GCP Cloud Run SSRF to Instance Metadata Service Credential Theft

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects attempts by processes to access the Google Cloud Platform Instance Metadata Service (IMS) at 169.254.169.254 or via the 'metadata.google.internal' DNS entry. This is often an indicator of reconnaissance, SSRF exploitation, or credential theft attempts by an adversary on a compromised cloud instance.