🎯 Unsecured Credentials

The items that name it 7

• Threat Hunter's Guide to GitHub (Datadog Security Labs)
  writeup2026-09-16

  High-volume secrets listing enumeration - attacker lists which repos/orgs/environments have secrets configured or pulls secret-scanning alert findings before stealing a secret

• Numbat
  repo2026-09-05
• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01It is written here as Unsecured Credentials: Credentials In Files.

  Keychain query functions targeting crypto-wallet seeds and mnemonics from Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX

• Socket: GitHub Actions Abuse Powers Distributed cPanel/WHM Exploitation Campaign
  writeup2026-07-23It is written here as Unsecured Credentials: Credentials in Files.

  Payload searches compromised servers for credentials, config files, SSH material, and tokens stored in files.

• Socket: Malicious NuGet Package Impersonates Sicoob Banking SDK
  writeup2026-05-29It is written here as Unsecured Credentials: Credentials in Files.

  PFX certificate files and passwords supplied by developers/read from disk during SDK initialization

• Socket: 5 Malicious NuGet Packages Target Chinese .NET Developers
  writeup2026-05-07It is written here as Unsecured Credentials: Credentials in Files.

  SSH private key (id_rsa) and browser saved-password theft.

• BufferZoneCorp Malicious Gems & Go Modules
  writeup2026-05-06It is written here as Unsecured Credentials: Private Keys.