Credential and secret harvesting
Named by 4 kept items in this workspace.
Search every workspace for Credential and secret harvesting. It matches the name as written, so it can find other things that share it.
The items that name it 4
lambsys harvests environment variables, .env files, database credentials, and API keys from compromised hosts.
~5,900 line PHP stealer with fifteen specialist collector modules harvesting cloud credentials (AWS, GCP, Azure, DigitalOcean, Heroku, Vercel, Netlify, Railway, Fly.io), infrastructure secrets (kubeconfig, Vault tokens, Helm configs, Docker config.json), developer credentials (SSH keys, git-credenti
Walks filesystem and process environment for AWS IAM credentials (~/.aws/credentials, EC2 instance metadata), GCP/Azure SDK config credentials, Kubernetes service-account tokens, HashiCorp Vault tokens (~/.vault-token), GitHub PATs/OAuth/short-lived tokens (ghp_*, gho_*, ghs_*), GitHub Actions OIDC
Full CI environment dump, /proc/*/environ for all running processes, PID 1 environment data, cloud credentials (AWS keys/session tokens, GCP OAuth tokens, Azure IMDS responses), SSH private keys, Docker registry configs, .npmrc tokens, Kubernetes configs, HashiCorp Vault tokens, Terraform credential
All techniques in this workspace.