-file-..-2f..-2f..-2f..-2fhome-2f-2a-2f.aws-2fcredentials -

Once the credentials are exfiltrated, the attacker uses the AWS CLI to assume the compromised identity:

Are you seeing this in your , or are you testing a security scanner ? -file-..-2F..-2F..-2F..-2Fhome-2F-2A-2F.aws-2Fcredentials