Unsecured Credentials: Cloud Instance Metadata API

Threat Actors may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

ID: ATAGS-T1126.002
Sub-technique of:  ATAGS-T1126
Targeted Components: Mission, Personnel & Identity
Responsibility: Shared
Created: 18 April 2026
Last Modified: 18 April 2026

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.