Tag: credentials
-
Critical Progress MarkLogic Server Vulnerabilities Could Enable Code Execution and Privilege Escalation
Progress has disclosed 31 vulnerabilities in MarkLogic Server that could lead to privilege escalation, server-side code execution, authentication bypass, credential exposure, and data compromise. In its security bulletin dated October 12, 2026, the company urges customers to install updates, warning that affected instances may operate normally without any prior signs of exploitation. The bulletin covers…
-
Hackers Use AI-Generated Event Lures to Steal Google Accounts and Bypass MFA
Tags: ai, authentication, credentials, cyber, framework, google, hacker, mfa, phishing, qr, spear-phishing, threatAn advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the operation uses institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Attackers repurposed legitimate public event information to make fraudulent invitations…
-
How to keep AI agents within their permissions
AI agents can use valid credentials to perform actions beyond their assigned permissions, creating risks that traditional access controls may not prevent. Token Security explains how organizations can enforce agent-specific policies without sacrificing autonomy. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/how-to-keep-ai-agents-within-their-permissions/
-
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer, a C# information stealer first publicly identified in April 2026, has expanded its capabilities beyond credential theft. New samples analyzed by Flashpoint bypass Chromium app-bound encryption, support remote command execution, and transmit stolen data through small, encrypted TCP exchanges instead of uploading a single archive. Flashpoint has not observed widespread adoption among threat actors.…
-
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
A campaign in July 2026 using a trojanized Terraform provider to deploy cross-platform malware against developer environments. The operation delivers FLATROOF for credential theft and initial access, followed by ROOFDECK for broader remote control. Attribution remains provisional. ThreatLabz found similarities in targeting, tooling, and tactics but lacked unique code matches, shared infrastructure, or cryptographic evidence…
-
AI Training Critical as Governance Challenges Grow
As AI adoption accelerates, ISACA is expanding its certification portfolio with a governance-focused credential designed to help professionals manage AI securely First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ai-training-critical-as-governance/
-
Breach Roundup: FortiBleed Still Hemorrhaging Credentials
Also: AI Agents Hit Wikimedia, Asos Traces Breach to Employee. This week: Fortibleed, OpenAI agents attacked Wikimedia, FBI hacking fallout hits Accenture, Silent Ransom leak and a Flydubai attack. Asos breach traced to employee account. A Hafnium hacker bounty. Google spotted compromised third-party cc-TLD domains. Man accused of illegally exporting chips. First seen on govinfosecurity.com…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
ASOS Confirms Data Breach Linked to Stolen Employee Credentials
The ASOS hack comes from the compromise of agentic marketing platform Simon AI, said the attackers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/asos-data-breach-stolen-employee/
-
GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/github-push-protection-modernbert/
-
GitHub adds AI to catch passwords before a code push
GitHub has announced an AI detector, developed with Microsoft Applied Sciences, to help prevent developers from uploading passwords and other credentials to code repositories. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/08/github-push-protection-modernbert/
-
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
Tags: access, blockchain, cloud, control, credentials, cyber, endpoint, infrastructure, korea, network, north-korea, open-source, service, threat, wormThreat actors are increasingly using blockchain networks as resilient command-and-control infrastructure to steal cloud credentials from developer endpoints and CI/CD environments. Recent campaigns involving the ChainDrop npm worm and the North Korea-linked PolinRider operation show how poisoned open-source packages can harvest short-lived cloud tokens, service-account credentials, deployment secrets, and source-code access tokens while resolving attacker…
-
Discord Security Bot Double Counter Hacked, Exposing Data of Millions of Users
The Discord security bot Double Counter experienced a targeted infrastructure breach that compromised personal information linked to millions of accounts. According to an incident report by operator Tellter SAS, an attacker accessed cloud credentials, hijacked the bot, copied about 12 GB of database contents, and misused a separate payment account. The attacker remained active in…
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.The malicious version 0.5.144 “contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,” Socket said First seen on thehackernews.com…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
Hackers Abuse GitHub Actions to Steal SSH Keys, Cloud Credentials and Access Tokens
Hackers are abusing GitHub Actions to steal SSH keys, cloud credentials, and access tokens through malicious workflows disguised as security checks. The workflows targeted 2,577 secrets, but targeting did not always translate into theft. Researchers confirmed successful exfiltration of 26 secrets from 13 repositories, highlighting the distinction between malicious injections and executed payloads. Attackers inserted…
-
Insider Threat Risks Rise Amid Layoffs and Workforce Changes
Workforce changes can increase insider threat risks. Learn how access controls, credential security, DLP, and third-party oversight can reduce exposure. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/news/layoffs-lead-to-rise-in-insider-threat-risk/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FBI warns that FortiBleed credential-harvesting attacks are locking out firewall users
An initial access broker is working with various ransomware groups in a global campaign. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-fortibleed-credential-harvesting-attacks/832366/
-
FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away
FBI and Secret Service warn FortiBleed, a credential-harvesting campaign against Fortinet firewalls, has compromised 86,644 devices and is locking out admins. The FBI and the U.S. Secret Service issued a joint advisory about FortiBleed, and the headline number alone is worth sitting with: more than 86,644 compromised Fortinet FortiGate devices across 194 countries, according to…
-
FBI, Secret Service add to warnings of FortiBleed credential stealing campaign
Users of two types of Fortinet hardware should take steps to limit their exposure to a now-global credential stealing campaign, U.S. federal law enforcement says. First seen on therecord.media Jump to article: therecord.media/fortibleed-warning-fbi-secret-service
-
FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
The U.S. Federal Bureau of Investigation (FBI) and Secret Service (USSS) on Tuesday warned that the FortiBleed credential harvesting campaign remains an active threat aimed at internet-facing Fortinet FortiGate firewalls and secure socket layer (SSL) virtual private network (VPN) gateways.”The campaign exploits reused or leaked credentials and legacy SHA-256 password storage, enabling threat First seen…
-
Hackers Use ERP Web Shell and IDOR Flaws to Breach Major South Korean Churches
Attackers breached two of South Korea’s largest churches through distinct intrusion chains, combining an ERP web shell, privileged database access, leaked credentials, and broken authorization controls. Oasis Security’s analysis of attacker-server files documents extensive collection of congregant, employee, financial, and administrative information across both organizations. Its findings describe recovered attacker artifacts, rather than a complete…
-
LUNEXSTEALER Gives Hackers Remote Control of Browsers Through Malicious Chrome Extension
A campaign that uses more than 100 compromised websites to distribute LUNEXSTEALER, a Windows infostealer that installs a browser extension giving attackers remote control. The extension, LUNARAXE, masquerades as “Microsoft Office Word Editor” inside Chromium-based browsers. Beyond stealing cookies, browsing history, and credentials entered into forms, it enables operators to execute JavaScript within webpages, manipulate…
-
12 Best Machine Identity Management Solutions Compared (2026): Features Pricing
CyberArk (Venafi) is the best machine-identity anchor for enterprise certificate estates, while Keyfactor pairs lifecycle with its own PKI and the SPIFFE-native insurgents (SPIRL, Smallstep) define the workload-identity frontier. We compared 12 vendors across three lanes certificate lifecycle, workload identity, and API/machine credentials because “machine identity” is now three purchases, and the 47-day TLS countdown…