CI/CD and Cloud Credential File Grab for 2026-10-16

Oct 16, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

United States: 7The Netherlands: 6Brazil: 4Belgium: 4Singapore: 3Canada: 2Iran: 1Switzerland: 1Taiwan: 1Australia: 1Chile: 1Germany: 1Indonesia: 1United Kingdom: 1Pakistan: 1Romania: 1
United States719.4%
The Netherlands616.7%
Brazil411.1%
Belgium411.1%
Singapore38.3%
Canada25.6%
Iran12.8%
Switzerland12.8%
Taiwan12.8%
Australia12.8%
Chile12.8%
Germany12.8%
Indonesia12.8%
United Kingdom12.8%
Pakistan12.8%
Romania12.8%

IP Address : ASN : City/Provider

Share on: