AI Coding Assistant Credential Theft for 2026-07-19
Last Updated: 00:00 UTC
Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files
Observed URIs
Attackers by Country
| France | 2 | 28.6% |
| Australia | 1 | 14.3% |
| The Netherlands | 1 | 14.3% |
| Belgium | 1 | 14.3% |
| Germany | 1 | 14.3% |
| United States | 1 | 14.3% |
IP Address : ASN : City/Provider
-
104.28.211.186 : AS13335 Cloudflare, Inc. : Paris
-
34.129.109.212 : AS396982 Google LLC : Melbourne
-
34.13.145.151 : AS396982 Google LLC : Groningen
-
34.140.5.164 : AS396982 Google LLC : Brussels
-
34.155.8.39 : AS396982 Google LLC : Paris
-
34.40.45.3 : AS396982 Google LLC : Frankfurt am Main
-
35.245.65.174 : AS396982 Google LLC : Washington