[tpmx]

In this incident, the unauthorized actor exfiltrated customer information on December 22, 2022, which included environment variables, keys, and tokens for third-party systems.

A lot of production AWS/GCP keys are likely stolen for those that deploy from CI/CD.

[fexecve]

Most people will just update their keys, so I doubt anyone is going to burn botnet cycles on trying to use the keys.