CI/CD and Cloud Credential File Grab for 2026-09-21

Sep 21, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 13Belgium: 8Singapore: 5Bulgaria: 2Taiwan: 2France: 1Germany: 1South Africa: 1Brazil: 1South Korea: 1The Netherlands: 1Finland: 1Hong Kong: 1Lithuania: 1United Kingdom: 1
United States1332.5%
Belgium820.0%
Singapore512.5%
Bulgaria25.0%
Taiwan25.0%
France12.5%
Germany12.5%
South Africa12.5%
Brazil12.5%
South Korea12.5%
The Netherlands12.5%
Finland12.5%
Hong Kong12.5%
Lithuania12.5%
United Kingdom12.5%

IP Address : ASN : City/Provider

Share on: