Tag: credentials
-
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials
Tags: access, breach, credentials, cybersecurity, data-breach, firewall, fortinet, hacker, network, vpnCybersecurity researchers have disclosed details of a large-scale campaign that has targeted exposed network edge devices such as Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls.”Artifacts from this investigation also indicate that operators in this campaign have obtained access to numerous organizations worldwide, and have attempted to further compromise some victims, First seen on thehackernews.com…
-
Infostealer riding the AI Train
ey Points Introduction Infostealers commonly target browser passwords, session cookies, and cryptocurrency wallets. This malware combines those established capabilities with dedicated collection routines for AI applications and development tools. Its targets include Claude, ChatGPT Desktop, Codex, Cursor, Windsurf, and GitHub Copilot, alongside cloud credentials and sensitive files from local development environments. This expanded targeting reflects…
-
StealC Infostealer Returns as Powerful Remote Access Trojan After Europol Takedown
StealC’s seller has resurfaced with Stadia, a modular remote access trojan that expands the disrupted infostealer into a platform for persistent endpoint control. Advertised on October 16, the malware combines credential theft with hidden desktop access, command execution, file management, and payload delivery, according to research supplied by Varonis Threat Labs. The comeback follows June’s…
-
China-Aligned Hackers Used Agentic AI to Target ConnectWise
Tags: access, ai, attack, china, cloud, credentials, framework, hacker, microsoft, open-source, supply-chainMicrosoft Ties Storm-0940 to Automated Intrusions Across Hundreds of Targets. Microsoft linked the ConnectWise supply chain compromise to China-aligned Storm-0940, which used the open-source Artex agentic AI framework to automate credential attacks, abuse trusted cloud applications and attempt access to more than 2,250 customer tenants at machine speed. First seen on govinfosecurity.com Jump to article:…
-
Disgraced eMudhra drops out of TLS business after using cert private key of 4
Flubbed key signing “ceremony” allowed minting of web credentials for any site. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/disgraced-emudhra-drops-out-of-tls-business-following-certificate-debacle/
-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX
Tags: ai, attack, backup, breach, china, cloud, credentials, exploit, framework, group, microsoft, open-source, penetration-testing, supply-chain, toolChina-linked Storm-0940 used AI tool ARTEX to target 2,250 Microsoft 365 tenants, exploiting stolen ConnectWise credentials at machine speed. Microsoft published a detailed technical report naming Storm-0940, a China state-aligned group, as the actor behind the ConnectWise Cloud Backup supply chain compromise. The group used ARTEX, an open-source AI-driven penetration testing framework, to run attacks…
-
LiteLLM release pipeline hacked to distribute info-stealer malware
Hackers compromised the LiteLLM project’s PyPI package and published malicious Docker images with a payload that steals credentials, secrets, and environment variables. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/
-
Machine speed attacks require machine speed detection and response
Attackers can steal credentials and begin exfiltrating data within minutes, often before security teams can respond. Exaforce examines real-world attacks involving stolen GitHub tokens, malicious AI installers, and MFA phishing, explaining why faster detection and automated containment are critical. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/machine-speed-attacks-require-machine-speed-detection-and-response/
-
LiteLLM hit by second supply chain attack this year, users urged to rotate credentials
A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/22/litellm-compromised-supply-chain-attack-pypi-docker/
-
K0T Hackers Target FortiGate, FortiWeb and Palo Alto GlobalProtect in Credential Theft Campaign
A widespread campaign targeting FortiGate, FortiWeb, and Palo Alto GlobalProtect appliances to steal credentials, establish persistent access, and exfiltrate corporate data. The investigation associates the activity with an operator known as k0t and identifies more than 70,000 exposed credentials across network-device records, LDAP dumps and other operational artifacts. Researchers identified potential connections to the FortiBleed…
-
Keeper Security Launches AI-Powered Phishing Protection to Block Credential Theft
Keeper Security has introduced a new AI-powered phishing protection feature designed to prevent users from entering their credentials on fraudulent websites. Available through the Keeper Browser Extension, the new Phishing Protection capability uses a local AI engine to detect look-alike domains, spoofed websites and brand impersonation attempts. By identifying suspicious login pages directly in the…
-
Hackers Used AI-Generated Scripts to Break Into Government Linux Servers and Hunt for Secrets
Hackers used apparently AI-generated scripts to compromise government Linux infrastructure, harvest credentials and pursue sensitive databases and official mailboxes in a campaign tracked as CL-UNK-1211. The investigation, published October 15, linked the operation to government entities and state-affiliated infrastructure. Attribution remains unresolved: under Unit 42’s attribution framework, the UNK designation means researchers have not established…
-
Hackers Use Fake App Updates to Replace Legitimate Banking Apps With Malicious Versions
Hirudo, an Android banking remote-access trojan (RAT) that can steal credentials and remotely control an infected phone. Its most unusual feature is the ability to replace selected genuine banking apps with modified copies designed to interfere with security checks from inside the app itself. Hirudo uses a two-app setup. Victims first install a convincing shopping…
-
Attackers Target Flowise AI Agents With Credential Theft, Prompt Injection and Workflow Hijacking
An attacker used an exposed Flowise AI orchestration server to enumerate workflows, harvest credentials, and try to turn its language-model agent into an offensive analysis assistant. Sekoia says the findings were first shared in a private FLINT report on 7 September 2026. The honeypot emulated Flowise 2.2.8 and captured requests without running real system code…
-
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor.On October 21, 2026, LiteLLM’s release pipeline was compromised to push 1.107.0 to the Docker Hub registry and the Python Package Index (PyPI) repository. The incident took place…
-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations
SafePay ransomware has hit 600+ organizations since 2024, using stolen credentials, VPN access and double extortion to pressure victims into paying. CISA, the FBI, the US Secret Service, Germany’s Landeskriminalamt Rheinland-Pfalz, and two UK law enforcement agencies jointly published an advisory this week on SafePay, a ransomware group they describe as one of the most…
-
LiteLLM Supply Chain Compromise Exposes AI Developer Credentials to Malware Attacks
Tags: ai, attack, authentication, cloud, container, credentials, cyber, malicious, malware, pypi, startup, supply-chainLiteLLM version 1.107.0 was compromised in a supply chain attack that distributed credential-stealing malware through PyPI wheels and container images. On October 21, 2026, researchers at Socket reported that malicious Python startup hooks could activate even if applications didn’t import LiteLLM, potentially exposing cloud credentials, developer secrets, and AI authentication files. Socket flagged seven malicious…
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index…
-
Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections
New York, NY, USA, October 21st, 2026, CyberNewswire According to the 2026 Autonomous Agents Threat Report, published by Arrakis Security, 76% of active agents have not run in 60 days, but their credentials still work and their triggers still fire. 44% have not run in 180 days. 24% of dormant agents can be started by…
-
Arrakis Security Report Finds 76% of AI Agents Are Dormant but Keep Their Credentials and Connections
New York, NY, USA, 21st October 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/arrakis-security-report-finds-76-of-ai-agents-are-dormant-but-keep-their-credentials-and-connections/
-
Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
Tags: blizzard, credentials, cyber, defense, espionage, government, group, hacker, intelligence, law, military, network, russiaSwallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.S. government identifies APT28 and…
-
Hackers Compromise 333 Tor Exit Nodes to Steal SSH Credentials and Deploy Ebury Malware
Attackers compromised 333 Tor exit nodes in a coordinated campaign to intercept SSH connections, steal passwords, and deploy the Ebury Linux backdoor, according to a research account published on October 20, 2026. The compromised infrastructure accounted for approximately 10% of Tor’s roughly 3,000 exit relays. The researcher reported that attackers accessed the underlying servers in…
-
INC Ransomware Hackers Use Claude AI, Expose 8,257 Messages and 46 Malware Builds
Ransomware affiliates associated with INC and The Gentlemen exposed an intrusion ecosystem after leaving operational servers publicly accessible. The investigation began in late September 2026 with open directories on 45.227.254[.]43. Configuration files and credentials led researchers to six additional adversary servers, exposing development infrastructure, command infrastructure and ransomware staging systems. The findings describe an active…
-
Why security tools lose sight of the credential
Security teams have tools for code, endpoints, cloud infrastructure, identity, and secrets management. Credentials cut across all of them. A developer finds an AWS key in a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/gitguardian-securing-credential-layer/
-
Zeabur shutting down after second security breach in two months
Development platform Zeabur has disclosed details of a cybersecurity incident in which an attacker used leaked internal credentials stored in plaintext to compromise its infrastructure and steal over 3.2 million environment variable records and information for 321,810 accounts. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/
-
The Internet goes on high alert after discovery of 8 compromised TLS certs
Intermediate certs allow anyone to mint web credentials for any Internet server. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/10/the-internet-goes-on-high-alert-after-discovery-of-8-compromised-tls-certs/
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…
-
Nikkei data breach affected over 1.8 million records
Nikkei disclosed a data breach affecting over 1.8 million records after hackers used stolen credentials to access a cloud service for system development. Japanese media company Nikkei has disclosed a data breach affecting more than 1.8 million records. The company, known for its financial news publications, including The Nikkei and the Financial Times, said attackers…