Two weeks a whole lot of secrets

Welcome to Secrets in the Wild, your biweekly field guide to secrets security.

There's no shortage of news about breaches, leaked credentials, and exposed secrets. And honestly, keeping up with all of it can be a lot.

So we figured we'd make things a little easier. Every two weeks, we'll round up the stories worth knowing about, along with interesting research, updates, and anything else we think you'll find useful.

At Truffle, our goal is to make secrets easier.

And sometimes that means making the news about secrets easier too.

Attackers used a vendor-held Cloud Backup credential to access customer environments. Huntress reported successful sign-ins across more than 300 tenants, though the extent of data theft remains unclear. In one tenant, attackers planted credentials in other applications. If you use ConnectWise or have dormant SkyKick connections, review application credentials and role changes. Disabling the original connection won't remove access planted elsewhere.

GhostAction is keeping up with spooky season. GitGuardian identified roughly 1,900 compromised GitHub accounts and more than 30,000 targeted repositories. Malicious workflows collected CI secrets and searched Git history for credentials. GitHub blocked workflows deployed in the October 10 and 12 attack waves, but earlier exposure still needs investigation. If affected, revoke the GitHub credential that enabled injection alongside exposed secrets. Deleting the workflow alone isn't enough.

An account-conversion flaw could reassign an attacker-controlled token to another user without changing its secret, potentially allowing private image downloads or malicious image publishing. Docker fixed the flaw and found no evidence of exploitation. Its October 2 notifications identify affected tokens. Docker deactivated transferred tokens October 8, except those explicitly retained by owners. According to Docker, users who weren't notified weren't exposed through this flaw.

Google: One Exposed Secret, a $90,000 Bounty

Security researcher Simon Köck found an exposed OAuth client secret in a Flask session cookie on Google's developer sites. Turns out, that same secret was being used to sign sessions. Combined with unsafe deserialization, he was able to forge a session cookie and achieve remote code execution. Google patched the issue within about 24 hours and awarded him a $90,000 bounty. Not a bad reminder of why reusing secrets can be dangerous.

ProjectDiscovery: Exposed AI Credentials Put the Model Supply Chain at Risk

Researchers at ProjectDiscovery found exposed credentials belonging to employees at NVIDIA, Nutanix, AllenAI, and other AI companies. Some weren't just read-only keys either. They had write access to model registries and experiment trackers. One Hugging Face token had been sitting in public Git history since 2024 and could have allowed someone to replace models under a trusted organization's name. Yikes.

We recently looked at 929 exposed AWS keys with quarantine policies attached. Turns out, 894 of them still had permissions for some pretty dangerous actions, including retrieving secrets, running commands on servers, and deleting databases or backups. Some of these keys had been exposed for years and were still active. AWS quarantine might restrict what a compromised key can do, but it doesn't actually revoke it.

A couple of useful updates landed in TruffleHog this month. You can now filter S3 scans by prefixes and file extensions, making it easier to focus on the files you actually want to scan. We also added OAuth2 support for custom verification endpoints, so teams can authenticate to those services without opening them up publicly. Both features are available in Enterprise and Open Source.