To mitigate the risks that arise from these scans, it is recommended to block access to .git/ directories, configure web servers to prevent access to hidden files, monitor server logs for suspicious .git/config access, and rotate potentially exposed credentials. Stealing credentials, API keys, SSH private keys, or even accessing internal-only URLs allows the threat actors to access confidential data, craft tailored attacks, and hijack privileged accounts. Git configuration files are configuration files for Git projects that can include branch information, remote repository URLs, hooks and automation scripts, and most importantly, account credentials and access tokens. In October 2024, Sysdig reported about a large-scale operation named "EmeraldWhale" which scanned for exposed Git config files, snatching 15,000 cloud account credentials from thousands of private repositories. Threat actors are intensifying internet-wide scanning for Git configuration files that can reveal sensitive secrets and authentication tokens used to compromise cloud services and source code repositories. In a new report from threat monitoring firm GreyNoise, researchers have recorded a massive spike in searches for exposed Git configs between April 20-21, 2025. This is the exact method that the threat actors used to breach Internet Archive's "The Wayback Machine" in October 2024, and then maintain their foothold despite the owner's efforts to thwart the attacks. Developers or companies deploy web applications without correctly excluding .git/ directories from public access, inadvertently exposing these files to anyone. Scanning for those files is a standard reconnaissance activity that provides numerous opportunities for threat actors. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. If web server access logs show unauthorized access to Git configs, any credentials stored within them should be rotated immediately.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 29 Apr 2025 19:05:06 +0000