TruffleHogTool
TruffleHog is an open-source secrets-discovery tool that is used to search for credentials, API keys, and encryption keys across a variety of data sources and environments. TruffleHog has the ability to discover credentials and secrets stored in code repositories, git history, CI/CD pipelines, among other common storage locations to include filesystems and cloud storage buckets.From MITRE ATT&CK
Last reported 4 days ago, by The Hacker News7 reports
ATT&CK techniques
6 of 14 · each with the sentence it comes from- T1195Supply Chain Compromise
“It was a comically small payout for the kind of access a supply chain compromise burns.”
- T1059Command and Scripting Interpreter
“…ese maps to specific MITRE ATT&CK techniques: T1552 (Unsecured Credentials), T1195 (Supply Chain Compromise), T1070.006 (Timestomp), and T1059 (Command and Scripting Interpreter).”
- T1070.006Timestomp
“Each of these maps to specific MITRE ATT&CK techniques: T1552 (Unsecured Credentials), T1195 (Supply Chain Compromise), T1070.006 (Timestomp), and T1059 (Command and Scripting Interpreter).”
- T1078Valid Accounts
“| T1078: Valid Accounts | Stolen developer PATs used to modify workflows |”
- T1098Account Manipulation
“| T1098: Account Manipulation | Permission escalation via write-all, id-token: write |”
- T1195.002Compromise Software Supply Chain
“| T1195.002: Compromise Software Supply Chain | Poisoned actions, dependencies, and lockfiles |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites“NorForge ran the secrets scanner Trufflehog over the panel data and found hundreds of secrets, 11% of which it verified as still valid.”
-
Happy Birthday, Shai-Hulud“The payload was a bundle.js file that ran TruffleHog, a legitimate secret scanner, to sweep the host for npm tokens, GitHub credentials, and cloud keys.”
-
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm“Credential theft: Used TruffleHog to steal npm tokens, GitHub PATs, and AWS/GCP/Azure keys.”
-
CI/CD pipeline abuse: the problem no one is watching“This self-propagating attack harvested GitHub Personal Access Tokens via gh auth token, ran TruffleHog for secret reconnaissance, and used compromised tokens to silently inject malicious code into other packages owned by the same developer.”
-
CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation“Weaponizing TruffleHog and Gitleaks”
-
Shai-Hulud V2 Poses Risk To NPM Supply Chain“…tilizes DefaultAzureCredential to authenticate and retrieve secrets from Azure Key Vault.TruffleHog abuseThe malware incorporates TruffleHog, a legitimate open-source secret scanning tool, to scan the user's entire home directory.”
-
Shai-hulud 2.0 Campaign Targets Cloud and Developer Ecosystems“TruffleHog secret scanning”
Indicators in its reports
named in the reports above- f92ee93a0af971a3966bfa8efa9c2625in 1 report
- 7bcf8d9f6834c44450eac145a967d2f2in 1 report
- 4140f7e17e6f97f83aa3472473e01addin 1 report
- hxxps://npm-cache[.]com/routerin 1 report
- npm-cache[.]comin 1 report
- awqhnjewqjkl[.]icuin 1 report
- hxxp://gfxnick.emerald.usbx[.]me/botin 1 report
- gfxnick.emerald.usbx[.]mein 1 report
- usbx[.]mein 1 report
- hxxp://193.34.213[.]150/nuts/x86;chmodin 1 report
- 193.34.213[.]150in 1 report
- hxxp://193.34.213[.]150/nuts/boltsin 1 report
- hxxp://193.34.213[.]150/nuts.shin 1 report
- 154.89.152[.]240in 1 report
- hxxps://raw.githubusercontent[.]com/nezhahq/scripts/main/agent/install.shin 1 report
- 107.174.123[.]91in 1 report
- hxxp://38.165.44[.]205/sin 1 report
- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- hxxps://216.238.68[.]169/ReactOSin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.