T1552.001Credentials In Files
T1552.001 — Credentials In Files is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 100 detection use cases covering it and 72 threat-intel articles citing it.
Credential Access
100Use cases
72Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1552 · Unsecured Credentials
Use cases covering this technique (100)
Azure Key Vault keys / secrets read [WEEKLY] Cross-category credential-store enumeration with rapid egress to anonymizing tunnel/CDN [WEEKLY] Developer interpreter / package-manager process exfiltrating tokens to public code-hosting / worker domains [WEEKLY] Install-Triggered Registry Publish or Git Push (Supply-Chain Worm Self-Propagation) [WEEKLY] npm-install spawned process performing cred-file fan-out plus IMDS reach [WEEKLY] npm Install-Time Lifecycle Hook Triggers Outbound Egress to Newly-Seen Domain (Shai-Hulud/Miasma/IronWorm pattern) [WEEKLY] npm/yarn/pnpm Install-Hook Spawn → Credential-Store Read or Worm-Payload Drop in node_modules [WEEKLY] Package install lifecycle hook spawns interpreter that reads developer credential stores [WEEKLY] Package-install lifecycle script harvests local credentials and beacons to a non-baselined domain [WEEKLY] Package-manager child process credential fan-out with public egress (Mini Shai-Hulud / TeamPCP worm chain) [WEEKLY] Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access [WEEKLY] Package-manager install hook spawns interpreter that beacons to non-registry host within 120s [WEEKLY] Package Manager Install Hook Spawns Scripting Interpreter Then Touches Credential Files or Egresses Off-Registry [WEEKLY] Package-Manager Install -> Interpreter Child -> Non-Registry Egress Within 5 Minutes [WEEKLY] Package-manager install-time interpreter spawn with credential-file read and outbound egress within 120s [WEEKLY] Package manager lifecycle hook spawns network-fetching shell or runtime [WEEKLY] Supply-chain repo credential theft → outbound exfil to attacker infra MCP Github Suspicious Operation MCP Sensitive System File Search Potential password in username Shai-Hulud 2 Exfiltration Artifact Files Windows Unusual FileZilla XML Config Access Windows Unusual Intelliform Storage Registry Access [LLM] Non-browser process fan-out reading SSH/npm/Docker/AWS/browser credential stores on Arch host [LLM] Atomic Arch infostealer — bulk reads of SSH/npmrc/Vault/browser-cookie files by non-shell process [LLM] TruffleHog binary spawned by npm/node — Shai-Hulud secret harvest [LLM] AI coding agent descendant reading developer credentials / env (Agentjacking credential access) [LLM] PowerShell process invoking LDAP:// with hardcoded plaintext credential [LLM] OpenClaw agent runtime reads secrets store (.env / .aws / id_rsa) followed by external network egress [LLM] Bun runtime egress to npm/PyPI publish endpoints or attacker-controlled GitHub repos [LLM] npm install-time process reads .npmrc, SSH key, or cloud-credential file [LLM] Meta Graph API request with access_token in URL query string (CVE-2026-48039 leak signature) [LLM] npm publish / login / auth-token write from a developer endpoint [LLM] Cross-platform memory scraping of GitHub Actions Runner.Worker process [LLM] Node child of node-gyp/python making outbound to GitHub dead-drop or anomalous web service during install [LLM] Bun runtime reading developer credential files (.npmrc / .pypirc / .ssh / .env / cloud configs) [LLM] Claude Code Action Read tool exfil: node opens /proc/<pid>/environ on Linux CI runner [LLM] Claude Code Read tool steered to cloud-credential files on GitHub Actions runner [LLM] Cloud/SSH/npm credential file access by Node or Bun during npm install [LLM] Cloud IMDS credential harvesting from node/bun process on CI runner [LLM] Cloud credential file access by node/python runtime [LLM] Process reading /proc/<pid>/mem of GitHub Actions Runner.Worker (in-memory secret extraction) [LLM] Kubernetes API curl/wget with ServiceAccount token from container [LLM] Vulnerable praisonai-platform deployment hunt (uvicorn launching praisonai_platform.api.app) [LLM] PraisonAI Python subprocess spawns OS shell with discovery / credential-reading commands [LLM] Container default credential leak — PKP_DB_PASSWORD=changeMePlease and --secret [LLM] Mini Shai-Hulud npm worm exfil to filev2.getsession.org [LLM] npm/yarn/pnpm postinstall hook spawning credential-harvest tooling [LLM] Shai-Hulud npm postinstall reads cloud credential files (~/.aws, ~/.ssh, ~/.kube, gcloud ADC) [LLM] Non-Codex-CLI node process reading ~/.codex/auth.json (Codex OAuth credential theft) [LLM] npm/bun process writing GitHub Actions workflow files (worm secret-exfil injection) [LLM] Megalodon harvester: bash secret-grep across workspace (API_KEY|SECRET|TOKEN|PRIVATE_KEY|BEGIN RSA) [LLM] Megalodon harvester: clustered read of ~/.ssh/id_*, ~/.kube/config, ~/.npmrc, ~/.docker/config.json in one session [LLM] Developer credential store read by Python or Node spawned from VS Code (Nx Console stealer pattern) [LLM] Compromised @cap-js stealer artefact hash present on disk or in execution [LLM] VS Code extension host fan-out reads of developer secrets (.ssh, .aws, .npmrc, ~/.claude/settings.json) [LLM] Burst credential-file harvest by VS Code / node process (Nx Console stealer behaviour) [LLM] Python Process Reading Multi-Cloud Credential Stores (durabletask Stealer Stage) [LLM] HAXcms CVE-2026-46395: unauthenticated GET to /system/api/connectionSettings [LLM] GitHub Actions Runner.Worker process-memory secret scraping via /proc [LLM] python3 reading /proc/<PID>/mem to scrape Runner.Worker secrets [LLM] Node.js process bulk-reading cloud & SCM credential files in single session [LLM] Arcane GitOps: non-admin PUT on /api/customize/git-repositories/{id} followed by /test, /branches, or /files within 5 min (CVE-2026-45625 cr [LLM] node.js process staging credential dump in nt-* temp directory [LLM] Node/npm/Bun process enumerating cloud, wallet, AI, and messaging credential file paths [LLM] Mini Shai-Hulud: Bun runtime executing `router_runtime.js` (2nd-stage stealer) [LLM] Mini Shai-Hulud known SHA256 IOC match (setup.mjs / execution.js / runner-memory dumper) [LLM] Node.js postinstall reading .env / .env.* during package install [LLM] Credential archive staging — trin.tar.gz created by python process [LLM] Shai-Hulud preinstall: node/npm spawning git/curl/gh pushing to attacker repo or GitHub API [LLM] Read of /proc/<pid>/mem targeting GitHub Runner.Worker (TeamPCP credential dump) [LLM] hackerbot-claw token exfiltration: curl POST with GITHUB_TOKEN to recv.hackmoltrepeat.com [LLM] Access to OpenClaw credential store (~/.openclaw/credentials/, ~/.openclaw/config.json5) [LLM] In-cluster Kubernetes secret enumeration with Python user-agent (litellm stealer K8s pivot) [LLM] TeamPCP exfiltration archive — tpcp.tar.gz file creation on host [LLM] GitHub Actions runner credential stealer: python3 base64-decoded payload reading /proc/<pid>/mem [LLM] TeamPCP Linux credential harvest: Python reading /etc/shadow + auth.log + cloud [LLM] Exfiltration to kubernetes-el attacker webhook.site UUIDs (Pwn Request payload) [LLM] Storybook portable-stories RCE — vitest/node spawning shell, recon or secret-grep child (CVE-2026-27148) [LLM] s1ngularity Nx postinstall — `gh auth token` spawned by node/npm on CI runner [LLM] tj-actions/changed-files compromise: memdump.py secret-exfiltration shell pattern on runner (CVE-2025-30066) [LLM] AI agent skill leaks Stripe key or card PAN/CVC verbatim in curl command line [LLM] AI session-log harvest via prompt-log extract.sh writing markdown with embedded secrets [LLM] AI agent process reads cloud-credential, SSH or dotenv files (skill credential theft) [LLM] AI CLI tool (claude/gemini/q) spawned non-interactively by node/npm/npx for recon [LLM] Shai-Hulud 3.0 'Goldox-T3chs' GitHub exfiltration marker observed [LLM] TruffleHog secret-scanner execution on developer / CI host (SHA1-Hulud credential harvest) [LLM] TruffleHog spawned by node/npm as postinstall — Shai-Hulud credential sweep [LLM] s1ngularity nx: AI CLI assistant invoked with permission-bypass flags (Claude/Gemini/Q) [LLM] GhostAction curl/wget POST of CI/CD secret token to Plesk endpoint [LLM] GhostAction GitHub workflow secret-enumeration commit pattern [LLM] TruffleHog secret-scanner executed by node/npm postinstall context [LLM] Postinstall node child enumerating multiple developer credential stores [LLM] AI coding agent CLI (claude/gemini/q) invoked with permission-bypass flags [LLM] Runner.Worker process memory dump via memdump.py on CI/CD runner (tj-actions credential theft) [LLM] Linux process opens /proc/<pid>/mem or /proc/<pid>/maps on a build/CI host (CVE-2025-8217 / CVE-2025-30066 memory dump TTP) [LLM] Scavenger loader/stealer SHA256 execution or drop on endpoint [LLM] Runner.Worker process memory dumped via /proc/PID/mem read on Linux runner [LLM] Container PID 1 environment harvest via /proc/1/environ read [LLM] Assets running vulnerable crypto-js (<4.2.0) or crypto-es (<2.1.0) — CVE-2023-46233 / CVE-2023-46133Articles citing this technique (72)
crit 400+ AUR Packages Hijacked: What the “Atomic Arch” Campaign Means for Supply-Chain Security art-14
high Miasma and Hades Are Spreading Now: Detect Them on Developer Machines with Suspicious Files art-45
crit [GHSA / CRITICAL] GHSA-jpvj-wpmj-h7rv: Supply chain compromise via malicious @cap-js/openapi art-123
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit The AntV Supply Chain Campaign Expands: Microsoft's `durabletask` PyPI Package Compromised art-248
crit [GHSA / CRITICAL] CVE-2026-46395: HAXcms: Private Key Disclosure via Broken HMAC Implementation art-261
crit Malicious node-ipc versions published to npm in suspected maintainer account compromise art-284