Compromised cloud keys exfiltrated to bucket