Unit 42 CTR: Sensitive Data Exposed in GitHub
Summary: Unit 42 researchers analyzed more than 24,000 public GitHub file uploads via the GitHub Events API and found thousands containing potentially sensitive information, including 2,328 username and password entries with 880 unique passwords, 2,464 API keys, and 1,998 OAuth tokens. Configuration files made up nearly 17% of the triggered files, and nearly 80% of them contained some aspect of a username, password, API key, or OAuth token.
Why it matters: An exposed API key or OAuth token lets an attacker impersonate the engineer and take control of the cloud environment, and one created with administrative privileges hands over the full cloud account. With 817 of the 880 unique passwords appearing three or fewer times, these are not throwaway strings - they look like the credentials engineers use in production.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026