Search — “TruffleHog”

Between Oct 14-26, 2026, an unknown actor used IAM credentials from Qubole's AWS account 805246085872 to assume trusted cross-account integration roles (with valid External IDs) in multiple customer AWS accounts, then enumerated resources, harvested secrets from Lambda env vars, Secrets Manager and SSM, validated found AWS/Entra ID/Okta credentials with TruffleHog, and exfiltrated S3 data. Wiz, Sentra and Mandiant confirm compromise of multiple victim environments. Hunt CloudTrail from Oct 1 for AssumeRole from 805246085872 with non-AWS sourceIPAddress, principal AIDA3W7DIFLYOLTK63SFS, session names starting quiam-, and TruffleHog user agents on GetCallerIdentity and IdP sign-ins.

Truffle Security, a researcher firm, launched a free Secrets Revocation Program that uses TruffleHog to validate leaked keys and asks issuers to revoke them, within 14 days, via a revocation endpoint or webhook. The company reports that 81% of keys it reported last year still worked six months later and that 2,655 working keys were found in AI coding tools' config files since January 2025. This is an awareness item about leaked secrets in public repositories, packages, and images; it describes no specific adversary behavior or detection content for hunting.

Independent researcher Ben Zimmermann scanned 7.25 million public Gitee repositories with TruffleHog and Kingfisher and reported 26,400 credentials that still authenticated, led by 9,473 Alibaba Cloud AccessKey pairs, plus YouTube, DeepSeek, Zhipu BigModel, and OpenAI keys. The sources do not confirm that any of these keys were revoked or abused, and the scan did not establish how long the keys had been exposed. Hunters should check for use of any Alibaba Cloud, OpenAI, Google/YouTube, or DeepSeek keys that appeared in public code and rotate any key ever committed to a public repository, since deleting it from code does not revoke it.