← Threat archive

T1552.001 Unsecured Credentials: Credentials In Files

2 threats tracked by Spectrum Delta use this technique.

T1552.001 on MITRE ATT&CK →

  • LiteLLM attack chain

    Throwaway-branch workflow runs post repository secrets to an external endpoint

    GitHub organization audit log: branch-creation and workflow-run events for the throwaway branches (ci-tmp-*), the run-deletion events that follow within minutes, and the hashed_token field linking the actions to one token; network/proxy: egress from CI runners to webhook[.]site. Workflow logs alone are insufficient — the runs were deleted; the audit log retains both the run and its deletion

    Seen in: GitHub organization audit log, Network / proxy (CI egress)

  • Aokigahara AI-session stealer

    aisessions handler: AI-tool credential and session file collection

    EDR file-access events with process attribution: the stealer process reading .claude, .codex, .copilot, .gemini, globalStorage, .aws and app-data paths (Sysmon EID 11 records file creation, not reads — does not substitute)

    Seen in: Sysmon / EDR