Tag: credential theft
220 articles
Singapore Officials Impersonated in Stunning, Damaging Scam
Think twice before trusting top search results: criminals are buying Google ads to surface near‑perfect clones of Singapore government sites and using AI-generated deepfakes of real officials to trick investors into wiring funds or handing over credentials.
Iran-Linked MuddyWater Exclusive: Damaging 100+ Targets
Imagine one hijacked mailbox becoming the battering ram: Iran‑linked MuddyWater used a trusted account, attacker‑controlled VPNs and the Phoenix backdoor to quietly worm into 100+ MENA government networks and siphon sensitive policy and personnel intelligence over months.
BeaverTail and OtterCookie: Stunning Critical Threat
Cisco Talos warns a North Korean group is fusing BeaverTail’s credential-theft with OtterCookie’s browser persistence into single, stealthier JavaScript malware that’s harder to spot — defenders should start hunting for blended behaviors and tighten basics like MFA, patching, and anomaly detection now.
Scattered Spider Shocking $115M Ransom Scandal
How did a 19‑year‑old become the alleged face of a criminal group accused of extracting $115 million in ransoms? U.S. prosecutors say Thalha Jubair and a co‑conspirator tied to Scattered Spider used social engineering and stolen credentials to hit hospitals, transit and retailers—proof that stronger defenses and international cooperation are now essential.
self-replicating worm: Shocking, Devastating NPM Breach
Imagine your everyday npm install quietly stealing your keys — researchers traced a self‑replicating worm to at least 187 NPM packages that exfiltrates developer credentials to GitHub each time an infected package is installed. This outbreak shows how fragile the software supply chain is and why immediate credential rotation, strict dependency hygiene, and better package vetting are essential.
NoRobot malware: Exclusive Dangerous Threat
When LostKeys was exposed this spring, Coldriver didn’t fold — they reinvented, rolling out a lean, modular strain called NoRobot that sneaks past signatures, steals credentials, and blends into normal traffic. Defenders now need behavior-based detection, stronger identity controls like MFA, and faster threat-sharing to keep up with this smarter, stealthier pivot.
Whisper 2FA: Exclusive Risky Phishing Threat
Think 2FA is foolproof? Researchers warn Whisper 2FA — a phishing‑as‑a‑service tool tied to roughly one million credential‑theft attempts since July 2025 — shows attackers can cheaply scale real‑time relay attacks, so phishing‑resistant authentication and layered defenses are now essential.
legacy Windows authentication: Must-Fix Risky Threat
Think your network’s locked? Resecurity warns that old Windows protocols like LM, NTLM and SMBv1 can hand attackers credential hashes — inventory, isolate, and migrate now before those easy paths are abused.
MonsterV2 malware: Dangerous Stunning Threat
Researchers uncovered TA585’s sophisticated campaign delivering a new MonsterV2 variant, using modular malware, resilient infrastructure and advanced obfuscation that can bypass signature-based defenses. Organizations should adopt layered detection, tighten email gateways and share intelligence now to stay ahead of these increasingly professionalized criminal operators.
Scattered Lapsus$ Hunters: Exclusive Risky Hiatus
After the FBI seized their site, teenage collective Scattered Lapsus$ Hunters vowed to go dark until 2026 — a defiant restart in a familiar retire-regroup-return cycle. Whether they stick to it or not, defenders should treat the pause as a chance to patch vulnerabilities, rotate credentials and strengthen defenses.
Payroll Pirate Crew: Exclusive Risky Threat to Campuses
Microsoft warns a cybercriminal group dubbed the Payroll Pirate Crew is targeting U.S. universities with phishing attacks that hijack HR systems to quietly reroute paychecks, leaving staff suddenly unpaid and campuses scrambling. Universities should tighten MFA, limit admin privileges, and require out‑of‑band verification for bank‑detail changes to protect employees and reputations.
malicious npm packages: Stunning Critical Threat Revealed
Researchers uncovered Beamglea — 175 malicious npm packages downloaded about 26,000 times — that quietly hosted credential‑harvesting phishing campaigns against 135+ organizations, a stark reminder that the convenience of open-source packages can become a gateway for large‑scale theft.
WordPress themes and plugins: Risky Must-Have Fix
A routine verification prompt can hide a dangerous trap: attackers are hijacking WordPress themes and plugins to inject stealthy JavaScript that redirects visitors to convincing phishing pages. Keep themes and plugins updated, use strong admin controls and a WAF, and vet all extensions to stop these silent, high-impact compromises before they spread.
WooperStealer and Anondoor: Exclusive Dangerous Threat
A new wave of phishing attacks tied to the Confucius actor is using WooperStealer and Anondoor to harvest credentials and establish long-term access in Pakistani networks, putting government, military, and critical infrastructure at risk. Simple steps like enforcing MFA, patching systems, and running realistic phishing training can sharply reduce exposure—now’s the time to harden defenses.
Milesight routers: Exclusive Dangerous Smishing Threat
Imagine your factory router moonlighting as a scammer — attackers have been hijacking Milesight industrial cellular routers to send believable phishing SMS from legitimate device numbers. Change default passwords, patch firmware, and disable unused SMS APIs before your edge devices start ringing alarm bells.
SonicWall SSL VPN Urgent Alert: Critical MFA Bypass Risk
Akira ransomware actors are rapidly exploiting SonicWall SSL VPN flaws to bypass MFA and spread payloads—proving MFA isn’t a silver bullet and that urgent patching, tighter segmentation, and better monitoring are essential to stop these fast-moving attacks.
QR-code steganography: Exclusive Dangerous Threat
A malicious npm package called Fezbox has been hiding stolen browser credentials inside seemingly innocuous QR images, turning routine builds into quiet data leaks. Treat every dependency with suspicion—pin versions, scan for suspicious runtime behavior, and rotate tokens—to defend against clever supply‑chain tricks like this.
ransomware attack: Stunning NCA Arrest Offers Hope
A multinational ransomware attack left airports scrambled and travellers stranded — now Britain’s National Crime Agency has arrested a suspect, a move that could unlock crucial evidence and help prevent future disruptions.
Pandoc CVE-2025-51591 Critical: Must-Patch Risk
A newly spotted SSRF flaw in Pandoc (CVE-2025-51591) is being abused to trick EC2 instances into handing over AWS IMDS tokens and temporary credentials, letting attackers steal keys and pivot across cloud accounts. If you run Pandoc in build pipelines or servers, inventory instances, patch or block metadata access, and enable IMDSv2 now to stop casual credential theft.
lateral movement: Stunning 18-Minute Risky Surge
Attackers now break out in a median of just 18 minutes, not hours, so organizations must embrace zero-trust, strong identity controls, segmentation and automated detection to stop breaches before they can spread.
Scattered Spider Exclusive: Risky Teen Casino Shocker
A Las Vegas teen surrendered this week in connection with the 2023 Scattered Spider attacks that disrupted casino networks and reportedly caused millions in damage, prompting fresh questions about how minors acquire the skills to hit high-value targets and how justice should respond. The arrest spotlights worrying cybersecurity gaps in the industry and the urgent need to channel youthful technical talent into lawful paths.
Ivanti EPMM Urgent: Must-Have Fixes for Risky Flaws
Urgent: CISA found attackers exploited Ivanti EPMM flaws to push multiple malware families — if your organization uses this MDM, patch immediately and rotate admin credentials. Lock down management access with MFA and monitor console activity now to prevent a potentially wide-scale breach.
phishing-as-a-service: Stunning Risky Surge
Phishing-as-a-service has exploded into a business — Netcraft found over 17,500 phishing domains spoofing 316 brands — turning credential theft into an off‑the‑shelf operation. Security teams and policymakers must act fast: harden authentication, automate detection, and disrupt the cross‑border plumbing that powers these disposable scams.
secret-stealing worm: Devastating npm threat Revealed
A fast‑spreading secret‑stealing worm nicknamed Shai‑Hulud is prowling npm, siphoning hundreds of credentials from developer machines and CI pipelines and turning routine installs into supply‑chain attacks. Act now: rotate exposed tokens, harden CI, and vet dependencies to stop further spread.