Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

EMERALDWHALE: 15k Cloud Credentials Stolen in Operation Targeting Exposed Git Config Files

The Sysdig Threat Research Team (TRT) recently discovered a global operation, EMERALDWHALE, targeting exposed Git configurations resulting in more than 15,000 cloud service credentials stolen. This campaign used multiple private tools that abused multiple misconfigured web services, allowing attackers to steal credentials, clone private repositories, and extract cloud credentials from their source code. Credentials for over 10,000 private repositories were collected during the operation.

The extent of Hardcoded Secrets: From Development to Production

Code repositories are the primary source of secrets, but GitGuardian data highlights the broader issue of secret sprawl. From code to production, understand how these vulnerabilities expose sensitive data and learn how to enhance your security posture with GitGuardian insights.

GitHub Comments from Legitimate Repositories Exploited to Deliver Remcos RAT

One of the most interesting findings of our Netskope Threat Labs Report: Insurance 2024 was the discovery that GitHub is the most popular application in terms of malware downloads for this specific vertical, surpassing Microsoft OneDrive, which is usually the undisputed leader of this unwelcome chart.