Loading story…
A security researcher reverse engineered a Fortune 500 company's Android app and discovered hardcoded AWS keys and API secrets. This vulnerability granted full database access and demonstrated the risks of embedding sensitive credentials in mobile applications. The incident highlights the importance of secure coding practices and regular security reviews for mobile app deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Silver Leaf Technologies' **Worksnaps** client was found to contain hardcoded cloud credentials that exposed the company's production environment, a flaw tracked as **`CVE-2025-10560`** and rated **critical**. Security researchers reported that affected client versions before **`1.6.20260201`** embedded AWS access keys, S3 bucket names, and related cloud access details in application binaries, allowing anyone who obtained the software to extract the secrets. The disclosed credentials reportedly authenticated as the vendor's **AWS root identity**, enabling access to production resources including S3 buckets that stored sensitive user data such as screenshots of employee desktops. SEC Consult said the issue extended beyond the initial embedded keys: after the vendor removed the original hardcoded root credentials, the client still received decryptable AWS credentials from the server during login, leaving access to screenshot buckets effectively unresolved for a period. Researchers also noted additional hardcoded **UCloud** credentials, though their validity was not confirmed. Worksnaps has since released **`1.6.20260201`** as the fixed version, while recommended response actions include immediate credential rotation, restricting or removing sensitive data from exposed buckets, and upgrading all affected clients.
Jun 29, 2026
A participant exploited hardcoded Firebase credentials and a misconfigured authentication service in the VaultPass v2 Android app during the KPMG CTF 2025. The attack chain involved reverse engineering the APK, discovering hardcoded API keys, and leveraging anonymous authentication to bypass database security. This allowed full access to protected data, highlighting the risks of improper credential management and cloud misconfigurations in mobile applications.
Jun 29, 2026
Truffle Security reported that more than **9,300 publicly exposed Amazon Web Services access keys** remained active and valid after being leaked between August 2022 and August 2026, highlighting a widespread cloud credential exposure problem. Across public sources, the researchers identified **64,024 unique AWS keys** and found that **88%** of a subset of **10,616** keys with complete credentials still successfully authenticated as of August 10. The leaked secrets included **526 root keys** and **242 IAM user keys** with **`AdministratorAccess`**, creating a path to full AWS account compromise. Researchers said the exposed credentials could allow attackers to steal or destroy data, take control of applications, establish persistence, and deploy cryptominers. **Hugging Face** was identified as the largest single source of leaked AWS keys in the dataset, while the persistence of valid credentials pointed to weak key rotation and poor credential hygiene across affected organizations. Truffle Security urged organizations to delete root access keys, rotate or revoke exposed credentials, review IAM key age and permissions, and enable AWS budget alerts to detect abuse.
Aug 24, 2026