hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/URL
Reported by 3 independent sources · first reported by Elastic Security Labs · last reported
Last reported 3 months ago
What the reports say
3 reports, newest first · the exact sentence from each-
From CI/CD to Cloud Data: How Shai Hulud Persistence Leads to Redshift Breach“curl -s --connect-timeout 3 hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/”
-
CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation“AWS: hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/”
-
AWS SNS Abuse: Data Exfiltration and Phishing“ROLE_NAME=$(curl -H "X-aws-ec2-metadata-token: $TOKEN" hxxp://169.254.169[.]254/latest/meta-data/iam/security-credentials/)”
Indicators reported together
named in the same reports- hxxp://gfxnick.emerald.usbx[.]me/botin 1 report
- gfxnick.emerald.usbx[.]mein 1 report
- usbx[.]mein 1 report
- hxxp://193.34.213[.]150/nuts/x86;chmodin 1 report
- 193.34.213[.]150in 1 report
- hxxp://193.34.213[.]150/nuts/boltsin 1 report
- hxxp://193.34.213[.]150/nuts.shin 1 report
- 154.89.152[.]240in 1 report
- hxxps://raw.githubusercontent[.]com/nezhahq/scripts/main/agent/install.shin 1 report
- 107.174.123[.]91in 1 report
- hxxp://38.165.44[.]205/sin 1 report
- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- hxxps://216.238.68[.]169/ReactOSin 1 report
- 216.238.68[.]169in 1 report
- 78.153.140[.]16in 1 report
- 80.64.16[.]241in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.