Tag: credentials
-
Scanner Poses as 32 AI Bots to Find Credentials and Private Keys
A scanner impersonates 32 AI bots, including OpenAI and Claude crawlers, to search websites for exposed credentials, private keys and cloud configuration files. First seen on hackread.com Jump to article: hackread.com/hackers-impersonate-ai-bots-hunt-exposed-credentials/
-
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/attacker-impersonates-ai-bots-scans-credentials
-
Sysob verstärkt sein Security-Portfolio mit Credential-Management-Software von Versasec
Der schwedische Hersteller Versasec bietet Unternehmen eine leistungsstarke Softwarelösung, die ein sicheres und effizientes Identitäts- und Zugriffsmanagement ermöglicht. Ab sofort sind die Produkte <> und <> für Reseller und IT-Dienstleister aus der DACH-Region bei Sysob erhältlich. Die Credential-Management-Software (CMS) von Versasec integriert gängige Authentifizierungsverfahren wie PKI, FIDO2 und RFID und ermöglicht es, physische und virtuelle…
-
Hackers Use Fake Phantom, Jupiter, and Bitget Firefox Extensions to Target Cryptocurrency Wallets
Three malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget to steal cryptocurrency wallet recovery phrases and private keys. The campaign combines deceptive branding, bundled credential stealers, and remotely delivered JavaScript, with stolen information routed through infrastructure under bonto[.]io. All three listings were removed before Socket published its findings on October 27, 2026. Phantom’s impersonator advertised…
-
FortiBleed 2.0 Exposes 40,573 FortiGate Secrets Across 975 Previously Unlisted Domains
Hudson Rock’s FortiBleed 2.0 investigation found 40,573 records with cleartext secrets in FortiGate configuration reports, exposing passwords and service credentials that could help attackers move beyond the firewall. Published on October 27, 2026, the research also identifies 975 domain labels missing from the earlier FortiBleed dataset. These labels do not represent 975 newly confirmed company…
-
Sony Data Breach Exposes 2.58 Million Customer Records and 54,401 Email Credentials
Tags: breach, communications, credentials, credit-card, cyber, data, data-breach, email, Internet, network, passwordSony Network Communications disclosed a data breach that exposed 2,585,481 customer records linked to its So-net and Plala (S Course) internet services. The breach, announced on October 27, 2026, compromised passwords for 54,401 email addresses. However, it did not affect primary membership passwords or credit card information. The compromised database contained 2,141,986 records from So-net…
-
Sony Data Breach Exposes 2.58 Million Customer Records and 54,401 Email Credentials
Tags: breach, communications, credentials, credit-card, cyber, data, data-breach, email, Internet, network, passwordSony Network Communications disclosed a data breach that exposed 2,585,481 customer records linked to its So-net and Plala (S Course) internet services. The breach, announced on October 27, 2026, compromised passwords for 54,401 email addresses. However, it did not affect primary membership passwords or credit card information. The compromised database contained 2,141,986 records from So-net…
-
Fake AI Attacks Target US Firms as Researchers Warn of Corporate Credential Theft
ANY.RUN analyzed 1,258 sandbox submissions showing how fake ChatGPT and Claude downloads and setup guides steal corporate credentials and browser session data. First seen on hackread.com Jump to article: hackread.com/fake-ai-attacks-target-us-firms-credential-theft/
-
American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed
Tags: access, attack, authentication, business, cloud, corporate, credentials, data-breach, phishing, serviceModern phishing campaigns can compromise American businesses without relying on traditional credential theft. Attackers can abuse legitimate cloud services, authentication mechanisms, and trusted business workflows to gain access to corporate accounts while leaving fewer obvious signs behind.ANY.RUN’s analysis of Skyw4lker, a device code phishing campaign primarily targeting U.S. organizations First seen on thehackernews.com Jump to…
-
INJ3CTOR3 Malware Steals FreePBX Credentials, Enabling Toll Fraud After Cleanup
The INJ3CTOR3 toll-fraud operation has given its FreePBX implant a dangerous new capability. Cyble Research & Intelligence Labs (CRIL) documented the JOMANGY PHP webshell in May. First seen on thecyberexpress.com Jump to article: thecyberexpress.com/inj3ctor3-jomangy-freepbx-credential-theft/
-
AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft
Tags: ai, attack, credentials, cyber, cybersecurity, data-breach, hacker, intelligence, theft, threat, toolThreat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts. The research follows Japan’s National Cybersecurity…
-
AI-Powered Hackers Target Japanese Companies With Automated Attacks and Credential Theft
Tags: ai, attack, credentials, cyber, cybersecurity, data-breach, hacker, intelligence, theft, threat, toolThreat actors targeting Japanese organizations are using artificial intelligence to automate intrusion workflows, speed up attack planning, and develop credential-theft tools, according to an investigation of three exposed attack infrastructures. The findings show distinct levels of AI involvement, from autonomous agents conducting attacks to experienced operators using generated scripts. The research follows Japan’s National Cybersecurity…
-
Malicious npm Campaign Hijacks 42 GitHub Repositories to Steal Credentials and Spread Malware
Research has identified 42 weaponized GitHub repositories belonging to 11 legitimate owners in the testmetest npm campaign, exposing an operation that combines credential theft, development-tool execution hooks, and malicious package publishing. The findings establish that the campaign extended beyond attacker-controlled test packages into established developers’ repositories. Researchers Guy Korolevski and Yair Benamou uncovered oversized payload…
-
Tailscale warns of SSH flaws allowing root privilege escalation
The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/tailscale-warns-of-serious-ssh-flaws-allowing-root-privilege-escalation/
-
DreamHost Security Incident Forces Password Resets for Email and FTP/SFTP Accounts
DreamHost has implemented forced password resets for certain email and FTP/SFTP accounts following an incident that affected its File Manager and webmail services. The company restored its browser-based File Manager on October 26, 2026. However, users affected by the incident must obtain new login credentials from their account owners before they can access their accounts.…
-
DreamHost Security Incident Forces Password Resets for Email and FTP/SFTP Accounts
DreamHost has implemented forced password resets for certain email and FTP/SFTP accounts following an incident that affected its File Manager and webmail services. The company restored its browser-based File Manager on October 26, 2026. However, users affected by the incident must obtain new login credentials from their account owners before they can access their accounts.…
-
Hackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks
Tags: access, ai, attack, authentication, backup, china, cloud, credentials, cyber, data, framework, hacker, microsoft, open-source, threatHackers abused compromised ConnectWise Cloud Backup application credentials to access Microsoft 365 environments, escalate privileges, and plant persistent credentials. Microsoft attributed the campaign to Storm-0940, a China-state-aligned threat actor using ARTEX, an open-source agentic AI framework, to accelerate downstream attacks against more than 2,250 tenants. Successful authentication, however, does not establish data theft. Huntress initially…
-
Exposed LiteLLM Key Enabled PyPI Supply Chain Attack
Unrevoked Credential Exposed in May Enabled Repository Compromise in October. An attacker exploited an unrevoked LiteLLM master key to steal GitHub credentials, bypass release controls and publish a credential-stealing PyPI package downloaded roughly 50,000 times, exposing developer systems, cloud environments and AI provider secrets. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/exposed-litellm-key-enabled-pypi-supply-chain-attack-a-33211
-
‘Gheist’ Weaponizes GitHub Tokens to Steal Cloud Secrets
An ongoing supply chain attack is harvesting credentials and sensitive data from thousands of developer repositories. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/gheist-stolen-github-tokens-cloud-secrets
-
Securing AI Coding Harnesses
Why AI Agents With Shell Access Need Sandboxes, Managed Policy and Human Oversight AI coding harnesses can read files, run shell commands, install software and push code with the authority of whoever launched them. Security teams need enforced sandboxes, managed permissions, short-lived credentials and auditable records before the tools spread across the enterprise. First seen…
-
Researchers Uncover Rentable Android Spyware uCreater Targeting WeChat and Telegram
uCreater is Android spyware disguised as trusted apps, stealing credentials, messages and wallet data through a rentable platform. uCreater is a rentable Android spyware platform that hides inside repackaged legitimate apps, targeting messaging services and mobile wallets. Its YingGai framework can intercept one-time passwords, steal account and chat data, collect contacts, manipulate sessions and spoof…
-
New Malware Targets AI Coding Tools to Steal Login Tokens, SSH Keys, and Cloud Credentials
A newly observed infostealer called Aokigahara is targeting AI coding assistants, developer workstations, and cloud credentials, expanding credential theft beyond browsers and cryptocurrency wallets. The targets include Claude Code and Desktop, ChatGPT Desktop, Codex, Cursor, Windsurf, GitHub Copilot, Gemini CLI, and JetBrains AI Assistant. Rather than exploiting an identified vulnerability in these products, the malware…
-
Hackers Turn Mac Password Stealer Into RAT That Survives Reboots and Executes Remote Commands
The Icarus macOS stealer, marketed as ICMacOS, has moved beyond smash-and-grab theft. Its latest version installs persistence, keeps a live channel open to its operators, and executes commands sent from a remote server. SOCRadar identified ICMacOS in September 2026 and found two variants. Version 1 focuses on core theft, targeting browser credentials, password manager databases,…
-
StealC Malware Returns as Stadia RAT After Operation Endgame Takedown
StealC’s seller has returned with Stadia RAT, combining credential theft, hidden desktop control, and remote command execution using… First seen on hackread.com Jump to article: hackread.com/stealc-malware-stadia-rat-operation-endgame-takedown/
-
11 Backup Recovery Solutions: The 2026 Buyer’s Verdict Guide
Ransomware rewrote backup’s job description attackers delete recovery points before encrypting production so 2026’s buying criteria are security properties: immutability stolen credentials can’t untick, isolation from your blast radius, and restores proven by stopwatch rather than dashboard. One roster note: our sheet listed Cohesity and Veritas separately, but their completed merger makes them one vendor…
-
Forgotten AI agents may still access sensitive company data
AI agents that have not run recently retain credentials and connections to company systems, according to Arrakis Security’s 2026 Autonomous Agents Threat Report. About 76% of … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/26/arrakis-dormant-ai-agent-risks-report/
-
Tailscale SSH Vulnerabilities Allow Attackers to Gain Root Access to Connected Servers
Security researchers have revealed multiple high-severity vulnerabilities in Tailscale and Headscale that could let attackers gain root access to connected servers, bypass network security policies, steal credentials, and disrupt remote-access infrastructure. Erica Windisch of Cyberdione Labs published these findings in a security research report titled Tailworm. The assessment examined Tailscale version 1.104.2 and headscale version…
-
Hackers Breached LiteLLM GitHub Repository 11 Days Before Supply Chain Attack
Hackers accessed LiteLLM’s GitHub organization and executed credential-stealing workflows eleven days before the October 21 supply chain attack that distributed malicious litellm==1.107.0 packages. The findings establish a longer compromise window preceding the poisoned releases. Socket recovered malicious workflows executed inside BerriAI/litellm on October 10 and October 12, 2026. Both used the maintenance-style commit message ci:…