AWS keys stolen for messaging reconnaissance

An author who ran a honeypot server for four months leaking fake credentials found that stolen AWS keys were overwhelmingly used for messaging reconnaissance rather than data exfiltration, while AI API keys were frequently tested and graded by automated checkers. The data revealed that theft and usage are typically split between separate infrastructures, with stolen credentials shifting to residential proxies and cloud tenants within a median of 37 minutes. Open article →