CI/CD and Cloud Credential File Grab for 2026-09-22

Sep 22, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 12Singapore: 12Belgium: 4Taiwan: 2United Arab Emirates: 1South Africa: 1Moldova: 1Romania: 1France: 1United Kingdom: 1
United States1233.3%
Singapore1233.3%
Belgium411.1%
Taiwan25.6%
United Arab Emirates12.8%
South Africa12.8%
Moldova12.8%
Romania12.8%
France12.8%
United Kingdom12.8%

IP Address : ASN : City/Provider

Share on: