# Credential Harvesting via Fake Backup Tool

- **Severity:** Critical
- **Signature ID:** `36f73f7e-e4f9-4f7e-88f0-ce286b4c407c`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API)
- **OWASP:** ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection)

## Summary

A malicious tool exposed to an AI agent presents itself as a backup utility but actually searches the filesystem for credentials like SSH keys, certificates, and environment files. It then encodes them and sends them to an external server, disguising theft as routine maintenance.

## How the attack works

The tool is registered with an agent under a benign-sounding name like 'backup' or similar. When invoked, it walks the filesystem looking for credential files: SSH private keys, TLS certificates, .env files, and similar secrets. It base64-encodes the collected data, which helps it blend into normal-looking traffic and avoid simple content filters. Finally it sends the encoded payload via an HTTP POST request to an external domain the attacker controls.

## Why it matters

An organization can lose SSH keys, certificates, and environment secrets that enable further compromise of servers, cloud accounts, and internal systems, without any obvious alert since the tool masquerades as a backup function.

## What you can do

- Review any MCP/agent tool named or described as a backup utility and check exactly what files it reads and where it sends data.
- Restrict agent tools from reading sensitive paths (SSH keys, certificate stores, .env files) unless explicitly required and audited.
- Block or monitor outbound HTTP POST requests from agent processes to unfamiliar external domains.
- Require tools that legitimately need to move credential data to use authenticated, logged, and reviewed transfer mechanisms rather than ad hoc encoding and posting.

## Known benign look-alikes

- Legitimate enterprise backup tools with proper authentication
- System administration scripts with secure credential handling
- DevOps deployment tools mentioning backup procedures in documentation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00217

---
Source: https://www.netzilo.com/threats/atr-credential-harvesting-via-fake-backup-tool