Fake Docker Hub / GHCR / ECR secret-leak credential breach lure — email claims Docker Hub, GHCR, GitLab Container Registry, Quay.io, Amazon ECR, ACR, or Google Artifact Registry detected hard-coded secrets in the recipient's container images, demands immediate credential rotation at a fake security console. Flare Sep 2025: 10,000+ Docker Hub images exposing AWS/DB/API keys; THN Dec 2025 IAM-crypto-mining chain. Distinct from fake-docker-hub-desktop-subscription-billing-phish (billing, not secret-leak)
fake-docker-hub-credential-breach-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Email claiming that Docker Hub, GitHub Container Registry (GHCR), GitLab Container Registry, Quay.io, Amazon ECR, Azure Container Registry (ACR), or Google Artifact Registry has detected hard-coded secrets (AWS keys, database passwords, API tokens) in the recipient's public container images — and demanding immediate credential rotation at a fake security console URL. Flare's September 2025 research found 10,000+ Docker Hub images exposing secrets from over 100 organizations (AWS keys, DB credentials, API tokens); The Hacker News December 2025 traced an IAM-crypto-mining chain that started with a malicious Docker image pulled 100,000+ times; The Hacker News April 2026 reported CVE-2026-34040 making Docker Hub-themed social engineering more plausible. The lure exploits DevOps team urgency around secret exposure (a real and well-publicized problem) combined with the normalized CI/CD pattern of receiving registry alerts by email. Real alerts from Docker Hub, GitHub, and GitLab reference specific image digests and link to official security dashboards on the official domain. Distinct from `fake-docker-hub-desktop-subscription-billing-phish` (billing impersonation, not secret-leak panic) and `fake-github-gitlab-developer-account-security-phish` (account-level takeover, not container-registry secrets). Fires on the triple of container-registry brand + secret-exposure alert + rotate/revoke CTA.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started