Service-account credentials are machine identities used by applications, build systems, scripts, and cloud tools to authenticate without a human user. They may include client secrets, keys, certificates, or short-lived tokens tied to a specific service account.
They matter because service accounts often have direct access to cloud APIs, storage, deployment pipelines, and source repositories. If malware steals them, the attacker can act like trusted automation instead of forcing a password login. In real attacks, compromised endpoints, poisoned packages, or abused CI/CD runners can expose these credentials from files, environment variables, or secret stores. Defenders reduce risk by scoping permissions tightly, using short-lived credentials, rotating secrets quickly, isolating build systems, and monitoring for unusual API use or access from unexpected hosts.