EmeraldWhale's Massive Git Breach Highlights Config Gaps

Researchers uncovered the EmeraldWhale campaign, a global operation that harvested hardcoded credentials and cloud secrets by scanning for exposed Git configuration files and misconfigured cloud services (including an exposed S3 bucket). The attackers cloned over 10,000 private repositories, dumped more than 15,000 credentials, used phishing and custom tools to obtain access, and monetized the data by selling target lists on underground marketplaces, highlighting the need to secure source code, secrets, and cloud configurations.