Credential Theft Threat Intelligence

Credential theft through password spraying, brute force, infostealer malware, and phishing is a primary attack vector enabling unauthorized access. defend.network tracks credential theft campaigns, compromised credential dumps, and authentication bypass techniques that affect enterprise environments.

Barracuda chained RCE, cPGuard backdoor supply chain, LLMjacking cloud fraud surge

Barracuda disclosed two critical chained vulnerabilities enabling root access; cPGuard's update infrastructure compromised to deploy backdoors; LLMjacking attacks costing enterprises up to $1M in fraudulent cloud charges.

FBI confirms $6.3B Binance heist; critical LXD/MicroCloud flaw; Polymarket $2.7M theft

FBI attributed record $6.3B Binance cryptocurrency heist to North Korean TraderTraitor group. Critical CVSS 10.0 flaw in LXD/MicroCloud enables authentication bypass. Polymarket lost $2.7M to supply-chain script injection; Northflank breach exposed AI API keys.

Ivanti Connect Secure chained RCE under active exploitation; Chainalysis breached

CISA confirms active exploitation of chained Ivanti Connect Secure vulnerabilities enabling unauthenticated root access. Chainalysis breached via AI-powered attack; Northflank API keys compromised.

Brotli RCE in PHP; Magento stores hijacked; GitHub supply-chain attack

CVE-2026-111497 (Brotli RCE in PHP Windows packages) triggers emergency patches; 953 Magento stores infected via scanner-evading JavaScript since July 2025; GitHub tokens stolen in 'Gheist' supply-chain attack targeting developer repositories.

Arista VeloCloud zero-day exploited; Railway, Capcom breaches; LiteLLM supply chain attack

Arista Networks' VeloCloud Orchestrator zero-day SQL injection actively exploited; Railway platform warns of secret exposure; Capcom confirms 11.7M account breach; LiteLLM release pipeline compromised with info-stealer malware.

eMudhra CA compromise, FortiSIEM RCE PoC, PHP emergency patches

eMudhra CA private keys compromised and revoked by browser makers; FortiSIEM critical RCE PoC released; PHP emergency patches imminent; Qilin and INC ransomware groups actively exploiting Palo Alto MFA bypass.

ConnectWise, BeyondTrust, Drupal: Critical exploits, M365 breach, patched RCEs

ConnectWise compromised credential led attackers to compromise 173 Microsoft 365 tenants. BeyondTrust zero-day in active exploitation by Chinese APT. Drupal patches critical RCEs.

ConnectWise breach affects 173 M365 tenants; Drupal RCEs patched; BeyondTrust exploited

ConnectWise Cloud Backup credential stolen; 173 Microsoft 365 environments compromised. Drupal patches two critical RCEs. Candiru spyware delivered via malicious ads. MALFEX npm package distributes shellcode loader.

Cisco Email Gateway RCE exploited; Nextcloud backdoors; 3 phishing platforms disrupted

Cisco Secure Email Gateway zero-day actively exploited for unauthenticated RCE; Nextcloud servers backdoored via Collabora vulnerability; Microsoft disrupts three phishing platforms behind 1B+ scam messages; U.S. charges 14 in North Korean IT worker fraud ring.

P7 DarkSword iOS exploits escalate; ShinyHunters arrests surge; AI agents targeted in bank breaches

P7 DarkSword iOS variant adds keychain & crypto-wallet theft; multiple ShinyHunters members arrested across three countries; Chinese threat actor exploited Claude AI agents in South Korean bank attacks.

Critical unpatched flaws in AhsayCBS, BIND, Apache Struts actively exploited

AhsayCBS backup platform flaws (CVE-2026-105133, CVE-2026-105134) exploited for webshell deployment and crypto mining; CISA adds five actively-exploited legacy vulnerabilities to KEV catalog. Anthropic restricts Claude internet access after injection attack discovery.

GitHub Actions malware spreads to 340+ repos; ShinyHunters arrests escalate; Android firmware exploits widen

Attackers compromised high-profile open-source maintainer accounts to inject credential-stealing GitHub Actions workflows into 340+ repositories. FBI arrests of ShinyHunters members continue following FBI breach. Android firmware malware hits 150+ countries.

SonicWall CVSS 10.0 flaw; Google domains hijacked via ccTLD compromise; PoeLLM malware targets AI servers

SonicWall SMA1000 pre-auth SSRF (CVSS 10.0) requires immediate patching, country-code TLD registries compromised to obtain unauthorized Google domain certificates, PoeLLM cryptomining malware infects 3, 400+ exposed AI servers

WordPress, Atlassian, ASOS breached; AI-powered phishing escalates

WordPress sites actively exploited via Ninja Forms, Atlassian critical file-access flaw disclosed

Cisco SD-WAN, Zimbra, Zammad under attack; active exploitation confirmed

Cisco Catalyst SD-WAN Manager zero-day actively exploited for admin access, Zimbra webshell deployments confirmed

Citrix NetScaler, Oracle, Cloudflare RCEs under active exploitation; WAF bypasses escalate risks

Two Citrix NetScaler RCE zero-days (CVE-2026-88771, CVE-2026-88772) actively exploited in wild; ShinyHunters gang bypasses WAF rules to resume Oracle PeopleSoft CVE-2026-35273 attacks; Cloudflare fixes cross-tenant container data exposure.

Oracle PeopleSoft, Microsoft patches, Elementor RCE under active exploitation

Oracle PeopleSoft CVE-2026-35273 (CVSS 9.8) under mass exploitation via WAF bypass; ShinyHunters deploying web shells globally. Microsoft released 974 security patches. Lunex stealer abuses AMD drivers to disable EDR and harvest credentials.

GitHub Actions re-compromised; North Korea suspected in $351M Bitget heist

Compromised GitHub Actions resumed executing malware after re-gaining access, WSO2, Adobe remain under active exploitation.

Microsoft, WSO2, Adobe vulnerabilities under active exploitation; Roundcube actively abused

CISA added five critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including WSO2 path traversal (CVE-2026-5430) and Adobe Commerce auth bypass (CVE-2026-71362). Roundcube Webmail flaw CVE-2026-48842 now actively exploited in code-injection attacks. Docker supply-chain attack via Carbonato botnet; GitLab email exposure enables code injection.

Check Point RCE, MikroTik SSH chain, malicious npm/Terraform packages in active exploitation

Check Point VPN gateway (CVE-2026-85102) actively exploited, MikroTik routers compromised via SSH chain, malicious Go malware in HashiCorp Terraform, npm

Check Point, WordPress, Zyxel actively exploited; EvilTokens phishing infrastructure seized

Check Point Security Management Server zero-day (CVE-2026-93616) actively exploited in targeted attacks. WordPress patched critical RCE flaw in v7.1.2. Microsoft disrupted EvilTokens phishing service compromising 12,000+ Microsoft 365 inboxes. Zyxel GS1900 switch exploits targeting government data.

Microsoft’s record patch batch; fake LastPass installer deploys kernel EDR killer

Microsoft released 974 security patches; fake LastPass installers deliver Microsoft-signed kernel driver disabling antivirus; Google fined €403M for GDPR location data violations.

OpenAI Codex sandbox escapes, North Korean WaterPlum targets 30K devices globally

Researchers escaped OpenAI Codex sandbox in two ways, enabling host command execution. North Korean WaterPlum campaign infected 30,000 devices and stole $10.7M in cryptocurrency. Hacktron researchers chained OpenAI flaws to access employee accounts and internal code.

Orkes Conductor RCE exploited; SolarWinds ARM patched; Linux kernel vulnerabilities added to CISA KEV

SolarWinds ARM hard-coded key flaw (CVE-2026-28326, CVSS 8.8) patched; Orkes Conductor pre-auth RCE (CVE-2026-58138, CVSS 9.8/9.3) actively exploited in wild. Three Linux kernel vulnerabilities added to CISA KEV catalog. Gyazo breach impacts 23.6 million users.

Cisco SEG SQL injection joins KEV; Acronis Linux flaw exploited; banking malware targets browsers

Cisco Secure Email Gateway SQL injection added to CISA KEV; Acronis cPanel plugin flaw exploited; Brazilian banking malware KREMLIN targets Chrome and Edge for session theft.

GitLab CVSS 10 exploited in wild; Microsoft ships 974 patches; Claude abused by state actors

GitLab path-traversal flaw (CVSS 10.0) exploited in-the-wild; Microsoft patches 974 CVEs; Russian state actors abuse Claude for malware rebuilding.

Android malware surge; AI-powered PaperCut campaign hits 395+ orgs

Mantax Otax and Gigabud banking trojans spread across Android, Russian-speaking actors deployed hundreds of AI agents to exploit PaperCut flaws on 395 organizations

Cisco FMC actively exploited; BlueMoon exploit kit chains Chrome & Windows; AI tokens bypass MFA

Cisco Secure FMC flaw CVE-2026-20079 under active attack; four China-linked espionage groups deployed BlueMoon exploit kit targeting Chrome and Windows; AI user accounts hijacked via infostealer logs to bypass MFA.

Microsoft patches record 974 CVEs; AI agents steal thousands of credentials; F5 devices breached

Microsoft released 974 security patches including two actively exploited zero-days. AI-driven credential harvesting compromised thousands of accounts in six hours. F5 BIG-IP devices are being breached to deploy Linux rootkits.

Chrome/Edge backdoors, Magento zero-day, Microsoft 365 phishing at scale

PEEP toolkit turns Chrome and Edge into post-compromise backdoors; Magento StyleSmuggler zero-day actively exploited to deploy Linux backdoors; BigBear phishing framework bypassed MFA at 258 organizations and stole 5,000+ Microsoft 365 credentials.

MikroTik routers, Magento zero-day, and Chromium V8 actively exploited

MikroTik routers hijacked without authentication; Magento/Adobe Commerce zero-day in active exploitation; REVSTEALER disables Defender to mine crypto; Chromium V8 in CISA KEV.

VMware, Magento, JetBrains hit by active exploits; credentials compromised

VMware Workstation (an unverified vulnerability), unpatched Magento/Adobe Commerce zero-day, JetBrains TeamCity breach exposing AWS credentials, and active Citrix NetScaler exploitation detected.

Critical RCEs in Cisco Nexus, HPE ArubaOS; infrastructure compromises escalate

Cisco patches critical Nexus 9000 unauthenticated RCE affecting 10 Silicon One switches; HPE releases 8 CVEs in ArubaOS-CX. Coder's Cloudflare infrastructure hijacked to distribute malicious Terraform modules. 153M+ driver licenses offered on dark web.

JFrog Artifactory, Langflow critical flaws exploited; TeamPCP arrested

JFrog Artifactory CVE-2026-82329 (CVSS 9.8) exploited to mint admin tokens; Langflow CVE-2026-0768 RCE active for API key theft. Two alleged TeamPCP supply-chain attackers arrested in Australia. iOS spyware campaign harvesting wallet seeds.

Kaspersky, Microsoft, Anthropic hit by infostealers; ransomware escalates AI tools

Infostealer malware targets Anthropic and Microsoft users; Aurora ransomware gang deploys Cursor AI; North Korean threat actors expand beyond IT into healthcare and sales.

Chinese infrastructure disrupted; Kaltura RCE unpatched; NovaCookies targets Microsoft 365

$320/month subscription model.

Mirage2FA hits 4,500 orgs; Oracle Weblogic RCE, NVIDIA AI poisoning, WordPress plugin flaws

Mirage2FA phishing toolkit has compromised 4,500 US/EU organizations via Microsoft 365 spoofing; Oracle Weblogic Server vulnerability (CVE-2026-21962) added to CISA KEV with 3-day patch deadline; NVIDIA NemoClaw vulnerable to unauthenticated model poisoning.

Keycloak authentication bypass, Microsoft active exploit, WordlistLoader/SynkLoader malware

Red Hat patches critical Keycloak account-takeover flaw; Microsoft releases 398 patches including one under active exploitation; WordlistLoader and SynkLoader malware families accelerate ransomware-adjacent payload delivery via ClickFix.

Android vehicles, AWS keys, Snowflake extortionist: Active threats escalate

Android car head units infected via malware-laden firmware updates; 9,300+ AWS keys remain active; Snowflake extortionist pleads guilty after compromising 165+ organizations.

Trojanized npm packages, AWS credential leak, Microsoft Defender driver abuse

14 trojanized npm packages deliver RedC2 4.0 Linux backdoor; 9,300 active AWS keys exposed; Microsoft Defender boot driver weaponized for security software deletion.

Microsoft Copilot, MLflow, and Windows Task Host under attack; ransomware exploitation confirmed

Microsoft Copilot Personal one-click data exfiltration flaws disclosed. MLflow and FUXA critical vulnerabilities exploited for cloud credential theft. Windows Task Host now actively exploited by ransomware gangs.

GitLab, Forminator WordPress, Azure breach: Critical RCEs and 3.6M records stolen

GitLab patched critical GraphQL flaw; Forminator WordPress plugin RCE affects 600K+ sites; threat actor claims 3.6M Azure account records stolen from Fortune 500 companies.

npm malware cluster, Metabase zero-day exploited, UNC6671 rebrands

Nearly 800 malicious npm packages deliver cross-platform RAT/infostealer; Metabase SQL injection exploited at Framework and Tally; UNC6671 extortion group rebrands across Redact, Pink, Helix, Falcon operations after millions in vishing revenue.

Google Password Manager passkey hijacking; APT29 hotel Wi-Fi espionage; N-able RMM auth bypass exploited

Malware on Windows machines can hijack Google-synced passkeys without verification. Russian APT29 is actively compromising hotel Wi-Fi globally to steal Microsoft 365 credentials. N-able N-central RMM faces active CVE-2026-18577 exploitation with a second bypass vector discovered post-patch.

AI agent poisoning, Langflow RCE exploited: Microsoft warns data theft risks

Microsoft research exposes AI agent manipulation via poisoned tool descriptions; Langflow RCE (CVE-2026-33017) actively exploited for Monero mining; six critical shell-injection bypasses discovered in open-source AI coding agents.

Oracle PeopleSoft breaches widen; malicious Chrome extension steals searches; Mustang Panda targets India

Oracle PeopleSoft zero-day exploited at Nissan and NAIC; malicious Chrome extension intercepted searches and address bar input; Mustang Panda uses Zoho WorkDrive in Indian government campaigns.

Signal backup keys targeted; Linux kernel RCE; AWS Q credential theft

Russian intelligence phishing now targets Signal Backup Recovery Keys. Linux kernel privilege escalation (CVE-2026-46331) has working exploit. AWS Q flaw (CVE-2026-12957, CVSS 8.5) allows malicious repos to steal cloud credentials.

FortiBleed harvests 110M credentials; Cisco SSRF actively exploited; GitHub patches CI/CD attacks

FortiBleed credential-harvesting campaign collected 110 million credentials from 430

Microsoft Defender zero-day, FortiBleed exposes 73k devices, GitHub worm spreads

Microsoft Defender privilege-escalation zero-day CVE-2026-50656 (patch pending). FortiBleed leaks credentials for 73,932 Fortinet devices; attackers actively harvesting access across 200 countries. GitHub supply-chain worm exploiting dismissed design flaws compromises hundreds of packages.

Google Gemini prompt injection, Microsoft 365 token theft, Redis RCE patched

Google Gemini voice assistant hijackable via poisoned notifications; Microsoft 365 Android apps leak tokens; Redis RCE (CVE-2026-23479) patched; critical fuel tank systems under active attack.

Active exploits: Palo Alto GlobalProtect, CISA credential leak, Linux kernel RCE

Palo Alto PAN-OS GlobalProtect flaw (CVE-2026-0257) under active exploitation; CISA contractor exposed AWS GovCloud keys on GitHub; Linux kernel CIFSwitch privilege escalation disclosed.

FortiClient EMS, GitHub secrets, CISA breach: critical exploitation ongoing

FortiClient EMS actively exploited to deploy credential stealer; CISA contractor leaked AWS GovCloud keys on GitHub; BTMOB Android RAT spreading via phishing with builder interface.

FortiClient EMS, Gogs RCE actively exploited; CISA GitHub leak exposes AWS keys

FortiClient EMS and Gogs RCE vulnerabilities actively exploited in the wild. CISA contractor exposed AWS GovCloud credentials on GitHub. FIFA World Cup fraud campaigns register 4,300+ malicious domains.

cPanel auth bypass; state token harvesting; SaaS extortion attacks

Critical vulnerabilities, state-sponsored token harvesting, large-scale phishing operations, and coordinated SaaS extortion attacks demand immediate defensive action across government and technology sectors.

SAP npm compromise; cPanel auth bypass; DPRK AI-assisted malware

Critical supply-chain attacks on SAP npm packages and North Korean AI-assisted malware, combined with cPanel authentication bypass and state-sponsored credential harvesting, create immediate existential threats to enterprise infrastructure and critical systems.

Bitwarden CLI & Checkmarx compromised; Russian Office 365 token theft

Critical supply-chain compromises affecting Bitwarden CLI and Checkmarx tools; Russian state actors harvesting Office 365 tokens; AI-powered attacks outpacing human response capabilities.

Russian APT token theft; Gentlemen ransomware claims 1,570 victims

Russian state-backed APT harvesting Microsoft tokens, 1,570+ Gentlemen ransomware victims, critical SD-WAN and RMM exploits, Windows Defender flaws—urgent patching required across infrastructure.

Defender zero-day; protobuf.js RCE; APT28 hits Ukrainian government

Critical Microsoft Defender zero-days actively exploited, 68% of cloud breaches from unmanaged service accounts, Russian state actors harvesting Office tokens, protobuf.js RCE with public exploit, APT28 targeting Ukrainian government.

Microsoft Defender zero-days; 68% cloud breaches from ghost identities

Critical Microsoft Defender zero-days under active exploitation, 68% of cloud breaches from unmanaged service accounts, and Russian state-sponsored token harvesting campaigns demand immediate action.

APT28 DNS hijack via routers; Iran hits PLCs; Docker RCE

Russian APT28 conducting large-scale DNS hijacking via compromised routers for token theft; Iranian hackers targeting U.S. critical infrastructure PLCs; critical Docker and Flowise vulnerabilities under active exploitation.

Next.js exploited; Cisco IMC, ShareFile flaws patched; $280M DPRK theft

Next.js React2Shell flaw actively exploited; critical Cisco IMC, Progress ShareFile flaws patched; $280M cryptocurrency theft attributed to North Korea; credential harvesting impacts 766 hosts