Tag: credentials
-
The Top 10 Attack Surface Exposures in 2026
Breaches don’t always start with a zero-day. An exposed admin panel can get brute-forced, or credentials reused from a previous attack. But when a vulnerability does drop, like MongoBleed earlier this year, which let attackers pull credentials and session tokens from server memory without authentication, anything internet-facing is immediately at risk.With time-to-exploit now down to…
-
JetBrains Plugin Security Alert: 70,000+ Installs Linked to AI Key Theft
A coordinated supply chain attack targeting JetBrains IDE users has exposed over 70,000 developers to silent credential theft. The campaign involves at least 15 malicious plugins distributed via the JetBrains Marketplace, masquerading as AI-powered coding assistants built on models such as DeepSeek. While these plugins function as advertised, offering features like code review, chat, and…
-
AI agents are turning credential sprawl into an MSSP problem
First seen on scworld.com Jump to article: www.scworld.com/news/ai-agents-are-turning-credential-sprawl-into-an-mssp-problem
-
Rokarolla Android Banking Trojan Enables Device Takeover
Malware Targets Banks, Crypto Platforms and Social Media. Newly surfaced Android-based banking Trojan gives threat actors near-total control over infected devices, letting them steal user credentials for direct access to financial accounts, says researchers. Rokarolla tricks users into side-loading malicious versions of popular, high traffic apps. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/rokarolla-android-banking-trojan-enables-device-takeover-a-31996
-
Fileless Phantom Stealer Targets Browser Credentials
In addition to executing entirely in memory, the malware’s infection chain incorporates other anti-analysis techniques designed to frustrate detection. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/fileless-phantom-stealer-targets-browser-credentials
-
Chinese Espionage Actor Abuses Email Rules to Steal Research Data
Tags: china, compliance, credentials, data, email, espionage, google, group, intelligence, malware, threatThreat Actor Silently Forwarded Sensitive Emails Matching Strategic Topics. Google says Chinese espionage group UNC6508 compromised REDCap environments at North American research institutions, deployed custom malware, stole credentials and covertly forwarded strategically relevant emails through abused compliance rules to support long-term intelligence collection. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-espionage-actor-abuses-email-rules-to-steal-research-data-a-31993
-
Developer laptops are the credential store attackers are picking through in 2026, GitGuardian announces Endpoint Protection
New York, New York, June 16th, 2026, CyberNewswire GitGuardian is introducing Developer Endpoint Protection, extending its secrets and non-human identity (NHI) security platform coverage to developer workstations. After 12 months of supply-chain campaigns harvesting credentials from developer machines, CISOs and IT leaders are reopening a question many considered settled: what does endpoint protection have to…
-
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google discovered and disrupted the sprawling campaign, which stole RedCAP credentials to breach numerous institutions and exfiltrate sensitive data. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected
-
Developer laptops are the credential store attackers are picking through in 2026, GitGuardian announces Endpoint Protection
New York, New York, 16th June 2026, CyberNewswire First seen on hackread.com Jump to article: hackread.com/developer-laptops-are-the-credential-store-attackers-are-picking-through-in-2026-gitguardian-announces-endpoint-protection/
-
Hackers Abuse Microsoft OAuth Device Code Flow to Take Over Microsoft 365 Accounts
An active campaign in which attackers are abusing Microsoft’s OAuth 2.0 Device Authorization Grant (device code) flow to take over Microsoft 365 accounts. Rather than capturing credentials with a fake login page, the threat actors persuade victims to complete a genuine Microsoft authentication process that, unbeknownst to them, authorizes an attacker-controlled “device.” The result: fully…
-
China-linked actor spent two years inside medical research networks
Tags: china, credentials, cyberespionage, email, google, group, intelligence, military, network, threatChina’s UNC6508 hid in North American medical research networks for 2 years, stealing credentials and forwarding emails to Gmail Google’s Threat Intelligence Group published a report this week on UNC6508, a China-linked cyberespionage group that breached North American medical and military research organizations and stayed hidden for more than two years. The earliest confirmed intrusion…
-
PRC-Nexus Hackers Abuse REDCap Servers to Monitor US Medical Research Organizations
A sophisticated, long-running cyberespionage campaign attributed to UNC6508, a People’s Republic of China (PRC)-nexus threat actor, that systematically targets North American academic, medical, and military research institutions. The campaign, active since at least September 2023, remained undetected for over a year while the threat actor silently harvested credentials, exfiltrated sensitive communications, and maintained persistent access across victim…
-
NewCore Launches With $66M to Rebuild Identity for AI Agents
Startup Targets Incumbents Doing Directories, Authentication, Federation and SSO. NewCore, founded by Dome9 creator Zohar Alon, emerged from stealth with $66 million to build security-first identity infrastructure designed to manage the explosion of autonomous AI agents, machine identities and cryptographic credentials expected across modern enterprises. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/newcore-launches-66m-to-rebuild-identity-for-ai-agents-a-31974
-
China-Nexus Actor Spy on US Researchers Undetected for a Year
Google discovered and disrupted the sprawling campaign, which stole RedCAP credentials to target numerous institutions and exfiltrate sensitive data. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected
-
China-Nexus Actor Spied on US Researchers Undetected for a Year
Google discovered and disrupted the sprawling campaign, which stole RedCAP credentials to target numerous institutions and exfiltrate sensitive data. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected
-
1Password Buys Apono to Expand AI Access Governance
Buying New York Startup Adds Just-in-Time Authorization and Governance Controls. 1Password acquired access governance startup Apono to combine credential security, just-in-time authorization and intent-based access controls into a unified platform designed to govern humans, machines and AI agents while reducing risks tied to static permissions. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/1password-buys-apono-to-expand-ai-access-governance-a-31963
-
Payroll Pirate Campaign Uses AiTM Session Hijacking to Bypass MFA and Redirect Salaries
A financially motivated campaign dubbed >>Payroll Pirate<< has emerged using advanced phishing and adversary-in-the-middle (AiTM) session hijacking to bypass multifactor authentication (MFA) and reroute payroll disbursements. This operation targets payroll and HR portals at mid-market and enterprise organizations, chaining credential theft, real-time session interception, and subtle profile changes to siphon funds without triggering conventional alarms.…
-
New DPAPISnoop Tool Enables Extraction of CREDHIST Hashes From Windows Systems
A newly enhanced version of the open-source DPAPISnoop tool is drawing attention in the security community after researchers demonstrated its ability to extract offline-crackable hashes from Windows DPAPI credential history (CREDHIST) files, potentially exposing historical password material and enabling deeper insight into user password patterns over time. New DPAPISnoop Tool Developed by Nettitude’s CyberLabs team,…
-
Infostealers, AI, and a 90% Affiliate Cut Fuel The Gentlemen group’s Rise
The Gentlemen ransomware used infostealer credentials, AI tools, and affiliates to hit 483 victims across 66 countries in under a year. The Gentlemen surfaced as a ransomware operation in September 2025 and by June 13, 2026 had listed 483 victims on their dark-web leak site, 380 of them in 2026 alone. That makes them the…
-
Open-source CI/CD abuse detector guards against stolen credential attacks
CI/CD Abuse Detector is an open-source project that uses a large language model to flag suspicious changes to continuous integration and continuous deployment pipelines, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/15/ci-cd-abuse-detector-open-source/
-
How Security Debt Can Accumulate Faster Than Technical Debt
Security debt sounds like a tidy metaphor until the first breach turns it into a billing department with teeth. Technical debt behaves like clutter. Code gets ugly, builds slow down, developers complain, and deadlines wobble. Security debt behaves like contagion. One weak credential policy, one forgotten admin panel, and one logging gap cause the system…
-
Over 400 Arch Linux AUR Packages Hijacked to Deploy Infostealer and eBPF Rootkit
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide…
-
400+ Arch Linux AUR Packages Hijacked to Install Rust Credential Stealer
Attackers took over more than 400 packages in the Arch User Repository (AUR) this week and rewrote their build scripts to install a credential stealer on any machine that built them.The malware is a Rust binary built to harvest developer secrets. When it lands with root, it can also load an eBPF rootkit to hide…
-
Google Sues Chinese Phishing Service Over Gemini Abuse
Complaint Says Service Generated More Than 1.5 Million Malicious URLs. Google has sued a Chinese phishing-as-a-service provider accused of teaching customers to use Gemini to generate and customize scam websites, a campaign linked to more than 1.59 million phishing URLs, over 100,000 victims, and widespread credential and financial theft. First seen on govinfosecurity.com Jump to…
-
Over 400 Arch Linux packages compromised to push rootkit, infostealer
More than 400 packages in the Arch User Repository (AUR) are distributing a Linux rootkit and infostealer malware targeting credentials and access tokens. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/over-400-arch-linux-packages-compromised-to-push-rootkit-infostealer/
-
OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials
A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product. For $250 a month buyers receive a web-based control panel, a payload builder, tiered licensing, and even refund guarantees if a build is detected lowering the barrier for…
-
OnyxC2 Stealer Uses Cloudflare-Fronted C2 to Exfiltrate Browser Data and Credentials
A new commercial-grade information stealer, marketed as OnyxC2, surfaced on cybercrime forums in early 2026 and demonstrates how commodity malware is increasingly packaged as a full-service product. For $250 a month buyers receive a web-based control panel, a payload builder, tiered licensing, and even refund guarantees if a build is detected lowering the barrier for…
-
Gesundheitsdaten gehören zu den wertvollsten Gütern der Cyberkriminalität
Nach Analyse des Handels mit Gesundheitsdaten im Cyberuntergrund: Deutschland zählt zu den Ländern mit den meisten öffentlich erreichbaren Medizinsystemen. TrendAI, der Enterprise-Cybersecurity-Geschäftsbereich von Trend Micro, veröffentlicht neue Forschungsergebnisse, die zeigen: Gestohlene Gesundheitsdaten werden heute in einer ausgereiften Underground-Economy gehandelt, an der Ransomware-Gruppen, Access Broker, Fraud-Marktplätze und Credential-Händler gleichermaßen beteiligt sind. Über einen Zeitraum von… First…
-
CISA Warning: LiteLLM Flaw Could Expose Enterprise AI Gateways
CISA’s LiteLLM warning shows why AI gateways and agents need service account governance, scoped access, credential rotation, and audit trails. The post CISA Warning: LiteLLM Flaw Could Expose Enterprise AI Gateways appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-litellm-cisa-ai-gateway-service-account-governance/