logo

News related to
credentials

Security researchers have released a proof-of-concept attack that can unlock BitLocker-protected Windows 11 drives within minutes on systems that remain exposed to a legacy Secure Boot trust path, sharpening concern over the limits of software patching when certificate revocation has not been completed. The technique, called BitUnlocker, targets CVE-2025-48804, a BitLocker security-feature bypass tied to Windows Recovery Environment handling and physical access to a machine. The attack […]

Checkmarx customers using Jenkins pipelines have been urged to review their environments after a modified version of the company’s Jenkins AST plugin was pushed to the official Jenkins Marketplace, extending a wider software supply chain campaign tied to compromised developer tooling. The affected release has been identified as version 2026.5.09 of the Checkmarx AST Scanner plugin, distributed as tampered HPI, JAR and POM artifacts. The exposed window […]

Android users across parts of Europe face a sharper mobile-fraud threat after a redesigned TrickMo variant began targeting banking, fintech, cryptocurrency wallet and authenticator applications with stronger stealth, persistence and network-control features. The malware, tracked as TrickMo C, does not appear to be a wholly new family. It is an overhaul of a known Android banking trojan that has been under active development for years, with its […]

Mac users searching for Claude downloads are being targeted through sponsored Google results that lead to legitimate-looking Claude shared chats carrying malicious installation instructions, exposing a weakness in how trusted platforms can be misused to deliver malware. The campaign centres on users looking for Claude or Claude Code for macOS. Instead of relying only on fake websites, the attackers are placing paid search ads that display the […]

Attackers used a fake Hugging Face repository posing as an OpenAI privacy tool to spread credential-stealing malware to Windows users, exposing a widening security gap in the fast-growing market for open AI models. The repository, named Open-OSS/privacy-filter, climbed to the top of Hugging Face’s trending list and recorded about 244,000 downloads before access was disabled. Its model card closely mirrored OpenAI’s legitimate Privacy Filter project, a tool […]

Cybersecurity teams are tracking a stealthy espionage-style malware operation that uses GitHub Releases to hide a Python-based infostealer behind humanitarian-themed phishing material aimed at Russian-speaking targets. The campaign, tracked as Operation HumanitarianBait, begins with phishing emails carrying a RAR archive that contains a malicious Windows shortcut file. The lure presents itself as a Russian-language humanitarian aid request or application form, exploiting a sensitive social context while keeping […]

Cybersecurity teams are racing to contain attacks against cPanel and WHM servers after a critical authentication bypass flaw opened a path for unauthorised access to hosting control panels used across large parts of the web. The vulnerability, tracked as CVE-2026-41940, affects cPanel & WHM versions after 11.40, including DNSOnly, as well as WP Squared versions up to 136.1.6. It carries a CVSS score of 9.8, placing it […]

Advertisements

  Cybercriminals have used artificial intelligence to identify and weaponise a previously unknown software flaw, marking a significant escalation in the use of AI for offensive cyber operations. The attempted campaign targeted a widely used open-source, web-based system administration tool and centred on a zero-day vulnerability that could bypass two-factor authentication when valid user credentials were already available. The operation was disrupted before it could be used […]

Cybercriminals are using fake Claude Code installation pages to push a PowerShell-based information stealer at developers, marking a sharper turn in attacks that exploit the rush to adopt AI coding tools. The campaign impersonates Anthropic’s Claude Code, a command-line assistant used by software teams to write, review and debug code. Victims are drawn through sponsored search results or cloned documentation pages that resemble legitimate installation guides. Instead […]

Binance Bahrain has renewed its ISO/IEC 27001 and ISO/IEC 27701 certifications, strengthening its information security and privacy credentials as regulated crypto platforms face rising scrutiny over user protection, operational resilience and compliance standards across the Gulf. The Manama-based crypto asset platform said the renewed certifications cover its information security management and privacy information management systems. The development places data governance at the centre of its Bahrain operations, […]

Cybercriminals are exploiting interest in OpenClaw with a counterfeit installer that delivers a Rust-based information stealer designed to harvest cryptocurrency wallet data, browser secrets and password-manager credentials. The campaign centres on a fake OpenClaw download site and a typosquatted GitHub organisation that impersonates the legitimate open-source AI assistant project. Victims are lured into downloading what appears to be a Windows installer, but the archive instead contains a […]

Mac users searching for Claude installation help are being targeted by a malvertising campaign that turns Google-sponsored results and legitimate Claude shared-chat pages into a malware delivery route. The campaign, disclosed on 10 May by security researcher Berk Albayrak, uses search ads that appear to point to Anthropic’s real claude. ai domain. Users looking for terms such as “Claude mac download” are led to a shared Claude […]

Alphabet has moved within striking distance of becoming the world’s most valuable company, as investor confidence in its artificial intelligence strategy reshapes Wall Street’s view of Google’s parent after years of concern that it had fallen behind rivals in the AI race. Shares of the company have surged this year, lifting its market value to about $4.86 trillion by the close of trading on May 8, 2026. […]

Hackers are exploiting demand for OpenClaw by circulating a counterfeit installer that delivers Hologram, a Rust-based information-stealing framework built to harvest credentials from crypto wallets, password managers and browser extensions. Security analysis of the campaign shows a polished fake installer site distributing an archive named OpenClawx64.7z. Inside it is OpenClawx64. exe, a bloated 130MB executable designed to appear legitimate while frustrating automated sandbox checks. The payload is […]

Cloud security teams are facing a new credential-theft campaign after researchers identified PCPJack, a worm-like malware framework built to compromise exposed container, database and cloud-native systems while stripping away traces of rival TeamPCP tooling. The framework targets internet-facing Docker APIs, Kubernetes environments, Redis and MongoDB instances, Ray dashboards and vulnerable web applications. Its operators appear less interested in cryptomining, a familiar revenue stream in cloud intrusions, and […]

Fraudulent Android apps promising private call records for any phone number drew more than 7.3 million downloads on Google Play before being removed, exposing fresh weaknesses in app-store screening, digital payments oversight and consumer protection around subscription fraud. The 28 apps, tracked under the name CallPhantom, advertised access to call histories, SMS records and WhatsApp call logs, a service they could not legitimately provide. Users were asked […]

Commercial artificial intelligence models helped an unidentified adversary plan and conduct a cyber intrusion against the operational technology environment of a water and drainage utility in Mexico, sharpening concern over how widely available AI systems can accelerate attacks on critical infrastructure. Industrial security specialists at Dragos said the campaign targeted a municipal utility serving the Monterrey metropolitan area after a wider compromise of Mexican government organisations between […]

Cisco has patched a high-severity denial-of-service flaw that could allow unauthenticated attackers to knock key network management systems offline by flooding them with connection requests, raising operational risks for service providers and large enterprises that rely on automated orchestration platforms. The vulnerability, tracked as CVE-2026-20188, affects Cisco Crosswork Network Controller and Cisco Network Services Orchestrator, two products used to manage complex, multi-vendor networks and automate service provisioning. […]

Corporate login credentials have become a growing internal security weakness, with one in eight workers admitting they have sold access to company systems or know someone who has done so over the past year. The finding points to a shift in workplace fraud risk from external hacking alone to insider-enabled access, where criminals can enter corporate systems through legitimate credentials rather than breaking through technical defences. The […]

Malicious NuGet packages masquerading as familiar. NET libraries have put developer workstations and build environments at risk of credential theft, with attackers using plausible package names, hidden version histories and obfuscated payloads to target users in Chinese software ecosystems. Five packages identified in the campaign — IR. DantUI, IR. OscarUI, IR. Infrastructure. Core, IR. Infrastructure. DataService. Core and IR. iplus32 — were published through the same account, […]

Cybercriminals are turning Vercel’s AI-assisted web development tools into a faster route for building convincing phishing pages, raising fresh concerns over how legitimate cloud platforms are being exploited to steal credentials and evade traditional email defences. Security analysts tracking the activity have identified a sharp rise in campaigns using Vercel-hosted pages to imitate widely recognised brands, including Microsoft, Spotify, Adidas, Ferrari, Louis Vuitton and Nike. The lures […]

Hackers are using sponsored Google search results to steal ManageWP credentials, raising fresh concerns over the exposure of agencies, developers and businesses that administer large fleets of WordPress websites through a single GoDaddy-owned dashboard. The campaign places a fraudulent advertisement above the legitimate ManageWP search result, copying the platform’s branding and directing users to a look-alike login page. Victims who search for ManageWP rather than typing the […]

Mac users are being targeted by a widening ClickFix campaign that disguises malicious commands as disk-cleaning and system-maintenance advice, turning routine troubleshooting into a route for credential theft, wallet compromise and cloud-data exposure. The attacks use pages that appear to offer help with storage optimisation, system clean-up or utility installation. Victims are instructed to copy commands into Terminal, or in some variants to trigger Apple’s Script Editor, […]

Cybersecurity investigators have linked a Microsoft Teams-based credential theft operation to MuddyWater, the state-sponsored threat group associated with Iran’s intelligence apparatus, after an intrusion first presented itself as an ordinary Chaos ransomware attack. The operation, detected in early 2026 and detailed this week, shows how trusted workplace collaboration tools are being turned into entry points for espionage. Attackers used Teams chats and screen-sharing sessions to trick employees […]

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA
Just in:
EU challenges TikTok video rankings over harmful content loops // From Seoul to Wuzhen: Korean Celebrities and Creators Spark a Water Town Slow-Living Trend // NIA Highlights Three Exemplary Breakthroughs from National Innovation Awards, Driving Thailand Toward a Global ‘Innovation Nation’ // UAE non-oil trade climbs to AED 2.945 trillion // Houthi missile barrage damages Aramco tower in Riyadh // Setback for Usha in Olympic body // Abu Dhabi court holds NMC executives liable for fraud // BJP leader condemns cyber attacks over Mammootty wedding visit // Setback for Usha in Olympic body // Vasavan alleges one-man show by CM Satheesan // Basheer sets Feb deadline for delayed ULCCS projects // Rubio rejects prospect of imminent Iran peace breakthrough // Sber announces results of GigaArt AI-art festival: Nearly half a million images // Bank of England flags sharper AI share correction risks // Public Protests Challenge Elected Power In Europe And India // Gulf states formalise joint railway operating framework // Nexawork AI Launches Custom Software for SMEs From RM19,900.00 // BJP leader condemns cyber attacks over Mammootty wedding visit // Vasavan alleges one-man show by CM Satheesan // Republicans Struggling To Come Out Of Nov 3 Debacle To Prepare For 2028 Prez Polls //