Tag: credentials
-
CISA Warns of Active Exploitation Following FortiBleed Leak
FortiBleed exposed credentials for 74,000 Fortinet devices, with attackers actively exploiting the leak to target systems worldwide. On June 18, CISA issued an emergency alert after reports surfaced that credentials for approximately 74,000 Fortinet firewalls and VPN gateways had been leaked in what researchers are calling FortiBleed. The agency confirmed that threat actors were actively…
-
24 Billion Stolen Credentials Exposed in Massive Data Leak
24 Billion Records Left Open Online: Passwords, Emails, and Everything Else Exposed database with 24 Billion records revealed stolen credentials from infostealers, Telegram channels, and breach collections, risking account takeovers. Cybernews researchers found an exposed Elasticsearch cluster on June 12th containing 24 billion records and more than 8.3 terabytes of data. They triple-checked the numbers.…
-
Klue Confirms OAuth Token Theft Led to Salesforce Data Heist
‘Compromised Legacy Credential’ Wielded by Extortion Group Calling Itself Icarus. Marketing intelligence platform Klue confirmed an attacker breached its infrastructure, saying they used a compromised legacy credential to obtain OAuth access tokens for integrated services and stole data directly from Klue customers’ Salesforce and Gong instances. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/klue-confirms-oauth-token-theft-led-to-salesforce-data-heist-a-32024
-
24B Records Exposed in Massive Leak of Emails, Passwords, and Login Data
Cybernews researchers found an exposed database with 24 billion credential records, raising fresh risks from password reuse and credential stuffing. The post 24B Records Exposed in Massive Leak of Emails, Passwords, and Login Data appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-24-billion-credential-records-exposed-database/
-
CISA warns Fortinet users to secure devices after FortiBleed leak
Tags: cisa, credentials, cybersecurity, data, data-breach, firewall, fortinet, infrastructure, leak, vpnThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged Fortinet customers to secure their devices after nearly 74,000 firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed.” First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/
-
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers have detailed an exploit chain, named AutoJack, that turns an AI browsing agent into a delivery vehicle for remote code execution.Steer the agent to load an attacker’s web page, and that page’s JavaScript can reach a privileged local service on the same machine and spawn a process on the host.No credentials, no sign-in…
-
Microsoft warnt Kunden vor gestohlenen GitHub Miasma-Wurm befällt 73 Microsoft-Repositories und stiehlt KI-Logindaten
First seen on security-insider.de Jump to article: www.security-insider.de/miasma-wurm-microsoft-github-repositories-ki-zugangsdaten-a-c09832938b8e85e4c3326613248fc3b8/
-
Crime Gang Sells Access to 74,000 Fortinet Firewall Devices
Ongoing Campaign May Be Grabbing Legacy Passwords From Fortinet FortiGate Devices. Cybercriminals are selling access to 75,000 Fortinet FortiGate devices with VPN and web management interfaces, and the admin credentials appear to be legitimate and recently harvested as part of a still-live campaign, security experts warned. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/crime-gang-sells-access-to-74000-fortinet-firewall-devices-a-32015
-
Cisco fixed a critical ISE vulnerability that lets attackers to gain root access
Cisco addressed CVE-2026-20181, a critical ISE vulnerability that lets authenticated admins execute commands and gain root access. Cisco addressed a critical command execution vulnerability, tracked as CVE-2026-20181 (CVSS score of 9.1), affecting Identity Services Engine (ISE) and ISE-PIC. The flaw stems from improper validation of user-supplied input, allowing an authenticated attacker with administrative credentials to…
-
Massive database with 24 billion credentials found exposed online
First seen on scworld.com Jump to article: www.scworld.com/brief/massive-database-with-24-billion-credentials-found-exposed-online
-
FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls
FortiBleed: Admin Passwords for 75,000 Fortinet Firewalls Are Out in the Wild. Half the Internet-Facing Fortinets on the Planet. Security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted…
-
74,000 Fortinet firewall credentials exposed in FortiBleed data leak
Tags: breach, credentials, cybercrime, data, data-breach, firewall, fortinet, group, leak, russia, vpnA Russian-speaking cybercriminal group has stolen credentials contained in the configuration files of nearly 74,000 Fortinet firewalls and VPN gateways around the world. The … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/18/fortinet-fortibleed-data-leak/
-
How security teams are getting credential visibility into developer endpoints
As we noted in our earlier analysis, attackers already know secrets are on your developers’ machines, the only question is whether security teams do. The supply chain … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/18/gitguardian-developer-endpoint-protection/
-
Modified OpenSSH Binaries Let Velvet Ant Steal Passwords, Log Commands, and Hide Activity
A long-running, stealthy campaign attributed to the China-nexus actor tracked as Velvet Ant has been found to include deeply engineered backdoors in the authentication stack: modified OpenSSH binaries and tampered PAM modules that exfiltrate credentials, record every executed command, and conceal attacker activity. The discovery, part of Sygnia’s Operation Highland investigation, reveals nearly a decade…
-
Massive breach spills credentials for thousands of sensitive networks
The affected include Oracle, Lenovo, FedEx, a NATO contractor, and Fortinet. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/06/massive-breach-spills-credentials-for-thousands-of-sensitive-networks/
-
FortiBleed Attack Exposes Fortinet Firewall Credentials in 194 Countries
Researchers say FortiBleed used stolen and tested credentials to access exposed Fortinet firewalls, putting major organizations and public agencies at risk now. First seen on hackread.com Jump to article: hackread.com/fortibleed-attack-fortinet-firewalls-credentials/
-
Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices
Attackers are actively targeting various sectors across nearly 200 countries and already have compiled a list of working credentials for tens of thousands of compromised devices. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices
-
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices.
A newly discovered data leak dubbed “FortiBleed” has exposed what appears to be a collection of Fortinet and FortiGate VPN credentials for 73,932 firewall URLs at organizations worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fortibleed-leak-exposes-fortinet-vpn-credentials-for-73-000-devices/
-
Serverless Phishing Kit on GitHub Targets Mexican Banks
GitBait phishing kit abuses GitHub Pages and the SheetBest API to steal Mexican banking credentials First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/gitbait-github-pages-sheetbest/
-
Modular Phishing Kit Uses GitHub Pages to Steal Payment Card Details and Passwords
A sophisticated, long-running phishing operation has evolved into a serverless, modular campaign that weaponizes GitHub Pages to harvest payment card data, credentials, and customer identifiers from banking customers in Mexico. The campaign’s architecture centers on a phishing kit containing a selector panel that operators use to generate institution-specific landing pages. Those landing pages impersonate at…
-
Sweeping Credential-Harvesting Heist Compromises +30K Fortinet Devices
Attackers actively are targeting various sectors across nearly 200 countries and have already compiled a list of working credentials for tens of thousands of compromised devices First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices
-
New Rokarolla Android Trojan Targets 217 Banking and Crypto Apps
Rokarolla Android malware targets 217 banking and crypto apps, steals credentials, blocks bank calls, intercepts SMS, and disables Play Protect. Zimperium’s zLabs researchers have published a detailed analysis of Rokarolla, a new Android banking trojan named after its command-and-control infrastructure. It spreads through malicious websites masquerading as TikTok and Chrome, one confirmed distribution point being…
-
The Top 10 Attack Surface Exposures in 2026
Breaches don’t always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop, like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication, anything internet-facing is immediately at risk.With time-to-exploit now down to…
-
The Top 10 Attack Surface Exposures in 2026
Breaches don’t always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop, like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication, anything internet-facing is immediately at risk.With time-to-exploit now down to…
-
JetBrains Plugin Security Alert: 70,000+ Installs Linked to AI Key Theft
A coordinated supply chain attack targeting JetBrains IDE users has exposed over 70,000 developers to silent credential theft. The campaign involves at least 15 malicious plugins distributed via the JetBrains Marketplace, masquerading as AI-powered coding assistants built on models such as DeepSeek. While these plugins function as advertised, offering features like code review, chat, and…
-
AI agents are turning credential sprawl into an MSSP problem
First seen on scworld.com Jump to article: www.scworld.com/news/ai-agents-are-turning-credential-sprawl-into-an-mssp-problem
-
Rokarolla Android Banking Trojan Enables Device Takeover
Malware Targets Banks, Crypto Platforms and Social Media. Newly surfaced Android-based banking Trojan gives threat actors near-total control over infected devices, letting them steal user credentials for direct access to financial accounts, says researchers. Rokarolla tricks users into side-loading malicious versions of popular, high traffic apps. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/rokarolla-android-banking-trojan-enables-device-takeover-a-31996
-
Fileless Phantom Stealer Targets Browser Credentials
In addition to executing entirely in memory, the malware’s infection chain incorporates other anti-analysis techniques designed to frustrate detection. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/fileless-phantom-stealer-targets-browser-credentials
-
Chinese Espionage Actor Abuses Email Rules to Steal Research Data
Tags: china, compliance, credentials, data, email, espionage, google, group, intelligence, malware, threatThreat Actor Silently Forwarded Sensitive Emails Matching Strategic Topics. Google says Chinese espionage group UNC6508 compromised REDCap environments at North American research institutions, deployed custom malware, stole credentials and covertly forwarded strategically relevant emails through abused compliance rules to support long-term intelligence collection. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-espionage-actor-abuses-email-rules-to-steal-research-data-a-31993