Python-Initiated GCP Credential Harvesting

Lacey Cochrane@NullVectorX

•updated Mar 27, 2026•5•0•185

Detects a Python-initiated process attempting to read Google Cloud Platform (GCP) credentials by looking for command-line arguments containing 'GOOGLE_APPLICATION_CREDENTIALS' and 'cat 2>/dev/null'. This behavior is indicative of credential harvesting, potentially related to supply chain compromises like the Trivy incident.