Credential harvesting and exfiltration
Named by 4 kept items in this workspace.
Search every workspace for Credential harvesting and exfiltration. It matches the name as written, so it can find other things that share it.
The items that name it 4
Harvested npm tokens, GitHub credentials, and cloud keys, exfiltrating to a hardcoded webhook and a public GitHub repository created on the victim's account
Collects secrets for AWS, GCP, Azure, GitHub, and npm, exfiltrating them via commits/pushes to a newly created public GitHub repository
Megalodon compressed harvested credentials from 5,500+ repositories and exfiltrated them to a bare IP on port 8443.
Worm searches developer machines and CI runners for credentials across GitHub, npm, AWS, Kubernetes, Vault, Azure, Google Cloud, Terraform, Docker, and Slack, then exfiltrates them
All techniques in this workspace.