Loading story…
Truffle Security reported that more than 9,300 publicly exposed Amazon Web Services access keys remained active and valid after being leaked between August 2022 and August 2026, highlighting a widespread cloud credential exposure problem. Across public sources, the researchers identified 64,024 unique AWS keys and found that 88% of a subset of 10,616 keys with complete credentials still successfully authenticated as of August 10. The leaked secrets included 526 root keys and 242 IAM user keys with AdministratorAccess, creating a path to full AWS account compromise.
Researchers said the exposed credentials could allow attackers to steal or destroy data, take control of applications, establish persistence, and deploy cryptominers. Hugging Face was identified as the largest single source of leaked AWS keys in the dataset, while the persistence of valid credentials pointed to weak key rotation and poor credential hygiene across affected organizations. Truffle Security urged organizations to delete root access keys, rotate or revoke exposed credentials, review IAM key age and permissions, and enable AWS budget alerts to detect abuse.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Truffle Security found that 88% of 10,616 exposed AWS keys with complete credentials still authenticated, showing that thousands of leaked keys remained usable. The source explicitly anchors this verification status as of August 10.
A new report described AWS's quarantine policy for publicly leaked credentials and said it still permits numerous sensitive actions, including SSM command execution, STS role assumption, some RDS and Auto Scaling operations, CloudTrail disruption, SNS/SES abuse, S3 writes and retention locking, secret access, backup deletion, and CloudFormation stack deletion. The piece argued that AWS's approach limits some fraud-related abuse without fully neutralizing compromised keys, leaving significant residual risk.
Truffle Security reported that more than 9,300 publicly exposed AWS access keys observed between August 2022 and August 2026 remained active and valid. The dataset included 64,024 unique keys from 50,654 AWS accounts, with many highly privileged credentials such as root keys and AdministratorAccess IAM keys.
Truffle Security said it tracked the public exposure of AWS credentials over a four-year period spanning August 2022 through August 2026.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcedocs.aws.amazon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers from Stanford University, the University of California, Davis, and TU Delft found **1,748 valid API credentials** exposed across roughly **10,000 public webpages** after analyzing about **10 million websites**, revealing a broad secret-leakage problem outside traditional code repositories. The credentials, identified with TruffleHog and detailed in the study *Keys on Doormats: Exposed API Credentials on the Web*, provided access to services including **AWS**, **GitHub**, **Stripe**, and **OpenAI**. The exposed secrets were tied to multinational corporations, critical infrastructure operators, government agencies, and at least one global bank. Most of the exposed credentials were embedded in **JavaScript** resources, often inside bundled files generated by tools such as Webpack, creating direct paths into cloud infrastructure, payment systems, and software repositories. Researchers said AWS keys made up more than **16%** of verified exposures, and cited cases including cloud credentials linked to a global bank’s core infrastructure and firmware repository credentials associated with drones and remote-controlled devices, raising the risk of malicious firmware updates. After responsible disclosure, the number of exposed credentials dropped by about half within two weeks, but the study found such secrets often remain publicly accessible for an average of **12 months** and sometimes for years.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for **cryptojacking** and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget. The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.
Jul 12, 2026
The Crimson Collective, a newly identified advanced persistent threat (APT) group, has been observed targeting Amazon Web Services (AWS) environments to steal sensitive data. Security researchers have reported that the group specializes in exploiting leaked AWS Identity and Access Management (IAM) keys, which are often sourced from exposed code repositories or misconfigured cloud environments. Using tools like TruffleHog, the attackers systematically search for and validate AWS credentials that have been inadvertently published or left unprotected. Once a valid access key is identified, the group leverages the GetCallerIdentity API call to confirm its usability and gain initial access to the victim's AWS account. The attackers then establish persistence by creating new IAM users, login profiles, and additional access keys, effectively embedding themselves within the compromised environment. To maximize their control, Crimson Collective attaches the AWS-managed AdministratorAccess policy to these new accounts, granting themselves full administrative privileges. In scenarios where immediate administrative access is not available, the group uses the SimulatePrincipalPolicy API to analyze existing permissions and identify pathways for privilege escalation. This methodical approach allows the attackers to conduct extensive reconnaissance, manipulate cloud resources, and exfiltrate sensitive data without detection. The group’s operations demonstrate a sophisticated understanding of AWS’s internal mechanisms and highlight the risks associated with overly permissive IAM policies. Victims of these attacks face significant threats, including data theft, extortion, and potential disruption of cloud-based services. The incident underscores the importance of securing access credentials, regularly auditing IAM policies, and monitoring for unusual API activity within cloud environments. Security experts recommend immediate revocation of exposed keys, implementation of least-privilege access models, and the use of automated tools to detect credential leaks. The emergence of Crimson Collective signals an escalation in targeted attacks against cloud infrastructure, emphasizing the need for robust cloud security practices. Organizations are urged to review their AWS configurations and ensure that sensitive credentials are never stored in public or unsecured locations. The attack chain employed by Crimson Collective serves as a cautionary example of how mismanaged cloud security can lead to severe breaches. Ongoing investigations aim to determine the full scope of affected organizations and the extent of data exfiltration. The cybersecurity community continues to monitor the group’s activities and share indicators of compromise to help defend against similar threats. This incident highlights the evolving tactics of APT groups in targeting cloud environments and the critical need for proactive defense measures.
Jul 12, 2026