Cyber CrimeFake Twilio npm Probe Hid Credential Theft
Researchers say a package posing as an authorized Twilio bug-bounty probe went through 11 versions before trying to exfiltrate API credentials.
> Search
30 results for “credentials”
Cyber Crime
Cyber CrimeThird-Party App Key Opens Door to BigCommerce Data Theft
Attackers used a compromised credential from the Ribon app to pull customer data from hundreds of online stores, exposing a soft spot in e-commerce supply chains.
Cyber CrimeStolen Passwords Expose 1,787 Water Providers
SpyCloud research finds infostealer malware has harvested credentials tied to 1,787 U.S. water and wastewater organizations, some reaching operational networks.
Cyber CrimeRust Developers Hit by Fake Job Call Scam
Rust team members and crate owners are being targeted by attackers who pose as recruiters to hijack credentials and push malicious packages.
SecurityWhy identity dark matter hides in plain sight
The Hacker News explains how unregistered accounts and machine credentials keep IAM blind spots open across cloud estates.
Cyber CrimeKREMLIN Malware Hijacks Chrome and Edge
Elastic Security Labs details a Brazilian banking malware toolkit that abuses browser extension installs and Ethereum smart contracts to steal credentials and sessions.
Cyber CrimeFake Hires Get Network Access First
A HYPR report finds most fraudulent hires receive corporate credentials before detection, leaving firms exposed to insider risk.
Cyber CrimeMeshCentral Backdoor Hid Inside 3BB Network
Hunt.io says an attacker used a legitimate remote-management tool to hold root access inside Thailand's 3BB and target subscriber credentials.
SecurityMarimo RCE Hit by Human at Machine Speed
Sysdig says a hand-built toolkit let a human operator exploit a Marimo flaw in eight seconds, without any sign of LLM use.
SecurityLiteLLM's Default Admin Key Exposed
A Wiz Research scan found 294 exposed LiteLLM gateways accepted the example admin key sk-1234, granting access to stored provider credentials.
SecurityRevoking Leaked API Keys Needs a Standard
Proposal for ORKS would add self-destruct capability to API keys, giving scanners and agents a way to revoke stolen credentials.
Cyber CrimeSlim Spider Targets Crypto Custody in Brazil
CrowdStrike uncovers Brazil-based threat actor Slim Spider stealing cloud credentials to access cryptocurrency custody secrets.
SecurityPhaaS Campaign Targets IT Providers via M365 Phishing
CloudSEK reports BigBear 2.0 phishing operation stole over 5,100 Microsoft credentials, hitting IT firms hardest.
SecurityPaperCut Attacks Target Education Sector
Attackers exploit two PaperCut flaws to steal credentials from schools and universities in the U.S. and Europe.
SecurityReal-time phishing platform steers attacks
A phishing platform gives attackers live control over victim sessions, adapting prompts as credentials are harvested.
SecurityMLflow SSRF Flaw Exploited for Cloud Credential Theft
Attackers are exploiting critical MLflow and FUXA vulnerabilities to steal cloud credentials and execute code.
SecuritySnowflake CI/CD Flaw Opens Door to Issue-Based Injection
A GitHub Actions workflow flaw in Snowflake's connector repo allowed crafted issues to execute commands with exposed Jira credentials.
Cyber CrimeFrench Tax Breach Hits 680K
France's tax agency says 678,000 people had data stolen in a credential-based attack.
SecurityInfostealers Fuel 1.7B Credential Haul
Flashpoint logs 7.4M infostealer infections and 1.7B credentials stolen in H1 2026, up 27%.
SecurityGoogle Doc Credentials Leak Serves as a Cautionary Tale
A developer's habit of storing passwords in a shared Google Doc led to a search-indexed exposure of staging credentials.
SecurityChrome's New Defense Against Cookie Theft
Device-bound session credentials could curb account takeovers, but rollout is limited for now.
SecurityDevice Trust Emerges as Key Defense in AI Era
As AI accelerates account takeover attacks, experts argue credentials alone can no longer secure access.
Cyber CrimeFake Solidity Extensions Steal Crypto Wallets
A malicious VS Code extension pack targets developers, exfiltrating wallets, credentials, and API keys via Telegram.
SecurityClickFix Delivers Go-Based macOS Infostealer
Huntress discovers macOS stealer via ClickFix, targeting crypto wallets and credentials.
Cyber CrimeMac Crypto Drainer Uses ClickFix Tactics
A newly identified Go-based malware targets macOS users by leveraging social engineering to steal credentials and crypto assets.
SecuritySticky Note Security Failures Exposed
A company’s attempt to simplify hardware deployment led to a significant data breach after IT staff left credentials in plain sight.
Russian APT29 Targets Hotel Wi-Fi Access
Microsoft identifies a state-sponsored campaign exploiting hotel captive portals to deploy infostealers and harvest credentials.
SecurityCaptiveCrunch Exploits Hospitality Wi-Fi
Threat actors are hijacking hotel network gateways to push fraudulent software updates and capture user credentials via deceptive portals.
SecurityCritical Shell Injection Hits Wazuh Workflows
A critical shell injection vulnerability in Wazuh workflows allows attackers to execute arbitrary commands and steal sensitive credentials via pull requests.
Cyber CrimeHealthcare SSO Targeted by ShinyHunters
A new advisory from Health-ISAC warns that extortion actors are compromising single-sign-on credentials to exfiltrate cloud data.