Threat video1:00
Poisoned Coding Assessment Cloud Theft: Detection & IOCs
A fake recruiter repo hides CLAUDE.md prompts that make an AI agent steal cloud keys. The page offers 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Poisoned Coding Assessment Cloud Theft: Detection & IOCs →
Chapters
- 0:00The hookAbout 1m51s: fake test stole cloud keys.
- 0:04The storyHidden instructions sat in trusted files.
- 0:10Attack pathA fake recruiter sends a poisoned repo.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise8 indicators to hunt: 1 domain, 5 file names and 2 paths.
- 0:36MITRE ATT&CK techniques10 ATT&CK techniques, from initial access to collection.
- 0:41Remediation4 steps now: Rotate any AWS access keys, kubeconfig credentials and CI/CD service-account.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About 1m51s: fake test stole cloud keys.
0:05Hidden instructions sat in trusted files.
0:07The agent obeyed them.
0:11A fake recruiter sends a poisoned repo.
0:13Opened in Cursor, auto-run on.
0:16It reads keys, then maps Kubernetes.
0:19More secrets are found and exfiltrated.
0:21The key still works.
0:26No threat actor is attributed. Confidence: low.
0:308 indicators to hunt: 1 domain, 5 file names and 2 paths.
0:3610 ATT&CK techniques, from initial access to collection.
0:414 steps now: Rotate any AWS access keys, kubeconfig credentials and CI/CD service-account.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.