CI/CD and Cloud Credential File Grab for 2026-09-23

Sep 23, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 10Germany: 8Belgium: 5Taiwan: 3Bulgaria: 2Singapore: 2The Netherlands: 2Canada: 1Japan: 1Romania: 1United Kingdom: 1Ireland: 1
United States1027.0%
Germany821.6%
Belgium513.5%
Taiwan38.1%
Bulgaria25.4%
Singapore25.4%
The Netherlands25.4%
Canada12.7%
Japan12.7%
Romania12.7%
United Kingdom12.7%
Ireland12.7%

IP Address : ASN : City/Provider

Share on: