AWS Credentials File Grab for 2026-10-19

Oct 19, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

United States: 184The Netherlands: 93France: 67Singapore: 60Bulgaria: 42Belgium: 28Germany: 24United Kingdom: 22Switzerland: 22Taiwan: 19Russia: 16Japan: 14Lithuania: 12Canada: 10Seychelles: 10Iran: 10Brazil: 8Spain: 8Australia: 7Türkiye: 7India: 6Indonesia: 6Finland: 4Sweden: 4United Arab Emirates: 4Ukraine: 4Poland: 3Romania: 3Moldova: 3Italy: 2Vietnam: 2Hong Kong: 2Ireland: 2Greece: 2Philippines: 1Morocco: 1Azerbaijan: 1China: 1Ivory Coast: 1Albania: 1Pakistan: 1Israel: 1Czechia: 1
United States18425.6%
The Netherlands9312.9%
France679.3%
Singapore608.3%
Bulgaria425.8%
Belgium283.9%
Germany243.3%
United Kingdom223.1%
Switzerland223.1%
Taiwan192.6%
Russia162.2%
Japan141.9%
Lithuania121.7%
Canada101.4%
Seychelles101.4%
Iran101.4%
Brazil81.1%
Spain81.1%
Australia71.0%
Türkiye71.0%
India60.8%
Indonesia60.8%
Finland40.6%
Sweden40.6%
United Arab Emirates40.6%
Ukraine40.6%
Poland30.4%
Romania30.4%
Moldova30.4%
Italy20.3%
Vietnam20.3%
Hong Kong20.3%
Ireland20.3%
Greece20.3%
Philippines10.1%
Morocco10.1%
Azerbaijan10.1%
China10.1%
Ivory Coast10.1%
Albania10.1%
Pakistan10.1%
Israel10.1%
Czechia10.1%

IP Address : ASN : City/Provider

Share on: