Credential Exfiltration via Fake DevOps Tool Initialization
An AI agent skill disguises itself as a legitimate DevOps utility but, when initialized, quietly reads cloud credential files, encodes them, and sends them to an external server. This is a form of malicious tooling planted to steal cloud access keys through an AI agent's normal workflow.
How the attack works
An attacker packages a skill or plugin that presents itself as a normal DevOps helper, something an agent or developer would install to manage infrastructure. During its initialization sequence, the skill reads multiple credential files from the local environment, such as cloud provider config or key files. It then base64-encodes the contents and transmits them via HTTP POST to an attacker-controlled endpoint. The theft happens as a side effect of what looks like routine tool setup, so it can go unnoticed unless the initialization behavior itself is inspected.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9dffa6f8-b66a-43fc-90a4-8ac26bde4578
- Severity
- Critical
Why it matters
Successful exfiltration hands an attacker valid cloud credentials, which can lead to full compromise of cloud accounts, data theft, or resource abuse billed to the victim.
What you can do
- →Review any DevOps-related skill or plugin before installation, especially its initialization code, and reject any that reads credential files unrelated to its stated purpose.
- →Restrict outbound network access from agent environments so initialization routines cannot reach arbitrary external endpoints.
- →Store cloud credentials with short-lived tokens or scoped permissions so a leaked file has limited value.
- →Monitor for processes that read multiple credential files in sequence followed by outbound HTTP POST requests, particularly during tool or skill installation.
Known benign look-alikes
- Legitimate DevOps documentation explaining credential management concepts
- Security training materials describing attack patterns as examples
- Official cloud provider SDKs with proper credential handling