CI/CD and Cloud Credential File Grab for 2026-10-20

Oct 20, 2026 Exploitation

Last Updated: 00:00 UTC

Requests for deployment secrets left in web roots: GitHub Actions workflow files, Docker registry auth (.docker/config.json), .git-credentials, Google Cloud application default credentials, Azure token caches, kubeconfig, npm/PyPI tokens and Terraform state.

MITRE ATT&CK

Tactic: Credential Access (TA0006)
Technique: T1552.001 — Unsecured Credentials: Credentials In Files

Observed URIs

Attackers by Country

Belgium: 9United States: 4Germany: 4Bulgaria: 3Switzerland: 3Taiwan: 2France: 1Canada: 1Thailand: 1Brazil: 1South Africa: 1The Netherlands: 1Japan: 1Lithuania: 1Romania: 1
Belgium926.5%
United States411.8%
Germany411.8%
Bulgaria38.8%
Switzerland38.8%
Taiwan25.9%
France12.9%
Canada12.9%
Thailand12.9%
Brazil12.9%
South Africa12.9%
The Netherlands12.9%
Japan12.9%
Lithuania12.9%
Romania12.9%

IP Address : ASN : City/Provider

Share on: