Provisioner secrets exfiltrated to coder-infra.com C2 domain

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.