Tag: login
-
Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor
The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-mustang-panda-hackers-deploy-infostealers-via-coolclient-backdoor/
-
ShinyHunters Target 100+ Firms Using Phone Calls to Bypass SSO Security
ShinyHunters is driving attacks on 100+ organisations, using vishing and fake login pages with allied groups to bypass SSO and steal company data, reports Silent Push. First seen on hackread.com Jump to article: hackread.com/shinyhunters-target-firms-bypass-sso-security/
-
Okta Flags Customized, Reactive Vishing Attacks Which Bypass MFA
Threat actors posing as IT support teams use phishing kits to generate fake login sites in real-time to trick victims into handing over credentials First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/okta-flags-vishing-attacks-which/
-
Okta Flags Customised, Reactive Vishing Attacks Which Bypass MFA
Threat actors posing as IT support teams use phishing kits to generate fake login sites in real-time to trick victims into handing over credentials First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/okta-flags-vishing-attacks-which/
-
Fortinet confirms new zero-day attacks against customer devices
cloud-init@mail.io and cloud-noc@mail.io. Other admin accounts are created with the names: audit, backup, itadmin, secadmin, and support. Mitigation: If these or other IOCs such as IP addresses are identified in configurations or the device logs, the system and its configuration should be considered compromised. Fortinet recommends updating the device to the latest available software release,…
-
149M Logins from Roblox, TikTok, Netflix, Crypto Wallets Found Online
Another day, another trove of login credentials in plain text found online. First seen on hackread.com Jump to article: hackread.com/logins-roblox-tiktok-netflix-crypto-wallets-found/
-
Data Leak Exposes 149M Logins, Including Gmail, Facebook
A massive unsecured database exposed 149 million logins, raising concerns over infostealer malware and credential theft. The post Data Leak Exposes 149M Logins, Including Gmail, Facebook appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-149-million-passwords-exposed-infostealer-database/
-
Okta users under attack: Modern phishing kits are turbocharging vishing attacks
Threat actors who specialize in vishing (i.e., voice phishing) have started using phishing kits that can intercept targets’ login credentials while also allowing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/23/okta-vishing-adaptable-phishing-kits/
-
149 Million Usernames and Passwords Exposed by Unsecured Database
This “dream wish list for criminals” includes millions of Gmail, Facebook, banking logins, and more. The researcher who discovered it suspects they were collected using infostealing malware. First seen on wired.com Jump to article: www.wired.com/story/149-million-stolen-usernames-passwords/
-
Critical GNU InetUtils telnetd Flaw Lets Attackers Bypass Login and Gain Root Access
A critical security flaw has been disclosed in the GNU InetUtils telnet daemon (telnetd) that went unnoticed for nearly 11 years.The vulnerability, tracked as CVE-2026-24061, is rated 9.8 out of 10.0 on the CVSS scoring system. It affects all versions of GNU InetUtils from version 1.9.3 up to and including version 2.7.”Telnetd in GNU Inetutils…
-
Secure web browsers for the enterprise compared: How to pick the right one
Tags: access, ai, android, api, attack, browser, business, chrome, cloud, computer, control, corporate, data, encryption, endpoint, fortinet, gartner, google, guide, identity, linux, login, malicious, malware, mfa, mobile, monitoring, network, okta, phishing, saas, service, siem, software, technology, threat, tool, training, vpn, windows, zero-trustEnable MFA at the beginning of any browser session by default.Handle isolation controls both with respect to the user’s session and to isolate any application from cross-infection. This means controlling the movement of data between the browser, your particular endpoint and the web application or applications involved.Control access to web destinations, either to allow or…
-
Jordanian Man Pleads Guilty to Selling Stolen Logins for 50 Companies
Jordanian man pleads guilty to selling stolen corporate logins in FBI sting after extradition from Georgia; tied to access of 50+ company networks. First seen on hackread.com Jump to article: hackread.com/jordanian-man-pleads-guilty-sell-companies-stolen-logins/
-
Remcos RAT Campaign Uses Trojanized VeraCrypt Installers to Steal Credentials
AhnLab Security Intelligence Center (ASEC) has identified an active Remcos RAT campaign targeting users in South Korea. The malware is being spread through multiple channels. It often masquerades as VeraCrypt utilities or tools used within illegal online gambling ecosystems. Once installed, the RAT can steal login credentials, monitor user activity, and give attackers remote control…
-
Cybercriminals Impersonate Malwarebytes to Steal User Credentials
As part of an ongoing effort to highlight active and technically interesting intrusions, a new “Flash Hunting Findings” investigation has uncovered a short but well”‘structured malware campaign impersonating MalwareBytes to deliver infostealers and steal user logins and crypto”‘wallet data. The activity was observed between January 11 and January 15, 2026, and is characterized by consistent…
-
Five Chrome extensions caught hijacking enterprise sessions
Blocking defenses and hijacking sessions: The campaign went beyond stealing credentials. Two of the extensions, Tool Access 11 and Data By Cloud 2, incorporated DOM manipulation routines that actively blocked access to security and administrative pages within the targeted platforms. This prevented the enterprise admins from reaching screens to change passwords, view sign-on history, or…
-
Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login
Palo Alto Networks has released security updates for a high-severity security flaw impacting GlobalProtect Gateway and Portal, for which it said there exists a proof-of-concept (PoC) exploit.The vulnerability, tracked as CVE-2026-0227 (CVSS score: 7.7), has been described as a denial-of-service (DoS) condition impacting GlobalProtect PAN-OS software arising as a result of an improper check for…
-
QR codes are getting colorful, fancy, and dangerous
QR codes have become a routine part of daily life, showing up on emails, posters, menus, invoices, and login screens. Security-savvy users have learned to treat links with … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/15/fancy-qr-codes-phishing-risk/
-
Phishing Scams Exploit Browserthe-Browser Attacks to Steal Facebook Passwords
Cybersecurity researchers issue warning over a surge in attacks designed to trick Facebook users into handing over login credentials First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/phishing-scams-exploit-browser/
-
Driving Passwordless Adoption with FIDO and Biometric Authentication
Tags: access, attack, authentication, awareness, banking, breach, business, cloud, compliance, container, control, credentials, cyber, data, defense, fido, finance, fraud, government, Hardware, iam, identity, insurance, login, mobile, passkey, password, phishing, risk, service, technology, threat, trainingDriving Passwordless Adoption with FIDO and Biometric Authentication madhav Tue, 01/13/2026 – 06:13 For decades, passwords have been the default mechanism for securing digital access. They are deeply embedded in enterprise systems and workflows, yet they were never designed to withstand today’s threat landscape. Cybersecurity Sarah Lefavrais – IAM Product Marketing Manager More About This…
-
Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds
New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims. First seen on hackread.com Jump to article: hackread.com/russian-bluedelta-fancy-bear-pdfs-steal-login/
-
Facebook login thieves now using browserbrowser trick
Hackers over the past six months have relied increasingly more on the browser-in-the-browser (BitB) method to trick users into providing Facebook account credentials. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/facebook-login-thieves-now-using-browser-in-browser-trick/
-
Zero-Trust Isn’t Optional Anymore”, It’s Your AI Agent Fire Drill
Here is the ugly truth about security incidents today. The bad guys don’t storm the castle breaking down the walls. Most attacks start with a login that was obtained. Once inside they see where they can go and what they can do. They enter the front door with working keys. And now, because the universe..…
-
QR codes a powerful new phishing weapon in hands of Pyongyang cyberspies
State-backed attackers are using QR codes to slip past enterprise security and help themselves to cloud logins, the FBI says First seen on theregister.com Jump to article: www.theregister.com/2026/01/09/pyongyangs_cyberspies_are_turning_qr/
-
Microsoft Mandates MFA for Microsoft 365 Admin Center Access
Microsoft is tightening security for its cloud customers by makingmulti-factor authenticationmandatory for anyone accessing the Microsoft 365 admin center, effectively ending password-only logins forhigh-privilegeadmin portals. The enforcement will fully kick in on February 9, 2026, following a phased rollout that began in early 2025. Deadline and enforcement scope Under the new policy, admin users who…
-
Three Malicious NPM Packages Target Developers’ Login Credentials
Security researchers at Zscaler ThreatLabz have uncovered three malicious npm packages designed to install a sophisticated remote access trojan (RAT) targeting JavaScript developers. The packages, named bitcoin-main-lib, bitcoin-lib-js, and bip40, collectively registered over 3,400 downloads before being removed from the npm registry in November 2025. The attack exploits developer trust in the legitimate BitcoinJS project…
-
Passwords are where PCI DSS compliance often breaks down
Most PCI DSS failures do not start with malware or a targeted attack. They start with everyday behavior. Reused passwords. Credentials stored in spreadsheets. Shared logins … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/08/passwords-pci-dds-compliance/
-
Malicious NPM Packages Deliver NodeCordRAT
IntroductionZscaler ThreatLabz regularly monitors the npm database for suspicious packages. In November 2025, ThreatLabz identified three malicious packages: bitcoin-main-lib, bitcoin-lib-js, and bip40. The bitcoin-main-lib and bitcoin-lib-js packages execute a postinstall.cjs script during installation, which installs bip40, the package that contains the malicious payload. This final payload, named NodeCordRAT by ThreatLabz, is a remote access trojan (RAT) with data-stealing capabilities. It is also possible to download bip40…