Skip to navigation

Threat reportThreat IntelligenceTL-2026-4874

Credential Layer Exposure: Hardcoded and Long-Lived Secrets Sprawl Across Repos, CI/CD, Laptops and Secrets Managers

mediumMONITORING

GitGuardian's State of Secrets Sprawl 2026 and its 30 Oct 2026 'credential layer' article report 28.65 million new hardcoded secrets in public GitHub commits in 2025 (+34% YoY) and that 64% of secrets confirmed valid in 2022 were still valid in January 2026. First disclosed .

Key facts

IdentifiersTL-2026-4874
Also known asSecrets Sprawl, Credential Layer Exposure
SeverityMEDIUM
First disclosed
Affected productsMultiple Source code repositories, CI/CD pipelines, developer endpoints, collaboration platforms, Kubernetes clusters and secrets managers
Weaknesses (CWE)CWE-798, CWE-312
MalwareShai-Hulud 2
ToolsTruffleHog - S9009
MITRE ATT&CK techniquesT1078 Valid Accounts, T1078.004 Valid Accounts: Cloud Accounts, T1087.004 Account Discovery: Cloud Account, T1098.001 Account Manipulation: Additional Cloud Credentials, T1195.002 Compromise Software Supply Chain, T1213.003 Data from Information Repositories: Code Repositories, T1530 Data from Cloud Storage, T1552 Unsecured Credentials, T1552.001 Unsecured Credentials: Credentials In Files, T1648 Serverless Execution
MotivationUNKNOWN
Target sectorstechnology, software-development, cloud, all-sectors
Target regionsGlobal
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4874 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Secret Scanner (TruffleHog/Gitleaks) Executed on Endpoint or CI Runner — Exploitation Phase

Detects execution of open-source secret scanners (TruffleHog v3, Gitleaks, detect-secrets, ggshield) on Windows endpoints and CI runners, especially with --only-verified or broad filesystem/org/bucket scope. Attackers reuse these tools to harvest hardcoded and long-lived credentials from developer laptops and CI/CD runners, as in the Shai-Hulud 2 analysis (6,943 systems, 33,185 unique secrets) cited in the credential layer exposure research (TL-2026-4874, T1552.001).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1552.001, T1552, T1195.002
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: medium
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| eval cmd=lower(CommandLine), img=lower(Image)
| where match(img,"(trufflehog|gitleaks|detect-secrets|ggshield)") OR match(cmd,"(trufflehog|gitleaks (detect|dir|git)|detect-secrets scan|ggshield secret scan)")
| eval verified_only=if(match(cmd,"--only-verified|--results=verified"),1,0), broad_scope=if(match(cmd,"(filesystem|--org|--bucket| dir )"),1,0)
| eval risk=case(verified_only=1 AND broad_scope=1,"high",verified_only=1 OR broad_scope=1,"medium",true(),"low")
| stats count AS executions values(CommandLine) AS cmdlines values(ParentImage) AS parents min(_time) AS first_seen max(_time) AS last_seen BY host, User, risk
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| extend Cmd = tolower(ProcessCommandLine)
| where tolower(FileName) matches regex @'(trufflehog|gitleaks|detect-secrets|ggshield)' or Cmd matches regex @'(trufflehog|gitleaks (detect|dir|git)|detect-secrets scan|ggshield secret scan)'
| extend VerifiedOnly = Cmd matches regex @'--only-verified|--results=verified', BroadScope = Cmd matches regex @'(filesystem|--org|--bucket| dir )'
| extend Risk = case(VerifiedOnly and BroadScope, 'high', VerifiedOnly or BroadScope, 'medium', 'low')
| summarize Executions = count(), CmdLines = make_set(ProcessCommandLine, 10), Parents = make_set(InitiatingProcessFileName, 5), FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by DeviceName, AccountName, Risk

Sigma

title: Secret Scanner Executed on Endpoint or CI Runner (TruffleHog/Gitleaks)
id: 3f6a2c1e-8b47-4d52-9a13-5c0e7d1b2a41
status: experimental
description: Detects execution of open-source secret scanners (TruffleHog v3, Gitleaks, detect-secrets, ggshield) on endpoints, a technique used to harvest hardcoded credentials from developer machines and CI runners (credential layer exposure, TL-2026-4874).
references:
  - https://blog.gitguardian.com/credential-layer-security-in-practice/
  - https://www.gitguardian.com/state-of-secrets-sprawl-report-2026
author: Threadlinqs Team
date: 2026/10/31
tags:
  - attack.credential_access
  - attack.t1552.001
  - attack.initial_access
  - attack.t1195.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\trufflehog.exe'
      - '\gitleaks.exe'
      - '\ggshield.exe'
  selection_cmd:
    CommandLine|contains:
      - 'trufflehog filesystem'
      - 'trufflehog git'
      - 'trufflehog github'
      - 'trufflehog s3'
      - '--only-verified'
      - 'gitleaks detect'
      - 'detect-secrets scan'
      - 'ggshield secret scan'
  condition: 1 of selection_*
falsepositives:
  - Authorized AppSec or DevSecOps teams running secret scanning
  - Pre-commit hooks and CI secret-scanning jobs
level: medium

Known false positives:

  • Authorized AppSec/DevSecOps teams running TruffleHog, Gitleaks or ggshield
  • Pre-commit hooks and scheduled CI secret-scanning jobs on build agents

Tuning notes: Allowlist the service accounts, hosts and parent processes of your sanctioned secret-scanning pipelines. Raise severity when --only-verified is used on a developer laptop or when the scanner binary runs from a temp or user-writable path. Add a Linux Sysmon or auditd variant for CI runners.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Mass Git Repository Clone or Mirror by Single Account — Exploitation Phase · unlock with TL Creds
  • S3 Bucket Made Public or Public Access Block Removed — Post-Exploitation Phase · unlock with TL Creds
  • Kubernetes Secrets Read Across Multiple Namespaces — C2 / Lateral Movement Phase · unlock with TL Creds
  • IAM Enumeration Burst by Long-Lived IAM User Key — Exploitation Phase · unlock with TL Creds
  • Credential and MCP Config File Read or Staged via Shell — Post-Exploitation Phase · unlock with TL Creds
  • Package Manager Lifecycle Script Spawning Secret Harvesting — C2 / Lateral Movement Phase · unlock with TL Creds
  • IAM Enumeration Followed by CreateAccessKey From Same IAM User — Post-Exploitation Phase · unlock with TL Creds
  • Lambda Code or Config Change Combined With AssumeRole Fan-Out — C2 / Lateral Movement Phase · unlock with TL Creds

Indicators of compromise

As of 2026-10-31, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-4874.

10 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

This is a landscape-level exposure trend, not a single incident, CVE or named-actor campaign.

This record documents a landscape-level credential exposure risk rather than a discrete exploit or campaign. GitGuardian defines the 'credential layer' as every surface where credentials are created, stored, transmitted or used: source repositories, CI/CD pipelines, developer laptops, collaboration tools (tickets, chat, wikis, shared drives), Kubernetes clusters and secrets managers. Its State of Secrets Sprawl 2026 report (5th edition, covered by The Hacker News on 2026-03-30) counted 28,649,024 new hardcoded secrets in public GitHub commits during 2025, a 34% year-over-year increase and the largest single-year jump recorded. Over five years (2021-2025) leaked secrets grew 152% against 98% growth in public active developers, so secrets are leaking about 1.6x faster than the developer population grows. Secrets tied to AI services grew about 81% year over year (1,275,105 incidents); eight of the ten fastest-growing secret categories were AI-related (for example OpenRouter 48x, DeepSeek 23x, Brave Search 13.5x, Firecrawl 9x). Internal repositories showed a leak rate of 32.2% versus 5.6% for public repositories (roughly 6x), and 28% of incidents originated entirely outside source code, in collaboration platforms, where 56.7% of collaboration-only leaks were rated critical versus 43.7% for code-only incidents. Self-hosted GitLab instances and Docker registries showed 3-4x higher exposure than public GitHub; in one analysis 80,000 credentials were found and 10,000 were still valid, and 18% of Docker images contained secrets with 15% still valid.

The report also found 24,008 unique secrets in Model Context Protocol (MCP) configuration files on public GitHub, of which 2,117 were verified valid; the most common types were Google API keys (19.2%), PostgreSQL connection strings (14%), Firecrawl keys (11.9%), Perplexity keys (11.2%) and Brave Search keys (11%). Commits co-authored by Claude Code leaked secrets at about 2x the baseline rate, with 3.5 million AI-assisted commits by October 2025. Analysis of the Shai-Hulud 2 supply-chain compromise covered 6,943 compromised systems holding 294,842 secret occurrences and 33,185 unique secrets; 59% of the machines were CI/CD runners, 44% held 10 or more secrets and 5% held over 100. Long-lived secrets accounted for 60% of policy breaches, and 46% of critical secrets lacked a validity checker.

The 2026-10-30 GitGuardian blog article adds that 64% of secrets confirmed valid in 2022 were still valid when retested in January 2026 (the report notes only 36% were rotated over four years). Developer laptops hold roughly 150 secrets each on average. GitGuardian research reached 44 active Kubernetes clusters through leaked secrets, and 30% of the exposed clusters had been exposed for over two years. The article also cites a Sysdig-reported intrusion: on 2025-11-28 an attacker found valid IAM user access keys in a public S3 bucket holding AI training data, enumerated IAM users and keys, created new administrative access keys, escalated through Lambda code injection against an over-privileged execution role and moved across 19 unique AWS principals, reaching admin access in about 8 minutes. Sysdig published the analysis on 2026-02-03 and stressed that no zero-day was involved, only long-lived keys and over-broad roles. The article names OWASP Kubernetes Top 10 risk K03 (Secrets Management Failures).

Cited risk scenarios: credentials copied into local configuration files during troubleshooting and later committed; hardcoded credentials in MCP servers used by AI coding assistants; long-lived static plaintext credentials giving persistent access while they remain valid; the same secret reused across repositories, pipelines, tickets and local files; and revocation without dependency mapping causing production outages, which discourages remediation. The key defensive lesson is that detection is not remediation: a secret that is found but not rotated or revoked remains exploitable.

Defensive guidance in the sources: map credential consumers and dependencies before revocation; re-validate after remediation and track 'closed but valid' incidents; move unmanaged secrets into approved vaults (AWS Secrets Manager, Delinea, CyberArk Conjur); cover developer endpoints via MDM (Jamf, Intune, Iru/Kandji) as well as repositories; scan CI/CD, collaboration tools and secrets-manager inventories; use honeytokens; prefer short-lived credentials; and combine enrichment, context, risk scoring and full coverage including non-validated secrets. The sources contain no CVE, named threat actor, malware family or network IOCs; the IOC list therefore holds behavioral, tool, platform and entity indicators only, all taken from the cited material.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1195.002 Compromise Software Supply Chain

Persistence

T1078 Valid Accounts; T1098.001 Account Manipulation: Additional Cloud Credentials

Privilege Escalation

T1078 Valid Accounts

Discovery

T1087.004 Account Discovery: Cloud Account

Collection

T1213.003 Data from Information Repositories: Code Repositories; T1530 Data from Cloud Storage

Credential Access

T1552 Unsecured Credentials; T1552.001 Unsecured Credentials: Credentials In Files

Execution

T1648 Serverless Execution

Remediation

Immediate actions

  • Rotate and revoke exposed secrets after mapping their dependent systems, to avoid production outages
  • Re-validate each remediated secret to confirm it can no longer authenticate; track 'closed but valid' incidents
  • Inventory secrets outside code repositories: tickets, chat, wikis, shared drives, developer laptops and CI/CD
  • Audit public S3 buckets and storage holding AI training data for embedded access keys
  • Review secrets in MCP server configuration files and AI coding assistant settings

Workarounds

  • Enable pre-commit and push-time secret scanning on repositories
  • Restrict and audit permissions of any credential that cannot yet be rotated

Longer-term hardening

  • Move unmanaged credentials into approved secrets managers and inventory the vaults
  • Replace long-lived static credentials with short-lived or federated credentials
  • Deploy developer endpoint secret scanning through MDM
  • Deploy honeytokens to detect credential abuse
  • Apply OWASP Kubernetes Top 10 K03 secrets-management controls and audit exposed clusters
  • Remove hardcoded credentials from MCP servers and AI coding assistant configurations
  • Remove excess privileges from cloud execution roles such as Lambda roles

Affected and fixed versions

  • Multiple — Source code repositories, CI/CD pipelines, developer endpoints, collaboration platforms, Kubernetes clusters and secrets managers
    Vulnerable versions: Any environment storing hardcoded or long-lived static credentials

Timeline

  • Secrets confirmed valid in 2022 form the baseline cohort later retested (date is year-level; the source gives only 2022).
  • During 2025, 28,649,024 new hardcoded secrets were added to public GitHub commits, up 34% YoY (date is year-level).
  • By October 2025 GitHub saw about 3.5 million AI-assisted commits; Claude Code co-authored commits leaked secrets at roughly 2x the baseline rate (date is month-level).
  • Attacker used valid IAM keys found in a public S3 bucket holding AI training data, created new admin access keys, escalated via Lambda code injection and reached AWS admin access in about 8 minutes across 19 principals.
  • In January 2026, 64% of secrets confirmed valid in 2022 were retested and found still valid (date is month-level).
  • Sysdig publishes its analysis of the AI-assisted AWS intrusion, noting no zero-day was involved, only long-lived keys and an over-privileged Lambda role.
  • The Hacker News covers GitGuardian's State of Secrets Sprawl 2026: 81% growth in AI-service leaks, internal repos about 6x more likely to leak, 28% of incidents outside source code, 2,117 valid secrets in MCP config files.
  • GitGuardian publishes the credential-layer article: ~150 secrets per developer laptop, 44 Kubernetes clusters reached via leaked secrets (30% exposed over 2 years), and remediation guidance.

Sources cited

Previous and next in threat intel

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats