10K Docker images spray live cloud creds across the internet

> The exposed secrets aren't theoretical test tokens or placeholders: they include active credentials.

How do security researchers verify this?