# Time-Gated Credential Exfiltration (Rug Pull Timebomb)

- **Severity:** Critical
- **Signature ID:** `c54c759a-a750-41fb-9ca4-374ca0157222`
- **MITRE ATLAS:** AML.T0048 (External Harms)
- **OWASP:** ASI03 (Identity and Impersonation), LLM07 (System Prompt Leakage)

## Summary

Some AI agent skill packages contain code that only steals credentials during specific hours, usually late at night. This lets the malicious code hide from reviewers who inspect it during normal business hours, since the theft logic never runs when someone is watching.

## How the attack works

The package includes a check like 'what time is it right now' before running any sensitive code. Outside the trigger window (commonly 2-4 AM), the code does nothing suspicious, so testing and code review during the day find nothing wrong. When the clock hits the trigger window, the code reads sensitive files such as .env, .ssh/id_rsa, .aws/credentials, or .npmrc. It then sends the contents of these files to an external server, giving the attacker working credentials for cloud accounts, SSH access, or package registries.

## Why it matters

Successful theft hands attackers live credentials for cloud infrastructure, source control, SSH servers, or package registries, which can be used for further intrusion, data theft, or supply-chain attacks — and the delay before misuse makes it harder to trace back to the compromised package.

## What you can do

- Review skill package source code for time-of-day checks (getHours, current time comparisons) combined with file reads of credential paths like .env, .ssh, .aws, or .npmrc.
- Run new or updated skill packages in a sandboxed environment for at least 24-48 hours to catch time-gated behavior before deploying to production.
- Restrict outbound network access for agent skill execution environments so exfiltration to unknown external hosts is blocked by default.
- Rotate credentials that were ever readable by installed skill packages, and monitor for outbound connections during unusual hours from agent hosts.

## Known benign look-alikes

- Legitimate scheduled task runners that read config files at specific times
- Cron job wrappers that check time windows for maintenance operations
- Log rotation scripts with time-based file reads

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00157

---
Source: https://www.netzilo.com/threats/atr-time-gated-credential-exfiltration-rug-pull-timebomb