CI/CD and Cloud Credential File Grab for 2026-09-25

Sep 25, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

Germany: 8United States: 7Belgium: 6Taiwan: 2The Netherlands: 2Canada: 2Japan: 1Singapore: 1Lithuania: 1Bulgaria: 1India: 1Romania: 1United Kingdom: 1
Germany823.5%
United States720.6%
Belgium617.6%
Taiwan25.9%
The Netherlands25.9%
Canada25.9%
Japan12.9%
Singapore12.9%
Lithuania12.9%
Bulgaria12.9%
India12.9%
Romania12.9%
United Kingdom12.9%

IP Address : ASN : City/Provider

Share on: