Potential Cloud Credential Discovery via Metadata Service Access

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

Detects Bun or Node.js processes communicating with cloud metadata service endpoints. This behavior is frequently associated with credential harvesting, cloud reconnaissance, token theft, and post-exploitation activity.