Credential-stealing platform verifies Bedrock access for AWS keys
Start here
Datadog Security Labs discloses that multiple credential-stealing platforms and scripts specifically verify whether stolen AWS keys can access Amazon Bedrock, rather than only confirming whether the keys are valid. Among them, the KMON_NOC platform has been scanning credentials for Datadog Cloud SIEM customers since August 31, 2026, and its front-end code shows it first validates keys with STS GetCallerIdentity, then separately checks Bedrock access, and extracts AWS_BEARER_TOKEN_BEDROCK.
Generated by AI from reports · Updated 4 days ago
Progress timeline
- Datadog Security LabsDatadog discloses how credential-stealing platforms verify Amazon Bedrock access for AWS keys
Datadog Security Labs found that multiple credential-stealing platforms and scripts specifically verify whether stolen AWS keys can access Amazon Bedrock, rather than only confirming whether the keys are valid. The KMON_NOC platform has been scanning credentials for Datadog Cloud SIEM customers since August 31, 2026, and its front-end code shows it first validates keys with STS GetCallerIdentity, then separately checks Bedrock access, and extracts the AWS_BEARER_TOKEN_BEDROCK token. Additionally, two Python scripts on VirusTotal test multi-region Bedrock access via ListFoundationModels, ListInferenceProfiles, and the Converse API, and one of them also calls Billing GetCredits to enumerate promotional credits to assess the financial value of the credentials.
Related discussion
Attention trend
New sources per day
- Oct 6: 1 new sources (1 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)