Credential Exfiltration via Fake Backup Verification
A malicious tool disguises itself as a routine backup or integrity verification step. Instead of just checking files, it gathers SSH keys, AWS credentials, and npm tokens, bundles them together, and sends them to an outside server.
How the attack works
An AI agent is given or fetches a tool that claims to 'verify backups' or run an 'integrity check'. Under that cover story, the tool reads multiple credential files at once, such as SSH private keys, AWS credential files, and npm auth tokens. It concatenates these files and encodes the result, typically to make it less recognizable in transit. The encoded bundle is then transmitted to an external server the attacker controls, completing the theft.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ba80a338-89f8-425c-8b4c-fc2e4cd36e6b
- Severity
- Critical
Why it matters
An organization can lose SSH keys, cloud (AWS) credentials, and package registry (npm) tokens in one action, giving an attacker access to servers, cloud infrastructure, and the ability to publish malicious packages under the victim's identity.
What you can do
- →Review any agent tool or script that touches multiple credential files at once, especially SSH keys, AWS credential files, and npm tokens together.
- →Require explicit user consent and a visible prompt before any backup or verification tool accesses credential files.
- →Restrict outbound network access for agents and tools that don't need it, and monitor for encoded data leaving to unfamiliar external hosts.
- →Rotate SSH keys, AWS credentials, and npm tokens if a suspicious 'backup verification' tool was ever run, and audit its source before trusting it again.
Known benign look-alikes
- Legitimate backup tools that explicitly request user consent before accessing credentials