Tag: credential theft
220 articles
GhostAction Exploits 1,900 GitHub Accounts, Hits 30,000 Repositories
Malicious actors launched a massive attack, dubbed GhostAction, that compromised nearly 1,900 GitHub accounts and infected over 30,000 repositories with a malicious workflow. The concentrated surge, which occurred on October 8-9, 2026, put thousands of users and organizations at risk.
Hirudo Trojan Exploits Patched Banking Apps to Evade Security Checks
Meet Hirudo, a sneaky Trojan that's exploiting patched banking apps to slip past security checks and wreak havoc on unsuspecting users. This malicious mastermind combines credential theft, device takeover, and even camera capture to pull off its dastardly heists.
GitHub Repositories Targeted in Credential-Stealing Workflow Attack
Malicious actors have launched a sneaky credential-stealing attack on GitHub repositories, using hijacked accounts to spread a malicious workflow that hit 345 repositories in just a few hours. The GhostAction campaign is back with a vengeance, putting developer credentials at risk.
UAC-0099 Deploys ASHVEIN RAT in Targeted Attacks on Ukrainian Government Personnel
Meet ASHVEIN, a sneaky new malware that's helping Russia-aligned hackers steal sensitive info from Ukrainian government targets - and hiding their tracks in clever, invisible ways. This .NET infostealer and remote access trojan is a master of disguise, blending credential theft, surveillance, and remote control features to fly under the radar.
ASOS Breach Exposes Customer Data After Credential Theft
ASOS recently fell victim to a sneaky social engineering attack, where hackers tricked an employee into handing over their login credentials, allowing the attackers to access sensitive customer data stored on third-party platforms. The company quickly sprang into action, locking down the affected platforms to prevent further damage.
Malware Worm Exploits Tensorlake npm Package to Steal Credentials
A malware worm has been discovered exploiting the popular Tensorlake npm package to steal sensitive credentials, with the first malicious commit occurring on October 7, 2026, at 01:20 a.m. UTC. The compromised package, version 0.5.144, was quickly taken down after publishing to the npm registry on October 8, 2026.
US Soldier Sentenced for Telecom Extortions
Meet Cameron John Wagenius, a 22-year-old US soldier who traded in his security clearance for a life of cybercrime, exploiting exposed Snowflake credentials to orchestrate a massive data heist. As Kiberphant0m, he and his co-conspirators downloaded sensitive data from major Snowflake customers, earning a guilty plea and a federal sentence.
Windows Botnet x47.c Exploits AI Credits with 18 Attack Methods
Meet x47.c, a sneaky Windows botnet that's draining AI credits with 18 clever attack methods, targeting paid AI service accounts like OpenAI and xAI by sending repeated billable requests. This malicious tool is even being sold on the darknet marketplace WraithTools, with packages starting from just $200.
Malicious npm Package Exploits Twilio Developers for Credential Theft
Malicious actors have struck again, this time with a fake npm package called tw-pkgprobe-7731 that masquerades as a security research tool to steal credentials from unsuspecting Twilio developers. The package was cleverly designed to evade detection, only collecting and exfiltrating sensitive data when it detected a Twilio developer environment.
TanStack npm Attack Exposes 170 Private GitHub Repositories
A shocking npm attack on TanStack exposed a massive 170 private GitHub repositories after a malicious actor exploited a stolen OAuth token from a former employee's account. The breach was linked to a supply-chain compromise of TanStack's npm packages, tracked as CVE-2026-45321, which allowed attackers to steal sensitive credentials.
AI Automates Credential Theft, Threatens Identity Security
In under six hours, a single operation compromised thousands of third-party credentials, highlighting the alarming speed and efficiency of AI-powered credential theft. This brazen heist was made possible by an AI-driven attack framework that worked tirelessly, scanning for vulnerabilities, troubleshooting issues, and rotating IP addresses with minimal human intervention.
Fraudulent Hires Evade Detection, Gain Network Access Before Exposure
Imagine getting hired, passing background checks, and receiving your official login credentials - all without being who you claim to be. Once inside, malicious hires can wreak havoc for days, with the average fraudulent employee enjoying 5.73 days of unrestricted access to sensitive corporate networks.
Florida DMV Breach Exposed via Stolen Police Credentials
A data breach at the Florida DMV exposed sensitive information after an international cybercriminal group compromised the system using stolen police credentials. The breach was quickly identified and mitigated on September 4, 2026, and no further unauthorized access has occurred.
Microsoft 365 Phishing Attacks Expose Data Theft Tactics
Microsoft warns that cyber attackers are using clever social engineering tactics, like impersonating IT help desks, to trick employees into spilling sensitive info and gaining access to Microsoft 365 accounts. These scammers do their homework, researching companies and staff on social media and professional networks to make their attacks convincing.
Cisco FMC Exploits Fuel Ransomware, Credential Theft
Cisco is urging customers to apply hotfixes immediately to protect against ransomware and credential theft attacks exploiting vulnerabilities in its Secure Firewall Management Center (FMC) software. The company has already released patches for the affected versions and plans to roll out additional security updates soon.
Account Recovery Exposes New Attack Path in MFA Defenses
As attackers get thwarted at every login, they're exploiting a glaring weak spot: account recovery processes that can be manipulated to bypass multi-factor authentication defenses. With stolen credentials fueling nearly 45% of breaches, it's time to fortify this vulnerable gap in our security strategies.
Microsoft 365 Phishing Op Exposes Thousands of Credentials
A recent phishing operation exposed a staggering 5,137 records from 461 organizations, including 1,032 plaintext passwords and 474 fully authenticated Microsoft 365 sessions that could be easily exploited. This massive haul highlights the alarming vulnerability of sensitive credentials to clever phishing tactics.
Threat Actors Deploy AI Frameworks for Widescale Credential Theft
Threat actors have upgraded their game, leveraging AI frameworks to supercharge credential theft and drastically cut the time between initial compromise and large-scale attacks. Gone are the days of simple, one-off AI prompts - now, attackers are orchestrating entire attacks with sophisticated multi-agent frameworks.
Microsoft Credentials Targeted in BigBear 2 PhaaS Campaign
Security researchers just uncovered a massive phishing operation targeting Microsoft 365 credentials, with a staggering 5,137 compromised records and 3,331 unique victim IPs exposed. The researchers even gained admin access to the operation's control panel, revealing a vast network of 42 VPS nodes used to carry out the attacks.
Passkey Security Compromised by 39 New Attack Methods
The promise of passkey security has been cracked: 39 new attack methods have been uncovered, threatening the layers of protection surrounding modern passkey systems. From phishing to credential theft, these vulnerabilities expose the weaknesses in what was thought to be a foolproof solution.
Australia Charges Two in TeamPCP Cybercrime Case Tied to Supply Chain Attacks
In a major breakthrough, the Australian Federal Police charged two men with 14 offences for their alleged roles in the notorious TeamPCP cybercrime syndicate, which compromised over 1,000 organizations worldwide and stole more than 500,000 credentials. The suspects, aged 23 and 21, were arrested and appeared in court after a joint operation seized electronic devices for forensic analysis.
Identity Verification Exploited in Onboarding, Recovery Processes
Cyber attackers are now exploiting weaknesses in identity verification processes, targeting the moments when identities are created or re-established, and using tactics like falsifying documents and stolen credentials to gain a foothold. This shift comes as defenders have made logins more secure, with stolen credentials involved in nearly 45% of breaches.
Clop Ransomware Operation Exploits Windchill Flaw with Custom Web Shell
The Clop ransomware operation has exploited a critical flaw in PTC Windchill and FlexPLM servers, deploying a custom web shell that allows for easy credential theft and massive data exfiltration. This sneaky move gives attackers a direct path to sensitive data, with no extra tools needed.
TWINLOOT Exploits Microsoft Services to Steal Credentials
Meet TWINLOOT, a sneaky Python implant that hides its command-and-control infrastructure inside trusted Microsoft services, making it super hard to detect. It uses SharePoint Online and Microsoft Teams to operate undetected, even leveraging a victim's own Edge browser to blend in.