# T1555.006 Cloud Secrets Management Stores > As of 2026-10-28, T1555.006 (Cloud Secrets Management Stores) appears in 10 tracked threats, first reported 2026-05-28 and most recently 2026-10-28; it most often appears alongside T1552.001 (Credentials In Files). - **Tracked threats:** 10 (4 critical, 4 high, 2 medium) - **First seen:** 2026-05-28 - **Last seen:** 2026-10-28 - **Detection rules:** 14 (counts only; Blue tier and above) ## Key facts - **ID:** T1555.006 - **Framework:** MITRE ATT&CK - **Tactics:** Credential Access - **Matrix:** Enterprise - **Parent:** T1555 - **Data as of:** 2026-10-28 - **MITRE:** https://attack.mitre.org/techniques/T1555/006/ ## Activity timeline T1555.006 first appeared in tracked threats on 2026-05-28 and was most recently reported on 2026-10-28. The busiest month was 2026-10 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-10. ## How adversaries use it T1555.006 Cloud Secrets Management Stores is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1555 Credentials from Password Stores](https://intel.threadlinqs.com/technique/T1555). Threadlinqs maps 10 of 3313 tracked threats (0.3%) to it; by severity that is 4 critical, 4 high, 2 medium. Threats that use T1555.006 most often also use [T1552.001 Credentials In Files](https://intel.threadlinqs.com/technique/T1552.001) (7 threats), [T1078.004 Cloud Accounts](https://intel.threadlinqs.com/technique/T1078.004) (6 threats), [T1528 Steal Application Access Token](https://intel.threadlinqs.com/technique/T1528) (6 threats), [T1552.005 Cloud Instance Metadata API](https://intel.threadlinqs.com/technique/T1552.005) (6 threats), [T1059.007 JavaScript](https://intel.threadlinqs.com/technique/T1059.007) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. ## Mitigations MITRE ATT&CK lists 1 mitigation for T1555.006. - [M1026 Privileged Account Management](https://attack.mitre.org/mitigations/M1026/) ## Data sources Telemetry that can reveal T1555.006, per MITRE ATT&CK. - Cloud Service — Cloud Service Enumeration ## Tracked threats 10 tracked threats use T1555.006. - [Shai-Hulud Self-Propagating Supply Chain Malware Campaign Targeting NPM, GitHub Actions and Release Pipelines](https://intel.threadlinqs.com/threat/TL-2026-4661) — high — 2026-10-28 - [Credential Layer Exposure: Secrets Sprawl and Shai-Hulud npm Supply Chain Credential Harvesting (GitGuardian)](https://intel.threadlinqs.com/threat/TL-2026-4090) — medium — 2026-10-22 - [Storm-0940 Uses ARTEX Agentic AI Framework in ConnectWise/SkyKick OAuth Supply-Chain Compromise of Microsoft…](https://intel.threadlinqs.com/threat/TL-2026-4060) — critical — 2026-10-21 - [AI Agents Create an Unseen Credential Surface Exposing API Keys and Cloud Secrets](https://intel.threadlinqs.com/threat/TL-2026-3643) — medium — 2026-10-15 - [AWS AI Agent Vulnerabilities (Loom, SageMaker Unified Studio) Let Attackers Bypass Authentication and Steal…](https://intel.threadlinqs.com/threat/TL-2026-2860) — critical — 2026-10-03 - [Autonomous AI Agent Operation (Strix, Cairn, Hermes) Steals 600K+ Payment Cards and Injects Skimmers into…](https://intel.threadlinqs.com/threat/TL-2026-2633) — critical — 2026-09-23 - [Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)](https://intel.threadlinqs.com/threat/TL-2026-2341) — high — 2026-09-05 - [Token Jacking: Cybercriminals Steal and Resell AI API Keys/Tokens via Transfer Stations](https://intel.threadlinqs.com/threat/TL-2026-1911) — high — 2026-08-06 - ['ChainDrop' self-propagating worm compromises hundreds of popular npm packages (keyv, cacheable ecosystem)…](https://intel.threadlinqs.com/threat/TL-2026-2822) — critical — 2026-08-04 - [First AI-Agent-Driven Cloud Intrusion — Marimo CVE-2026-39987 RCE → AWS Secrets Manager → SSH Bastion →…](https://intel.threadlinqs.com/threat/TL-2026-0619) — high — 2026-05-28 ## Related CVEs CVEs referenced by the tracked threats that use T1555.006, most frequent first. - [CVE-2026-103956](https://intel.threadlinqs.com/cve/CVE-2026-103956) - [CVE-2026-103957](https://intel.threadlinqs.com/cve/CVE-2026-103957) - [CVE-2026-103958](https://intel.threadlinqs.com/cve/CVE-2026-103958) - [CVE-2026-104019](https://intel.threadlinqs.com/cve/CVE-2026-104019) - [CVE-2026-39987](https://intel.threadlinqs.com/cve/CVE-2026-39987) ## Detection coverage Threadlinqs maintains 14 detection rules mapped to T1555.006 (SPL 5, KQL 7, Sigma 2). Rule content is available to Blue tier accounts and above; this page shows counts only. 14 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1555 Credentials from Password Stores](https://intel.threadlinqs.com/technique/T1555) — 471 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1555.006 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)