Collecting Cyber-News from over 60 sources

Tag: credentials

Hackers Exploit DeepSeek and Claude AI to Launch Global Attacks on FortiGate Devices

Feb 24, 2026 7:02 AM

Tags: ai, attack, breach, credentials, cyber, exploit, firewall, hacker

Hackers are using commercial AI models DeepSeek and Claude to automate attacks against FortiGate firewalls worldwide, turning basic misconfigurations into a high”‘volume intrusion campaign. In early February 2026, a misconfigured SimpleHTTP server running on 212.11.64[.]250:9999 was found exposing more than 1,400 files and 139 subdirectories, including stolen FortiGate configurations, Active Directory maps, credential dumps, exploit…
Russian group uses AI to exploit weakly-protected Fortinet firewalls, says Amazon

Feb 24, 2026 6:01 AM

Tags: access, ai, api, attack, authentication, business, ciso, control, credentials, cybersecurity, data-breach, detection, exploit, firewall, fortinet, group, Internet, linkedin, malicious, mfa, monitoring, network, password, russia, software, threat, tool, vpn, vulnerability

Recommendations: The Amazon report makes a number of recommendations to network admins with FortiGate devices. They include ensuring device management interfaces aren’t exposed to the internet, or, if they have to be, restricting access to known IP ranges and using a bastion host or out-of-band management network. As basic cybersecurity demands, all default and common…
600+ FortiGate Devices Hacked by AI-Armed Amateur

Feb 24, 2026 1:01 AM

Tags: ai, backup, credentials, firewall, hacker, ransomware, russia

A Russian-speaking hacker used generative AI to compromise the FortiGate firewalls, targeting credentials and backups for possible follow-on ransomware attacks. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/600-fortigate-devices-hacked-ai-amateur
Cracks in the Bedrock: Bypassing SCP Enforcement with Long-Lived API Keys

Feb 23, 2026 6:01 PM

Tags: api, control, credentials, iam, service

Introduction Following the release of Amazon Bedrock Powered by AWS Mantle, I discovered a mechanism to bypass Service Control Policy (SCP) statements limiting the use of bedrock-mantle IAM permissions. By leveraging long-lived API keys backed by Service Specific Credentials, I was able to successfully leverage bedrock-mantle:CreateInference despite an SCP statement denying that action. SCPs are……
1.2 Million Accounts Exposed in French Bank Registry Breach

Feb 23, 2026 4:00 PM

Tags: access, breach, credentials, data, data-breach, finance, government

Stolen government credentials were used to access France’s FICOBA registry, exposing data tied to roughly 1.2 million bank accounts. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/1-2-million-accounts-exposed-in-french-bank-registry-breach/
New Arkanix stealer blends rapid Python harvesting with stealthier C++ payloads

Feb 23, 2026 2:00 PM

Tags: credentials, data, detection, exploit, theft, vpn

The stealer employs a broad data-theft toolkit: The researchers noted that the Python implementation acts as a wide-net data harvester. It collects system information, extracts browser-stored data, and pulls details from communication platforms, including Telegram and Discord. Additional modules target VPN configurations, retrieve selected files from the host, and can deliver other payloads, suggesting the…
Attackers exploit Ivanti EPMM zero-days to seize control of MDM servers

Feb 23, 2026 1:01 PM

Tags: advisory, apt, backup, china, control, credentials, cve, exploit, flaw, government, group, ivanti, mobile, network, password, service, software, threat, update, vpn, vulnerability, zero-day

Patch, but verify first: Unit 42 directed organizations to Ivanti’s security advisory for remediation guidance, which recommends applying version-specific RPM patches for EPMM 12.x branches that require no appliance downtime. Ivanti cautioned, however, that the patch does not survive a version upgrade and must be reinstalled if the software is updated. “The permanent fix for…
Starkiller Phishing Kit Clones Real Login Pages to Evade MFA Protections

Feb 23, 2026 1:01 PM

Tags: authentication, credentials, cyber, framework, login, mfa, phishing, theft, update

New phishing framework Starkiller is enabling more convincing, scalable credential theft by proxying real login pages and bypassing multi-factor authentication (MFA), significantly raising the bar for defenders. Traditional phishing kits typically serve static HTML clones of popular login portals, which quickly become outdated when brands update their interfaces, creating telltale visual discrepancies. Starkiller takes a…
Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Feb 23, 2026 1:01 PM

Tags: api, attack, credentials, crypto, cybersecurity, malicious, supply-chain, worm

Cybersecurity researchers have disclosed what they say is an active “Shai-Hulud-like” supply chain worm campaign that has leveraged a cluster of at least 19 malicious npm packages to enable credential harvesting and cryptocurrency key theft.The campaign has been codenamed SANDWORM_MODE by supply chain security company Socket. As with prior Shai-Hulud attack waves, the malicious code…
Police seize 100,000 stolen Facebook credentials in cybercrime raid

Feb 23, 2026 12:01 PM

Tags: breach, credentials, cybercrime, group, organized, phishing

Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) dismantled an organized group that used phishing to seize Facebook accounts and extract BLIK payment … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/23/poland-cybercrime-facebook-phishing-ring/
Anthropic Didn’t Kill Cybersecurity. It Just Reminded Us There Are Two Doors.

Feb 23, 2026 11:02 AM

Tags: ai, breach, credentials, identity, saas

Anthropic’s Claude Code Security sparked a sharp SaaS market selloff, but investors missed a critical reality: AI code scanning addresses only half of modern cyberattacks. Identity, credentials, and human factors remain the dominant breach vectors. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/anthropic-didnt-kill-cybersecurity-it-just-reminded-us-there-are-two-doors/
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
13 ways attackers use generative AI to exploit your systems

Feb 23, 2026 9:01 AM

Tags: access, ai, attack, authentication, awareness, breach, captcha, ceo, chatgpt, ciso, cloud, credentials, crypto, cyber, cyberattack, cybercrime, cybersecurity, dark-web, data, deep-fake, defense, detection, email, espionage, exploit, extortion, finance, flaw, framework, fraud, google, government, group, hacker, identity, infrastructure, intelligence, law, LLM, login, malicious, malware, marketplace, network, open-source, password, phishing, privacy, ransomware, resilience, risk, saas, scam, service, social-engineering, startup, supply-chain, tactics, technology, theft, threat, tool, vulnerability, zero-day

Facilitating malware development: AI can also be used to generate more sophisticated, or less labour-intensive, malware.For example, cybercriminals are using gen AI to create malicious HTML documents. The XWorm attack, initiated by HTML smuggling, which contains malicious code that downloads and runs the malware, bears the hallmarks of development via AI.”The loader’s detailed line-by-line description…
North Korean Hackers Exploit Fake IT Worker Schemes and Malicious Interview Lures

Feb 23, 2026 9:01 AM

Tags: credentials, cyber, exploit, hacker, jobs, malicious, malware, north-korea, software, threat

North Korean state-backed hackers are running large-scale fake IT worker and “Contagious Interview” campaigns that abuse developer hiring workflows to deliver JavaScript-based malware, steal code and credentials, and covertly generate revenue for the regime. Since at least 2022, North Korean threat actors have impersonated recruiters and hiring managers, luring software developers into executing booby-trapped code…
EC-Council Expands AI Certification Portfolio to Strengthen U.S. AI Workforce Readiness and Security

Feb 21, 2026 11:02 AM

Tags: ai, ciso, credentials, cybersecurity, hacker, risk

With $5.5 trillion in global AI risk exposure and 700,000 U.S. workers needing reskilling, four new AI certifications and Certified CISO v4 help close the gap between AI adoption and workforce readiness.EC-Council, creator of the world-renowned Certified Ethical Hacker (CEH) credential and a global leader in applied cybersecurity education, today launched its Enterprise AI Credential…
Dynamic Objects in Active Directory: The Stealthy Threat

Feb 20, 2026 6:01 PM

Tags: access, attack, blueteam, breach, cloud, computer, container, control, credentials, cve, data, defense, detection, dns, endpoint, group, identity, malicious, microsoft, monitoring, password, powershell, risk, soc, strategy, threat, tool, update, vulnerability

Active Directory’s “dynamic objects” feature offers attackers a perfect evasion cloak. These objects automatically self-destruct without a trace, so they allow adversaries to bypass quotas, pollute access lists, and persist in the cloud, leaving forensic investigators with nothing to analyze. Key takeaways The threat: Dynamic objects self-delete without leaving any traces, or “tombstones” in AD…
CISA gives federal agencies three days to patch actively exploited Dell bug

Feb 20, 2026 2:01 PM

Tags: cisa, credentials, espionage, exploit, flaw, update

Hardcoded credential flaw in RecoverPoint already abused in espionage campaign First seen on theregister.com Jump to article: www.theregister.com/2026/02/20/cisa_dell_vulnerability/
CharlieKirk Grabber Malware Targets Windows Systems to Steal Login Credentials

Feb 20, 2026 2:01 PM

Tags: control, credentials, cyber, data, login, malware, password, theft, windows

CharlieKirk Grabber is a Python-based Windows infostealer that focuses on rapid “smash”‘and”‘grab” credential theft and data exfiltration rather than long-term system control or destructive behavior. It targets browser”‘stored passwords, Wi”‘Fi keys, Discord tokens, and gaming sessions, then exfiltrates the collected data via third”‘party file hosting and encrypted Discord or Telegram channels. File Name CharlieKirk.exe File…
New phishing campaign tricks employees into bypassing Microsoft 365 MFA

Feb 20, 2026 5:01 AM

Tags: access, attack, awareness, business, credentials, defense, email, google, identity, incident response, least-privilege, login, malicious, mfa, microsoft, monitoring, office, phishing, risk, saas, social-engineering, training

microsoft.com. But the attacker has pre-registered their device to get the code for [the victim] to verify.”David Shipley, head of Canadian security awareness training provider Beauceron Security, said OAuth device code attacks have been gaining steam since 2024. “It’s the natural evolutionary response to improvements in account security, particularly MFA”, he said. The easiest defense is…
How infostealers turn stolen credentials into real identities

Feb 19, 2026 5:00 PM

Tags: breach, credentials, risk

Infostealer dumps increasingly tie stolen credentials to real identities, linking usernames, cookies, and behavior across personal and enterprise accounts. Specops explains how analyzing 90,000 dumps shows reuse fuels enterprise risk and how continuous AD scanning disrupts that cycle. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-infostealers-turn-stolen-credentials-into-real-identities/
Massiv Attack: Android Trojan Targets IPTV Users

Feb 19, 2026 12:01 PM

Tags: android, attack, credentials, malware, theft

New Trojan May Soon Be Offered for Sale to Criminal Underground. Security researchers warn of Massiv, an Android Trojan – disguised as an IPTV app – targeting users who sideload streaming apps. The malware enables screen capture, overlays and credential theft – and may soon be marketed on criminal underground forums as malware as a…
Shadow Machines: The Non-Human Identities Exposing Your Cloud AI Stack

Feb 19, 2026 10:01 AM

Tags: access, ai, api, authentication, automation, business, cloud, compliance, container, control, credentials, data, encryption, framework, governance, iam, identity, infrastructure, iot, jobs, login, mfa, password, risk, risk-management, saas, service, software, strategy, supply-chain, tool

Shadow Machines: The Non-Human Identities Exposing Your Cloud & AI Stack madhav Thu, 02/19/2026 – 06:30 The machines we don’t see are the ones running our businesses. Unfortunately, most IAM systems do not track them. In an ironic twist, the ghost in the machine has become the machine itself: invisible, autonomous, and increasingly beyond human…
Notepad++ author says fixes make update mechanism ‘effectively unexploitable’

Feb 19, 2026 1:01 AM

Tags: access, attack, backdoor, china, control, credentials, dns, espionage, exploit, group, infrastructure, intelligence, malicious, monitoring, network, risk, risk-management, service, software, supply-chain, threat, ukraine, update, vulnerability

CSOonline, Ho said that no system can ever be declared absolutely unbreakable, “but the new design dramatically raises the bar.”An attacker must now compromise both the hosting infrastructure and the signing keys, he explained, adding that the updater now validates both the manifest and the installer, each with independent cryptographic signatures. And any mismatch, missing…
Chinese hackers exploited zero-day Dell RecoverPoint flaw for 1.5 years

Feb 19, 2026 12:00 AM

Tags: access, backdoor, china, credentials, detection, endpoint, exploit, firewall, flaw, hacker, linkedin, linux, malware, mandiant, network, service, vmware, zero-day

Pivot techniques: In addition to the payloads themselves, the investigation also revealed new techniques. For example, the legitimate shell script convert_hosts.sh that exists on these appliances has been modified to include the path of the backdoors to achieve persistence.The SLAYSTYLE web shell, which is designed to receive commands over HTTP and execute them on the…
French Ministry confirms data access to 1.2 Million bank accounts

Feb 19, 2026 12:00 AM

Tags: access, breach, credentials, data, finance, government, hacker

A hacker accessed data from 1.2 million French bank accounts using stolen official credentials, the Economy Ministry said. A hacker gained access to data from 1.2 million French bank accounts using stolen credentials belonging to a government official, according to the French Economy Ministry. French authorities said affected account holders will be notified in the…
XSS Bug in VS Code Extension Exposed Local Files

Feb 18, 2026 9:03 PM

Tags: credentials, data-breach, flaw, xss

An XSS flaw in the VS Code Live Preview extension exposed developers’ local files and credentials through the localhost server. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/xss-bug-in-vs-code-extension-exposed-local-files/
Identity and supply chain need more attention, risk intelligence firm says

Feb 18, 2026 5:58 PM

Tags: attack, breach, credentials, identity, intelligence, risk, supply-chain

Roughly a third of attacks now use stolen credentials, according to the company’s latest report. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/identity-supply-chain-dataminr-report/812447/
Telegram channels expose rapid weaponization of SmarterMail flaws

Feb 18, 2026 5:58 PM

Tags: breach, credentials, cve, exploit, flaw, monitoring, ransomware

Underground Telegram channels shared SmarterMail exploit PoCs and stolen admin credentials within days of disclosure. Flare explains how monitoring these communities reveals rapid weaponization of CVE-2026-24423 and CVE-2026-23760 tied to ransomware activity. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/telegram-channels-expose-rapid-weaponization-of-smartermail-flaws/
Anti-phishing rules mistakenly blocked emails, Teams messages

Feb 18, 2026 5:58 PM

Tags: credentials, detection, email, microsoft, phishing

Microsoft says an Exchange Online issue that mistakenly quarantined legitimate emails last week was triggered by faulty heuristic detection rules designed to block credential phishing campaigns. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/microsoft/microsoft-anti-phishing-rules-mistakenly-blocked-emails-teams-messages/
Carelessness versus craftsmanship in cryptography

Feb 18, 2026 3:58 PM

Tags: access, advisory, api, attack, authentication, computing, credentials, cryptography, data, email, encryption, github, hacker, oracle, side-channel, software, threat, tool, update, vpn, vulnerability

Two popular AES libraries, aes-js and pyaes, “helpfully” provide a default IV in their AES-CTR API, leading to a large number of key/IV reuse bugs. These bugs potentially affect thousands of downstream projects. When we shared one of these bugs with an affected vendor, strongSwan, the maintainer provided a model response for security vendors. The…