Credential Exfiltration via Fake Backup Verification - ATR-2026-00214 (f2656b8d-ad39-512c-b6e0-d94da8faebd4)
Detects malicious tools that exfiltrate sensitive credentials (SSH keys, AWS credentials, npm tokens) by disguising the theft as legitimate "backup verification" or "integrity checks". The attack pattern concatenates multiple credential files, encodes them, and transmits to external servers.