Threat actors are abusing virtual private servers (VPS) to compromise software-as-a-service (SaaS) accounts, according to an investigation by Darktrace. The cybersecurity vendor identified coordinated SaaS account compromises across multiple customer environments, all of which involved logins from IP addresses linked to various VPS providers. The compromised accounts were used to conduct follow-on phishing attacks, with threat actors taking steps to avoid detection and enable persistent access. A VPS is a legitimate virtualized server widely used by businesses to provide dedicated resources and control on a shared physical device. However, they can be abused by attackers to bypass geolocation-based defenses by mimicking local traffic, evading IP reputation checks with clean, newly…