Secret-stealing malware is malicious software that searches a device for sensitive information-such as passwords, API keys, cloud credentials, browser cookies, or authentication tokens-and copies it to an attacker-controlled location. It may target files, application data, environment variables, or credentials cached by developer and administrator tools.
Stolen secrets can let attackers access accounts, services, or cloud environments without first exploiting those systems directly. In software supply-chain attacks, a tampered command-line tool or installer may run the malware when a user downloads and executes it. Defenses include verifying artifact integrity and provenance, limiting access to release accounts, using short-lived or narrowly scoped credentials, and rotating secrets promptly if a device may have run suspicious software.