MITRE ATT&CK Technique
T1552Unsecured Credentials
- First Reported
- Jul 7, 2026
- Latest Reported
- Sep 14, 2026
Official Description
Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. [Shell History](https://attack.mitre.org/techniques/T1552/003)), operating system or application-specific repositories (e.g. [Credentials in Registry](https://attack.mitre.org/techniques/T1552/002)), or other specialized files/artifacts (e.g. [Private Keys](https://attack.mitre.org/techniques/T1552/004)).(Citation: Brining MimiKatz to Unix)
- Tactics
- Credential Access
- Platforms
- Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider
- MITRE Version
- 1.5
- Last Modified
- Oct 24, 2025
Sub-techniques (8)
Reported Context (3)
- cred_hunt.sh searched compromised hosts for SSH private keys, PHP configuration files, database credentials, SNMP community strings, and shell history. Exposed Directory Reveals FortiGate and MeshCentral Intrusion Targeting Thai Broadband Provider
- The agent harvested cloud and AI-provider keys from the compromised host. Researchers Report AI Agent Ran Ransomware Intrusion From Exploit to Data Destruction
- The payload harvested API keys, passwords, secrets, and tokens directly from matching environment variables on developer machines and CI runners. Typosquatted npm and PyPI Packages Steal Secrets from Payment-App Developers
CVE (12)
Malware (4)
People (1)
MITRE ATT&CK (28)
Vendors (7)
Products (25)
Tools (1)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.