Skip to content

Instantly share code, notes, and snippets.

View Moritz-cmd's full-sized avatar

Moritz Theile Moritz-cmd

1 follower · 4 following
  • Leipzig University
  • Germany (Leipzig)
  • 11:27 (UTC +02:00)
View GitHub Profile
@Moritz-cmd
Moritz-cmd / iam_masscek-aws-credential-checker-ioc.md
Created July 30, 2026 21:59

IOC: iam_masscek/2.0 — undocumented AWS credential validation tool

TL;DR: A custom Boto3 user_agent_extra suffix, iam_masscek/2.0, observed validating stolen AWS credentials against a Thinkst Canarytoken. As of 2026-07-30 this string appears in no public threat feed, GitHub repository, or vendor report.

Observation

| Date (UTC) | Source IP | ASN | Event |