Hackers find 15,000 credentials by scanning for git configuration

Sysdig discovered an open Amazon S3 bucket holding more than 1 TB of data attributed to an operation called EMERALDWHALE that harvested over 15,000 cloud and email service credentials by targeting exposed Git configuration files. The collected data included validated keys, access to private repositories and malicious tools; researchers observed activity from August–September and assessed the credentials are being used for spam, phishing and resale on underground markets, highlighting automated, low-effort but high-impact leakage paths from exposed repositories and configuration files.