Tag: credentials
-
UAT-11985 Uses Fake Event Invites to Target Taiwan Research Affiliates With Google AitM Phishing
Tags: authentication, credentials, cybersecurity, framework, google, mfa, phishing, spear-phishing, threatCybersecurity researchers have disclosed details of an advanced persistent threat (APT) spear-phishing campaign that has targeted individuals affiliated with Taiwan research organizations to direct victims to an adversary-in-the-middle (AitM) phishing framework designed to harvest their Google account credentials and multi-factor authentication (MFA) codes.The activity is being tracked by First seen on thehackernews.com Jump to article:…
-
Zero-Day in BeyondTrust Remote Support Appliances Exploited
‘Patch ASAP’ Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns. All self-hosted BeyondTrust Remote Support appliance users are being urged to immediately patch a bug that an advanced persistent threat group tied to China, which specializes in hacking edge devices. Its been exploiting since late August as a zero-day vulnerability to steal credentials and…
-
Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A likely Russian-speaking threat actor used hundreds of AI agents to exploit PaperCut NG/MF servers, steal Windows credentials and establish reusable access to internal networks. GreyNoise identified at least 440 compromised instances belonging to 395 organizations across 48 countries, demonstrating how agent-assisted workflows can accelerate exploitation of enterprise infrastructure. The operator combined OpenAI’s Codex harness…
-
Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Tags: china, credentials, cyber, email, finance, fraud, infrastructure, international, malicious, microsoft, phishing, service, theftMicrosoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates more than 100 million malicious emails monthly. The coordinated action targeted a Chinese-speaking fraud ecosystem encompassing related phishing kits, infrastructure providers, and services enabling credential theft and financial fraud. Microsoft and Health-ISAC filed a civil lawsuit in the U.S. District…
-
Hackers Target Claude, ChatGPT and Cursor Credentials Using Aoki Infostealer
The Aoki infostealer, also known as Aokigahara, has expanded its collection capabilities to steal credentials and session files from AI coding assistants, putting developer identities and connected infrastructure at risk. First observed earlier in 2026, Aoki previously lacked collection routines for AI applications. Their appearance in recent samples indicates active development, with attackers broadening their…
-
New Aoki Infostealer Targets AI Coding Assistant Credentials
Symantec warned that Aoki can steal API keys and tokens from a number of popular AI coding assistants, including Claude and Gemini First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/aoki-infostealer-ai-coding/
-
AI Agent Workflows Could Expose Credentials Through Trusted Developer Tools
AI agents can expose credentials during routine development tasks, moving secrets from protected stores into command arguments, logs, transcripts, and inputs to external models. The concern is not that developer tools are inherently malicious. Rather, agents inherit developer privileges and repeatedly translate requests into shell commands, consuming their output before deciding what to execute next.…
-
GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories
The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations.The spike, according to GitGuardian, was observed on October 8 and 9, 2026.”This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI,” security researchers Gaetan First…
-
10 Best Secrets Detection Tools Compared (2026): Features Pricing
GitGuardian anchors the dedicated platform lane, TruffleHog owns verification-first scanning (one vendor, despite two sheet rows), and GitHub’s native scanning plus Gitleaks set a free floor every team should exploit. With investigations revealing how a massive GitHub leak exposed over 39 million API keys and credentials, leaving authentication tokens in codebases is an invitation to…
-
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android banking trojan called Hirudo that takes a genuinely different approach to defeating banking security. Instead of throwing a fake login screen over the real app, it uninstalls the real…
-
KGB RAT Uses FUD Crypter to Evade Windows Defender and Spy on Victims
KGB RAT, a Windows remote access trojan marketed as legitimate administration software, combines surveillance, credential theft, and configurable malicious functions with a built-in crypter advertised to evade Windows Defender. Researchers identified unobfuscated payloads, obfuscated variants, and encrypted loaders that reconstruct malware during execution. This distinction matters: the crypter conceals the underlying payload, while the deployed…
-
Anthropic ‘SneakPeek’ Flaw Is a Silent Zero-Click Threat
A bug in Claude Code Desktop’s preview pane can allow adversaries to quietly steal credentials from developers, including SSH private keys, AWS credentials, and Claude 0Auth tokens. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/new-anthropic-sneakpeek-silent-zero-click-threat
-
Fake WatchGuard VPN site steals credentials, then serves the genuine signed client
Huntress researchers have uncovered an SEO-poisoning campaign that harvests SSL VPN credentials through a lookalike WatchGuard download page, then hands victims the real, validly signed installer from WatchGuard’s own CDN, leaving endpoint tools with nothing to detect. The activity, detailed by the Huntress SOC on 13 October, centres on watchguard-vpn[.]net, a lookalike domain posing as…
-
Hirudo Android malware replaces banking apps to evade security checks
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hirudo-android-malware-replaces-banking-apps-to-evade-security-checks/
-
Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
Tags: access, attack, credentials, detection, ivanti, monitoring, network, vpn, vulnerability, zero-dayIvanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise. On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained…
-
GitHub adopts cheaper AI model to catch secrets developers leave in code
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/github-secret-detection-model/
-
GitHub adopts cheaper AI model to catch secrets developers leave in code
GitHub has trained a credential classifier to improve generic secret detection and reduce false alerts. The new pipeline cut median post-push scan execution time by 86% and … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/github-secret-detection-model/
-
Attackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/14/ivanti-zero-days-gain-root-patched-vpn-appliances/
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication
Tags: access, authentication, credentials, cyber, exploit, hacker, ivanti, network, threat, vpn, vulnerability, zero-dayAttackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data. Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the…
-
Ivanti VPN Zero-Day Exploited in Active Attacks
Threat Actor UTA0576 Chains 3 Flaws to Execute Commands as Root. Attackers are exploiting CVE-2026-104935 in Ivanti Connect Secure to bypass authentication and gain root access through a three-flaw exploit chain, targeting Active Directory credentials, BitLocker recovery keys and other secrets as researchers warn of wider enterprise compromise. First seen on govinfosecurity.com Jump to article:…
-
How to Transfer Passwords and Passkeys Between Android Password Managers
Android users can transfer passwords and passkeys between compatible password managers. Here’s how Credential Exchange works, how to import into 1Password, and what to check before switching. The post How to Transfer Passwords and Passkeys Between Android Password Managers appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-transfer-passwords-passkeys-android-managers/
-
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
A flaw in SAP’s Cloud SDK for Python can send an application’s OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP’s official Python client for BTP services. An attacker must…
-
The MFA Gaps Attackers are Still Exploiting
Attackers continue exploiting gaps in MFA coverage, using stolen credentials to access VPNs, RDP, and Windows systems that still rely on passwords alone. Specops explains why protecting cloud applications isn’t enough and how organizations can close these authentication gaps. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/the-mfa-gaps-attackers-are-still-exploiting/
-
Attackers Can Hijack npm Packages Without Stealing Developer Credentials
A flaw in npm’s Trusted Publishing mechanism could let attackers publish malicious updates to legitimate packages without compromising a developer’s npm account, GitHub account, or publishing token. Researchers identified more than 1,500 potentially exposed packages with over 10 million combined downloads. The weakness is particularly concerning as AI coding agents increasingly select, install, and execute…
-
XWorm HBrowser Plugin Lets Attackers Control Authenticated Browser Sessions Without Credentials
XWorm’s HBrowser plugin gives attackers interactive control of authenticated browser sessions on infected endpoints, allowing them to operate accounts without stealing passwords or completing another multifactor authentication challenge. Researchers recorded 1,236 XWorm detection events across more than 100 customer organizations during Q3 2026, four times the volume observed in Q3 2025. Financial services represented approximately…
-
Critical Progress MarkLogic Server Vulnerabilities Could Enable Code Execution and Privilege Escalation
Progress has disclosed 31 vulnerabilities in MarkLogic Server that could lead to privilege escalation, server-side code execution, authentication bypass, credential exposure, and data compromise. In its security bulletin dated October 12, 2026, the company urges customers to install updates, warning that affected instances may operate normally without any prior signs of exploitation. The bulletin covers…