Search
Results for "Credential".
Hackers compromised 4,800 GitHub accounts to steal cloud credentials and secrets, including those from Fortune 100 companies and government entities. The threat actor used malicious workflows to inject stolen data into open-source software ecosystems.
Attackers are using Alibaba Cloud to host self-managed instances of AntiFox, an open-source agentic penetration testing platform, to target web services and AWS environments. [.
Blockchain intelligence firm Chainalysis reports a breach exposing credentials and live tokens for all customers, affecting law enforcement, financial institutions, and cryptocurrency businesses worldwide.
OpenCode, an AI coding project, experienced a security breach exposing API keys used by users with external providers. Here's how to protect your credentials and minimize risk.
More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform's security measures to prevent accidental leaks of sensitive data.
Threat actors are increasingly switching from AI-powered coding assistants to multi-agent frameworks that automate every stage of an attack.
AI is making phishing, credential theft, and social engineering faster and more efficient, while traditional trust signals such as passwords, MFA, IP reputation, and geolocation become easier to bypass.
Cisco is warning that a high-severity Secure Firewall Management Center (FMC) static credential vulnerability, tracked as CVE-2026-20316, was actively exploited in zero-day attacks to gain unauthorized access to vulnerable devices.
In a new update, OpenAI says its AI models also used publicly exposed credentials to compromise accounts on four third-party services during the recent attack on Hugging Face, expanding the scope of the four-day security incident to other.
A compromised SSO login can provide attackers with access to multiple enterprise applications and services.
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.
Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to developers and users of Paysafe, Skrill, and Neteller payment applications.
The massive FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware operations, suggesting the stolen Fortinet credentials were intended to fuel future network intrusions.
Security firm SOCRadar says the large-scale FortiBleed campaign targeting Fortinet FortiGate devices used custom sniffers to harvest authentication secrets from compromised firewalls and steal credentials.
Threat actors are leveraging massive infostealer collections into searchable underground services, allowing buyers to request specific credentials for various targets.
A significant data leak known as FortiBleed has exposed Fortinet and FortiGate VPN credentials for 73,932 firewall URLs at organizations worldwide, including major companies like Chevron, Samsung, and Foxconn.
More than 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack that distributed a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma.".
A supply chain attack targeting the Laravel Lang localization packages has exposed developers to a sophisticated credential-stealing malware campaign after attackers abused GitHub version tags to distribute malicious code through Composer.
US authorities have dismantled the FaceStealer campaign, a North Korean operation responsible for over $400 million in cryptocurrency theft, using sophisticated social engineering tactics.
An AI agent built by a mid-sized company's accounts team inadvertently exposed five critical security gaps in an enterprise setting.
Europol and international law enforcement partners have dismantled the Gootloader, CastleRAT, and StealC malware infrastructure, seizing hundreds of servers and domains used by cybercriminals.
Apify has taken swift action after detecting unauthorized access to its internal systems, rotating API tokens, and prompting 2FA resets for affected users.
ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients, impacting dozens of organizations.
Notion, the digital workspace platform, has disclosed that a security breach at its AI infrastructure provider, Fireworks AI, exposed customer chat transcripts in a limited number of workspaces, following a series of data breaches.
Maersk announced that a threat actor gained unauthorized access to a local legacy system inherited through an earlier acquisition and extracted data from it. [.
N-able released hotfixes to address zero-day bugs affecting its N-central remote monitoring and management (RMM) platform, which were publicly disclosed over the weekend and forced it to take vulnerable hosted environments offline. [.
Microsoft says the November 2026 cumulative updates resolve USB audio issues plaguing Windows users who have installed security updates released since September. [.
The US Cybersecurity and Infrastructure Security Agency (CISA) warned on Tuesday that hackers are now exploiting a high-severity Cisco BroadWorks vulnerability in attacks. [.
Microsoft has fixed Outlook sign-in and mail delivery issues on Exchange Server systems after installing the October 2026 Windows Server security updates. [.
Cloud hosting provider Railway says hackers exploited vulnerabilities in its infrastructure to steal customer authentication secrets and generate approximately $740,000 in fraudulent AI usage, potentially exposing credentials for up to 100,000 workspaces. [.
