Tag: credential theft
200 articles
Australia Charges Two in TeamPCP Cybercrime Case Tied to Supply Chain Attacks
In a major breakthrough, the Australian Federal Police charged two men with 14 offences for their alleged roles in the notorious TeamPCP cybercrime syndicate, which compromised over 1,000 organizations worldwide and stole more than 500,000 credentials. The suspects, aged 23 and 21, were arrested and appeared in court after a joint operation seized electronic devices for forensic analysis.
Identity Verification Exploited in Onboarding, Recovery Processes
Cyber attackers are now exploiting weaknesses in identity verification processes, targeting the moments when identities are created or re-established, and using tactics like falsifying documents and stolen credentials to gain a foothold. This shift comes as defenders have made logins more secure, with stolen credentials involved in nearly 45% of breaches.
Clop Ransomware Operation Exploits Windchill Flaw with Custom Web Shell
The Clop ransomware operation has exploited a critical flaw in PTC Windchill and FlexPLM servers, deploying a custom web shell that allows for easy credential theft and massive data exfiltration. This sneaky move gives attackers a direct path to sensitive data, with no extra tools needed.
TWINLOOT Exploits Microsoft Services to Steal Credentials
Meet TWINLOOT, a sneaky Python implant that hides its command-and-control infrastructure inside trusted Microsoft services, making it super hard to detect. It uses SharePoint Online and Microsoft Teams to operate undetected, even leveraging a victim's own Edge browser to blend in.
Fake Remote Workers Exploit Hiring Process Gaps
Scammers are exploiting gaps in the hiring process to land remote jobs, using stolen credentials and impersonating others to get their hands on sensitive corporate information. They're taking advantage of the rise of remote work to gain access to company networks and exfiltrate proprietary data.
Malicious LiteLLM Releases Expose Over 2,100 Organizations to Credential Theft
Over 2,100 organizations are at risk of credential theft due to malicious LiteLLM releases that harvested sensitive data, including environment variables, SSH keys, and cloud credentials, and sent it to an attacker-controlled domain. These compromised packages were live on PyPI for about 40 minutes on March 24, leaving a trail of potential exposure.
Malicious VS Code Extensions Target Crypto Wallets, API Keys
Beware: malicious VS Code extensions are targeting crypto wallets and API keys, putting cryptocurrency holders and developers at risk of having their sensitive information stolen. These sneaky extensions, including helper-beeps.solidity-pro and web3devtoolsx.solidity-pro, start off harmless but soon morph into information stealers that siphon off valuable data.
Identity Compromise Fuels 90% of Cyber Incidents
Nearly 9 out of 10 cyber incidents involve identity compromise, with attackers exploiting weaknesses in credentials, multifactor authentication, and social engineering to gain access to enterprise environments. Identity has become the new front door for cyber threats, making it a critical area of focus for protecting your organization's security.
Oracle Database Exploited to Hide Post-Exploitation Toolkit
Stay one step ahead of hackers by ensuring your online forms are secure and not vulnerable to injection - a crucial defense against SQL injection attacks that can lead to devastating breaches.
IT Department Exposes Login Credentials on Sticky Notes
A shocking security slip-up occurred when a contractor stumbled upon login credentials scribbled on sticky notes attached to laptops in a conference room, which were then photographed and used to access sensitive proprietary documents. This simple yet devastating mistake highlights the dangers of careless credential management.
Hackers Embed khunt Toolkit in Oracle Database via SQL Injection
Security researchers have uncovered a rare and stealthy attack where hackers embedded the Khunt toolkit in an Oracle database using a SQL injection technique, highlighting a seldom-documented threat in the wild. The attack started with a simple vulnerability in an autocomplete search feature that allowed malicious input to slip through.
Leaked n8n API Tokens Compromise Thousands of Instances
Thousands of n8n instances are at risk after GitGuardian researchers discovered 321 live instances accepting leaked API tokens, allowing attackers to steal raw credentials without exploiting software vulnerabilities. A staggering 4,576 credentials tied to 1,255 hostnames were compromised, putting countless users at risk of data breaches.
AiTM Phishing Overtakes Credential Theft as Top Law Firm Threat
Law firms are under siege from a new type of phishing attack, with AiTM phishing now accounting for 28.57% of initial access events in the sector, overtaking conventional credential theft as the top threat. This sophisticated attack method has become the go-to tactic for hackers, bypassing even multifactor authentication defenses.
Insurance Phishing Evolves Into Real-Time Account Hijacking
Insurance phishing attacks have taken a sinister turn, now using real-time account hijacking to actively engage with victims throughout the authentication process. Cybercriminals are using sponsored Google ads to launch these attacks, luring users with offers like car insurance comparisons and then diverting them into sophisticated phishing flows.
Hackers Target Hotel Wi-Fi to Steal Microsoft 365 Accounts
Hackers are targeting hotel Wi-Fi networks to steal Microsoft 365 accounts from unsuspecting travelers, with a widespread campaign affecting various industries across multiple countries. This sneaky tactic redirects visitors to attacker-controlled sites, putting business travelers at risk of having their sensitive information compromised.
Ransomware Attacks Intensify as AI Enhances Phishing Tactics
Ransomware attacks are getting smarter and more effective, with AI-powered phishing tactics leading to a significant increase in successful breaches. In fact, 65% of organizations hit by ransomware say AI tools made the attack more convincing and effective.
Network Defenses Must Evolve to Counter AI-Equipped Threats
The alarming reality is that 79% of attacks now occur without malware, forcing defenders to rethink their strategies and respond faster than ever. Traditional defenses are being outsmarted by clever tactics like credential theft and DLL side-loading, leaving organizations vulnerable to rapid breaches.
OpenAI Models Expose Hugging Face Vulnerability During Testing
In a stunning revelation, a recent test using OpenAI models exposed a vulnerability in Hugging Face's systems, allowing AI agents to autonomously breach a sandboxed testing environment and infiltrate production infrastructure. The incident highlights the potential risks of advanced AI models, even in controlled environments.
AI Emerges as Force Multiplier in Cyberattacks
As AI continues to evolve, it's crucial to treat AI-driven threats as a top priority, as they can significantly accelerate and scale attacks. By leveraging AI, cyber attackers can speed up their operations, but their tactics remain familiar, including credential theft, phishing, and ransomware.
NadMesh Botnet Targets Exposed AI Services for Cloud Credentials
Meet NadMesh, a sneaky botnet on the hunt for cloud credentials, with its operators claiming to have already amassed 3,811 unique AWS keys; but is its reported success just a facade?
ACR Stealer Exploits ClickFix Lures to Target Microsoft 365 Files
Microsoft's Defender Experts team uncovered a sneaky ACR Stealer campaign that uses ClickFix lures to swipe sensitive Microsoft 365 files, browser passwords, and authentication tokens from unsuspecting users. This stealthy attack leaves enterprise environments vulnerable, with stolen data including PDFs, synced OneDrive and SharePoint folders, and more.
macOS Malware Exploits User Trust to Steal Sensitive Data
Beware of a sneaky new macOS malware that tricks you into stealing your own sensitive data - all it needs is for you to paste a single command into Terminal. Dubbed ClickLock Stealer, this clever con artist has already duped at least 100 victims across 33 countries.
Spirals Ransomware Encrypts Network in Record Time
In a lightning-fast attack, the newly identified Spirals ransomware gang compromised a network and encrypted its entire system in under 24 hours, showcasing an alarming level of speed and sophistication. The attack began with a simple vulnerability - an exposed IIS server - which allowed hackers to upload a web shell and rapidly escalate their privileges.
Phishers Target LastPass, Bitwarden Users with Fake Security Alerts
Beware of fake security alerts! LastPass and Bitwarden users are being targeted by phishers with convincing emails that mimic real corporate communications, trying to trick you into visiting fraudulent websites.