Datadog discloses how credential-stealing platforms verify Amazon Bedrock access for AWS keys
Beyond valid credentials: How exposed AWS keys are tested for Amazon Bedrock access
Datadog Security Labs found that multiple credential-stealing platforms and scripts specifically verify whether stolen AWS keys can access Amazon Bedrock, rather than only confirming whether the keys are valid. The KMON_NOC platform has been scanning credentials for Datadog Cloud SIEM customers since August 31, 2026, and its front-end code shows it first validates keys with STS GetCallerIdentity, then separately checks Bedrock access, and extracts the AWS_BEARER_TOKEN_BEDROCK token. Additionally, two Python scripts on VirusTotal test multi-region Bedrock access via ListFoundationModels, ListInferenceProfiles, and the Converse API, and one of them also calls Billing GetCredits to enumerate promotional credits to assess the financial value of the credentials.