AML.T0055
Unsecured Credentials

MITRE source definition

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. bash history), environment variables, operating system, or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. private keys).

Source modified 2026-05-27. Reproduced from the pinned ATLAS release; inline technique links resolve to local reference pages.

Parent, sub-techniques and ATT&CK references

• T1552 Unsecured Credentials — explicit ATLAS ATT&CK reference

Source-backed defensive context

MITRE mitigations

No explicit relationship in this pinned source.

MITRE case studies

• AML.CS0016 Achieving Code Execution in MathGPT via Prompt Injection · Exercise
• AML.CS0023 ShadowRay: Hijacking Exposed Ray Clusters · Incident
• AML.CS0027 Organization Confusion on Hugging Face · Exercise
• AML.CS0030 LLM Jacking · Incident
• AML.CS0043 Malware Prototype with Embedded Prompt Injection · Incident
• AML.CS0047 Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code Extension · Incident
• AML.CS0054 Data Exfiltration via Remote Poisoned MCP Tool · Exercise
• AML.CS0068 Autonomous OpenAI Evaluation Agents Compromise Hugging Face Infrastructure · Incident
• AML.CS0069 GTG-1002 Claude Code Espionage Campaign · Incident

These are explicit source relationships, not independently reproduced incidents or validated detection coverage.

Simulation and telemetry boundary

This is a technique reference page, not a runnable simulation. No ATLAS-specific telemetry mapping, local attack execution or detector validation is asserted. MITRE maturity describes its source evidence, not a 1200km lab result.

For broader context—not technique-specific control mappings—see AI Security, AI Security Course, and detection-validation methodology.

Provenance and attribution

Immutable MITRE ATLAS source · Import provenance · Attribution and transformation notice · Apache License 2.0

Copyright 2021-2026 MITRE. Source text and explicit relationships are retained; navigation, formatting and local links are provided by 1200km.

No explicit relationship in this pinned source.