Hackers steal 15,000 cloud credentials from exposed Git config files
A large-scale malicious operation named "EmeraldWhale" scanned for exposed Git configuration files to steal over 15,000 cloud account credentials from thousands of private repositories.
Git configuration files, such as /.git/config or .gitlab-ci[.]yml, are used to define various options like repository paths, branches, remotes, and sometimes even authentication information like API keys, access tokens, and passwords.
According to Sysdig, who discovered the campaign, the operation involves using automated tools that scan IP ranges for exposed Git configuration files, which may include authentication tokens.
These tokens are then used to download repositories stored on GitHub, GitLab, and BitBucket, which are scanned for further credentials.
See more: https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/
#cybersecurity #git
zCat
npub1zm…5pnd6
2024-10-31 11:55:09
Author Public Key
npub1zm7jduqq2nmxz5wxh4ujtm00g9vxzqa0r82yt7flvm67yje5gfaqa5pnd6Published at
2024-10-31 11:55:09Event JSON
{
"id": "2c453c4fe589bf4ba9cde93b7c0858e799cab10c267da45979581bd7c184763c",
"pubkey": "16fd26f00054f66151c6bd7925edef41586103af19d445f93f66f5e24b34427a",
"created_at": 1730375709,
"kind": 1,
"tags": [
[
"t",
"cybersecurity"
],
[
"t",
"git"
],
[
"r",
"https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/"
]
],
"content": "Hackers steal 15,000 cloud credentials from exposed Git config files\n\nA large-scale malicious operation named \"EmeraldWhale\" scanned for exposed Git configuration files to steal over 15,000 cloud account credentials from thousands of private repositories.\n\nGit configuration files, such as /.git/config or .gitlab-ci[.]yml, are used to define various options like repository paths, branches, remotes, and sometimes even authentication information like API keys, access tokens, and passwords.\n\nAccording to Sysdig, who discovered the campaign, the operation involves using automated tools that scan IP ranges for exposed Git configuration files, which may include authentication tokens.\n\nThese tokens are then used to download repositories stored on GitHub, GitLab, and BitBucket, which are scanned for further credentials.\n\nSee more: https://www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/\n\n#cybersecurity #git",
"sig": "ad0cdb217dd98fd108ca92ab657704b7eb48413eb9194c3037d31439afa665229ddb2c6b8dbdb1c39bd72efbcba4eb48fb431166f893adc2334e336e0adce35d"
}