AI Coding Assistant Credential Theft for 2026-08-08
Last Updated: 00:00 UTC
Requests for the credential and config files of AI coding assistants: ~/.claude/.credentials.json and .claude.json (Claude Code), ~/.codex (OpenAI Codex), ~/.gemini (Gemini CLI), Cursor and Copilot. These files hold OAuth tokens and API keys, and scanners walk path traversals to common home directories (root, ubuntu, admin) to find them on servers where the tools run.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files
Observed URIs
Attackers by Country
| United States | 7 | 36.8% |
| Singapore | 5 | 26.3% |
| Japan | 4 | 21.1% |
| Poland | 1 | 5.3% |
| Germany | 1 | 5.3% |
| Sweden | 1 | 5.3% |
IP Address : ASN : City/Provider
-
136.85.67.167 : AS396982 Google LLC : Singapore
-
20.215.70.187 : AS8075 Microsoft Corporation : Warsaw
-
20.218.66.54 : AS8075 Microsoft Corporation : Frankfurt am Main
-
34.124.149.77 : AS396982 Google LLC : Singapore
-
34.143.182.144 : AS396982 Google LLC : Singapore
-
34.146.58.76 : AS396982 Google LLC : Tokyo
-
34.158.38.172 : AS396982 Google LLC : Singapore
-
34.20.243.154 : AS396982 Google LLC : Los Angeles
-
34.50.175.247 : AS396982 Google LLC : Las Vegas
-
34.50.185.87 : AS396982 Google LLC : Las Vegas
-
34.73.231.195 : AS396982 Google LLC : North Charleston
-
34.73.46.118 : AS396982 Google LLC : North Charleston
-
34.84.68.153 : AS396982 Google LLC : Tokyo
-
34.85.113.213 : AS396982 Google LLC : Tokyo
-
35.187.243.203 : AS396982 Google LLC : Singapore
-
35.200.87.182 : AS396982 Google LLC : Tokyo
-
35.243.147.70 : AS396982 Google LLC : North Charleston
-
4.223.171.122 : AS8075 Microsoft Corporation : Sweden
-
8.229.45.141 : AS396982 Google LLC : The Dalles