AWS Credentials File Grab for 2026-10-20

Oct 20, 2026 Exploitation

Last Updated: 00:00 UTC

Direct requests for /.aws/credentials — the AWS CLI credential store. Long-term AWS access keys in this file grant full programmatic access to the associated AWS account. Widely targeted in automated cloud credential harvesting campaigns.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.005 — Cloud Instance Metadata API

Observed URIs

Attackers by Country

United States: 170The Netherlands: 68Singapore: 54Belgium: 53Germany: 35France: 28Canada: 22Taiwan: 20Japan: 20Brazil: 15Seychelles: 13Bulgaria: 9Lithuania: 9United Kingdom: 8United Arab Emirates: 7Russia: 6India: 4Iran: 3Indonesia: 3Spain: 3Ireland: 2Philippines: 1Finland: 1Azerbaijan: 1Sweden: 1Slovenia: 1Italy: 1Switzerland: 1Malaysia: 1Argentina: 1South Africa: 1Pakistan: 1Ukraine: 1Australia: 1Romania: 1Eritrea: 1Czechia: 1Georgia: 1
United States17029.9%
The Netherlands6812.0%
Singapore549.5%
Belgium539.3%
Germany356.2%
France284.9%
Canada223.9%
Taiwan203.5%
Japan203.5%
Brazil152.6%
Seychelles132.3%
Bulgaria91.6%
Lithuania91.6%
United Kingdom81.4%
United Arab Emirates71.2%
Russia61.1%
India40.7%
Iran30.5%
Indonesia30.5%
Spain30.5%
Ireland20.4%
Philippines10.2%
Finland10.2%
Azerbaijan10.2%
Sweden10.2%
Slovenia10.2%
Italy10.2%
Switzerland10.2%
Malaysia10.2%
Argentina10.2%
South Africa10.2%
Pakistan10.2%
Ukraine10.2%
Australia10.2%
Romania10.2%
Eritrea10.2%
Czechia10.2%
Georgia10.2%

IP Address : ASN : City/Provider

Share on: