IMDSv2 Token Acquisition for Metadata Exfiltration

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•3

Detects unexpected processes requesting AWS IMDSv2 tokens from the link-local address 169.254.169.254. This activity can indicate an attempt to steal temporary cloud credentials from compromised EC2 instances, as seen with malware like Miasma.