Credential and secret theft
Named by 3 kept items in this workspace.
Search every workspace for Credential and secret theft. It matches the name as written, so it can find other things that share it.
The items that name it 3
Second stage reportedly targets GitHub and npm tokens, cloud credentials, private keys, database connection strings, Vault tokens, Kubernetes service account tokens, and GitHub Actions runner memory
Steals .env files, npm/PyPI/GitHub/Slack/Twilio/AWS/Azure/GCP/Vault tokens, SSH keys, Docker credentials, Kubernetes configs
Malware targets GitHub, npm, PyPI, RubyGems, JFrog, cloud credentials, Kubernetes service account material, SSH keys, Docker configuration, shell histories, .env files, package registry credentials, and AI developer tool configuration
All techniques in this workspace.