Tag: credential theft
220 articles
FileFix attacks: Urgent Risky Facebook Alert Scam
Beware: a fast-moving campaign called FileFix fakes Facebook security alerts to trick users into downloading tools that actually install the StealC infostealer and follow-on downloaders. Stay cautious—verify alerts inside the official app, never run executables from links, and enable phishing-resistant MFA.
malicious bundlejs: Stunning Devastating npm Alert
Over 40 npm packages were quietly republished with an injected bundle.js that steals credentials, turning trusted modules into stealthy supply‑chain lures. Lock down maintainer accounts, enable MFA and artifact signing, and scan for unexpected postinstall scripts to stop this kind of attack.
recovery codes: Risky Mistake Sparks Stunning Breach
A single plaintext file of MFA recovery codes on a desktop turned a security convenience into an org‑wide breach tied to the SonicWall attacks — a stark reminder that strong tech fails when basic procedures are ignored. Treat recovery codes like passwords: store them encrypted or offline, enforce controls, and stop letting convenience hand attackers the keys.
browser-based attacks: Critical Must-Have Defenses
We’ve hardened email — it’s time to treat browsers as the frontline: discover the six browser-based attacks every security team must prioritize now and the practical defenses to keep users, credentials, and networks safe.
Salesforce platforms: Must-Have Critical Security Guide
The FBI just flagged active campaigns targeting Salesforce platforms—if you rely on Salesforce for customer data, now’s the time to harden access, rotate tokens, and audit integrations. Take a few simple steps today to prevent data theft, detect suspicious exports, and reduce your risk before attackers strike.
phishing-as-a-service: Stunning Risky Threat
Think a thief who never touches the lock — VoidProxy is a phishing-as-a-service that intercepts live logins, relays MFA and session tokens in real time, and lets attackers quietly hijack Microsoft and Google accounts. Learn why layered defenses, hardware-backed keys, and session risk detection are now essential to stop these fast, stealthy takeovers.
fileless malware: Deadly Exclusive Stealth Threat
Imagine fighting a ghost that leaves no footprint — attackers are running AsyncRAT entirely in memory, hiding behind trusted Windows tools like PowerShell and rundll32. Luckily, better runtime visibility, behavioral EDR and stronger identity controls can help defenders spot and stop these stealthy, fileless intrusions.
ConnectWise ScreenConnect Risky Exploit: Stunning AsyncRAT
Imagine your trusted remote-admin tool becoming the very doorway attackers use to steal credentials and siphon crypto—researchers found ConnectWise ScreenConnect sessions abused to run a fleshless, in-memory VBScript loader that dropped AsyncRAT to harvest keys, keystrokes, and wallets. Harden RMM access, monitor session scripts, and assume compromise—because when legitimate tooling is weaponized, detection needs to get smarter fast.
modular macOS backdoor: Stunning Dangerous Threat Revealed
What if your Mac had been quietly harboring a stealthy backdoor for years? Researchers say ChillyHell—a modular macOS implant—evaded Apple’s protections for up to four years, showing how dormancy and clever design let attackers hide in plain sight.
Zero trust: Must-Have Best Practices for SLED Security
As ransomware and credential-stuffing rise, SLED IT leaders are combining AI-driven zero trust with gamified training to tighten defenses and turn staff and students into an active line of defense.
supply chain attack: Stunning Near-Miss, Risky Lessons
A fast, coordinated open‑source response helped avert what could have been a massive npm supply‑chain breach, but the near miss raises urgent questions for developers, maintainers and policymakers about dependency hygiene, registry controls and long‑term resilience.
Salt Typhoon: Exclusive, Dangerous Domain Network
Imagine attackers quietly living in your network for years — Salt Typhoon used dozens of rotating, innocent-looking domains since 2020 to stay hidden, steal intelligence, and frustrate takedowns. Defenders now need continuous monitoring, smarter DNS controls, and cross-sector cooperation to spot and evict these patient spies.
remote access Risky Threats: Must-Have Defenses
Attackers are increasingly using misconfigured or abused remote-access tools to stage ransomware, so treating RDP, VPNs and apps like TeamViewer as frontline security priorities—with MFA, patching, segmentation and monitoring—is no longer optional.
signed Windows kernel driver: Stunning Risky Backdoor
When a Microsoft‑signed WatchDog driver (amsdk.sys) was abused to neuter endpoint defenses and plant ValleyRAT, it proved that a valid signature isn’t a guarantee of safety. This Silver Fox campaign underscores why organizations must stop trusting signatures alone and add behavior‑based controls and tighter vetting for privileged drivers.
Cozy Bear Exposed: Risky OAuth Attack — Must-Have Alert
AWS says it disrupted a Cozy Bear (APT29) campaign that used fake websites and OAuth consent tricks to coax Microsoft users into granting access to mail, calendars and other data. The episode is a reminder that convenient features like single sign‑on can be repurposed for stealthy espionage — and why cloud providers are increasingly acting as front‑line defenders.
ShadowSilk campaign: Exclusive, Alarming Threat
A stealthy campaign called ShadowSilk is quietly probing Central Asian and Asia‑Pacific government networks—stealing credentials, planting webshells and exfiltrating sensitive data—exposing how under-resourced states can be pawns in wider geopolitical espionage. Strengthening basic cyber hygiene, regional cooperation and fast incident response can blunt its impact before the next covert breach reshapes diplomacy and public trust.
ShadowSilk Exclusive: Risky Cyber Heist Exposes 36 Govs
Group-IB says ShadowSilk quietly siphoned sensitive data from 36 government-linked targets across Central Asia and the Asia‑Pacific, proving stealthy, data-driven espionage can outflank regional defenses. Its modular tools and persistent backdoors underscore why governments must share intelligence, harden networks, and treat cybersecurity as an ongoing strategic priority.
credential-theft campaign: Exclusive Salesforce Risk
Google warns of a credential-theft campaign that abused a Salesloft integration to phish Salesforce logins — a wake-up call that third-party apps can be your weakest link. Audit connected apps, enforce MFA, and tighten permissions now before attackers pivot from integrations into your CRM.
phishing campaign: Critical RAT Threat Exposed
Researchers warn of a global phishing campaign that uses highly personalized emails and convincing fake sites to slip UpCrypter-wrapped downloads that install remote access trojans, giving attackers persistent control of machines. Stay cautious—verify unexpected requests, avoid untrusted downloads, enable MFA, and keep endpoint defenses tuned to block obfuscated threats.
malware-laden Android apps: Stunning Threats Reveal Risk
Got a scary “your phone is infected” pop-up despite downloading from Google Play? A new Zscaler report found over 19 million installs of malware-laden Android apps that slipped past scans via malicious SDKs, repackaging and delayed activation — a reminder to keep apps updated, check permissions, and stay a little skeptical even in official stores.
Aussie Telco Limited Stunning Data Leak: Risky Fallout
A stolen login at iiNet has put roughly 280,000 customers’ names, emails, phone numbers and addresses in the hands of attackers — the exact kind of info scammers use to launch convincing phishing and account-fraud attempts. If you’re affected, enable MFA, stay alert for suspicious messages, and follow any guidance from your provider.
CRM platform Risky Breach: Stunning Contact Exposure
Workday says its core systems were untouched, but a third-party CRM was breached — exposing business contacts that could fuel phishing, BEC and credential-stuffing attacks. Treat contact data as compromised: tighten MFA, audit integrations, and warn teams to watch for targeted social engineering.
Taiwanese web hosting Exclusive: Critical Espionage Risk
Imagine an invisible enemy living inside the servers that power your websites and email — Cisco Talos found a Chinese‑linked APT using a Taiwanese web host to intercept traffic, harvest credentials and stage persistent espionage. This supply‑chain breach is a wake‑up call: treat hosts as critical infrastructure and demand stronger controls, logging and incident guarantees now.
Taiwanese web host Critical: Exclusive Must-Have Fixes
A suspected Chinese state-backed crew quietly breached a Taiwanese web host, stealing credentials and planting backdoors to maintain months-long access — a stark reminder that compromising one trusted provider can expose dozens of downstream victims. Strengthening access controls, adopting zero-trust segmentation, and rotating credentials aren’t optional — they’re the best way to stop a single breach from becoming a widespread supply-chain disaster.