[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1552":3},{"item":4,"lessons":18,"controls":69,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1552","T1552","Unsecured Credentials",8,"MITRE","**What attackers do.** Attackers search compromised systems and repositories for credentials stored insecurely, such as passwords in files, scripts, registry keys, shell history, cloud metadata services, private keys or code. This serves the Credential Access tactic.\n\n**How to defend.** Move secrets into a managed vault, scan code repositories and file shares for exposed credentials, and rotate anything found. Protect cloud instance metadata services with the hardened versions that require session tokens. Limit access to configuration files and shell histories.\n\n**Signs to look for.** Look for searches across file shares for words like password, access to private key files, requests to instance metadata services from unusual processes, and use of credentials from unexpected hosts. A common gap is secrets embedded in old scripts and deployment files that nobody owns.","Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and\u002For misplaced in many locations on a system, including plaintext files (e.g. Shell History), operating system or application-specific repositories (e.g. Credentials in Registry),  or other specialized files\u002Fartifacts (e.g. Private Keys).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1552\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},14,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"ai-powered-agents-exploiting-aws-credentials-via-webshells-and-ec2-roles","AI-Powered Agents Exploiting AWS Credentials via Webshells and EC2 Roles","2026-11-11T16:20:39.974+00:00",{"slug":26,"title":27,"published_at":28},"build-system-escape-and-oidc-misconfiguration-let-attackers-steal-740k-in-ai-api-keys","Build System Escape and OIDC Misconfiguration Let Attackers Steal $740K in AI API Keys","2026-11-10T18:21:05.506+00:00",{"slug":30,"title":31,"published_at":32},"ai-powered-secret-harvesting-exposes-github-credentials-in-minutes","AI-Powered Secret Harvesting Exposes GitHub Credentials in Minutes","2026-11-09T11:22:24.281+00:00",{"slug":34,"title":35,"published_at":36},"ai-powered-credential-harvesting-turns-github-mistakes-into-cloud-breaches-in-minutes","AI-Powered Credential Harvesting Turns GitHub Mistakes into Cloud Breaches in Minutes","2026-11-06T13:22:09.55+00:00",{"slug":38,"title":39,"published_at":40},"black-october-llmjacking-campaign-exposes-ai-platform-credential-risks","Black October: LLMJacking Campaign Exposes AI Platform Credential Risks","2026-10-31T00:20:27.931+00:00",{"slug":42,"title":43,"published_at":44},"stolen-github-tokens-enable-secret-exfiltration-via-actions-logs","Stolen GitHub Tokens Enable Secret Exfiltration via Actions Logs","2026-10-26T10:21:50.084+00:00",{"slug":46,"title":47,"published_at":48},"ai-coding-agents-require-dedicated-endpoint-visibility-and-forensic-controls","AI Coding Agents Require Dedicated Endpoint Visibility and Forensic Controls","2026-10-12T12:21:09.449+00:00",{"slug":50,"title":51,"published_at":52},"compromised-identity-opens-door-to-cloud-devops-pipeline-takeover","Compromised Identity Opens Door to Cloud DevOps Pipeline Takeover","2026-09-29T18:21:58.594+00:00",{"slug":54,"title":55,"published_at":56},"ai-powered-botnet-exploits-exposed-docker-hosts-to-steal-credentials","AI-Powered Botnet Exploits Exposed Docker Hosts to Steal Credentials","2026-09-28T22:21:13.3+00:00",{"slug":58,"title":59,"published_at":60},"marimo-rce-exploited-to-reach-ssh-bastion-in-eight-seconds","Marimo RCE Exploited to Reach SSH Bastion in Eight Seconds","2026-09-15T14:22:29.939+00:00",{"slug":62,"title":63,"published_at":64},"ai-powered-credential-harvesting-campaign-steals-thousands-of-api-keys-in-hours","AI-Powered Credential Harvesting Campaign Steals Thousands of API Keys in Hours","2026-09-08T16:23:03.704+00:00",{"slug":66,"title":67,"published_at":68},"700-ai-agents-exploit-ssrf-and-exposed-api-tokens-to-breach-hugging-face","700 AI Agents Exploit SSRF and Exposed API Tokens to Breach Hugging Face","2026-08-28T14:21:51.731+00:00",[70,75,79,83,88,93],{"slug":71,"name":72,"problem":73,"stories":74},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",9,{"slug":76,"name":77,"problem":78,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":80,"name":81,"problem":82,"stories":9},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":84,"name":85,"problem":86,"stories":87},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",6,{"slug":89,"name":90,"problem":91,"stories":92},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",5,{"slug":94,"name":95,"problem":96,"stories":97},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",2,[99,105,110,115,119,123,128,132],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","6","Control 6","Access Control Management",10,{"family":106,"item":107,"code":108,"title":109,"together":87},"gdpr","32","Article 32","Security of processing",{"family":111,"item":112,"code":113,"title":114,"together":87},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":111,"item":116,"code":117,"title":118,"together":87},"ia-5","IA-5","Authenticator Management",{"family":100,"item":120,"code":121,"title":122,"together":92},"3","Control 3","Data Protection",{"family":124,"item":125,"code":126,"title":127,"together":92},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",{"family":111,"item":129,"code":130,"title":131,"together":92},"ac-6","AC-6","Least Privilege",{"family":133,"item":134,"code":135,"title":136,"together":137},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",4]