The Credentials That Live Outside AWS Are the Ones That Get Stolen

TeamPCP didn't attack AWS to steal AWS credentials. They compromised a CI pipeline and waited for the credentials to come to them. The campaign that hit Trivy, LiteLLM, and Checkmarx in 8 days reveals something important about where your AWS keys actually rest.