Threat video1:00
Secrets Sprawl 2026 Credential Exposure: Detection & IOCs
Public GitHub commits held 28.65M hardcoded secrets in 2025, and 64% of 2022 valid secrets still work. 9 detection rules, 10 IOCs and a free Splunk SPL rule.
Read the full threat intel for Secrets Sprawl 2026 Credential Exposure: Detection & IOCs →
Chapters
- 0:00The hookNearly 28.6 million secrets leaked in 2025.
- 0:05The story28.6 million secrets leaked in 2025.
- 0:14Attack pathSecrets in code, config, and developer machines.
- 0:31AttributionNo threat actor is attributed.
- 0:35Indicators of compromiseNo malicious indicators were published.
- 0:40MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to collection.
- 0:44Remediation5 steps now: Rotate and revoke exposed secrets after mapping their dependent systems.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Nearly 28.6 million secrets leaked in 2025.
0:0628.6 million secrets leaked in 2025.
0:1064% still valid in 2026.
0:15Secrets in code, config, and developer machines.
0:18Valid AWS keys found in a public S3 bucket.
0:22Attacker authenticated, created admin keys, injected Lambda code.
0:27Reached admin in 8 minutes, no zero-day.
0:31No threat actor is attributed. Confidence: low.
0:35No malicious indicators were published.
0:4010 ATT&CK techniques, from initial access to collection.
0:445 steps now: Rotate and revoke exposed secrets after mapping their dependent systems.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.