All news with #credential access tag

🔎 This Unit 42 report outlines the top five initial access vectors observed in September 2026. It highlights a heavy reliance on exploitation of public-facing apps and credential abuse, alongside persistent social engineering campaigns targeting public sector and critical infrastructure. The analysis also emphasizes high-impact supply chain intrusions and drive-by compromises as systemic risks requiring prioritized detection and mitigation.

🛡️ The U.S. Department of Justice disrupted the Famous Chollima (WageMole) network by charging 14 individuals, arresting two U.S. nationals, and seizing about 187 laptops linked to North Korean remote IT worker schemes. Operation "Lonestar Roundup" involved searches of 40 residences in Texas where facilitators hosted employer-issued devices used to mask DPRK operatives. CrowdStrike has tracked these schemes since April 2025, noting methods like fake theft reports and address rotation to divert shipments. An Ohio indictment describes a scheme from 2019–July 2025 that impacted 70 companies and generated roughly $3 million for the threat actors.

🔒 Cybersecurity researchers disclosed an active credential-theft campaign that used compromised maintainer GitHub accounts to inject malicious GitHub Actions workflows into more than 340 repositories. The malicious workflows, masquerading as Security Audit or GitHub Actions Security, exfiltrate repository secrets and credentials to a hard-coded IP address and scan the working tree and git history for API keys and tokens. The activity, attributed to the GhostAction campaign, has affected hundreds of users and led to thousands of secrets being harvested since late August 2026. Developers are urged to search for the offending workflow files, assume compromise, revoke affected credentials, and remove the injected workflows across branches and forks.

🔒 Researchers from Palo Alto Networks’ Unit 42 and Zenity Labs detail repeated security regressions in AWS AgentCore and AgentCore Runtime, where default tools and misconfigured metadata access allowed prompt-injection and IMDS-based credential exfiltration. Reports show agents can return full STS credentials, move laterally, and access other agents’ code and secrets, exposing broad blast radius risks. AWS has issued fixes, but timelines and completeness remain unclear, underscoring the difficulty of securing autonomous agents.

🛡️ ASOS confirmed a data breach caused by a social engineering attack in which an employee’s login credentials were stolen and used to access information on third-party platforms. The company locked down affected systems, engaged external experts, law enforcement and regulators, and said payment details and account passwords were not accessed. ASOS warned customers to be wary of unsolicited messages and said no action is required on accounts while the investigation continues.

📧 This article describes a modular phishing campaign that impersonates brands to trick YouTube creators into surrendering Google account access. The attackers start with personalized collaboration emails, direct victims to convincing fake platforms, and then present a Google sign-in or permissions prompt to capture credentials or obtain channel-management rights. Creators are advised to verify offers, check domains and permissions, use strong authentication, and follow recovery steps if compromised.

🔒 A former core infrastructure engineer pleaded guilty after remotely accessing his employer's network and scheduling tasks that changed hundreds of passwords, deleted domain admin accounts, and disabled thousands of servers and workstations. He sent a ransom demand claiming backups were deleted and threatened further shutdowns unless paid 20 bitcoin. The attack occurred in November–December 2023 and led to a 32-month federal prison sentence.

🔒 GitGuardian outlines why the credential layer deserves immediate attention and how detection is the first essential step. The article explains that credential sprawl spans repositories, endpoints, collaboration tools, and AI agents, increasing attack surfaces and making discovery urgent. It highlights research showing rising hardcoded secrets and explains the need for context — validity, ownership, permissions, and dependencies — to prioritize remediation. The piece argues security teams must connect multiple discovery sources to measure coverage and reduce exposure.

🛡️ TA419, a China-aligned cyber espionage group, has run credential phishing campaigns aimed at U.S. AI policy experts at think tanks, universities, and law firms. The actor impersonated economists, policymakers, and an Anthropic employee to phish victims via shortened links that redirect to an OneDrive adversary-in-the-middle (AitM) page using a Frameless BitB technique. Proofpoint links this activity to broader Chinese intelligence objectives amid U.S.–China AI tensions.

🔒 The Microsoft Digital Defense Report finds government agencies were the most impacted sector for cyber threats between July 2025 and June 2026, with 27% of observed activity. The post highlights rising dwell time, increased phishing-driven intrusions, and the expanded risk from compromised credentials. It recommends five priorities for governments, including cross-sector coordination, secure-by-design AI practices, and robust information sharing to strengthen resilience.

🔐 Bitget confirmed attackers exploited a zero-day vulnerability in third-party security products to steal $387.5 million from its hot and warm wallets, according to a SlowMist investigation. The breach, disclosed on September 24, 2026, allowed attackers to obtain high-level credentials, bypass risk controls, and initiate fraudulent withdrawals across 11 blockchains. Bitget disabled the affected functionality and notified the vendor while freezing some assets.

🛡️ Microsoft observed July 2026 phishing campaigns that distributed a masqueraded, digitally signed MSP360 RMM installer via diverse social-engineering lures and hosting services. The installer established persistent MSP360 services after UAC elevation and was used to silently download and install a ConnectWise ScreenConnect client as a secondary remote-access channel. Threat actors then used these legitimate administration platforms to deploy additional tooling for credential access and information collection while blending into normal IT workflows.

🔒 Security researchers at Varonis Threat Labs have demonstrated an attack, dubbed TrustSink, that lets an attacker with a highly privileged Microsoft Entra account register a rogue external MFA provider to capture users' passwords during legitimate logins. The malicious provider displays a convincing copy of Microsoft's password prompt during the MFA step, captures credentials in plaintext, then returns a valid signed token so the login completes normally. The technique requires post-compromise access to Global Administrator or Authentication Policy Administrator privileges and can persist across password resets until the rogue provider is removed.

🛡️ A joint advisory attributes the long-running Contagious Interview campaign to North Korean-linked actors who have compromised at least 30,000 devices across 100+ countries and stolen from over 7,000 cryptocurrency wallets, totaling at least $10.71 million. The campaign targets developers and crypto specialists by posing as recruiters, using coding tests to deploy malware families like BeaverTail, InvisibleFerret, and RATatouille, then exfiltrating data and credentials. Agencies from Japan, the U.S., Australia, and Germany warn the activity is tied to clusters such as WaterPlum and PurpleDelta, and that the operation leverages laptop farms, enablers, and AI-crafted identities to recruit proxies and bypass sanctions.

🔒 AWS Continuum for penetration testing introduces a frontier agent that performs on-demand, customized penetration tests with real exploitability checks. The new capability authenticates using provided login credentials before a full test, capturing and suggesting all accessible domains reached during login to help define accurate network scope. Accessible domains are surfaced whether credential attempts succeed, fail, or time out, reducing misconfiguration and wasted test cycles.

🛡️ Joint advisories warn that Iranian state-linked hackers deploy a Windows malware called CHOSEN BRICK to spy on dissidents, activists, and journalists. The malware harvests email, Telegram, and WhatsApp data, captures screenshots and audio, and establishes persistence via Registry Run keys while adding Microsoft Defender exclusions. Attacks begin with social engineering on WhatsApp or Telegram and malicious files masquerading as trusted apps. Stolen data is exfiltrated via Telegram or cloud services and sometimes published on pro-Iranian leak sites.

🔍 A HYPR report finds fraudulent hires obtain corporate credentials and internal access before detection in 42% of cases, with an average of 5.73 days of unmonitored access. The study of 500 US HR executives notes 98% encountered candidate fraud and highlights gaps across screening, interviews and onboarding. HYPR warns that attackers can bypass network breaches by securing legitimate credentials through remote hiring.

🔍 A 22-year-old Singaporean, Malone Lam, pleaded guilty to leading a group that stole over US $245 million in cryptocurrency from U.S. victims between October 2023 and May 2025. Lam, who used aliases like Anne Hathaway and King Greavy, recruited accomplices via gaming platforms and allegedly orchestrated scams including fake tech support calls. The gang spent lavishly on nightclubs, luxury cars, mansions, private jets, and security, drawing law enforcement attention. Lam faces up to 20 years in prison while co-conspirators receive sentences and ongoing prosecutions continue.

🔒 ShinyHunters says it accessed the Florida Department of Highway Safety and Motor Vehicles' DAVID system and stole over 200,000 records, publishing a screenshot tied to Jeffrey Epstein as proof. The group set a September 11 deadline to negotiate before releasing additional data and claims to have exploited a password-reset weakness to compromise multiple DMV accounts. The alleged intrusion could expose sensitive personal identifiers that enable identity theft and fraud. While IDScan has confirmed a related Nexus ID-scan exposure, the Florida DMV has not publicly verified ShinyHunters' claim.

🛡️ Google Threat Intelligence Group (GTIG) reports financially motivated and state-aligned actors are leveraging agentic AI and autonomous multi-agent frameworks to conduct rapid, large-scale credential harvesting and supply chain compromises. Teams like TeamPCP (aka Altered Spider) deploy credential stealers such as SANDCLOCK and DUSTMAKER to target developer tools, cloud environments, and AI assets. Adversaries also repurpose open-weight models and misappropriate proprietary AI research, increasing risks to enterprise AI deployments and prompting calls for industry safety baselines.