Tag: password
-
Crime Gang Sells Access to 74,000 Fortinet Firewall Devices
Ongoing Campaign May Be Grabbing Legacy Passwords From Fortinet FortiGate Devices. Cybercriminals are selling access to 75,000 Fortinet FortiGate devices with VPN and web management interfaces, and the admin credentials appear to be legitimate and recently harvested as part of a still-live campaign, security experts warned. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/crime-gang-sells-access-to-74000-fortinet-firewall-devices-a-32015
-
Malware erbeutet 124 Millionen Passwörter was du jetzt tun solltest
First seen on t3n.de Jump to article: t3n.de/news/haveibeenpwned-malware-erbeutet-124-millionen-nutzerdaten-was-du-jetzt-tun-solltest-1747930/
-
Google Adds New Android Controls for WhatsApp Backups, Password Transfers
Google’s June 2026 Android system updates add WhatsApp backup controls, Play Protect checks, passkey portability, and Play Store AI search. The post Google Adds New Android Controls for WhatsApp Backups, Password Transfers appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-android-june-2026-system-updates/
-
Modified OpenSSH Binaries Let Velvet Ant Steal Passwords, Log Commands, and Hide Activity
A long-running, stealthy campaign attributed to the China-nexus actor tracked as Velvet Ant has been found to include deeply engineered backdoors in the authentication stack: modified OpenSSH binaries and tampered PAM modules that exfiltrate credentials, record every executed command, and conceal attacker activity. The discovery, part of Sygnia’s Operation Highland investigation, reveals nearly a decade…
-
Riesige Angriffswelle: Hacker knacken Admin-Passwörter von 74.000 Firewalls
Angreifer attackieren massenhaft Firewalls des Herstellers Fortinet. Sie sollen bereits Admin-Zugangsdaten für 74.000 Geräte erbeutet haben. First seen on golem.de Jump to article: www.golem.de/news/riesige-angriffswelle-hacker-knacken-admin-passwoerter-von-74-000-firewalls-2606-209916.html
-
Smashing Security podcast #472: AI gets hacked, and BitLocker gets bypassed
What if your AI coding assistant could be tricked into stealing your own company’s secrets – by reading a single booby-trapped bug report? No phishing email. No malware. No password ever stolen. Just an AI doing exactly what it was told. First seen on grahamcluley.com Jump to article: grahamcluley.com/smashing-security-podcast-472/
-
FortiBleed Exposes Admin Passwords for 75,000 Fortinet Firewalls
FortiBleed: Admin Passwords for 75,000 Fortinet Firewalls Are Out in the Wild. Half the Internet-Facing Fortinets on the Planet. Security researcher Bob Diachenko found a server sitting open on the internet containing what appeared to be valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for tens of thousands of organizations. He posted…
-
Über 400 ArchPakete im AUR manipuliert
Hacker haben über 400 Community-Pakete im Arch User Repository manipuliert, um Passwörter zu stehlen und ein eBPF-Rootkit zu installieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/linux-pakete-manipuliert
-
Über 400 ArchPakete im AUR manipuliert
Hacker haben über 400 Community-Pakete im Arch User Repository manipuliert, um Passwörter zu stehlen und ein eBPF-Rootkit zu installieren. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/linux-pakete-manipuliert
-
Modular Phishing Kit Uses GitHub Pages to Steal Payment Card Details and Passwords
A sophisticated, long-running phishing operation has evolved into a serverless, modular campaign that weaponizes GitHub Pages to harvest payment card data, credentials, and customer identifiers from banking customers in Mexico. The campaign’s architecture centers on a phishing kit containing a selector panel that operators use to generate institution-specific landing pages. Those landing pages impersonate at…
-
Passwörter sind out: Die Passkeys kommen
Einfacher in der Nutzung und schwerer zu stehlen: Passkeys gelten immer stärker als sichere Alternative zu Passwort, Phishing und gestohlenen Zugangsdaten. Passwörter schützen Online-Konten seit Jahrzehnten, wurden aber nie für die Bedrohungslage entwickelt, mit der Nutzer heute konfrontiert sind. Phishing, gestohlene Zugangsdaten und die Wiederverwendung derselben Passwörter machen sie nach wie vor zu einer… First…
-
Amos Stealer Targets macOS Keychain Files and Browser Passwords
Amos Stealer targets macOS users through fake downloads, stealing Keychain files, browser passwords, cookies, and developer configs for data theft. First seen on hackread.com Jump to article: hackread.com/amos-stealer-macos-keychain-files-browser-passwords/
-
Mit Malware erbeutet: 124 Millionen neue Passwörter bei HaveIBeenPwned
Cyberkriminelle greifen mit Infostealer-Malware häufig Zugangsdaten ab. HaveIBeenPwned hat seine Datenbank um eine große Sammlung davon erweitert. First seen on golem.de Jump to article: www.golem.de/news/mit-malware-erbeutet-124-millionen-neue-passwoerter-bei-haveibeenpwned-2606-209825.html
-
Ghostwriter APT Uses Fake Gmail Login Panels to Steal Passwords and 2FA Codes
Ghostwriter (UNC1151) has escalated its long-standing phishing operations by deploying convincing fake Gmail login panels that harvest both passwords and two-factor authentication (2FA) codes, CERT Polska reports. The group historically focused on Polish email providers such as Onet, Wirtualna Polska and Interia shifted in March 2026 to high-volume Gmail-targeted campaigns. Attackers send professionally worded Polish-language…
-
The Onboarding Password Mistake That Creates Unnecessary Risk
Employee onboarding is a busy time for IT teams. New starters need devices, accounts, access permissions, and passwords, all delivered within a tight timeframe.That usually means sharing a temporary “first-day” password so employees can access systems for the first time. The issue is that these passwords don’t always stay temporary. They may be sent over…
-
Datenverlust im Passwortmanager: Passwort-Tresore plötzlich leer
Tags: passwordDer niederländische Provider Ziggo hat einen Passwortmanager im Angebot. Bei einer Störung sind dort Passwörter unwiederbringlich verloren gegangen. First seen on golem.de Jump to article: www.golem.de/news/zugangsdaten-ade-datenverlust-bei-passwortmanager-trifft-kunden-eines-providers-2606-209782.html
-
New DPAPISnoop Tool Enables Extraction of CREDHIST Hashes From Windows Systems
A newly enhanced version of the open-source DPAPISnoop tool is drawing attention in the security community after researchers demonstrated its ability to extract offline-crackable hashes from Windows DPAPI credential history (CREDHIST) files, potentially exposing historical password material and enabling deeper insight into user password patterns over time. New DPAPISnoop Tool Developed by Nettitude’s CyberLabs team,…
-
Wurm Miasma infiltriert 73 Microsoft-Repositories
GitHub hat 73 infizierte Microsoft-Repositories gesperrt. Der Krypto-Wurm Miasma stahl dort gezielt Passwörter und API-Schlüssel von Entwicklern. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/wurm-miasma-microsoft-repositories
-
21,786 Home Cameras, No Password, No Warning
21,786 live cameras stream with zero authentication. Cheap gear is the real risk, webcamXP open 46% of the time. Your home router is the broadcast tower. In May 2026, Mysterium VPN queried a public internet-wide device index to count every camera and recorder that answers the open internet. They found more than three million reachable…
-
Hacker stehlen Passwörter mit TikTok-Videos: Falsche Spotify-Hacks
Cyberkriminelle nutzen Videos für kostenloses Spotify Premium auf TikTok, um Schadsoftware zum Diebstahl von Passwörtern und Krypto-Wallets zu verbreiten. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-passwoerter-tiktok-videos
-
Meta Instagram Recovery Flaw Exposed More Than 20,000 Accounts
Meta says a bug in its AI-assisted account recovery workflow likely let attackers reset passwords for more than 20,000 Instagram accounts. The post Meta Instagram Recovery Flaw Exposed More Than 20,000 Accounts appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-meta-instagram-recovery-flaw-20k/
-
GitHub disables Microsoft repos pushing password-stealing malware
Microsoft removed 73 repositories across its Azure, microsoft, Azure-Samples, and MicrosoftDocs organizations on GitHub, disrupting continuous integration pipelines. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/github-disables-microsoft-repos-pushing-password-stealing-malware/
-
Passwort-Bypass bei Check Point: Hacker greifen VPN-Systeme an
Eine Logiklücke in Check-Point-VPNs (CVE-2026-50751) erlaubt Passwörter zu umgehen. Die Schwachstelle wird aktiv für Ransomware-Angriffe ausgenutzt. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/passwort-bypass-bei-check-point
-
Apple Intelligence can now replace weak passwords without user intervention
Apple’s next generation of Apple Intelligence, the company’s personal intelligence system, expands its capabilities and introduces new security features in Passwords. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/06/09/apple-intelligence-automated-passwords-security-updates/
-
Datenpanne bei Instagram: Mark Zuckerbergs Handynummer plötzlich im Netz
Tags: passwordDurch einen Bug beim Passwort-Reset von Instagram ließen sich zeitweise Rufnummern anderer Nutzer abgreifen. Auch Zuckerberg blieb nicht verschont. First seen on golem.de Jump to article: www.golem.de/news/datenpanne-bei-instagram-mark-zuckerbergs-handynummer-ploetzlich-im-netz-2606-209563.html
-
Infosecurity Europe: Why JLR’s CISO Enforced In-Person Password Resets Following Cyber-Attack
Speaking at Infosecurity Europe, Ashish Shrestha, former CISO at Jaguar Land Rover revealed why he wanted over 30,000 employees to change their passwords in the immediate aftermath of the incident First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/jlr-cyberattack-ciso-inperson/
-
New Apple feature automatically changes your compromised passwords
At WWDC 26, Apple announced an Apple Intelligence-powered feature that can automatically fix weak and compromised passwords. This works in Safari, and it’s rolling out with iOS 27. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/new-apple-feature-automatically-changes-your-compromised-passwords/
-
Microsoft’s open source tools were hacked to steal passwords of AI developers
Microsoft shut down dozens of GitHub code repositories for Azure and AI coding tools after a reported hack. First seen on techcrunch.com Jump to article: techcrunch.com/2026/06/08/microsofts-open-source-tools-were-hacked-to-steal-passwords-of-ai-developers/
-
Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups
Check Point has warned of active exploitation of a critical vulnerability impacting Remote Access VPN and Mobile Access deployments that are configured to use the deprecated IKEv1 key exchange protocol.The vulnerability, tracked as CVE-2026-50751 (CVSS score: 9.3), is a case of a logic flow weakness in certificate validation that allows an unauthenticated remote attacker to…