People paste credentials into chat. A password to unblock a colleague, an API key in a ticket comment, a token in an email thread. MITRE ATT&CK calls the collection of these Chat Messages, technique T1552.008, under the credential access tactic. The platforms listed are SaaS and Office Suite.
How attackers use it
MITRE describes credentials sent and stored in email, chat services such as Slack or Teams, and collaboration tools such as Jira or Trello. They can be usernames and passwords, API keys or authentication tokens, shared in private or public internal channels.
This is different from reading saved chat logs from disk. Here the adversary goes to the service itself: the user endpoint, the servers hosting the service, or the administrator portals of cloud hosted services. MITRE also notes that adversaries may compromise integration tools such as Slack Workflows to search messages automatically and pull out credentials.
The stolen values are then used for follow-on activity such as lateral movement or privilege escalation.
How to detect it
MITRE gives no detection data sources for this technique. Useful angles are the ones your collaboration platforms already offer: audit logs for new integrations and workflows, unusual bulk search or export activity, and administrator portal logins from unfamiliar places. Treat a newly installed workflow that reads many channels as something to review the same day.
How to reduce the risk
MITRE's two mitigations are simple and worth doing together.
- Audit. Search your communication services ahead of the attacker for shared credentials. MITRE suggests searching for common patterns such as the words "password is" and "password=", then taking action to reduce exposure when you find them. Rotate anything you find, because deleting the message does not undo the exposure.
- User training. Make sure developers and system administrators understand the risk of sharing unsecured passwords across communication services. Give them a better path, such as a team password manager or a secrets vault, so the shortcut is not the easy one.
For source repositories the same problem has tooling. The demo shows how automated secrets scanning flags credentials before they spread.
Click through it at your own pace, or open it full screen.
Quick check
You find an API key in an old channel message. Is deleting the message enough?
No. Anyone or anything that could read the message may have copied the key. Rotate it, then delete the message.
