Potential Credential Discovery in Git History

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to search git commit history for cloud provider credentials or API keys. Attackers target git history because secrets that were committed and later removed remain recoverable, making repositories a valuable source of credentials even after remediation. Various supply chain attacks have been observed leveraging this technique to steal credentials from CI/CD environments.

2026-10-19 00:00:00

None

c4e2a91d-6b3f-4d07-c15e-9a3d7b2e0f64

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)