Secret exfiltration is the covert theft of sensitive values from a system, such as passwords, API keys, access tokens, private keys, or session cookies. The attacker’s goal is usually to copy the secret without triggering obvious alerts, so the stolen value can be reused later from another machine or account.
This matters because a secret often is the real control plane for modern systems. In software supply chain attacks, malware may search developer laptops, CI runners, package managers, and cloud environments for registry tokens or GitHub credentials. Once stolen, those secrets can be used to publish malicious packages, access repositories, move laterally, or impersonate trusted automation. Defenders reduce risk with short-lived credentials, least privilege, secret scanning, hardware-backed authentication, and keeping sensitive values out of build logs, environment dumps, and client-side code.