Tag: credential theft
181 articles
SonicWall SSL VPN Urgent Alert: Critical MFA Bypass Risk
Akira ransomware actors are rapidly exploiting SonicWall SSL VPN flaws to bypass MFA and spread payloads—proving MFA isn’t a silver bullet and that urgent patching, tighter segmentation, and better monitoring are essential to stop these fast-moving attacks.
QR-code steganography: Exclusive Dangerous Threat
A malicious npm package called Fezbox has been hiding stolen browser credentials inside seemingly innocuous QR images, turning routine builds into quiet data leaks. Treat every dependency with suspicion—pin versions, scan for suspicious runtime behavior, and rotate tokens—to defend against clever supply‑chain tricks like this.
ransomware attack: Stunning NCA Arrest Offers Hope
A multinational ransomware attack left airports scrambled and travellers stranded — now Britain’s National Crime Agency has arrested a suspect, a move that could unlock crucial evidence and help prevent future disruptions.
Pandoc CVE-2025-51591 Critical: Must-Patch Risk
A newly spotted SSRF flaw in Pandoc (CVE-2025-51591) is being abused to trick EC2 instances into handing over AWS IMDS tokens and temporary credentials, letting attackers steal keys and pivot across cloud accounts. If you run Pandoc in build pipelines or servers, inventory instances, patch or block metadata access, and enable IMDSv2 now to stop casual credential theft.
lateral movement: Stunning 18-Minute Risky Surge
Attackers now break out in a median of just 18 minutes, not hours, so organizations must embrace zero-trust, strong identity controls, segmentation and automated detection to stop breaches before they can spread.
Scattered Spider Exclusive: Risky Teen Casino Shocker
A Las Vegas teen surrendered this week in connection with the 2023 Scattered Spider attacks that disrupted casino networks and reportedly caused millions in damage, prompting fresh questions about how minors acquire the skills to hit high-value targets and how justice should respond. The arrest spotlights worrying cybersecurity gaps in the industry and the urgent need to channel youthful technical talent into lawful paths.
Ivanti EPMM Urgent: Must-Have Fixes for Risky Flaws
Urgent: CISA found attackers exploited Ivanti EPMM flaws to push multiple malware families — if your organization uses this MDM, patch immediately and rotate admin credentials. Lock down management access with MFA and monitor console activity now to prevent a potentially wide-scale breach.
phishing-as-a-service: Stunning Risky Surge
Phishing-as-a-service has exploded into a business — Netcraft found over 17,500 phishing domains spoofing 316 brands — turning credential theft into an off‑the‑shelf operation. Security teams and policymakers must act fast: harden authentication, automate detection, and disrupt the cross‑border plumbing that powers these disposable scams.
secret-stealing worm: Devastating npm threat Revealed
A fast‑spreading secret‑stealing worm nicknamed Shai‑Hulud is prowling npm, siphoning hundreds of credentials from developer machines and CI pipelines and turning routine installs into supply‑chain attacks. Act now: rotate exposed tokens, harden CI, and vet dependencies to stop further spread.
FileFix attacks: Urgent Risky Facebook Alert Scam
Beware: a fast-moving campaign called FileFix fakes Facebook security alerts to trick users into downloading tools that actually install the StealC infostealer and follow-on downloaders. Stay cautious—verify alerts inside the official app, never run executables from links, and enable phishing-resistant MFA.
malicious bundlejs: Stunning Devastating npm Alert
Over 40 npm packages were quietly republished with an injected bundle.js that steals credentials, turning trusted modules into stealthy supply‑chain lures. Lock down maintainer accounts, enable MFA and artifact signing, and scan for unexpected postinstall scripts to stop this kind of attack.
recovery codes: Risky Mistake Sparks Stunning Breach
A single plaintext file of MFA recovery codes on a desktop turned a security convenience into an org‑wide breach tied to the SonicWall attacks — a stark reminder that strong tech fails when basic procedures are ignored. Treat recovery codes like passwords: store them encrypted or offline, enforce controls, and stop letting convenience hand attackers the keys.
browser-based attacks: Critical Must-Have Defenses
We’ve hardened email — it’s time to treat browsers as the frontline: discover the six browser-based attacks every security team must prioritize now and the practical defenses to keep users, credentials, and networks safe.
Salesforce platforms: Must-Have Critical Security Guide
The FBI just flagged active campaigns targeting Salesforce platforms—if you rely on Salesforce for customer data, now’s the time to harden access, rotate tokens, and audit integrations. Take a few simple steps today to prevent data theft, detect suspicious exports, and reduce your risk before attackers strike.
phishing-as-a-service: Stunning Risky Threat
Think a thief who never touches the lock — VoidProxy is a phishing-as-a-service that intercepts live logins, relays MFA and session tokens in real time, and lets attackers quietly hijack Microsoft and Google accounts. Learn why layered defenses, hardware-backed keys, and session risk detection are now essential to stop these fast, stealthy takeovers.
fileless malware: Deadly Exclusive Stealth Threat
Imagine fighting a ghost that leaves no footprint — attackers are running AsyncRAT entirely in memory, hiding behind trusted Windows tools like PowerShell and rundll32. Luckily, better runtime visibility, behavioral EDR and stronger identity controls can help defenders spot and stop these stealthy, fileless intrusions.
ConnectWise ScreenConnect Risky Exploit: Stunning AsyncRAT
Imagine your trusted remote-admin tool becoming the very doorway attackers use to steal credentials and siphon crypto—researchers found ConnectWise ScreenConnect sessions abused to run a fleshless, in-memory VBScript loader that dropped AsyncRAT to harvest keys, keystrokes, and wallets. Harden RMM access, monitor session scripts, and assume compromise—because when legitimate tooling is weaponized, detection needs to get smarter fast.
modular macOS backdoor: Stunning Dangerous Threat Revealed
What if your Mac had been quietly harboring a stealthy backdoor for years? Researchers say ChillyHell—a modular macOS implant—evaded Apple’s protections for up to four years, showing how dormancy and clever design let attackers hide in plain sight.
Zero trust: Must-Have Best Practices for SLED Security
As ransomware and credential-stuffing rise, SLED IT leaders are combining AI-driven zero trust with gamified training to tighten defenses and turn staff and students into an active line of defense.
supply chain attack: Stunning Near-Miss, Risky Lessons
A fast, coordinated open‑source response helped avert what could have been a massive npm supply‑chain breach, but the near miss raises urgent questions for developers, maintainers and policymakers about dependency hygiene, registry controls and long‑term resilience.
Salt Typhoon: Exclusive, Dangerous Domain Network
Imagine attackers quietly living in your network for years — Salt Typhoon used dozens of rotating, innocent-looking domains since 2020 to stay hidden, steal intelligence, and frustrate takedowns. Defenders now need continuous monitoring, smarter DNS controls, and cross-sector cooperation to spot and evict these patient spies.
remote access Risky Threats: Must-Have Defenses
Attackers are increasingly using misconfigured or abused remote-access tools to stage ransomware, so treating RDP, VPNs and apps like TeamViewer as frontline security priorities—with MFA, patching, segmentation and monitoring—is no longer optional.
signed Windows kernel driver: Stunning Risky Backdoor
When a Microsoft‑signed WatchDog driver (amsdk.sys) was abused to neuter endpoint defenses and plant ValleyRAT, it proved that a valid signature isn’t a guarantee of safety. This Silver Fox campaign underscores why organizations must stop trusting signatures alone and add behavior‑based controls and tighter vetting for privileged drivers.
Cozy Bear Exposed: Risky OAuth Attack — Must-Have Alert
AWS says it disrupted a Cozy Bear (APT29) campaign that used fake websites and OAuth consent tricks to coax Microsoft users into granting access to mail, calendars and other data. The episode is a reminder that convenient features like single sign‑on can be repurposed for stealthy espionage — and why cloud providers are increasingly acting as front‑line defenders.