Tag: credential theft
220 articles
Vercel Breach Exposes Customer Data Theft via AI Tool Compromise
A single compromised AI tool has led to a massive breach at Vercel, exposing customer data and raising serious questions about trust and security. An attacker exploited a third-party AI tool used by an employee to steal sensitive credentials and OAuth tokens, gaining access to multiple services and customer data.
Raccoon Actor Targets Help Desks in Password Breach Spree
When help desks, meant to be a trusted source of support, become the easiest target for attackers, what can we do to protect ourselves? A recent surge in breaches, including a password breach spree by a Raccoon-linked actor, has left technologists, policymakers, and everyday users scrambling for answers.
North Korea Exploits Social Engineering to Target macOS Users
Beware of a sneaky new scam where North Korean hackers trick macOS users into handing over their credentials and cryptocurrency by posing as a fake Zoom update. They're using social engineering to get you to do the work for them, making it a low-cost but hard-to-stop threat.
AgingFly Malware Targets Ukraine Govt, Hospitals in Data Heist
A newly discovered malware called AgingFly is targeting Ukraine's government and hospitals, stealing sensitive online identity keys and putting public services at risk. This fresh threat siphons authentication data from popular web browsers and messaging apps, sparking urgent concern.
GitHub AI Agents Exposed to Credential Theft via Prompt Injection
Security researchers have uncovered a shocking vulnerability in popular GitHub AI agents, demonstrating how a simple prompt injection technique can be exploited to steal sensitive credentials, leaving users alarmingly exposed. The findings highlight a disturbing lack of transparency from vendors, putting automation and service access at risk.
Impersonator Exploits Slack to Target Linux Developers
A clever impersonator tricked Linux developers on Slack by posing as a trusted official, leading them to click a link that seemed harmless but actually handed over their credentials and development environment. This sneaky attack used Google-hosted pages to disguise a bogus root certificate, catching developers off guard.
Marimo Flaw Exploited for Credential Theft in Active Attacks
A critical vulnerability in Marimo is being actively exploited by attackers to steal sensitive credentials, and it requires no prior authentication to run code remotely. This flaw has severe consequences for organizations using Marimo, making it essential to take immediate action.
Google Chrome Bolsters Defenses Against Session Cookie Theft
Google Chrome just got a major security boost with the introduction of Device Bound Session Credentials (DBSC) protection, designed to block info-stealing malware from harvesting session cookies and putting your online credentials at risk. This move is a key step in the ongoing cat-and-mouse game between defenders and cyber threats.
APT28 Hijacks Routers to Steal Credentials via Malicious DNS Servers
Beware of invisible hands rerouting your online traffic: a state-linked Russian hacking group, APT28, has been hijacking routers to intercept credentials by manipulating DNS servers, putting your online security at risk. This stealthy tactic allows them to capture user authentication data, compromising your digital identity.
Credential Theft Evolves, Outpaces Breach Monitoring Defenses
Imagine the keys to your online kingdom being quietly copied and stolen before you even notice - that's the alarming reality of credential theft, where infostealers are harvesting sensitive info at scale, often bypassing traditional defenses. Simple breach monitoring just can't keep up with this modern threat.
Hackers Exploit React2Shell in Widespread Credential Theft Drive
Hackers are on the prowl, exploiting the React2Shell flaw (CVE-2025-55182) to steal sensitive credentials from vulnerable Next.js applications on a massive scale. With a single vulnerability, they can wreak havoc - the question is, how many credentials will be compromised before a patch is applied?
Venom Phishing Platform Targets C-Suite Execs in Credential Theft Campaigns
Meet Venom, a sneaky new phishing platform that's putting top executives in its crosshairs, threatening to drain their credentials and wreak havoc on corporate boardrooms. This automated threat is scaling up credential theft like never before, making it a high-risk concern for senior leaders and their organizations.
Storm Infostealer Decrypts Credentials to Evade Detection
Meet Storm, a sneaky new infostealer that's taking password theft to the next level by remotely decrypting stolen credentials, allowing hackers to slip past security defenses undetected. This game-changing tactic lets stolen passwords be used immediately, bypassing local security controls that would normally sound the alarm.
Venom Stealer Platform Automates Data Theft with ClickFix Tactics
Imagine a silent thief lurking in the shadows of your digital life, quietly siphoning off sensitive info - and now, cybercriminals can easily access this capability with Venom Stealer, a new malware-as-a-service tool that automates data theft with alarming ease. This menacing platform is poised to revolutionize cybercrime, making it simpler than ever for attackers to steal credentials, cookies, and cryptocurrency assets.
TikTok Phishing: Alarming AiTM Campaign Targets Business Accounts
Beware of a sneaky new phishing campaign targeting TikTok Business accounts, using clever AiTM tactics to steal login credentials. Don't get caught out - stay vigilant and protect your account from these cunning cyber threats!
DeepLoad Malware Poses Critical Threat with Advanced Evasion Tactics
A new and highly sophisticated malware threat, DeepLoad, has emerged with advanced evasion tactics that blur the lines between human psychology and digital security, putting sensitive information at risk. This powerful malware loader uses social engineering and AI-assisted obfuscation to evade detection, making it a critical threat that demands immediate attention.
Phishing Surges with Alarming New Tactics This Tax Season
Tax season is here, and with it, a surge in phishing attacks that could leave you vulnerable to identity theft and financial loss. Don't wait until it's too late - stay ahead of cybercriminals and protect your sensitive info from their alarming new tactics.
Shai-Hulud-Like Worm: Exclusive Critical npm Threat
What if the npm packages you trust were actually malicious? Researchers uncovered a Shai‑Hulud‑like, self‑replicating worm hidden in npm packages that runs at install time to steal developer and CI secrets, hijack AI tooling, and spread across the registry.
Chrome extensions Exclusive: Malicious AI steal API keys
Before you add that shiny AI assistant to Chrome, pause: researchers found 30+ extensions secretly siphoning API keys, emails and other sensitive data from hundreds of thousands of users. What promised convenience turned into a fast track for credential theft and account takeover.
pkr_mtsi Reveals Stunning, Dangerous Payloads
Think of pkr_mtsi as a benign-looking packer that attackers have turned into a slick delivery system—using malvertising and social lures to slip credential stealers, covert coin‑miners, and backdoors onto victims’ PCs. By running loaders in memory and staging payloads, it keeps infections quiet while letting criminals squeeze ongoing profit from compromised machines.
n8n flaw Exclusive: Critical bug lets attackers run servers
A critical unauthenticated RCE in n8n lets attackers run arbitrary code and seize control of servers. If you run n8n, patch now to protect your workflows, credentials, and sensitive data across potentially 100,000 installs.
LinkedIn Job Scams: Exclusive Tips to Avoid Costly Fraud
When a recruiter asks for your LinkedIn password, it’s not hiring—it’s a trap. Learn simple, practical ways to spot fake job offers, protect your credentials, and keep your career and accounts safe from sophisticated scammers.
630M Passwords Stolen: Stunning, Alarming Credential Cost
Some 630 million passwords have been leaked to criminal marketplaces — a stark reminder that passwords are no longer sacred. Now’s the moment to stop reusing credentials, enable MFA, and push for faster detection and smarter defenses.
After Email Hacking, Campus Faces Stunning Costly Breach
The University of Pennsylvania breach began with an Oct. 31 email hack that quickly escalated into a far costlier intrusion, leaving students and staff scrambling and officials grappling with steep financial and operational fallout. Its a stark reminder that a single compromised inbox can cascade into widespread harm for campuses everywhere.