Tag: credentials
-
GitHub Actions workflow compromised to steal CI/CD credentials
First seen on scworld.com Jump to article: www.scworld.com/brief/github-actions-workflow-compromised-to-steal-ci-cd-credentials
-
5,561 GitHub Repositories Hit by Megalodon Supply Chain Attack in Six Hours
SafeDep uncovered the Megalodon attack targeting 5,561 GitHub repositories with malicious CI workflows and cloud credential theft. First seen on hackread.com Jump to article: hackread.com/github-repositories-megalodon-supply-chain-attack/
-
Deleted Google API keys keep working for up to 23 minutes, researchers warn
Google API keys are credentials that let applications access Google services, from Maps to the Gemini AI. If a key is leaked, an attacker can use it to make API calls, rack up … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/22/deleted-google-api-keys-risk/
-
Proton Pass adds monitored credential sharing for AI agents
Proton Pass, a secure, end-to-end encrypted password manager, added credential sharing through AI access tokens, allowing users to give AI agents access to selected items and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/22/proton-pass-adds-monitored-credential-sharing-for-ai-agents/
-
Einfaches Identitäts- und Zugangs-Management – Ein Credential für Tür, Rechner und Cloud
First seen on security-insider.de Jump to article: www.security-insider.de/ein-credential-fuer-tuer-rechner-und-cloud-a-b21b2f732fd8df36b6467dcf67b58f72/
-
Defenders fall behind, as AI rewrites the rules of a data breach
For almost 20 years, stolen credentials have been the most common route for attackers into organizations, according to the Verizon Data Breach Investigations Report (DBIR). But that’s no longer the case. First seen on fortra.com Jump to article: www.fortra.com/blog/defenders-fall-behind-ai-rewrites-rules-data-breach
-
Proton Launches Credential Tokens to Tackle AI Agent Security Gap
A growing tension sits at the heart of enterprise AI deployments: organisations want agents to act autonomously, yet handing over passwords and API keys to automated systems represents a significant and largely unresolved security risk. Proton is now attempting to close that gap with the launch of Proton Pass for AI Agents, a capability that…
-
Industry Reacts to Verizon DBIR 2026 as Vulnerability Exploitation Takes Top Spot
Tags: access, ai, attack, breach, credentials, data, data-breach, exploit, risk, threat, vulnerabilityThe 2026 Verizon Data Breach Investigations Report (DBIR) has sparked widespread industry reaction, with security leaders warning that AI-enabled attacks, vulnerability exploitation, and third-party risk are reshaping the threat landscape faster than many organisations can respond. For the first time in the report’s history, vulnerability exploitation overtook stolen credentials as the leading initial access vector,…
-
When Identity is the Attack Path
Consider a cached access key on a single Windows machine. It got there the way most cached credentials do – a user logged in, and the key stored itself automatically. Standard AWS behavior. No one misconfigured anything or violated a policy. Yet that single key, which was easily accessible to a minor-league attacker, could have…
-
Fake Invitation Phishing Campaign Steals Credentials From U.S. Organizations
A large-scale phishing campaign leveraging fake event invitations is actively targeting U.S. organizations, combining credential theft, OTP interception, and remote access tool abuse into a single attack chain. The campaign stands out due to its repeatable phishing framework, which allows threat actors to rapidly generate event-themed lure pages at scale. These pages often begin with…
-
Hackers bypass SonicWall VPN MFA due to incomplete patching
Threat actors brute-forced VPN credentials and bypassed multi-factor authentication (MFA) on SonicWall Gen6 SSL-VPN appliances to deploy tools used in ransomware attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching/
-
CISA Contractor Exposed Sensitive Credentials in Public GitHub Repository
CISA is investigating after a contractor’s public GitHub repository exposed AWS GovCloud credentials, internal files, and passwords. The post CISA Contractor Exposed Sensitive Credentials in Public GitHub Repository appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-cisa-contractor-github-credential-leak/
-
Verizon DBIR: Vulnerability exploitation is the dominant initial access vector
Vulnerability exploitation has overtaken stolen credentials as the most common way attackers gain initial access to target networks, according to the 2026 Verizon Data Breach … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/20/verizon-2026-dbir-findings/
-
Gremlin Stealer Hides C2 and Exfiltration Paths in Encrypted Resources
A newly identified variant of the Gremlin stealer malware is leveraging advanced obfuscation techniques to conceal its command-and-control (C2) infrastructure and data exfiltration logic within encrypted .NET resource sections. This evolution highlights a significant shift toward stealth, modularity, and anti-analysis sophistication in modern infostealer campaigns. Its targets include browser-stored credentials, session tokens, cryptocurrency wallets, clipboard…
-
Verizon DBIR: Vulnerability Exploits Overtake Credentials as Top Access Vector
Verizon DBIR finds 31% of data breaches began with software flaws last year First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/verizon-dbir-exploits-top-access/
-
Wurm Mini-Shai-Hulud kapert populäre AntV-Software
Eine neue Welle des Mini-Shai-Hulud-Wurms infiziert über ein kompromittiertes npm-Konto Hunderte Pakete des AntV-Ökosystems mit Credential-Stealern. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/wurm-mini-shai-hulud-antv-software
-
CISA credential leak raises alarms, and Capitol Hill demands answers
A researcher who found a repository that leaked on GitHub said it was one of the worst he’s witnessed. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisa-credential-leak-congress-demands-answers/
-
CISA GitHub Leak Exposes AWS GovCloud Secrets
A public GitHub repository tied to a CISA contractor reportedly exposed AWS GovCloud credentials and internal deployment data. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/cisa-github-leak-exposes-aws-govcloud-secrets/
-
CISA Exposes Secrets, Credentials in ‘Private’ Repo
The agency’s GitHub repository, publicly available since November 2025, was ironically named Private-CISA. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/cisa-exposes-secrets-credentials-private-repo
-
In stunning display of stupid, secret CISA credentials found in public GitHub repo
SSH keys, plaintext passwords, other sensitive data had been up since November 2025. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/05/in-stunning-display-of-stupid-secret-cisa-credentials-found-in-public-github-repo/
-
Patched OpenClaw Flaw Let Hackers Hijack AI Agents
Chainable Bugs Enable Credential Theft, Persistence, Takeover. Four chainable flaws in OpenClaw allowed attackers to move from an initial foothold to persistent system-level compromise by abusing the AI agent’s own privileges. The bugs enabled credential theft, privilege escalation and backdoor deployment, affecting all versions released before April 23. First seen on govinfosecurity.com Jump to article:…
-
PureLogs infostealer is stealing credentials worldwide
A phishing campaign is smuggling the powerful PureLogs information stealer onto targets’ Windows machines by hiding encrypted malicious payloads inside cat photos, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/05/19/purelogs-infostealer-delivery-steganography/
-
VoidStealer Malware Targets Chrome Data Despite Built-In Browser Protections
A newly discovered infostealer called VoidStealer is raising concerns after researchers revealed it can bypass Google Chrome’s App-Bound Encryption (ABE), a security feature designed to protect sensitive browser data. The malware introduces a novel technique that allows attackers to extract encryption keys directly from memory, enabling session hijacking and credential theft even on updated systems. VoidStealer Malware…
-
Compromised Nx Console 18.95.0 Targeted VS Code Developers with Credential Stealer
Cybersecurity researchers have flagged a compromised version of the Nx Console extension that was published to the Microsoft Visual Studio Code (VS Code) Marketplace.The extension in question is rwl.angular-console (version 18.95.0), a popular user interface and plugin for code editors like VS Code, Cursor, and JetBrains. The VS Code extension has more than 2.2 million…
-
Compromised GitHub Action Steals Workflow Credentials
A widely used GitHub Action, actions-cool/issues-helper, has been compromised in a supply chain attack that exposes sensitive CI/CD secrets to an attacker-controlled domain. The attack hinges on a subtle but powerful manipulation of Git tags. Instead of altering the visible commit history, the attacker moved all release tags to an “imposter commit” identified as 1c9e803, which does…
-
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server.”Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action’s normal commit…
-
CISA Admin Reportedly Exposes AWS GovCloud Credentials in Public GitHub Repository
Tags: cisa, credentials, cyber, cybersecurity, data, data-breach, github, government, infrastructureA significant security lapse involving the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has come to light after a contractor reportedly exposed highly sensitive AWS GovCloud credentials in a public GitHub repository. The incident, disclosed by security researchers on May 15, 2026, is being described as one of the most serious government-related data exposures in…
-
Compromised Nx Console VS Code Extension Steals Developer and Cloud Secrets
Nx Console’s popular VS Code extension was briefly weaponized into a credential-stealing tool that can leak developer and cloud secrets and plant a persistent backdoor. Anyone who installed v18.95.0 should treat their environment as fully compromised. On May 18, 2026, a malicious build of the Nx Console VS Code extension, nrwl.angular-console v18.95.0 was published to the Visual…
-
GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials
In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code that harvests sensitive credentials and exfiltrates them to an attacker-controlled server.”Every existing tag in the repository has been moved to point to an imposter commit that does not appear in the action’s normal commit…