Credential Harvesting Through Public Code Beautifiers

Du'aine Davis

Observed in the wild

• watchTowr researchers at discovered over 80,000 saved JSON submissions on popular online code formatting tools (JSONFormatter.org and CodeBeautify.org), exposing highly sensitive data. Leaked information included Active Directory credentials, API keys, private keys, cloud environment secrets, and customer PII from organisations across critical sectors such as government, finance, banking, healthcare, telecoms, and cybersecurity.
• The team exploited legitimate functionality on these platforms, specifically the “Recent Links” feature and predictable URL patterns, to scrape saved content. Using OSINT techniques and automated parsing, they extracted secrets from shareable links created by users who unknowingly stored sensitive data. Evidence suggests other actors are already scraping and testing these credentials, highlighting active exploitation risk.
• Organisations are advised to audit for leaked credentials and secrets, rotate exposed keys immediately, and enforce strict policies against using public tools for sensitive data. For Microsoft environments, monitor Defender alerts for anomalous authentication attempts, credential misuse, and suspicious API calls. Implement Defender for Identity to detect lateral movement and credential exposure, and configure Defender for Endpoint to flag unusual PowerShell activity or access to external code formatting sites.

Stop Putting Your Passwords Into Random Websites (Yes, Seriously, You Are The Problem)