Cloud Credential Access Following Malicious Terraform/Go Module Execution

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•4

Detects processes spawned by Terraform or Go (e.g., during init, apply, or run) that exhibit suspicious access to local cloud credential files (AWS/Azure/GCP) or Terraform state files. This behavior is indicative of a malicious module attempting to exfiltrate cloud credentials from a developer's workstation or a CI/CD build host.