Stitch-SDK - Cloud Metadata URL Extraction (T1552.005)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•6

Detects Node.js attempting to query the AWS/GCP internal metadata IP (169.254.169.254) to extract cloud instance IAM roles. This activity is associated with the Stitch-SDK scope squatting credential harvester.