Researchers Uncover 9,300 Active Leaked AWS Keys, 768 With Admin Rights

AI digestMimile.ai EditorialAugust 24, 2026 at 01:05 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

Researchers Uncover 9,300 Active Leaked AWS Keys, 768 With Admin Rights

Truffle Security found 64,024 unique AWS key pairs across 431,875 public findings between August 2022 and August 2026. Of 10,616 pairs with complete credentials, 88% still authenticate, including 768 corporate keys with full admin rights. The researchers notified every identifiable owner.

Key Facts

Truffle Security identified 64,024 unique AWS key pairs across 431,875 public findings between August 2022 and August 2026.
Of 10,616 key pairs with complete credentials, 88% still authenticate, including 768 corporate AWS keys with full admin rights.
Hugging Face was the largest single source of leaked keys, with 8,482 unique live keys across 3,394 public datasets.
Only 9.5% of leaked keys had a budget alert configured to flag suspicious activity such as cryptocurrency mining.
For live keys with creation dates, the median age was around five years, and the oldest was over 17 years.

Exposure Scope

Truffle Security scanned git history, Hugging Face datasets, Docker images, package registries, and CI logs. The researchers re-verified 10,616 key pairs with complete credentials and enumerated key age, attached policies, budgets, and last month's spend. No key material was published, and every identifiable owner was notified. Hugging Face accounted for 8,482 unique live keys across 3,394 public datasets, 18% of which had root privileges.

Key Age and Rotation

For live keys with creation dates, the median age was around five years, and the oldest was over 17 years. Only 13.7% of keys (398 of 2,903) had any newer key alongside the leaked one. The remaining 86% were never rotated, superseded, or cleaned up. 43% of discovered keys appeared more than once across repositories, datasets, and images.

Risk Mitigation

Truffle Security urged organizations to delete root access keys, noting that one in six leaked keys had root privileges. The report recommended sorting IAM keys by age using the AWS CLI and setting a maximum age policy. A budget alarm, even at $10, would help catch cryptocurrency mining early, as 90.5% of leaked-key accounts had no alert configured. If AWS attaches the AWSCompromisedKeyQuarantine policy to a user, it indicates the key is public.

1 source

Researchers Uncover 9,300 Active Leaked AWS Keys, 768 With Admin Rights

infosecurity-magazine.com

Infosecurity Magazine

Technology

Aryon Security Finds 3.7M Short-Lived AWS Resources Exposed Annually

Research from Aryon Security has found that 3.7 million short-lived AWS cloud resources are publicly exposed each year, often containing sensitive data. These exposures typically last only minutes or hours, evading traditional CSPM and CNAPP tools. The findings highlight a growing risk as AI-driven attack automation accelerates.

Technology

NadMesh botnet targets exposed AI services, steals 3,811 AWS keys

A Go-based botnet called NadMesh emerged in early July, hunting exposed AI services and harvesting cloud credentials. The operator's dashboard claims 3,811 unique AWS keys, 47 credential hauls, and 41 model inventories, according to QiAnXin's XLab report published Friday.

Technology

CameraSwarm campaign compromises 14,530 Dahua devices in Ukraine, Russia

Hackers compromised more than 14,500 Dahua IP cameras in Ukraine and Russia between June 17 and July 22, 2026, Hunt.io researchers said. The 35-day operation used credential attacks, two authentication-bypass vulnerabilities, and a P2P relay to install persistent backdoor accounts on some devices. Both vulnerabilities remained in CISA's Known Exploited Vulnerabilities catalog as of August 19, 2026.

Technology

Check Point uncovers StopAndProtect cybercrime ring using 2,000 WordPress sites

Check Point Research uncovered a global cybercrime ring dubbed StopAndProtect that hijacked around 2,000 WordPress sites and infected 5,000 computers. The operation used compromised WordPress installations to deliver malware, conduct surveillance, steal data, and distribute ransomware. The discovery raises concerns about the security of outdated WordPress versions and third-party plugins.

Researchers Uncover 9,300 Active Leaked AWS Keys, 768 With Admin Rights

Key Facts

Exposure Scope

Key Age and Rotation

Risk Mitigation

Read more

Read more