Tag: credentials

New Arkanix stealer blends rapid Python harvesting with stealthier C++ payloads

Feb 23, 2026 2:00 PM

Tags: credentials, data, detection, exploit, theft, vpn

The stealer employs a broad data-theft toolkit: The researchers noted that the Python implementation acts as a wide-net data harvester. It collects system information, extracts browser-stored data, and pulls details from communication platforms, including Telegram and Discord. Additional modules target VPN configurations, retrieve selected files from the host, and can deliver other payloads, suggesting the…
Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

Feb 23, 2026 1:01 PM

Tags: advisory, apt, backup, china, control, credentials, cve, exploit, flaw, government, group, ivanti, mobile, network, password, service, software, threat, update, vpn, vulnerability, zero-day

Patch, but verify first: Unit 42 directed organizations to Ivanti’s security advisory for remediation guidance, which recommends applying version-specific RPM patches for EPMM 12.x branches that require no appliance downtime. Ivanti cautioned, however, that the patch does not survive a version upgrade and must be reinstalled if the software is updated. “The permanent fix for…
Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

Feb 23, 2026 1:01 PM

Tags: authentication, credentials, cyber, framework, login, mfa, phishing, theft, update

New phishing framework Starkiller is enabling more convincing, scalable credential theft by proxying real login pages and bypassing multi-factor authentication (MFA), significantly raising the bar for defenders. Traditional phishing kits typically serve static HTML clones of popular login portals, which quickly become outdated when brands update their interfaces, creating telltale visual discrepancies. Starkiller takes a…
Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Feb 23, 2026 1:01 PM

Tags: api, attack, credentials, crypto, cybersecurity, malicious, supply-chain, worm

Cybersecurity researchers have disclosed what they say is an active “Shai-Hulud-like” supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code…
Police seize 100,000 stolen Facebook credentials in cybercrime raid

Feb 23, 2026 12:01 PM

Tags: breach, credentials, cybercrime, group, organized, phishing

Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/23/poland-cybercrime-facebook-phishing-ring/
Anthropic Didn’t Kill Cybersecurity. It Just Reminded Us There Are Two Doors.

Feb 23, 2026 11:02 AM

Tags: ai, breach, credentials, identity, saas

Anthropic’s Claude Code Security sparked a sharp SaaS market selloff, but investors missed a critical reality: AI code scanning addresses only half of modern cyberattacks. Identity, credentials, and human factors remain the dominant breach vectors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/anthropic-didnt-kill-cybersecurity-it-just-reminded-us-there-are-two-doors/
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
North Korean Hackers Exploit Fake IT Worker Schemes and Malicious Interview Lures

Feb 23, 2026 9:01 AM

Tags: credentials, cyber, exploit, hacker, jobs, malicious, malware, north-korea, software, threat

North Korean state-backed hackers are running large-scale fake IT worker and “Contagious Interview” campaigns that abuse developer hiring workflows to deliver JavaScript-based malware, steal code and credentials, and covertly generate revenue for the regime. Since at least 2022, North Korean threat actors have impersonated recruiters and hiring managers, luring software developers into executing booby-trapped code…
EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security

Feb 21, 2026 11:02 AM

Tags: ai, ciso, credentials, cybersecurity, hacker, risk

With $5.5 trillion in global AI risk exposure and 700,000 U.S. workers needing reskilling, four new AI certifications and Certified CISO v4 help close the gap between AI adoption and workforce readiness.EC-Council, creator of the world-renowned Certified Ethical Hacker (CEH) credential and a global leader in applied cybersecurity education, today launched its Enterprise AI Credential…
Dynamic Objects in Active Directory: The Stealthy Threat

Feb 20, 2026 6:01 PM

Tags: access, attack, blueteam, breach, cloud, computer, container, control, credentials, cve, data, defense, detection, dns, endpoint, group, identity, malicious, microsoft, monitoring, password, powershell, risk, soc, strategy, threat, tool, update, vulnerability

Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
CISA gives federal agencies three days to patch actively exploited Dell bug

Feb 20, 2026 2:01 PM

Tags: cisa, credentials, espionage, exploit, flaw, update

Hardcoded credential flaw in RecoverPoint already abused in espionage campaign First seen on theregister.com Jump to article: www.theregister.com/2026/02/20/cisa_dell_vulnerability/
CharlieKirk Grabber Malware Targets Windows Systems to Steal Login Credentials

Feb 20, 2026 2:01 PM

Tags: control, credentials, cyber, data, login, malware, password, theft, windows

CharlieKirk Grabber is a Python-based Windows infostealer that focuses on rapid “smash”‘and”‘grab” credential theft and data exfiltration rather than long-term system control or destructive behavior. It targets browser”‘stored passwords, Wi”‘Fi keys, Discord tokens, and gaming sessions, then exfiltrates the collected data via third”‘party file hosting and encrypted Discord or Telegram channels. File Name CharlieKirk.exe File…
New phishing campaign tricks employees into bypassing Microsoft 365 MFA

Feb 20, 2026 5:01 AM

Tags: access, attack, awareness, business, credentials, defense, email, google, identity, incident response, least-privilege, login, malicious, mfa, microsoft, monitoring, office, phishing, risk, saas, social-engineering, training

microsoft.com. But the attacker has pre-registered their device to get the code for [the victim] to verify.”David Shipley, head of Canadian security awareness training provider Beauceron Security, said OAuth device code attacks have been gaining steam since 2024. “It’s the natural evolutionary response to improvements in account security, particularly MFA”, he said. The easiest defense is…
How infostealers turn stolen credentials into real identities

Feb 19, 2026 5:00 PM

Tags: breach, credentials, risk

Infostealer dumps increasingly tie stolen credentials to real identities, linking usernames, cookies, and behavior across personal and enterprise accounts. Specops explains how analyzing 90,000 dumps shows reuse fuels enterprise risk and how continuous AD scanning disrupts that cycle. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-infostealers-turn-stolen-credentials-into-real-identities/
Massiv Attack: Android Trojan Targets IPTV Users

Feb 19, 2026 12:01 PM

Tags: android, attack, credentials, malware, theft

New Trojan May Soon Be Offered for Sale to Criminal Underground. Security researchers warn of Massiv, an Android Trojan – disguised as an IPTV app – targeting users who sideload streaming apps. The malware enables screen capture, overlays and credential theft – and may soon be marketed on criminal underground forums as malware as a…
Shadow Machines: The Non-Human Identities Exposing Your Cloud AI Stack

Feb 19, 2026 10:01 AM

Tags: access, ai, api, authentication, automation, business, cloud, compliance, container, control, credentials, data, encryption, framework, governance, iam, identity, infrastructure, iot, jobs, login, mfa, password, risk, risk-management, saas, service, software, strategy, supply-chain, tool

Shadow Machines: The Non-Human Identities Exposing Your Cloud & AI Stack madhav Thu, 02/19/2026 – 06:30 The machines we don’t see are the ones running our businesses. Unfortunately, most IAM systems do not track them. In an ironic twist, the ghost in the machine has become the machine itself: invisible, autonomous, and increasingly beyond human…
Notepad++ author says fixes make update mechanism ‘effectively unexploitable’

Feb 19, 2026 1:01 AM

Tags: access, attack, backdoor, china, control, credentials, dns, espionage, exploit, group, infrastructure, intelligence, malicious, monitoring, network, risk, risk-management, service, software, supply-chain, threat, ukraine, update, vulnerability

CSOonline, Ho said that no system can ever be declared absolutely unbreakable, “but the new design dramatically raises the bar.”An attacker must now compromise both the hosting infrastructure and the signing keys, he explained, adding that the updater now validates both the manifest and the installer, each with independent cryptographic signatures. And any mismatch, missing…
Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years

Feb 19, 2026 12:00 AM

Tags: access, backdoor, china, credentials, detection, endpoint, exploit, firewall, flaw, hacker, linkedin, linux, malware, mandiant, network, service, vmware, zero-day

Pivot techniques: In addition to the payloads themselves, the investigation also revealed new techniques. For example, the legitimate shell script convert_hosts.sh that exists on these appliances has been modified to include the path of the backdoors to achieve persistence.The SLAYSTYLE web shell, which is designed to receive commands over HTTP and execute them on the…
French Ministry confirms data access to 1.2 Million bank accounts

Feb 19, 2026 12:00 AM

Tags: access, breach, credentials, data, finance, government, hacker

A hacker accessed data from 1.2 million French bank accounts using stolen official credentials, the Economy Ministry said. A hacker gained access to data from 1.2 million French bank accounts using stolen credentials belonging to a government official, according to the French Economy Ministry. French authorities said affected account holders will be notified in the…
XSS Bug in VS Code Extension Exposed Local Files

Feb 18, 2026 9:03 PM

Tags: credentials, data-breach, flaw, xss

An XSS flaw in the VS Code Live Preview extension exposed developers’ local files and credentials through the localhost server. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/xss-bug-in-vs-code-extension-exposed-local-files/
Identity and supply chain need more attention, risk intelligence firm says

Feb 18, 2026 5:58 PM

Tags: attack, breach, credentials, identity, intelligence, risk, supply-chain

Roughly a third of attacks now use stolen credentials, according to the company’s latest report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/identity-supply-chain-dataminr-report/812447/
Telegram channels expose rapid weaponization of SmarterMail flaws

Feb 18, 2026 5:58 PM

Tags: breach, credentials, cve, exploit, flaw, monitoring, ransomware

Underground Telegram channels shared SmarterMail exploit PoCs and stolen admin credentials within days of disclosure. Flare explains how monitoring these communities reveals rapid weaponization of CVE-2026-24423 and CVE-2026-23760 tied to ransomware activity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/telegram-channels-expose-rapid-weaponization-of-smartermail-flaws/
Anti-phishing rules mistakenly blocked emails, Teams messages

Feb 18, 2026 5:58 PM

Tags: credentials, detection, email, microsoft, phishing

Microsoft says an Exchange Online issue that mistakenly quarantined legitimate emails last week was triggered by faulty heuristic detection rules designed to block credential phishing campaigns. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-anti-phishing-rules-mistakenly-blocked-emails-teams-messages/
Carelessness versus craftsmanship in cryptography

Feb 18, 2026 3:58 PM

Tags: access, advisory, api, attack, authentication, computing, credentials, cryptography, data, email, encryption, github, hacker, oracle, side-channel, software, threat, tool, update, vpn, vulnerability

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects. When we shared one of these bugs with an affected vendor, strongSwan, the maintainer provided a model response for security vendors. The…
Carelessness versus craftsmanship in cryptography

Feb 18, 2026 3:58 PM

Tags: access, advisory, api, attack, authentication, computing, credentials, cryptography, data, email, encryption, github, hacker, oracle, side-channel, software, threat, tool, update, vpn, vulnerability

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects. When we shared one of these bugs with an affected vendor, strongSwan, the maintainer provided a model response for security vendors. The…
Flaws in four popular VS Code extensions left 128 million installs open to attack

Feb 18, 2026 2:58 PM

Tags: access, api, attack, cloud, credentials, cve, flaw, infrastructure, malicious, microsoft, risk, supply-chain, tool, update, vulnerability, xss

Microsoft quietly patched its own extension: The fourth vulnerability played out differently. Microsoft’s Live Preview extension, with 11 million downloads, contained a cross-site scripting flaw that, according to OX Security, let a malicious web page enumerate files in the root of a developer’s machine and exfiltrate credentials, access keys, and other secrets.The researchers reported the…
OpenClaw AI Framework v2026.2.17 Adds Anthropic Model Support Amid Credential Theft Bug Concerns

Feb 18, 2026 2:58 PM

Tags: ai, credentials, cyber, framework, open-source, theft

OpenClaw, the open-source autonomous AI assistant that has gained widespread adoption in early 2026, released version v2026.2.17 on February 17, 2026, introducing support for Anthropic’s latest Claude Sonnet 4.6 model. The release comes amid growing security concerns after researchers documented the first in-the-wild credential theft targeting OpenClaw configuration files by infostealer malware. New Anthropic Model…
Keenadu: Android malware that comes preinstalled and can’t be removed by users

Feb 18, 2026 1:58 PM

Tags: access, ai, android, backdoor, banking, browser, cctv, chrome, control, credentials, data, endpoint, firmware, governance, identity, infection, kaspersky, malware, mitigation, mobile, network, risk, software, update

Embedded in core system apps: Keenadu can control legitimate system applications on affected devices. Kaspersky observed it inside critical components such as face unlock applications, raising the possibility that attackers could access biometric data. The malware was also found operating within the home screen app that controls the device’s primary interface.The researchers warned that the…
One stolen credential is all it takes to compromise everything

Feb 18, 2026 12:58 PM

Tags: access, breach, credentials, email, login, saas

Attackers often gain access through routine workflows like email logins, browser sessions, and SaaS integrations. A single stolen credential can give them a quick path to move … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/identity-based-cyberattacks-compromise/