EmeraldWhale's .git/.env credential scraping is still running, ~2 years on
The threat group EmeraldWhale continues to scrape exposed .git and .env files from publicly accessible web servers to steal cloud credentials, nearly two years after first being documented. The campaign targets misconfigured sites, extracting API keys, database passwords, and other secrets from version control and environment configuration files.
Background
- EmeraldWhale is a long-running credential scraping operation that targets exposed **.env** files and **.git** directories on public web servers. These are common developer mistakes: .env files store API keys, database passwords, and cloud tokens; .git directories contain full version-control histories, often with secrets embedded in earlier commits.
- The campaign systematically scans IP ranges for these exposed files, harvests the credentials inside, and uses them to compromise cloud accounts and send spam or launch further attacks. It has been active for roughly two years and shows no signs of stopping.
- This matters because it demonstrates how **simple misconfigurations** — not sophisticated zero-days — remain one of the most effective vectors for credential theft. Many developers still commit secrets to public repos or leave .env files accessible on production servers, and automated tools like EmeraldWhale's constantly probe for them.
- The post is a technical breakdown of the scraping infrastructure, the credentials targeted, and the scale of the ongoing operation. It serves as both a warning and a reference for defenders trying to detect or block similar activity.