Unit 42 research explores how root access on a compromised Kubernetes node can be leveraged to misuse SPIFFE/SPIRE metadata. Attackers can spoof and harvest co-located workload identities, bypassing traditional security controls. This deep dive into post-exploitation identity misuse in cloud-native environments is crucial for understanding advanced persistent threats in Kubernetes deployments.