Hackers steal 15,000 cloud credentials from exposed Git config files

EmeraldWhale is a large criminal campaign that scanned millions of IPs for exposed .git and .env files to harvest authentication tokens, validated and used them to download private repositories, and exfiltrated roughly 15,000 cloud credentials to victim S3 buckets; the stolen secrets were used in phishing/spam campaigns and sold to other criminals, leveraging commodity tools like Masscan, httpx, Multigrabber, Mizaru, and Seyzo.