Log in Request a demo

Attack technique

Credentials in Files: Stealing Secrets from Config Files (T1552.001)

Also known as Credentials in Files, Unsecured Credentials: Credentials In Files

Credentials in Files means an attacker reads passwords, keys and tokens that sit in ordinary files on a disk or a file share.

In short

Credentials in Files means an attacker reads passwords, keys and tokens that sit in ordinary files on a disk or a file share. Config files, .env files and cloud credential files are common targets. The stolen secret is then used to sign in somewhere else. MITRE tracks it as T1552.001.

Last updated 21 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Credential Access · Step 9 Of 15 In The Attack Chain

  1. MITRE IDT1552.001ATT&CK technique
  2. Detection4ways to spot itConfig reads by unusual users
  3. Defences5ways to stop itBan password storage in files

How it works

MITRE says adversaries may search local file systems and remote file shares for files with insecurely stored credentials. These can be files users made for their own passwords, shared credential stores, configuration files with passwords for a service, or source and binary files with embedded passwords.

MITRE adds that in cloud and container environments, user and service account credentials are often kept in local configuration and credential files. They may also appear as parameters to deployment commands in container logs. In some cases the file can be copied to another machine, or its contents read and used to authenticate without copying anything.

A real example

MITRE lists the TeamPCP Cloud Stealer, which can check more than 50 file paths for credentials across CI/CD, cloud and container environments. It also lists Mini Shai-Hulud, which collects credentials from configuration files. On 21 October 2026 Socket mapped the malicious LiteLLM 1.107.0 release to this technique: its stealer read cloud, developer and AI tool credential files and .env files. See the LiteLLM 1.107.0 incident profile and our LiteLLM 1.107.0 response checklist.

How to detect

  1. Reads of credential files, then use of the secret

    MITRE's strategy DET0307 looks for access to insecure credential files such as .env, .xml or .ps1 files. It then looks for suspicious process execution or logins that use the retrieved credentials.

  2. Config reads by unusual users

    MITRE says to flag reads of config files with password fields by non-root or unusual users, followed by SSH login attempts.

  3. Container access to mounted secrets

    MITRE says to flag container processes that read mounted secrets or config paths such as /run/secrets, followed by network activity or credential use.

  4. Cloud credential files, then metadata calls

    MITRE says to flag access to local credential files such as ~/.aws/credentials, followed by metadata API calls or cloud role assumptions.

How to defend

  1. Audit for files that hold passwords

    MITRE mitigation M1047 (Audit) says to scan proactively for files that contain passwords and reduce exposure where they are found.

  2. Ban password storage in files

    MITRE mitigation M1027 (Password Policies) suggests an organizational rule against storing passwords in files.

  3. Restrict file and share permissions

    MITRE mitigation M1022 limits file shares to specific directories and gives access only to the users who need it.

  4. Train developers and administrators

    MITRE mitigation M1017 (User Training) says to make people aware that plaintext passwords in config files can persist on endpoints and servers.

  5. Rotate after any host that ran untrusted code

    After the LiteLLM 1.107.0 compromise, LiteLLM tells users to rotate every secret the host could reach, because it says a marker file confirms exfiltration but its absence proves nothing.

Questions

What counts as a credential file?

MITRE names user-made password files, shared credential stores, configuration files with passwords and source or binary files with embedded passwords. In cloud and container setups it also names local credential and config files.

Is T1552.001 the same as credential dumping?

No. MITRE treats OS Credential Dumping as a separate technique, T1003. T1552.001 is about reading files that already hold secrets. MITRE notes that passwords can also be pulled from backups or saved virtual machines through dumping.

In our research

  1. LiteLLM 1.107.0 Supply Chain Attack: Timeline, Stolen Data and a Response Checklist October 2026

Sources

  1. Unsecured Credentials: Credentials In Files, T1552.001 MITRE ATT&CK
  2. Unsecured Credentials, T1552 MITRE ATT&CK
  3. LiteLLM PyPI Package and Docker Images Compromised to Steal Cloud and AI Credentials Socket
  4. Contained: Oct 21, 2026 LiteLLM release v1.107.0 Compromised LiteLLM (BerriAI)

Browse the threat library

Keep exploring

Knowledge Hub

Malware

TeamPCP Cloud Stealer

TeamPCP Cloud Stealer is a credential stealer that checks more than 50 file paths on build servers, cloud accounts and developer machines.

Read more

Malware

Mini Shai-Hulud

Mini Shai-Hulud is a credential stealer and self-replicating worm that spreads through software packages and build pipelines.

Read more

Technique

OS Credential Dumping

OS credential dumping is when an attacker pulls account login material out of a computer.

Read more