Microsoft warns that the Chinese state-sponsored cyber-espionage group Silk Typhoon has shifted its tactics to target IT supply chains. Instead of directly breaching organizations, they now exploit remote management tools and cloud services used by IT providers to infiltrate downstream customer networks.

The hackers steal API keys, credentials, and authentication tokens to access cloud environments stealthily, avoiding malware or web shells. They have also exploited zero-day vulnerabilities in major enterprise software, such as Ivanti, Palo Alto Networks, and Citrix, to escalate privileges and maintain persistent access.

Organizations are urged to patch vulnerabilities, monitor API key leaks, and enhance identity security to mitigate this growing threat.