Supply chain attacks are stacking up fast, and they’re following the same playbook: breach, find secrets, pivot deeper. Just in the past month, three high-profile incidents stood out:

• A widespread data theft attack against Salesforce instances via compromised OAuth tokens for the Salesloft Drift integration

• A supply-chain attack against the Nx build system that published malicious packages to NPM that stole and exfiltrated additional secrets (S1ngularity)

• A supply-chain attack against NPM packages that replicates itself, stealing and exfiltrating secrets found on machines that installed the packages (the Shai-Hulud npm worm)

In all these attacks, threat actors turned to publicly available tools to uncover credentials. One of those tools was TruffleHog.

Here’s the striking part: threat intelligence groups aren’t just flagging TruffleHog’s use by attackers, they’re recommending defenders use TruffleHog too.

Source: Google Threat Intelligence blog post- Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

The same capability that enables attackers to pivot is the one defenders need to use to spot and close exposures before they’re exploited.

So when a tool like TruffleHog shows up in your logs, what does that really mean? And how do security teams shift from reacting to proactively defending against the tactics shaping today’s biggest supply chain breaches?

What TruffleHog Is (and Isn't)

TruffleHog is an open-source scanner built to detect exposed credentials in code, logs, Slack, wikis, and other sources. It’s a legitimate secret scanning tool run by thousands of security teams every single day.

Beyond simple pattern matching, TruffleHog goes a step further: it attempts to verify whether a discovered secret is still live and potentially usable by an attacker. For example, when it finds an AWS key, it checks whether that key can be successfully used to call a benign API (the GetCallerIdentity endpoint). This liveness checking works across more than 800 secret types and almost completely eliminates false positives.

It's important to distinguish that TruffleHog does not execute exploitation actions; it is a detection and liveness verification tool.

Attribution in a Complex Ecosystem

When TruffleHog shows up in your logs, context is everything. Its presence doesn’t automatically mean an attacker—it could just as easily be your own AppSec team or a bug bounty hunter. The challenge is attribution.

TruffleHog identifies itself with a TruffleHog user-agent string, which now appears frequently in SaaS and cloud provider logs (e.g., GitHub, AWS) due to its secret liveness verification feature. To reduce confusion, TruffleHog allows users to append a custom suffix with the --user-agent-suffix=SUFFIX flag (e.g., TruffleHog InternalScan). This simple flag allows your SOC or SIEM to immediately distinguish between sanctioned internal scans and potential external threats.

Reduce the Attack Surface

The most effective way to counter the techniques seen in recent supply chain attacks is straightforward: find and fix exposed secrets before attackers do. This is how security teams shift from reacting to proactively defending. A strong defense starts with four steps:

1. Scan To Find Exposed Secrets in Your Own Infrastructure

Run TruffleHog against your environment to understand your exposure. Always use a unique user-agent string to distinguish legitimate scans from potentially malicious ones.

2. Rotate Exposed Secrets

Discovery is only useful if it’s paired with remediation. Simply deleting the file, commit, or message where the secret appeared isn’t enough; an attacker may already have it. When a valid secret is exposed, it should be revoked and replaced as quickly as possible. 

A solid rotation playbook should cover three essentials: identify who owns the exposed asset, determine whether the replacement secret can be issued with fewer privileges, and define clear steps for revocation and replacement. Rotation is often the hardest part of remediation, but it’s also the most critical.

3. Prevent Secrets from Entering Your Codebase

Once existing leaks are under control, the next priority is prevention. The S1ngularity-NX attack highlighted how dangerous secrets in CI/CD environments can be. To keep them out in the first place:

• Pre-commit hooks: Give developers immediate feedback by catching secrets before code is pushed.

• CI/CD integration: Add secret scanning as a required step in your build process.

• Commit history scanning: Go beyond the latest commit and cover full Git histories, where long-forgotten secrets often remain.

• Centralized Secrets Management: Tools like HashiCorp Vault, AWS Secrets Manager, or Google Secret Manager allow applications to fetch secrets dynamically at runtime, removing the need to hardcode them in the first place.

4. Expand Monitoring Beyond Source Code

As the Salesforce breach showed, secrets don’t just live in code. They surface in SaaS platforms like Slack, Jira, and Confluence, making continuous, automated monitoring across both code and non-code assets essential. Early detection ensures leaks are immediately caught and routed into the rotation workflow.

The open-source version of TruffleHog focuses on scanning code platforms such as GitHub, GitLab, Jenkins, HuggingFace, and Postman. What it doesn’t provide is continuous monitoring or coverage for non-code sources.

TruffleHog Enterprise builds on the open-source tool to address these gaps:

• Scanning both code and non-code sources (e.g., Slack, Jira, Confluence, Google Drive).

• Continuously monitoring for newly exposed secrets and ensuring previously exposed ones are rotated.

• Integrating with ticketing systems like Jira to streamline remediation.

Learn more about TruffleHog Enterprise.

Conclusion: From Signal to Strategy

Secret scanning is a fundamental part of the modern offensive playbook. Seeing TruffleHog in your logs is a valuable data point that requires careful attribution.

However, the ultimate defense is a proactive one. By continuously scanning your own infrastructure, immediately rotating any exposed secret, and building preventative controls into your SDLC, you nullify the attacker's efforts. Don’t wait for an attacker to run TruffleHog in your environment; run it yourself.