Slim Spider Steals the Keys the Cloud Hands Out for Free

recently i wrote about plump spider, a brazilian crew that gets inside bank software and makes fraudulent transfers look legitimate. here is its cousin. a second brazil-based ecrime threat actor, slim spider, and this one is not after your transfers. it is after the keys to your crypto.

slim spider is new, tracked only since march 2026. it hit a brazilian financial institution and went straight for two things. pix instant-payment accounts and cryptocurrency custody credentials. the latter is more important. custody credentials are the keys controlling the wallets. get those, and you are no longer trying to trick a payment system. now you can move the assets out, and there may be no transaction to reverse.

but the target is not the interesting part. the method is. slim spider's real skill is the cloud. most people still picture basement-dwelling attackers breaking into servers. slim spider lives in aws-style cloud environments and knows them really well. it wrote custom scripts for querying the cloud metadata service, the internal address handing out temporary access credentials to running instances. it quietly harvests those tokens. it then enumerates the secrets sitting behind those credentials, looking specifically for material tied to digital assets. then it uses a go-based backdoor called mikedor to sit inside and watch.

it even used openssl directly inside its bash scripts for cryptographic signing, avoiding third-party libraries capable of creating additional detection opportunities.

and it did not stop at the cloud account. the actor likely used compromised azure devops credentials to run malicious pipelines into a managed kubernetes cluster. they even named one implant spi to blend in with the infrastructure behind pix. this is not somebody fumbling around in aws. this is an adversary who understands how modern financial systems are actually built.

for years the crown jewels sat on servers a company owned, could see, and could touch. now they sit in the cloud, and the keys to them are temporary tokens floating around inside the cloud environment itself. slim spider figured out you do not need to break into the vault if you can stand next to it and catch the keys as they are handed out. the metadata service was built for convenience. they turned it into a credential faucet.

and this is the part i think matters most. the cloud did not fail because somebody compromised it. it failed because the attacker learned how to become something the cloud already trusted. once the token is valid, the infrastructure often does exactly what it was designed to do. this is no longer just an access problem. it is an identity problem.

and here is the bigger picture, because slim spider does not stand alone. crowdstrike places it inside the same broader shift we are already seeing with plump spider.

brazil's financial sector now has at least two distinct, professionalized ecrime adversaries, each with a different specialty. one is adept at manipulating the payment rails, and one stealing the cloud keys to the crypto. brazil built one of the most advanced instant-payment and digital-asset markets on earth, and the criminal talent grew up right alongside it, specialized and cloud-native.

and notice how many trust boundaries are collapsing into one another here. cloud identity, devops pipelines, kubernetes, secrets management, and financial custody are no longer separate worlds. compromise one trusted layer and the access can flow straight into the next. the attacker does not need five different breakthroughs anymore. sometimes one valid identity is enough to start walking the entire stack.

the lesson reaches well past brazil. every company moving its money into the cloud is inheriting a new attack surface most of them do not fully understand yet. the old instinct was to guard the perimeter, the doors and the servers. slim spider, and most threat actors nowadays do not care about the perimeter. they care about the tokens your cloud hands out automatically, thousands of times a day, to things it assumes are trustworthy. the assumption is the way in.

you did not get breached at the front door. you got breached by the key the building was handing out on its own.