In October 2024, the Sysdig Threat Research Team disclosed EMERALDWHALE, a credential theft operation that harvested more than 15,000 cloud service credentials by scanning the internet for exposed Git configuration files. When a web server is misconfigured, its .git directory can be downloaded, and the .git/config file often contains the remote repository URL with a username and access token embedded. EMERALDWHALE's tools scanned huge IP ranges for these files and for exposed Laravel .env files, validated the tokens they found, used them to clone private repositories on GitHub, GitLab and Bitbucket, and then searched the code for more secrets such as AWS keys. Sysdig found the results in a public S3 bucket belonging to an earlier victim, holding more than a terabyte of data, including credentials for over 10,000 private repositories. The goal appeared to be spam and phishing: stolen cloud and email credentials were tested for their ability to send mail, and credentials and target lists were sold.
Key takeaways
- EMERALDWHALE stole more than 15,000 cloud service credentials by scanning for exposed .git/config and .env files.
- Tokens embedded in Git remote URLs were validated and used to clone private repositories, which were then searched for more secrets.
- Credentials for over 10,000 private repositories were collected, according to Sysdig.
- The stolen data sat in a public S3 bucket belonging to a previous victim; AWS took it down after Sysdig reported it.
- The identity lesson: a token in a Git remote URL is a live credential, and a web server misconfiguration publishes it to anyone who scans.
At a glance
| Organisations | Thousands of organisations and developers with exposed Git configurations; Sysdig (research) |
|---|---|
| When | Scanning in August and September 2024; disclosed 30 October 2024 |
| Attacker | The EMERALDWHALE operation, using the commodity tools MZR V2 and Seyzo-v2; unattributed |
| Entry point | Exposed .git/config and Laravel .env files on misconfigured web servers |
| Identities abused | Git access tokens; cloud, email and other service credentials found in private repositories |
| Impact | More than 15,000 cloud credentials stolen; credentials for over 10,000 private repositories collected |
| Category | NHI. Incident class: confirmed NHI breach (tokens from exposed Git configurations used to steal further credentials) |
What happened
Sysdig found the operation through its cloud honeypot, where it "observed an unusual ListBuckets call using an account that had been compromised." The bucket referenced belonged to someone else and was public. Inside, Sysdig "discovered malicious tools and over a terabyte of data, which included compromised credentials and logging data." The logs showed "a massive scanning campaign between August and September for servers that had exposed Git repository configuration files." Sysdig reported the bucket to AWS, which took it down.
Sysdig described the attack chain: "Starting with long lists of IP address ranges, the toolset used by EMERALDWHALE automatically discovers relevant hosts, extracts credentials, and validates the recovered tokens. It then uses the stolen tokens to clone repositories, both public and private, belonging to any Git-compatible service. The tool scans the downloaded repositories and extracts more credentials." The MZR V2 toolkit looked for remote URLs of the form user:token@github, gitlab or bitbucket, checked them against the GitHub API, and then searched cloned code for AWS access keys. It could also create a new IAM user with the AdministratorAccess policy and test whether stolen AWS keys could send email through SES.
BleepingComputer reported Sysdig's figures: the operation "stole 15,000 cloud credentials from 67,000 URLs that exposed configuration files," and "Of the exposed URLs, 28,000 corresponded to Git repositories, 6,000 were GitHub tokens, and a notable 2,000 were validated as active credentials." CyberScoop quoted Sysdig's conclusion: "EMERALDWHALE isn't the most sophisticated operation, but it still managed to collect over 15,000 credentials."
Timeline
| Date | Event |
|---|---|
| August to September 2024 | EMERALDWHALE scans for exposed Git configuration files. |
| October 2024 | Sysdig's honeypot detects activity and leads it to the attackers' S3 bucket; AWS takes it down. |
| 30 October 2024 | Sysdig publishes its research; BleepingComputer and CyberScoop report it. |
How it happened: the identity attack path
- Git directory exposed. Misconfigured web servers served .git/config and .env files publicly.
- Tokens harvested. Scanners pulled remote URLs with embedded usernames and tokens.
- Tokens validated. Tools checked the tokens against Git service APIs.
- Private repositories cloned. Valid tokens were used to download private code.
- More credentials extracted. Cloud and email keys found in the code were tested, used for spam and sold.
Impact
- Credentials: more than 15,000 cloud service credentials stolen.
- Repositories: credentials for over 10,000 private repositories collected.
- Use: phishing and spam, and sale of credentials and target lists, according to Sysdig.
What this means for NHI governance
EMERALDWHALE shows that secrets do not need to be committed to leak. A token embedded in a Git remote URL lives only in a local configuration file, but deploying a site by copying a working directory to a web server can publish that file. From there, automation does the rest: one token opens private repositories, and those repositories often contain the cloud keys that attackers actually want. As Sysdig put it, "secret management alone is not enough to secure an environment. There are just too many places credentials could leak from."
The answer is layered: keep tokens out of remote URLs, block .git paths on every web server, scan for secrets in code, and prefer short-lived credentials that are worthless by the time they are found. See our Secrets Management Guide and CI/CD Pipeline Identity Security Guide.
Recommendations
- Block .git and .env paths on web servers. Deny access to dotfiles and test it. See our Secrets Management Guide.
- Keep tokens out of remote URLs. Use a credential helper or SSH keys instead. See the SSH Key Management Guide.
- Deploy build artefacts, not working directories. Ship only what the site needs. See the CI/CD Pipeline Identity Security Guide.
- Use short-lived cloud credentials. Keys that expire lose value quickly after theft. See the Cloud Workload Identity Guide.
- Alert on new IAM users and SES use. These were the attackers' first moves with stolen AWS keys. See the ITDR Guide.
Frequently asked questions
What was EMERALDWHALE?
A credential theft operation disclosed by Sysdig in October 2024 that scanned for exposed Git configuration files and stole more than 15,000 cloud credentials.
How do exposed Git config files leak credentials?
The .git/config file can hold a remote repository URL with a username and access token. If a web server exposes the .git directory, anyone can download it.
What were the stolen credentials used for?
Mainly spam and phishing, according to Sysdig. Credentials and target lists were also sold.
Related NHI Mgmt Group resources
Misconfigured Git Servers 2026 · Internet Archive Breach 2024 · Indian Government Breach 2021 · Secrets Management Guide · LLMjacking Guide
How NHI Mgmt Group can help
Tokens leak from places nobody thinks of as code. We help teams find exposed configuration, remove long-lived tokens and detect stolen keys in use. See our NHI and AI agent security training.
References
- Sysdig: EMERALDWHALE: 15k Cloud credentials stolen in operation targeting exposed Git config files (30 October 2024)
- BleepingComputer: Hackers steal 15,000 cloud credentials from exposed Git config files (30 October 2024)
- CyberScoop: Hackers find 15,000 credentials by scanning for git configuration (30 October 2024)