InvisibleFerret/BeaverTail Cloud Credential File Access by python or node

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects instances where common scripting runtimes (Python, Node.js) or development-related parent processes (e.g., VS Code, npm) access sensitive cloud credential or configuration files (AWS, Google Cloud, Azure). This behavior may indicate an adversary or an unauthorized script attempting to exfiltrate or leverage stored cloud credentials from an developer workstation.