Anomalous interactive Jira activity by qa@snowflake.net service account

Ishaan S@isrv

•updated Aug 20, 2026•1•0•6

Detects anomalous human-like interactive browsing behavior from the 'qa@snowflake.net' Jira service account. This account is typically restricted to automated ticket creation via GitHub Actions; broad exploration of Jira boards, timelines, and reports indicates a potential account compromise where an API token has been exfiltrated and repurposed for reconnaissance.