Contagious Interview: Cloud Credential File Theft by Python or Node Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects instances where Python or Node.js processes access common cloud provider credential files (e.g., AWS, GCP, Azure). This behavior is often associated with infostealer campaigns, such as the 'Contagious Interview' campaign, where adversaries attempt to harvest stored cloud credentials for further compromise.