attackers deployed a malicious pod into the company’s Kubernetes cluster, extracting a highly privileged service account token. Using this token, they bypassed perimeter security, accessed backend financial systems, and stole millions. These attacks follow a recurring pattern: threat actors exploit vulnerabilities to infiltrate a container, steal Kubernetes credentials, and escalate privileges to compromise broader cloud infrastructure. Automated tools like Peirates designed to map cluster permissions and extract secrets accelerate this process, enabling rapid lateral movement. Security failures often stem from overprivileged identities and poor configurations. To mitigate risks, experts recommend: - Strict Role-Based Access Control (RBAC) to limit pod permissions. - Short-lived service account tokens to reduce the window for exploitation. - Runtime monitoring and audit logging to detect anomalous behavior, such as unauthorized script downloads or restricted file access. Without these safeguards, attackers can chain minor exploits into full-scale cloud compromises making Kubernetes a critical attack surface in modern cyber threats.