SecurityNewGoogle Doc Credentials Leak Serves as a Cautionary Tale
A developer's habit of storing passwords in a shared Google Doc led to a search-indexed exposure of staging credentials.
> Search
27 results for “credentials”
SecurityNew
SecurityChrome's New Defense Against Cookie Theft
Device-bound session credentials could curb account takeovers, but rollout is limited for now.
SecurityDevice Trust Emerges as Key Defense in AI Era
As AI accelerates account takeover attacks, experts argue credentials alone can no longer secure access.
Cyber CrimeFake Solidity Extensions Steal Crypto Wallets
A malicious VS Code extension pack targets developers, exfiltrating wallets, credentials, and API keys via Telegram.
SecurityClickFix Delivers Go-Based macOS Infostealer
Huntress discovers macOS stealer via ClickFix, targeting crypto wallets and credentials.
Cyber CrimeMac Crypto Drainer Uses ClickFix Tactics
A newly identified Go-based malware targets macOS users by leveraging social engineering to steal credentials and crypto assets.
SecuritySticky Note Security Failures Exposed
A company’s attempt to simplify hardware deployment led to a significant data breach after IT staff left credentials in plain sight.
Russian APT29 Targets Hotel Wi-Fi Access
Microsoft identifies a state-sponsored campaign exploiting hotel captive portals to deploy infostealers and harvest credentials.
SecurityCaptiveCrunch Exploits Hospitality Wi-Fi
Threat actors are hijacking hotel network gateways to push fraudulent software updates and capture user credentials via deceptive portals.
SecurityCritical Shell Injection Hits Wazuh Workflows
A critical shell injection vulnerability in Wazuh workflows allows attackers to execute arbitrary commands and steal sensitive credentials via pull requests.
Cyber CrimeHealthcare SSO Targeted by ShinyHunters
A new advisory from Health-ISAC warns that extortion actors are compromising single-sign-on credentials to exfiltrate cloud data.
SecurityCritical RCE Flaw Found in 9router 0.4.59
A chain of vulnerabilities in 9router allows unauthenticated attackers to gain full control of the host operating system via default credentials.
SecurityCritical Pheditor Auth Bypass Found
A flaw in the Pheditor forced password-change flow allows unauthenticated attackers to hijack administrative accounts on systems using default credentials.
SecurityBudibase REST Datasource Credential Theft
A critical vulnerability in Budibase allows unauthenticated attackers to steal stored REST datasource credentials via a cross-origin request leak.
SecurityHugging Face Incident Exposes Risks
Internal datasets and service credentials were compromised as attackers utilized a malicious dataset to gain unauthorized access.
SecurityNadMesh Botnet Turns AI Tools Into Hooks
A newly identified Go-based botnet is pivoting from simple compute-hijacking to harvesting cloud credentials from exposed AI services.
SecurityWireGuard Easy Vulnerability Allows Unauthorized Credential Recovery
A critical flaw in WireGuard Easy allows unauthenticated attackers to brute-force weak tokens and hijack VPN peer credentials.
SecurityRussian Threat Group Leverages Trojan Apps
The UAT-11795 threat actor is deploying the Starland RAT via trojanized installers to harvest credentials and crypto assets.
SecurityRansomware’s Pivot to Identity Theft
New findings reveal that compromised credentials are now the primary catalyst for ransomware breaches, eclipsing software flaws.
Cyber CrimeCrashStealer Malware Leverages Apple Developer IDs to Bypass Security
A sophisticated new macOS threat masquerades as system crash reporting tools to siphon credentials through a notarized infection chain.
SecurityThe Silent OAuth Exploit Bypassing Cloud Identity Defenses
Threat actors are weaponizing OAuth client ID spoofing to validate stolen credentials while remaining invisible to standard telemetry.
SecurityThe Hidden Predictability of AI-Generated Security Credentials
Researchers warn that asking AI chatbots to create passwords results in dangerously predictable patterns rather than true randomness.
Cyber CrimeSupply Chain Breach Hits Jscrambler NPM Package Integrity
Compromised publishing credentials allowed attackers to inject malicious binaries into widely used Jscrambler NPM versions.
SecurityBeyond Credentials: The Year Salesforce Was Used Against Itself
Microsoft details how threat actors bypassed traditional defenses to compromise Salesforce environments via OAuth and guest access.
SecurityCrashStealer Malware Evades MacOS Defenses via Signed Notarization
A sophisticated new C++ information stealer leverages legitimate Apple developer IDs to bypass Gatekeeper and harvest user credentials.
SecurityWhen Internal Missteps Expose Critical Cloud Infrastructure
A contractor's exposed repository forced a rapid internal incident response at CISA to secure sensitive cloud credentials.
Cyber CrimeDormant Infostealer Infection Turns World Cup Spat Into Data Breach
A decade-long developer's device, infected nearly a year ago, likely provided the gateway for a breach of the Argentine Football Association.