Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1552.008: Chat Messages

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation [1].

EnterpriseT1552.008Sub-techniqueObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

Chat Messages (T1552.008) matters because business communication tools can become an informal credential store. If users paste passwords, API keys, tokens, or other secrets into SaaS chat, office, or collaboration services, an adversary with access to an endpoint, service backend, admin portal, or compromised workflow/integration may be able to collect those credentials and use them for follow-on access.

Executive priority

Treat this as an identity, SaaS governance, and audit-readiness issue—not just a user behavior problem. Leaders should ask whether the organization can prove that secrets are not routinely shared in chat channels, whether chat and collaboration platforms are audited, and whether security teams can investigate exposed credentials quickly enough to reduce lateral movement or privilege escalation risk. The relationship to User Training and Audit makes this a practical control-prioritization area for compliance evidence and incident response readiness.

Technical view

This is a credential-access sub-technique under Unsecured Credentials and applies to SaaS and Office Suite platforms. SOC, detection engineering, and IR teams should validate whether they can identify credentials shared in communication services such as chat, email, Jira/Trello-style collaboration spaces, and workflow/integration content. Because ATT&CK provides no official detection text, local detection should be built around the related detection strategy DET0111: detecting unsecured credentials shared in chat messages. Teams should also account for access paths described by ATT&CK: user endpoints, servers hosting the service, cloud administrator portals, and compromised integrations such as Slack Workflows.

Likely telemetry

  • SaaS chat and collaboration message audit logs where available
  • Office suite and email audit events relevant to message access and search
  • Cloud admin portal activity for communication platforms
  • Endpoint evidence of local chat or collaboration client access
  • Workflow, automation, and integration execution logs for chat platforms

Detection direction

  • Validate whether DET0111-style detections exist for secrets in chat messages and collaboration content.
  • Tune secret detection for common credential formats such as passwords, API keys, and authentication tokens while managing false positives from examples, test data, and security training content.
  • Check blind spots in private channels, direct messages, archived content, third-party collaboration tools, and workflow/integration outputs.
  • Correlate exposed-secret findings with identity activity to determine whether credentials may have been abused for follow-on access.
  • Confirm whether audit retention and search permissions are sufficient for incident response without assuming every SaaS platform exposes the same telemetry.

Mitigation priorities

  • Prioritize user training that explicitly discourages sharing passwords, API keys, and tokens in chat or collaboration tools.
  • Implement and regularly review auditing for communication and collaboration services, including admin access and workflow/integration activity.
  • Establish an operational process to revoke or rotate credentials found in messages.
  • Reduce reliance on shared static secrets where possible through approved identity and access management practices.
  • Use audit results to demonstrate compliance readiness and to identify teams or workflows that need targeted remediation.
Analyst notes and limits

ATT&CK identifies this as a credential-access behavior and notes that LAPSUS$ uses this technique. That relationship should inform threat-informed validation, but it should not be interpreted as evidence of current targeting or exposure in any specific environment. The most important local question is whether chat and collaboration systems are governed as sensitive credential repositories when users misuse them that way.

The official ATT&CK object does not provide detection guidance, and the relationship context only names DET0111 without detailed logic. Platform scope is limited to SaaS and Office Suite in the supplied fields. Specific products, log schemas, detection rules, and exposure levels require environment-specific validation.

Official MITRE ATT&CK definition

Chat Messages

Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels.

Rather than accessing the stored chat logs (i.e., Credentials In Files), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation [1].

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1552 Unsecured Credentials This object subtechnique of Unsecured Credentials.
Associated objects

Groups, software, and campaigns

Group Enterprise

G1004: LAPSUS$

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.[1][2][3]

Relationship explorer

All related ATT&CK context

detects · Detection Strategy DET0111: Detect Unsecured Credentials Shared in Chat Messages Enterprise uses · Group G1004: LAPSUS$ Enterprise mitigates · Mitigation M1047: Audit Enterprise subtechnique of · Technique T1552: Unsecured Credentials Enterprise mitigates · Mitigation M1017: User Training Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1047: Audit

Auditing is the process of recording activity and systematically reviewing and analyzing the activity and system configurations. The primary purpose of auditing is to detect anomalies and identify potential threats or weaknesses in the environment. Proper auditing configurations can also help to meet compliance requirements. The process of auditing encompasses regular analysis of user behaviors and system logs in support of proactive security measures.

Auditing is applicable to all systems used within an organization, from the front door of a building to accessing a file on a fileserver. It is considered more critical for regulated industries such as, healthcare, finance and government where compliance requirements demand stringent tracking of user and system activates.This mitigation can be implemented through the following measures:

System Audit:

- Use Case: Regularly assess system configurations to ensure compliance with organizational security policies. - Implementation: Use tools to scan for deviations from established benchmarks.

Permission Audits:

- Use Case: Review file and folder permissions to minimize the risk of unauthorized access or privilege escalation. - Implementation: Run access reviews to identify users or groups with excessive permissions.

Software Audits:

- Use Case: Identify outdated, unsupported, or insecure software that could serve as an attack vector. - Implementation: Use inventory and vulnerability scanning tools to detect outdated versions and recommend secure alternatives.

Configuration Audits:

- Use Case: Evaluate system and network configurations to ensure secure settings (e.g., disabled SMBv1, enabled MFA). - Implementation: Implement automated configuration scanning tools like SCAP (Security Content Automation Protocol) to identify non-compliant systems.

Network Audits:

- Use Case: Examine network traffic, firewall rules, and endpoint communications to identify unauthorized or insecure connections. - Implementation: Utilize tools such as Wireshark, or Zeek to monitor and log suspicious network behavior.

Mitigation Enterprise

M1017: User Training

User Training involves educating employees and contractors on recognizing, reporting, and preventing cyber threats that rely on human interaction, such as phishing, social engineering, and other manipulative techniques. Comprehensive training programs create a human firewall by empowering users to be an active component of the organization's cybersecurity defenses. This mitigation can be implemented through the following measures:

Create Comprehensive Training Programs:

- Design training modules tailored to the organization's risk profile, covering topics such as phishing, password management, and incident reporting. - Provide role-specific training for high-risk employees, such as helpdesk staff or executives.

Use Simulated Exercises:

- Conduct phishing simulations to measure user susceptibility and provide targeted follow-up training. - Run social engineering drills to evaluate employee responses and reinforce protocols.

Leverage Gamification and Engagement:

- Introduce interactive learning methods such as quizzes, gamified challenges, and rewards for successful detection and reporting of threats.

Incorporate Security Policies into Onboarding:

- Include cybersecurity training as part of the onboarding process for new employees. - Provide easy-to-understand materials outlining acceptable use policies and reporting procedures.

Regular Refresher Courses:

- Update training materials to include emerging threats and techniques used by adversaries. - Ensure all employees complete periodic refresher courses to stay informed.

Emphasize Real-World Scenarios:

- Use case studies of recent attacks to demonstrate the consequences of successful phishing or social engineering. - Discuss how specific employee actions can prevent or mitigate such attacks.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
0c537fc1d5ce739f...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle 0c537fc1d5ce…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Slack Security Risks

    Michael Osakwe. (2020, November 18). 4 SaaS and Slack Security Risks to Consider. Retrieved March 17, 2023.

    Open source URL
  2. [2]
    mitre-attack T1552.008
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use