We plant fake cloud credentials. Attackers harvest them — and use them in the wild. This is the bait working, end to end.
No out-of-band API actions recorded in this window.