Tag: credentials
-
Glassworm Malware Infects Popular React Native npm Packages
Tags: attack, country, credentials, cyber, international, malicious, malware, phone, supply-chain, windowsA new Glassworm-linked supply chain attack has briefly turned two popular React Native npm packages into delivery vehicles for Windows credential-stealing malware. On March 16, 2026, malicious versions of AstrOOnauta’s react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 were published to npm, each embedding an identical staged loader that executes during a routine npm install. Together, these packages account for…
-
Glassworm Malware Infects Popular React Native npm Packages
Tags: attack, country, credentials, cyber, international, malicious, malware, phone, supply-chain, windowsA new Glassworm-linked supply chain attack has briefly turned two popular React Native npm packages into delivery vehicles for Windows credential-stealing malware. On March 16, 2026, malicious versions of AstrOOnauta’s react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 were published to npm, each embedding an identical staged loader that executes during a routine npm install. Together, these packages account for…
-
LiveChat Support Tools Abused in SaaS Phishing Scheme
A newly identified campaign shows how Software-as-a-Service (SaaS) platforms like LiveChat are being weaponized to steal sensitive data in real time. Unlike traditional phishing attacks that rely on fake login pages or static forms, this tactic uses live chat conversations to extract credentials, financial data, and personally identifiable information (PII). The campaign begins with phishing…
-
Zero lessons learned: Convicted scammer allegedly ran another athlete-focused phishing scam from federal prison
Kwamaine Jerell Ford allegedly impersonated an adult film star and tricked his high-profile victims into sharing their iCloud credentials and MFA codes under false pretenses. First seen on cyberscoop.com Jump to article: cyberscoop.com/nba-nfl-athletes-social-engineering-scheme-apple-icloud-mfa/
-
Decentralized Identity and Verifiable Credentials: The Enterprise Playbook 2026
The decentralized identity market hits $7.4B in 2026. Every EU member state must deploy a digital identity wallet by year-end. This enterprise playbook covers how verifiable credentials, DIDs, ZKPs, and the EUDI Wallet work, and how to build a practical adoption roadmap. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/decentralized-identity-and-verifiable-credentials-the-enterprise-playbook-2026/
-
Don’t confuse asset inventory with exposure management
Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-managementAsset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…
-
Don’t confuse asset inventory with exposure management
Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-managementAsset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…
-
Don’t confuse asset inventory with exposure management
Tags: access, ai, api, attack, breach, business, chatgpt, cloud, compliance, control, credentials, cyber, cybersecurity, data, data-breach, detection, endpoint, flaw, framework, governance, government, identity, infrastructure, intelligence, Internet, leak, least-privilege, metric, mfa, monitoring, network, regulation, risk, saas, service, software, threat, tool, update, vulnerability, vulnerability-managementAsset discovery tells you what IT exists in your environment. Exposure management tells you what will get you breached. If your platform can’t connect vulnerabilities, identities, misconfigurations, and AI systems into real attack paths, you don’t have exposure management. You have inventory. Key takeaways True exposure management requires more than asset inventory. It’s about merging…
-
LiveChat Abuse: How Phishers Are Exploiting SaaS Support Tools to Steal Sensitive Data
Tags: attack, credentials, credit-card, cybercrime, data, email, exploit, finance, mfa, phishing, saas, service, threat, toolThreat actors are abusing the LiveChat SaaS platform to impersonate brands like PayPal and Amazon in phishing campaigns designed to steal credentials, credit card details, MFA codes, and other sensitive data. Victims are lured through phishing emails and directed to LiveChat pages where attackers use chat interactions to request personal and financial information. The campaign…
-
Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk
From profile manipulation to root shell: The blog post detailed a full privilege escalation chain demonstrated on a default Ubuntu Server installation with the Postfix mail server. By loading a crafted security profile that blocks a specific privilege-dropping capability in Sudo, the researchers said they forced Sudo into a “fail-open” condition: unable to shed its…
-
Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk
From profile manipulation to root shell: The blog post detailed a full privilege escalation chain demonstrated on a default Ubuntu Server installation with the Postfix mail server. By loading a crafted security profile that blocks a specific privilege-dropping capability in Sudo, the researchers said they forced Sudo into a “fail-open” condition: unable to shed its…
-
FortiGate Firewall Exploitation Fuels Network Breaches in New Attack Wave
Tags: attack, breach, credentials, cve, cyber, cybersecurity, exploit, firewall, flaw, fortinet, network, threat, vulnerabilityCybersecurity defenders identified a surge in network breaches originating from compromised FortiGate Next-Generation Firewalls. According to incident responders at SentinelOne, threat actors exploit recent vulnerabilities to extract configuration files, steal credentials, and establish deep network footholds. Attackers are primarily leveraging flaws in Fortinet’s Single Sign-On mechanisms. Vulnerabilities like CVE-2025-59718, CVE-2025-59719, and the recently patched CVE-2026-24858…
-
PDF Phishing: How Cybercriminals Exploit PDF Documents in Modern Email Attacks
Key Takeaways PDF phishing is a fast-growing email attack technique where cybercriminals hide malicious links, QR codes, or credential forms inside seemingly legitimate PDF attachments. Attackers exploit the trust people place in PDFs, disguising phishing documents as invoices, contracts, HR forms, or delivery notifications to trick users into interacting with them. Malicious elements inside PDFs,……
-
Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins
Attackers linked to Storm-2561 use SEO-poisoned search results to lure users to fake Ivanti, Cisco, and Fortinet VPN sites that steal corporate login credentials. In mid-January 2026, Microsoft Defender Experts uncovered a credential-theft campaign attributed to Storm-2561. Threat actor is spreading fake enterprise VPN clients impersonating Ivanti, Cisco, and Fortinet software. By poisoning search engine…
-
IRONSCALES Winter ’26 Release: Preemptive Email Security
<div cla A few months ago, I wrote about the Phishing Renaissance and how AI hasn’t invented new attack types so much as perfected the classics. Credential theft, vendor impersonation, executive fraud. Same playbook, exponentially better execution. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/ironscales-winter-26-release-preemptive-email-security/
-
AI Agents Present ‘Insider Threat’ as Rogue Behaviors Bypass Cyber Defenses: Study
Artificial intelligence (AI) agents, once touted as the next frontier of corporate efficiency, are increasingly exhibiting deceptive and rogue behaviors that could overwhelm traditional cybersecurity. New research shows autonomous systems are now capable of collaborating to smuggle sensitive data, forge credentials, and even peer-pressure other AIs into bypassing safety protocols. According to findings from Irregular,..…
-
Fake enterprise VPN sites used to steal company credentials
A threat actor tracked as Storm-2561 is distributing fake enterprise VPN clients from Ivanti, Cisco, and Fortinet to steal VPN credentials from unsuspecting users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-enterprise-vpn-downloads-used-to-steal-company-credentials/
-
Credential-stealing crew spoofs VPN clients from Cisco, Fortinet, and others
And then they send victims to the legit VPN download to hide their tracks First seen on theregister.com Jump to article: www.theregister.com/2026/03/13/vpn_clients_spoofed/
-
Fake enterprise VPN sites used to steal company credentials
A threat actor tracked as Storm-2561 is distributing fake enterprise VPN clients from Ivanti, Cisco, and Fortinet to steal VPN credentials from unsuspecting users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-enterprise-vpn-downloads-used-to-steal-company-credentials/
-
How AI Changes the Role of Privileged Access in Cybersecurity
For most organizations, privileged access management (PAM) has historically been treated as a security hygiene requirement. Secure the administrator passwords, enforce approval workflows, rotate credentials, and record sessions for audit purposes. While these controls remain essential, artificial intelligence (AI) is reshaping cybersecurity. And privileged access is evolving from a credential protection mechanism into one of the most strategic observation points in enterprise security architecture. It’s a shift worth……
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
Most Google Cloud Attacks Start With Bug Exploitation
Forget stolen credentials and misconfigurations; AI means vulnerability exploits that beat patching cycles are the top cause of compromises in the cloud. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/google-cloud-attacks-bug-exploitation
-
Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials
Microsoft has disclosed details of a credential theft campaign that employs fake virtual private network (VPN) clients distributed through search engine optimization (SEO) poisoning techniques.”The campaign redirects users searching for legitimate enterprise software to malicious ZIP files on attacker-controlled websites to deploy digitally signed trojans that masquerade as trusted VPN clients First seen on thehackernews.com…
-
Fake enterprise VPN downloads used to steal company credentials
A threat actor tracked as Storm-2561 is distributing fake enterprise VPN clients from Ivanti, Cisco, and Fortinet to steal VPN credentials from unsuspecting users. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/fake-enterprise-vpn-downloads-used-to-steal-company-credentials/
-
Storm-2561 Uses SEO Poisoning, Fake Signed VPN Apps to Steal Enterprise Credentials
A financially motivated threat actor tracked as Storm-2561 is running a credential theft campaign that abuses SEO poisoning and fake, signed VPN installers to steal enterprise VPN credentials. Active since May 2025, Storm-2561 continues to exploit user trust in search results, known VPN brands, and code-signing certificates to distribute malware disguised as legitimate remote access…
-
How Threat Intelligence Protects Player Experience for Betting and Gaming Customers
Threat intelligence and bot mitigation strategies help gaming and betting platforms stop credential stuffing, scraping and automated fraud. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/how-threat-intelligence-protects-player-experience-for-betting-and-gaming-customers/
-
How Threat Intelligence Protects Player Experience for Betting and Gaming Customers
Threat intelligence and bot mitigation strategies help gaming and betting platforms stop credential stuffing, scraping and automated fraud. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/how-threat-intelligence-protects-player-experience-for-betting-and-gaming-customers/