We plant fake cloud credentials. Attackers harvest them — and use them in the wild. This is the bait working, end to end.
No out-of-band API actions recorded in this window.
| Campaign | Class | Events | Countries | First seen |
|---|
Usernames sprayed against the trap — only generic, well-known logins are published.
Structure of the sprayed passwords — never the values. “Target-domain derived” means mutated from the victim’s own domain.