🎯 Credential harvesting

The items that name it 15

• How we detect frontier model misalignment
  article2026-10-29

  Monitored category: seeking passwords, tokens or secrets outside the authorized task

• MemTensor Compromise: Poisoned MemOS Releases on npm and PyPI
  article2026-10-18It is written here as Credential harvesting: sckit searches for credential files and secrets for npm, PyPI, GitHub, GitLab, AWS, Vault, SSH and other services, and reads the host's full environment.
• Frequently Asked Questions About the BeyondTrust Remote Support Arbitrary File Upload (CVE-2026-102764)
  advisory2026-10-16

  Attacker collected credentials stored on the appliance

• Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
  article2026-10-16
• Addendum to GPT-6 Astra System Card: GPT-6.1 Sol
  article2026-09-29

  misalignment flag category observed increasing relative to GPT-6 Sol in internal Codex traffic simulation

• Active exploitation of Cisco Secure Firewall Management Center vulnerabilities
  writeup2026-09-09

  theft of AD service-account credentials, MySQL account credentials, domain account information, and user authentication data from FMC databases by all three clusters

• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeup2026-09-03

  Stealing authentication credentials (passwords, access keys, temporary tokens) to impersonate legitimate users or roles

• Swarm of OpenAI Agents Exploit Artifactory Zero-Day to Escape Sandbox and Breach Hugging Face
  article2026-08-04

  Exfiltrated a secret object containing 136 production keys

• Compromised PyPI Package: mrmustard 0.7.4 Steals SSH, Cloud, and Kubernetes Credentials
  writeup2026-07-25

  Payload reads SSH private keys from ~/.ssh, AWS credentials/config from ~/.aws, Kubernetes config from ~/.kube/config, and environment variables matching AWS_, KUBE, SLURM_, PBS_, SGE_, CUDA, NVIDIA, CONDA prefixes.

• Gabson0x/pentdem
  repo2026-07-20

  Extracts credentials, tokens, and secrets from HTTP responses via regex patterns for API keys, tokens, passwords; JWT detection; hardcoded credential detection

• Security incident disclosure — July 2026
  article2026-07-16

  Actor harvested cloud and cluster credentials after gaining node-level access

• AWS Well-Architected: Software Supply Chain Security
  article2026-06-04

  Malicious packages scan developer environments and CI/CD pipelines for secrets such as npm tokens, GitHub tokens, and AWS IAM access keys

• Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages
  article2026-05-19

  Payload scrapes plaintext secrets from CI/CD runner memory and steals GitHub tokens, npm tokens, GitHub Actions OIDC tokens, AWS credentials and instance metadata, Kubernetes service account files, HashiCorp Vault tokens, SSH keys, Docker authentication files, database connection strings, and enviro

• Cooldowns.dev
  article2026-05-06

  LiteLLM compromise harvested cloud credentials and SSH keys for about two hours.

• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repo

  Uses TruffleHog to scan for exposed secrets (Shai-Hulud 2.0); ChainDrop targets 300+ credential patterns including AI tooling (Anthropic/Claude, OpenAI, Cursor, Gemini), cloud IAM, SSH keys, Kubernetes, Vault, and crypto wallets.