Tag: credentials
-
Chinese hackers use Quad7 botnet to steal credentials
First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/microsoft-chinese-hackers-use-quad7-botnet-to-steal-credentials/
-
Quad7 botnet-compromised credentials tapped by various Chinese hackers
First seen on scworld.com Jump to article: www.scworld.com/brief/quad7-botnet-compromised-credentials-tapped-by-various-chinese-hackers
-
Massive cloud credential theft conducted via exposed Git configuration breach
First seen on scworld.com Jump to article: www.scworld.com/brief/massive-cloud-credential-theft-conducted-via-exposed-git-configuration-breach
-
EmeraldWhale steals 15,000 credentials from exposed Git configurations
First seen on scworld.com Jump to article: www.scworld.com/news/emeraldwhale-steals-15000-credentials-from-exposed-git-configurations
-
Honeypot Surprise: Researchers Catch Attackers Exposing 15,000 Stolen Credentials in S3 Bucket
Sysdig researchers trace a bizarre S3 bucket misconfiguration to EmeraldWhale, exposing 1.5 terabytes of stolen credentials and script. The post Honey… First seen on securityweek.com Jump to article: www.securityweek.com/honeypot-surprise-researchers-catch-attackers-exposing-15000-stolen-credentials-in-s3-bucket/
-
Hackers find 15,000 credentials by scanning for git configuration
First seen on cyberscoop.com Jump to article: cyberscoop.com/sysdig-git-credentials-cloud-service-emeraldwhale/
-
SMB Force-Authentication Vulnerability Impacts All OPA Versions For Windows
Open Policy Agent (OPA) recently patched a critical vulnerability that could have exposed NTLM credentials of the OPA server’s local user account to r… First seen on gbhackers.com Jump to article: gbhackers.com/smb-auth-vulnerability-opa-windows/
-
Hackers steal 15,000 cloud credentials from exposed Git config files
A global large-scale dubbed EmeraldWhale exploited misconfigured Git configuration files to steal over 15,000 cloud account credentials from thousands… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-steal-15-000-cloud-credentials-from-exposed-git-config-files/
-
New Windows Themes zero-day gets free, unofficial patches
Free unofficial patches are now available for a new Windows Themes zero-day vulnerability that allows attackers to steal a target’s NTLM credentials r… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-windows-themes-zero-day-gets-free-unofficial-patches/
-
Mobile Apps With Millions of Downloads Expose Cloud Credentials
Popular titles on both Google Play and Apple’s App Store include hardcoded and unencrypted AWS and Azure credentials in their codebases or binaries, m… First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/mobile-apps-millions-downloads-expose-cloud-credentials
-
Hackers Exploit Roundcube Webmail XSS Vulnerability to Steal Login Credentials
Unknown threat actors have been observed attempting to exploit a now-patched security flaw in the open-source Roundcube webmail software as part of a … First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/hackers-exploit-roundcube-webmail-xss.html
-
Patching problems: The >>return<< of a Windows Themes spoofing vulnerability
Despite two patching attempts, a security issue that may allow attackers to compromise Windows user’s NTLM (authentication) credentials via a maliciou… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/10/29/windows-themes-spoofing-vulnerability/
-
New tool bypasses Google Chrome’s new cookie encryption system
A researcher has released a tool to bypass Google’s new App-Bound encryption cookie-theft defenses and extract saved credentials from the Chrome web b… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/new-tool-bypasses-google-chromes-new-cookie-encryption-system/
-
Swarms of Fake WordPress Plug-ins Infect Sites With Infostealers
GoDaddy flagged a ClickFix campaign that infected 6,000 sites in a one-day period, with attackers using stolen admin credentials to distribute malware… First seen on darkreading.com Jump to article: www.darkreading.com/endpoint-security/swarms-fake-wordpress-plug-ins-infect-sites-infostealers
-
Fortinet zero-day attack spree hits at least 50 customers
Active exploits of a critical vulnerability in FortiManager began in late June, Mandiant said. Firewall credentials and configuration data have been s… First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fortinet-zero-day-attack-spree/730894/
-
Unmanaged Cloud Credentials Pose Risk to Half of Orgs
These types of long-lived credentials pose a risk for users across all major cloud service providers, and must meet their very timely ends, researcher… First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/unmanaged-cloud-credentials-risk-half-orgs
-
Hardcoded Creds in Popular Apps Put Millions of Android and iOS Users at Risk
Recent analysis has revealed a concerning trend in mobile app security: Many popular apps store hardcoded and unencrypted cloud service credentials di… First seen on gbhackers.com Jump to article: gbhackers.com/hardcoded-creds-risk-android-ios-apps/
-
Detective Charged With Purchasing Stolen Credentials
First seen on packetstormsecurity.com Jump to article: packetstormsecurity.com/news/view/36502/Detective-Charged-With-Purchasing-Stolen-Credentials.html
-
Protecting Public Sector Organizations from the Threat of Compromised Credentials
First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/10/protecting-public-sector-organizations-from-the-threat-of-compromised-credentials/
-
FIDO Alliance Drafts New Protocol to Simplify Passkey Transfers Across Different Platforms
The FIDO Alliance said it’s working to make passkeys and other credentials more easier to export across different providers and improve credential pro… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/fido-alliance-drafts-new-protocol-to.html
-
Hardcoded cloud credential exposure prevalent in Android, iOS apps
First seen on scworld.com Jump to article: www.scworld.com/brief/hardcoded-cloud-credential-exposure-prevalent-in-android-ios-apps
-
Russia’s APT29 Mimics AWS to Steal Windows Credentials
First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/russias-apt29-aws-windows-credentials
-
Roundcube XSS flaw exploited to steal credentials, email (CVE-2024-37383)
Attackers have exploited an XSS vulnerability (CVE-2024-37383) in the Roundcube Webmail client to target a governmental organization of a CIS country,… First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2024/10/22/cve-2024-37383-exploited/
-
SailPoint announces new identity security credential to address global talent shortage
First seen on scworld.com Jump to article: www.scworld.com/news/sailpoint-announces-new-identity-security-credential-to-address-global-talent-shortage-at-navigate-2024
-
Critical OPA Vulnerability Exposes Windows Credentials
Attackers Could Exploit Flaw to Relay Credentials, Compromise Systems. A critical vulnerability in Open Policy Agent could expose NTLM credentials fro… First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/critical-opa-vulnerability-exposes-windows-credentials-a-26590
-
Roundcube credentials targeted via patched XSS vulnerability
First seen on scworld.com Jump to article: www.scworld.com/brief/roundcube-credentials-targeted-via-patched-xss-vulnerability
-
Hackers exploit Roundcube webmail flaw to steal email, credentials
Threat actors have been exploiting a vulnerability in the Roundcube Webmail client to target government organizations in the Commonwealth of Independe… First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-exploit-roundcube-webmail-flaw-to-steal-email-credentials/
-
Half of Organizations Have Unmanaged Long-Lived Cloud Credentials
First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/orgs-long-lived-cloud-credentials/
-
US Police Detective Charged With Purchasing Stolen Credentials
Terrance Michael Ciszek is charged with buying stolen account credentials from the Genesis Market dark web marketplace. The post US Police Detective C… First seen on securityweek.com Jump to article: www.securityweek.com/us-police-detective-charged-with-purchasing-stolen-credentials/
-
Unknown threat actors exploit Roundcube Webmail flaw in phishing campaign
Hackers exploited a now-patched Roundcube flaw in a phishing attack to steal user credentials from the open-source webmail software. Researchers from … First seen on securityaffairs.com Jump to article: securityaffairs.com/170055/hacking/roundcube-flaw-exploited-in-phishing-attack.html