#Credential Theft
All CosmicBytez Labs articles tagged #Credential Theft, across news, security advisories, how-to guides, and projects.
- News
Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
GhostAction hijacked pyxel's and Uber athenadriver's maintainer accounts, pushing credential-stealing workflows to hundreds of repos in a 500-account wave.
- News
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Socket found 16 fake Firefox extensions cloning Rabby and OKX wallets that stole recovery phrases via Cloudflare Workers before Mozilla's Oct. 5 removal.
- News
ASOS Links Data Breach to Social Engineering Attack, Credential Theft
ASOS confirms a stolen employee login — obtained via social engineering — not a Snowflake hack, was the root cause of its October breach.
- Security
CVE-2026-63688: Missing Authentication in Dell CSM Authorization gRPC Server Exposes Storage Array Credentials
An unauthenticated gRPC server in Dell CSM Authorization lets attackers retrieve admin credentials for every registered storage array.
- News
Alert: FortiBleed Remains an Active Campaign, Can Lock Out Users or Lead to Ransomware
The FBI and Secret Service warn FortiBleed is still active, now tied to 400,000+ Fortinet devices and causing lockouts that precede ransomware attacks.
- News
Microsoft Tracks Active Zimbra CVE-2026-73570 Exploitation: Web Shells, Root Escalation, Stolen Secrets
Microsoft found attackers exploiting Zimbra flaw CVE-2026-73570 to drop JSP web shells, escalate to root via PAM, and steal mailbox auth secrets.
- News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 impersonated ex-White House officials and an Anthropic staffer to phish AI policy experts via a Microsoft OAuth AitM kit.
- News
JadePuffer: Agentic AI Threat Actor Hits Microsoft Azure, Destroys Cloud Resources in Minutes
JadePuffer (Storm-3168) used AI agents and leaked credentials to recon an Azure tenant, then deleted 100+ storage accounts in 7 minutes.
- News
New x47.c Windows Botnet Weaponizes xAI Grok for AI-Powered Persistence and API Draining
Qrator details x47.c, a $950 Windows botnet using xAI Grok for persistence and a novel attack that drains stolen OpenAI/xAI API credits.
- News
Rogue External MFA Providers Can Steal Passwords During Logins
TrustSink lets a privileged Entra admin register a rogue external MFA provider that quietly captures users' passwords in plain text.
- News
CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories
A former employee's still-active GitHub token, compromised in May's TanStack npm attack, let a hacker copy 170 of CrowdSec's private repos.
- News
Identity Visibility in 2026: The Foundation of Identity Security
Why identity visibility — seeing every identity and how its access is actually used — is now foundational to identity security.
- News
Florida DMV Data Breach Tied to ShinyHunters Traced to Officer's Personal Device
ShinyHunters breached Florida's motor vehicle department after exploiting a police officer's credentials stored on a personal device.
- News
Phishing Research Challenges Conventional Security Awareness Testing
Analysis of 2.47 million simulated attacks shows why organizations should measure credential leaks and reporting, not just clicks.
- News
Florida Confirms DMV Database Breached via Stolen Police Account
FLHSMV confirms its DAVID driver database was breached using credentials stolen from an officer's personal device, as ShinyHunters claims 200,000+ records.
- News
Critical Langflow Flaw Exploited to Steal OpenAI and AWS Keys
Attackers are exploiting unauthenticated RCE in Langflow (CVE-2026-0768) to harvest OpenAI and AWS credentials from exposed AI-agent servers.
- News
WordlistLoader and SynkLoader: Two New Windows Malware Loaders Analysed
Security researchers expose WordlistLoader deploying Amatera stealer via ClickFix and SynkLoader delivering a 7-module RAT through Microsoft Teams phishing.
- Security
CVE-2026-53546: Termix WebSocket Host Bypass Grants Cross-User SSH Access
Termix terminal WebSocket accepts attacker-controlled host IDs without ownership checks, enabling cross-user SSH access to any managed server. CVSS 9.6.
- Security
CVE-2026-53548: Termix IDOR Exposes All Stored SSH Passwords to Any User
Termix's password endpoint returns decrypted SSH credentials for any host ID without ownership verification, exposing all stored passwords. CVSS 9.6.
- News
Hacker Claims 3.6 Million Azure Account Records Stolen from Major Companies
A threat actor is selling employee databases allegedly taken from Microsoft Azure infrastructure of multiple Fortune 500 firms via compromised credentials.
- News
Enterprise Perimeter Defenses Improved — Interior Security Collapsed
Picus Blue Report 2026: edge prevention rose to 69% but interior dropped to 37%. Registry credential theft blocked less than 1% of the time.
- Security
CVE-2026-11325: Cloudflare pages-action GitHub Actions RCE
High-severity RCE in cloudflare/pages-action exposes CI/CD credentials. Migrate to wrangler-action before Sept 18, 2026 sunset.
- News
When Credentials Are No Longer Enough: Device Trust in the AI Era
AI is making phishing, credential theft, and MFA bypass faster and cheaper than ever. As traditional trust signals — passwords, MFA codes, IP geolocation...
- News
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have uncovered malicious Visual Studio Code extensions posing as Solidity development tools that silently exfiltrate crypto...
- News
New CSS Attacks Can Break Webmail Defenses to Steal Passwords and Tokens
PortSwigger researcher Gareth Heyes demonstrated at Black Hat USA 2026 that CSS and HTML within emails can escape message boundaries to capture typed...
- News
Hackers Hijack Hotel Wi-Fi DNS to Steal Microsoft 365 Accounts
Attackers are modifying DNS settings on Wi-Fi devices at hotels and conference centers to redirect users attempting to reach Microsoft 365 to convincing...
- News
FortiBleed Credential Theft Linked to INC and Lynx Ransomware Operations
SOCRadar uncovered FortiBleed — a large-scale credential-harvesting campaign targeting 11,250 FortiGate portals across 150+ countries, resulting in 110...
- News
Data Breach Exposes Up to 14.2 Million Email Logins at Six ISPs
Japanese telecom giant KDDI Corporation disclosed a data breach affecting up to 14.22 million email accounts across six ISPs — including Nifty, Biglobe,...
- News
FortiBleed: 5-Stage Attack Chain Behind 110 Million Credential Heist on FortiGate Firewalls
Deep analysis of the FortiBleed operation reveals a sophisticated five-stage credential harvesting pipeline — custom Golang sniffers, Telegram-based...
- News
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist
The FortiBleed campaign's operators weaponize Fortinet's own built-in diagnostic command to run a custom Golang sniffer that intercepts 24 authentication...
- News
FortiBleed: Russian IAB Harvested 110 Million Credentials from 430,000 FortiGate Firewalls
A financially motivated Russian-speaking initial access broker behind the FortiBleed campaign has been systematically harvesting credentials from over...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
FortiBleed Campaign Used Custom FortiGate Sniffer to Steal Credentials
The large-scale FortiBleed campaign targeting Fortinet FortiGate devices deployed custom packet sniffers to harvest authentication secrets from...
- News
144 Mastra npm Packages Compromised via Hijacked Contributor Account
A supply chain attack dubbed easy-day-js has compromised 144 npm packages in the @mastra/* namespace by hijacking a contributor account for the popular...
- News
Rust-Written IronWorm Hits NPM Supply Chain
IronWorm, a self-propagating supply chain worm written in Rust, is targeting npm developers to steal credentials and reuse them to spread across the...
- News
Infostealers Turn Millions of Devices Into Credential Theft Machines
Attackers increasingly favor stolen credentials over exploits, and infostealers have become the primary access broker feeding ransomware and cybercrime...
- News
The Miasma Worm Source Code Briefly Leaked on GitHub
The Miasma credential-stealing worm framework was briefly open-sourced on GitHub before removal, potentially enabling copycat attacks against open-source...
- News
What the 2026 DBIR Confirms: Attacks Are Living in the Browser
The 2026 Verizon DBIR confirms phishing, shadow AI, malicious extensions, and credential theft now execute inside the browser, exposing major security gaps.
- News
Suspicious Polyfill Login Prompts Pop Up on Toshiba, Muji Websites
Tech giant Toshiba and mega-retailer Muji have warned visitors that suspicious sign-in screens appearing on their websites could be harvesting credentials — a…
- News
Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new Mini Shai-Hulud supply chain campaign codenamed Miasma has compromised Red Hat's @redhat-cloud-services npm packages, deploying a self-propagating…
- Security
CVE-2026-48027: Nx Console Embedded Malicious Code — CISA KEV
CISA adds CVE-2026-48027 to KEV after a malicious Nx Console VS Code extension was found harvesting credentials from disk and memory via obfuscation.
- News
Italy Disrupts CINEMAGOAL Piracy App That Stole Streaming
Italian authorities have dismantled the CINEMAGOAL piracy ecosystem after the app was found to have been stealing authentication codes from streaming...
- News
Laravel-Lang PHP Packages Compromised to Deliver
Multiple PHP packages belonging to the Laravel-Lang organization have been poisoned in a software supply chain attack, delivering a cross-platform...
- News
Ukraine Identifies Infostealer Operator Tied to 28,000
Ukrainian cyberpolice, working with US law enforcement, identified an 18-year-old from Odesa suspected of running an infostealer malware operation that...
- News
Popular GitHub Action Tags Redirected to Imposter Commit to Steal CI/CD Credentials
Threat actors have compromised the widely-used actions-cool/issues-helper GitHub Action, redirecting every existing tag to a malicious imposter commit...
- News
Inside the REMUS Infostealer: Session Theft, MaaS, and Rapid Evolution
A Flare threat intelligence analysis breaks down the REMUS infostealer — a rapidly evolving credential theft tool built around stolen browser sessions and...
- News
Worm Redux: Fresh Mini Shai-Hulud Infections Bite npm
Hundreds of npm packages in the TanStack open source ecosystem have been infected by a fresh wave of Mini Shai-Hulud worm activity from TeamPCP — the same...
- News
Quasar Linux RAT Steals Developer Credentials for Software
A newly discovered Linux implant called Quasar Linux RAT (QLNX) is silently targeting software developers to harvest credentials, log keystrokes, and...
- News
1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, and Intercom
The TeamPCP threat group's Mini Shai-Hulud supply chain campaign compromised SAP-related npm packages along with PyTorch Lightning and Intercom client...
- News
Poisoned Ruby Gems and Go Modules Exploit CI Pipelines for Credential Theft
A new supply chain attack campaign dubbed BufferZoneCorp has been observed using sleeper packages in RubyGems and Go module registries to push...
- News
PyTorch Lightning and Intercom-client Hit in Supply Chain
Threat actors compromised the popular Python PyPI package 'Lightning' — used for PyTorch model training — pushing malicious versions 2.6.2 and onward to...
- News
SAP-Related npm Packages Compromised in Credential-Stealing
Security researchers have uncovered a coordinated supply chain attack campaign dubbed 'mini Shai-H' targeting SAP-related npm packages, injecting...
- News
Cloud Platform Vercel Says Company Breached Through
Vercel has confirmed a security breach in which limited customer credentials were exposed after an employee's workstation was compromised through malware...
- News
No Exploit Needed: How Attackers Walk Through the Front
Stolen credentials remain the dominant initial access vector in 2026 — no zero-days, no malware, just valid logins that blend in with normal activity...
- News
Tycoon 2FA Loses Phishing Kit Crown Amid Surge in Attacks
Following law enforcement disruption of the Tycoon 2FA platform, threat actors are reusing its tools and techniques across a wave of new phishing kits,...
- News
Your Next Breach Will Look Like Business as Usual
Credential-based attacks now dominate the threat landscape, and traditional detection models are failing. Here are the fundamental shifts cybersecurity...
- Security
CVE-2026-5412: Juju Controller Facade Allows Low-Privilege
An authorization flaw in Juju's Controller facade allows any authenticated low-privilege user to call the CloudSpec API and extract the cloud provider...
- News
Cryptocurrency ATM Giant Bitcoin Depot Reports $3.6 Million
Bitcoin Depot, one of North America's largest Bitcoin ATM operators, has filed an SEC disclosure revealing a cyberattack in which threat actors gained...
- News
Authorities Disrupt APT28 Router DNS Hijacks Targeting
An international law enforcement operation has dismantled FrostArmada, an APT28 campaign that hijacked DNS on compromised MikroTik and TP-Link routers to...
- News
Hackers Exploit React2Shell in Automated Credential Theft
Threat actors are running a large-scale, automated campaign exploiting React2Shell (CVE-2025-55182) in vulnerable Next.js applications to steal...
- News
Device Code Phishing Attacks Surge 37x as New Kits Spread
Device code phishing attacks abusing the OAuth 2.0 Device Authorization Grant flow have exploded 37-fold in 2026 as ready-made phishing kits proliferate...
- Security
CVE-2026-35560: Amazon Athena ODBC Driver Fails Certificate
Improper certificate validation in Amazon Athena ODBC driver versions prior to 2.1.0.0 allows man-in-the-middle attackers to intercept authentication...
- News
Claude Code Leak Used to Push Infostealer Malware on GitHub
Threat actors are capitalising on the Claude Code source code leak by creating fake GitHub repositories that impersonate the leaked source to deliver...
- News
Hackers Exploit CVE-2025-55182 to Breach 766 Next.js Hosts
A large-scale credential harvesting campaign has been observed exploiting the React2Shell vulnerability (CVE-2025-55182) as an initial infection vector,...
- News
Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks
A new report reveals how industrialized credential theft has become the common thread connecting ransomware campaigns, SaaS platform breaches, and...
- Security
CVE-2026-2370: GitLab Jira Connect Credential Impersonation
GitLab has patched a high-severity vulnerability in its Jira Connect integration affecting CE/EE versions from 14.3 through 18.10 that allowed an...
- News
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides
The TeamPCP threat actor — behind previous supply chain attacks on Trivy, KICS, and litellm — has now compromised the telnyx Python package on PyPI,...
- News
LeakBase Admin Arrested in Russia Over Massive Stolen
Russian law enforcement has arrested the alleged administrator of LeakBase — a credential marketplace operating since 2021 with 142,000 members and...
- News
GlassWorm Escalates: 72 Malicious Open VSX Extensions Use
The GlassWorm self-propagating worm campaign has compromised 72 Open VSX extensions using invisible Unicode Private Use Area characters and a Solana...
- News
Researchers Disclose Critical n8n Flaws Enabling RCE and Credential Theft
Security researchers have published details of two newly patched critical vulnerabilities in n8n — CVE-2026-27577 (CVSS 9.4), an expression sandbox escape...
- News
Diesel Vortex: Russian Cybercrime Ring Steals 1,649
A Russian-linked phishing operation dubbed Diesel Vortex has stolen over 1,649 credentials from major freight and logistics companies across the US and...