News related to
credentials

Settra ransomware appears in retail and manufacturing intrusions

Cybersecurity researchers have documented two attacks involving Settra ransomware, exposing a repeatable post-compromise playbook that combines legitimate remote-management software, recovery sabotage and efforts to erase forensic evidence. Huntress said the incidents affected a consumer services and retail organisation in July and a manufacturing company in September. Settra was first observed publicly in June, but the two investigations provide fresh detail on how operators maintain access after compromise […]

WaterPlum compromises 30,000 devices through fake interviews

North Korean cyber operators posing as recruiters have compromised at least 30,000 devices in more than 100 countries, using fraudulent job interviews to infect technology professionals and steal cryptocurrency, authorities from four countries have disclosed. The campaign, attributed to a group tracked as WaterPlum and widely known as Contagious Interview, targeted web designers, software engineers, freelancers and specialists in cryptocurrency, blockchain and Web3 technologies between about December […]

AI agent orchestrates multistage personal-data breach in Spain

Spain’s data protection authority has disclosed its first notified personal-data breach in which an artificial intelligence agent allegedly carried out several stages of an intrusion, including vulnerability discovery, data modification and access to billing records. The Agencia Española de Protección de Datos said the incident involved an agent using a known large language model and marked a significant shift in the operational use of AI in cyberattacks. […]

CrowdSec traces repository theft to TanStack compromise

CrowdSec has said a supply-chain attack involving compromised TanStack npm packages led to the unauthorised copying of about 170 private GitHub repositories after credentials linked to a departing employee were exposed. The cybersecurity company said its investigation, completed with assistance from GitHub, traced the breach to an OAuth token obtained after the employee’s account was compromised in the May TanStack attack. The repositories were downloaded on May […]

Hackers breach Flock camera, recover 1.6m images

Hackers who physically removed a Flock Safety roadside camera were able to copy much of its internal storage, uncover an encryption key and access tens of thousands of video clips and data linked to about 1.6 million images generated over 21 days. The compromise involved a single camera taken from above a roadway and did not amount to a remote breach of Flock Safety’s cloud network. The […]

RatHat malware harnesses AI to target banking data

Cybersecurity researchers have identified a new Android malware strain that uses generative artificial intelligence to help attackers navigate infected devices and steal banking credentials, payment information and authentication codes. Zimperium’s zLabs team disclosed the malware, named RatHat, on September 16, saying its technical indicators point to threat actors who appear to be operating from China. The researchers stopped short of definitively attributing the campaign, basing the assessment […]

GhostCode exploits Entra enrolment for persistent access

A newly identified phishing kit called GhostCode is exploiting Microsoft Entra device-code authentication to register attacker-controlled devices, allowing access to persist even after stolen tokens are revoked, security researchers have found. eSentire’s Threat Response Unit said it detected the active campaign in late August, with operators using business-email social engineering rather than conventional fake login pages. Attackers posed as procurement staff from legitimate organisations, including BJ’s Wholesale […]

Blockstream rebuffs ransom demand after Liquid bitcoin breach

Blockstream has refused to pay a ransom for nearly 600 bitcoin still controlled by the actors behind the $320 million exploit of its Liquid Network, saying it will pursue recovery through law enforcement, exchanges and forensic specialists if the funds are not returned. The Bitcoin infrastructure company said on September 11 that it had engaged with those responsible in an effort to recover user assets but would […]

NIST strengthens safeguards for SSO and API tokens

The US National Institute of Standards and Technology has finalised new guidance aimed at reducing theft, forgery and misuse of digital tokens that underpin single sign-on, cloud federation and API access. NIST Interagency Report 8587, released on September 15, sets out implementation recommendations for federal agencies and cloud service providers handling identity tokens, access tokens and assertions. The document focuses on how organisations should protect signing keys, […]

EPFO widens member outreach through WhatsApp channel

Trump rebuffs AI safeguards as crypto risks mount

President Donald Trump has rejected calls for tougher artificial intelligence safeguards, arguing that existing US powers are sufficient even as security specialists warn that faster AI systems are widening the attack surface for cryptocurrency platforms and decentralised finance. Trump said on September 14 that additional safeguards were unnecessary and dismissed warnings from technology executives about uncontrolled development. His position places the White House at odds with industry […]

Swiss Bitcoin Pay suspends service after suspected intrusion

Swiss Bitcoin Pay has taken its servers offline after detecting what it described as likely unauthorised access to internal systems, while warning that customer contact, banking and transaction data may have been exposed. The Switzerland-based Bitcoin payments provider disclosed the incident on September 14 and said it was investigating the intrusion and securing its infrastructure before restoring service. It has not announced a date for reopening. Swiss […]

Human operator executes Marimo cloud pivot in eight seconds

A skilled human attacker exploited a critical Marimo notebook flaw and moved from an exposed WebSocket session to authenticated access on an SSH bastion host in eight seconds, Sysdig’s Threat Research Team has documented. The operation centred on CVE-2026-39987, a pre-authentication remote code execution vulnerability affecting the Marimo Python notebook platform. Sysdig said the attacker used a hand-built Python toolkit rather than an AI agent, chaining initial […]

JeetBot extension routes Twitch tokens to bot servers

A browser extension used by nearly 31,000 Twitch viewers has been found forwarding live OAuth session tokens to proxy infrastructure controlled by the operator of a Russian-language commercial bot service, exposing credentials that can grant access to account functions without requiring passwords or two-factor authentication. Security company Socket said the extension, “Twitch Enhanced Viewer | JeetBot”, was available through both the Chrome Web Store and Mozilla’s Firefox […]

Casbaneiro distributes command traffic across multiple servers

A Casbaneiro banking Trojan campaign targeting users in Latin America is using geofenced phishing, staged malware delivery and separate command-and-control servers to make malicious activity harder to detect and analyse, according to security research published this month. FortiGuard Labs said it observed the campaign in August, with activity focused on Argentina, Peru, Colombia and Mexico. Victims are approached through phishing emails and PDF documents disguised as invoices, […]

Phishing operation exploits Windows Mshta for credential theft

A phishing campaign active since June is abusing Microsoft’s legitimate mshta. exe utility to run malicious HTML Application files, profile infected Windows systems and deliver follow-on malware capable of stealing credentials and other local secrets, security researchers have found. Fortra Intelligence and Research Experts, known as FIRE, said the operation remains active and is primarily targeting Spanish-speaking users at global organisations. The attackers use Spanish-language invoice and […]

Revolut discloses customer data leak after email scam

Revolut has disclosed that a limited number of customers had sensitive personal and financial information exposed after the fintech company responded to fraudulent requests sent from an unauthorised account operating within a legitimate government agency’s email domain. The company said the requests appeared authentic because they came from an official government domain and carried valid domain authentication credentials. Revolut later determined that the email account had been […]

cPanel presses CSF users to close critical flaw

cPanel has urged server administrators to update ConfigServer Security & Firewall after disclosure of a critical command-injection vulnerability that can let unauthenticated remote attackers run arbitrary commands on affected systems under specific service configurations. The flaw, tracked as CVE-2026-65638, affects cPanel’s WebPros-maintained CSF versions 14.00 through 16.29 and was addressed in version 16.30 and later. cPanel said administrators should move to the latest available release as soon […]

GitLab issues urgent patches for exploited critical flaw

GitLab has issued emergency security updates for self-managed installations after fixing two critical vulnerabilities, including a maximum-severity flaw now listed by US authorities as actively exploited. The company released GitLab Community Edition and Enterprise Edition versions 19.3.2, 19.2.6 and 19.1.8 on September 10, urging administrators running affected versions to upgrade immediately. GitLab. com is already operating the patched release, while GitLab Dedicated customers do not need to […]

CISA case renews scrutiny of AI accountability

A US government cybersecurity episode involving ChatGPT is drawing attention to a wider governance problem: organisations are deploying artificial intelligence faster than they are assigning responsibility for what AI systems are allowed to do. The issue centres on CISA acting director Madhu Gottumukkala, who uploaded sensitive but unclassified government contracting documents to a public version of ChatGPT during July and early August 2025. The activity triggered automated […]

Cisco flags active attacks through critical FMC flaws

Cisco has warned that attackers are actively exploiting two vulnerabilities in its Secure Firewall Management Center software, with intrusions leading to root-level access, credential theft, reconnaissance and malware deployment on compromised systems. Cisco Talos said on September 9 that it had identified three clusters of post-compromise activity involving CVE-2026-20079 and CVE-2026-20316. The first flaw, rated a maximum 10.0 on the CVSS scale, can let an unauthenticated remote […]

MantaxOtax fuses Android ransomware with surveillance tools

A newly documented Android malware strain called MantaxOtax combines ransomware, spyware and remote-control functions, enabling attackers to encrypt files, steal sensitive communications and obstruct victims from using infected phones. Mobile security researchers at Zimperium’s zLabs detailed the malware on September 9, saying analysed samples were linked through language indicators and recovered victim material to threat actors operating in Indonesia. Some samples were distributed as standalone Android application […]

Gigabud exploits Android cloning to bypass fraud checks

Cybercriminals behind the Gigabud Android banking trojan are using a weaponised app-cloning tool to isolate fraudulent banking activity from malware alerts, according to research published by Group-IB on September 9. The cybersecurity company said Gigabud is being paired with Vwork, a modified fork of the open-source Android application Shelter, to create a separate Work Profile and place banking applications inside it. Group-IB attributed both Gigabud and Vwork […]

Anthropic accuses Moonshot over concealed Claude routing

Anthropic has accused Moonshot AI of secretly sending customer requests meant for its Kimi chatbot to Anthropic’s Claude models, alleging that the Beijing-based company concealed the practice from users and presented Claude-generated answers as its own. The US artificial intelligence developer said on Thursday that it identified one ten-day period in which Moonshot routed almost 300,000 requests through a network of 5,380 fraudulent accounts, with much of […]