Targeted GetObject Retrieval of credentials.json/.env from Internal MinIO Bucket

Duo Tech@duotech

•updated Jul 8, 2026•1•0•5

Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.