Loading story…
Pageloot disclosed that staging-environment credentials were exposed after a contractor stored them in a Google Doc set to "anyone with the link can view", allowing the document to become discoverable through Google Search. The issue surfaced when a Pageloot developer, while debugging, saw a staging hostname and what appeared to be a credential string appear in Google autocomplete. The company said it revoked the contractor’s access, rotated the affected credentials, and prohibited password storage in shared collaboration platforms including Google Docs, Slack, and Notion.
The exposure highlights how misconfigured sharing settings and weak access controls in cloud collaboration tools can turn routine documentation into a security incident. Reporting on the case linked it to a broader rise in third-party and human-error-driven breaches, echoing similar exposures involving other firms and a separate Pageloot access-control lapse in which a former employee reportedly retained access and redirected a customer’s QR codes to a competitor’s site.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
Verizon's 2025 Data Breach Investigations Report said around 60% of breaches involved human factors such as misconfiguration and misuse of valid credentials. The report is cited to contextualize incidents like the Pageloot exposure.
Ateam's permissive Google Drive sharing configuration remained in place until November 2023. Ateam said it found no evidence that the exposed data had been taken.
In 2018, government users exposed passwords and security plans through public Trello boards. The incident is cited as another example of accidental exposure through collaboration platforms.
Ateam left a Google Drive instance configured as "Anyone on the internet with the link can view" beginning in March 2017. The exposure ultimately included 1,369 files and personal data belonging to 935,779 people.
After 85 Google Docs containing training material for Meta, Google, and xAI were left editable to anyone with the link, Scale AI disabled users' ability to share managed documents publicly. No explicit date is provided for either the exposure or the remediation.
In a separate access-control failure, a disgruntled former Pageloot employee retained access that had not been revoked and used it to redirect a customer's QR codes to a competitor's site. The incident is described as another consequence of poor access governance at Pageloot.
After discovering the exposed Google Doc, Pageloot revoked the contractor's access and changed every affected credential. The company also banned password storage in Google Docs, Slack, Notion, and other shared workspaces.
At an unspecified date, a Pageloot contractor stored staging-environment credentials in a Google Doc set to "anyone with the link can view," and the document became discoverable through Google Search. A Pageloot developer noticed the exposure while debugging after Google autocomplete surfaced a staging hostname and an apparent credential string.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourceverizon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from WatchTowr identified a significant security risk involving the public exposure of sensitive credentials and secrets through popular online code formatting tools, specifically JSONFormatter and CodeBeautify. These platforms, widely used by developers to format and share code, allow users to save their code snippets, which are then made accessible through a 'Recent Links' feature. Due to predictable URL structures and a lack of access controls, over 80,000 user pastes containing sensitive data—including Active Directory credentials, API keys, private keys, and configuration files—were found to be publicly accessible. The exposed data originated from organizations in critical sectors such as government, banking, healthcare, telecommunications, and cybersecurity. The WatchTowr team demonstrated the real-world risk by planting canary tokens in these services, which were quickly accessed and used by unknown parties, confirming that malicious actors are actively scraping these sources for credentials. The incident highlights the dangers of uploading sensitive information to third-party web services without proper security controls and underscores the need for organizations to educate staff about the risks of using public tools for handling confidential data. The findings have prompted calls for both improved platform security and greater user awareness to prevent similar exposures in the future.
Jun 29, 2026
A security researcher discovered that a Home Depot employee had inadvertently published a private GitHub access token online, which remained exposed for approximately a year. The token granted access to hundreds of private source code repositories, as well as critical internal systems such as order fulfillment, inventory management, and code development pipelines. The researcher attempted to alert Home Depot multiple times but received no response until the issue was escalated through media contact, after which the exposure was remediated. The exposed credential provided not only read but also write permissions to sensitive repositories and cloud infrastructure, significantly increasing the risk of unauthorized modifications or data breaches. Home Depot has since removed the leaked token from public view, but the incident highlights the dangers of credential leakage and the importance of timely response to security disclosures. The company has hosted much of its developer infrastructure on GitHub since 2015, making such exposures particularly impactful.
Jun 29, 2026
Researchers at Noma Security disclosed **GitLost**, a prompt injection technique that can make GitHub **Agentic Workflows** expose data from private repositories through public issue comments. In the demonstrated attack, an adversary needed only to open a crafted issue in a public repository; if the workflow had broad cross-repository read access and permission to post publicly, the agent could be steered into retrieving content from a private repository in the same organization and publishing it as part of its response. The proof of concept showed the agent reading a private repository `README` and using its own authorized access as the exfiltration path, without the attacker needing credentials, coding skills, or direct access to the private repo. Noma said GitHub had been notified through responsible disclosure and published workflow reproductions and proof-of-concept evidence after testing. The researchers also reported that GitHub’s prompt-based output protections could be bypassed with a one-word prefix—**"Additionally,"**—causing the model to comply with the malicious instruction instead of refusing it. The findings highlight an architectural risk in AI agents that combine access to sensitive internal data, ingestion of untrusted public input, and an outward publishing channel; recommended mitigations include minimizing token and repository scope, limiting what agents can publish publicly, restricting which users can trigger agent actions, and requiring human review before public posting.
Jul 13, 2026