Stealer/1.0 harvesting AWS, SSH, Docker, npm, Maven credentials

Subhankar H@Andrewsec57

•updated Aug 31, 2026•1•0•5

Detects access to sensitive credential and configuration files commonly used by developers and automated systems, such as AWS credentials, SSH keys, Docker configurations, NPM tokens, and Maven settings. Access to these files is a high-indicator of credential harvesting by malicious actors or stealer-type malware.