CI/CD and Cloud Credential File Grab for 2026-10-12

Oct 12, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 6Belgium: 5Canada: 4Brazil: 4The Netherlands: 3Taiwan: 2Japan: 2Singapore: 1Germany: 1Argentina: 1Hong Kong: 1Lithuania: 1
United States619.4%
Belgium516.1%
Canada412.9%
Brazil412.9%
The Netherlands39.7%
Taiwan26.5%
Japan26.5%
Singapore13.2%
Germany13.2%
Argentina13.2%
Hong Kong13.2%
Lithuania13.2%

IP Address : ASN : City/Provider

Share on: